Safe is not the same as working.
A test that passes against the old code is not evidence.
The most expensive bug I’ve shipped didn’t break anything. Every test was green. The feature was safe in every way we checked. And it reached nobody, because the data it was waiting for could never arrive.
Most of our checks prove the safety property: if this new thing is absent, nothing changes. Very few prove the value property: when it’s present, something useful actually happens.
Since then I ask two questions before calling anything done. Would this test go red against the old code? If not, it proves nothing. And have we run the real thing against real data, in its real shape, and seen the outcome with our own eyes?
It is slower by an hour. It has saved me weeks.