Legacy Code Review

Legacy no longer means old. It means code that is in production and that nobody has read, and generated code reaches that state in weeks rather than years. It arrives with plausible structure, consistent naming, and no history of anyone verifying that it does what it appears to do.

The trap is specific and it is the reason this skill exists.

The one rule: never derive an assertion from the code under test

Writing a characterization test for untested code is how a defect gets blessed. You read the handler, you assert what it currently returns, the test goes green, and the bug is now protected by your test suite. Nobody can fix it later without arguing with CI, so nobody does.

The canonical scar: a refund handler dropped a currency unit conversion and refunded 39 cents where 3900 was owed. Its own test asserted amount === "39". Green in CI for months. The test was not missing. The test was the reason the bug survived.

So the assertions come from outside the code under test: