The AI PR that says "no behavior change" is the one I read twice

Picture a pretty normal agent PR. Title: "Refactor user serializer, no behavior change." 140 lines, tests green, the summary is tidy and confident.

Here's what's easy to miss in a diff like that:

• a field went from created_at to createdAt because the agent "cleaned up naming"
• a nullable field now defaults to an empty string instead of null
• an error that used to be a 404 is now a 400, because the validation moved up a layer

None of that breaks your tests if your tests only check your own code. All of it breaks whoever calls your API. And the PR description literally told you not to worry about it.

The thing is, the agent isn't lying. It genuinely thinks those changes are cosmetic. "No behavior change" from an agent usually means "no behavior change that I was asked to care about."

The 2-minute check I do now

When a PR claims no behavior change, I stop reading the summary and look at the surface instead:

1. Anything public that got renamed? Fields, routes, flags, env vars, exported functions. Search the diff for removed lines in serializers, schemas, route files and type definitions.
2. Did any default change? null vs empty, false vs missing, a timeout, a page size. Defaults are where "cosmetic" changes hide.
3. Did an error shape or status code move? Callers branch on these. A 404 turning into a 400 is a behavior change, full stop.
4. Is there one test that would fail if the old behavior came back wrong? If the tests were edited in the same PR to match the new output, that doesn't count.

If any of those turn up something, I don't argue about whether it "counts". I reject the claim, not the PR: "This changes X for callers. Either keep the old shape or call it out as a breaking change." Usually the fix is small.

Why this one matters more with agents

A human who renames a public field mostly knows they did it. An agent will do it as a side effect of tidying, in the same PR as the thing you actually asked for, and then describe the whole bundle as a refactor. So the claim in the description is exactly the part to verify, not the part to trust.

I keep this and seven other "stop and look" rules on a free one-pager if you want to pin it next to your review tab: https://chopragunji.gumroad.com/l/zpnmdn

And if there's a specific AI PR you're nervous about, I'm doing a few line-by-line reviews at $49 right now: https://chopragunji.gumroad.com/l/byoyi/FOUNDING

What's the sneakiest "no behavior change" you've caught?