How certain can we be that code is correct if we don't write tests that assume the worst of ourselves?