Every agent-authored change arrives with the same reassuring signal: the tests pass, the diff is small, nothing looks obviously wrong. And every so often one of those changes has quietly removed a column, a branch, or a configuration key that no test ever touched.
The diff was honest. It reported exactly what it checked — the tests that exist. The gap is what a diff can never report: the completeness of a change relative to the surface it touches.
Why deleting is invisible
A test suite is a set of assertions about behaviour someone thought to assert. Removal is the one class of change that can be perfectly consistent with all of them: if nothing selected that column, nothing fails when it disappears.
Adding is different. A new column breaks something quickly, because the readers that do not know about it start returning wrong data or throwing. Addition is self-announcing; deletion is silent.
That asymmetry is why review intuition fails here. Reviewers look for what is new, because that is where mistakes usually are in human-written code. An agent's characteristic mistake is the opposite — it removes what it believes is unused, and it is often right about "unused in the tests" while wrong about "unused".
Make the schema diff its own artifact
The cheapest fix I know is to compute the thing the code diff cannot show: a diff of the surface.
- For a database, that is columns added, removed, or type-changed between the previous version and the new one.
- For a config file, that is keys removed or defaulted differently.
- For a public API, that is fields dropped from the response shape.
Review that diff on its own, as a separate artifact from the code change. A removed column then arrives as a line item that says "this is being removed", instead of hiding inside a hundred lines of refactoring.
The gate that costs almost nothing
Snapshot the surface before and after. Fail the check on any removal unless the same change set also touches every reader of that field — and if you cannot enumerate the readers mechanically, treat that as a reason to require a human acknowledgement rather than a reason to skip the check.
That converts "did the agent drop something?" from a review question into a mechanical one, which is the only kind that survives a busy afternoon.
What this is not
It is not an argument against deletion, or against trusting diffs. It is the observation that a diff is a statement about what changed, while we keep reading it as a statement about what is still there. Those are different claims, and only the first one is being checked.
Related, same thread: your rollback destroys the evidence you need to judge it and the restart budget is a sum, not a default.
Top comments (0)