Too bad they can't get stuff like this right.
If I were to program a Dominion application, I would define all abilities that move a card (trash it, discard it, play it, etc.) as having a defined origin as well as a destination. The origin is given either in the ability itself -- for instance your hand (Remodel) or the play area (Procession's trashing ability) -- or, and I think this only applies to triggered "when you gain" abilities like Watchtower, it's given in the ability that gained the card (it could be gained to your discard or to your deck, and this would be the origin of the "when you gain" ability). When it becomes time to actually resolve the ability, if the card isn't at its origin, it isn't moved.
I think you have to do it this thoroughly if you want it to never fail. There are just too many card combinations to try to program each each one specifically.