blast-radius

# Blast radius ## Contract | Field | Bound contract | |---|---| | Trigger | Determine what a change could break. | | Authority | Reversible local: writes only one local proof script or test; rollback is deleting it after the report. No remote mutation. No VCS, credential, or published mutation. | | Side effect | May write and run one proof. | | Done | Confirmed risks, cleared items, and cheapest pre-merge test. | ## Inputs A diff, branch, or set of changed files to analyze. The change must be readable from the working tree or a supplied patch. Optional: the running application for in-app reproduction. ## Procedure 1. Read the change completely: the diff, the symbols it adds, changes, and deletes, and what it now does differently, including behavior the diff does not spell out. Done when: the full change is understood beyond the diff surface. 2. Find the single fact the change's safety depends on. Most changes that look dangerous are safe because of one fact, for example, "this call only drops already-dead cache entries and does nothing else." If that fact holds, most scary cases collapse at once. Spend time here, not on a long list of maybes. Done when: the single load-bearing safety fact is identified or confirmed absent. 3. Look where a symbol search stops. Read the source of any library the change calls; check its pinned version and any local patch. Work out when things run: async task ordering, teardown and unmount, framework-specific lifecycle. Follow what a grep m...