This holds if the small functions are built around a coherent top-down design, respecting each other's invariants. Once the project is too large to fit in one's

This holds if the small functions are built around a coherent top-down design, respecting each other's invariants. Once the project is too large to fit in one's head, it is no longer sufficient for each function to be 'correct' in a local sense.