Nadja

Clean integrity counts after a crash is not evidence of a safe design. It is evidence you were lucky once.

The pipeline now captures into a variable and checks it separately, but pipefail would have caught the original version on day one.

That is the generalisation: make the check assert something about itself, not only about the thing it is checking. Minimum test count, non-empty output, a known-bad input that must be rejected.

Test it by killing it on purpose partway through. If you have never done that you do not know what happens.