blast-radius

Blast Radius — who reads the thing you're changing?

A change can be locally correct, fully tested, and still break production — because the correctness of a producer says nothing about the assumptions of its consumers. And the most expensive version of that break isn't the loud one; it's the silent one, where a downstream catch or fallback converts the breakage into missing data that nobody notices for weeks, long after the deploy that caused it has stopped being a suspect. This skill exists to make "who reads this?" a mandatory step in the change, not an instinct you hope the author has.

When to apply this

Apply it the moment a change alters the shape, format, semantics, or published identity of anything consumed outside the edited code: a function's return value or type, an API or tool response body, a serialized payload, a database column other code reads, a log or telemetry field, an event or queue message, a config value or env var, CLI/stdout output that anything parses, or an identifier a caller addresses by name (a tool, route, or command). Wrapping counts. Renaming counts — a field or an identifier. Adding an envelope around existing data counts — the bytes a consumer parses are different even though "the data is still there."

Skip it for changes with genuinely no consumers outside the edited function, and for strictly additive optional fields that no consumer is required to read.

The test is not "did I change an interface file" — it's "does anything outside this diff read the bytes, fields, or values I'm changing, or address something by the name I'm changing?" If you haven't checked, the answer is unknown, and unknown means yes.

Run sections 1–6 in order. They're cheap — a few searches and one real observation — and each exists because skipping it has a specific failure mode.

---

1. Name the seam

Before editing, state in one sentence what contract is changing: the producer, and either the data shape and transport (return value / response body / column / log field / event / stdout) or the published identity (tool, route, command) a caller addresses by name. Why: an unnamed seam can't be searched for. "I'm changing how search results come back" is a vibe; "the tool's text channel currently carries raw JSON that callers parse" is a searchable surface with findable consumers.