Debugging a Failed Run From Its Trace

A customer wrote back to say that half of the money was missing. She had been charged 120 dollars twice for a broken blender, and Desk had replied that her refund was complete. The payment system held one refund of 120 dollars, when it should have held 240.

Nothing had raised an alert. No tool had returned an error, the run had taken 6 steps, and the customer had confirmed the refund that Desk proposed. How do you find, starting from a bad result, the one span that caused it, prove that a repair works, and keep the defect fixed?