Proving change safety

Leading words: one safety fact, prove by running, unproven stays unproven, grep is not enough.

Listing callers is not the job. Grep those in a second. The job is the breakage grep will not show.

Copy these steps into the todo list verbatim. Skip with skip: <reason>.

1. Read the change: symbols added, changed, deleted, including what the diff does not spell out.
2. Name the one fact it is safe because of.
3. Look where grep stops: library source, pinned version, microtasks, wire format, other languages, flags, code three hops down.
4. Honest risk list: chance, cost, file:line. Cleared items listed separately.
5. Prove the one fact by calling the real function (script or test). Leave the prove script in the tree. Cite its path in the reply. If you cannot get to "ran it", write unproven. If you ran it and the fact is false, write do not ship — that is not unproven.

How sure

For each safety fact, get as far down this list as is cheap, and say where it stopped.