Here’s a movie every engineer has watched. A “modernization” PR lands: a code formatter, thirty dependency bumps, some dead-code cleanup — one branch, one review, one merge. Checks are green. Deploy. Something breaks — loudly if you’re lucky, quietly if you’re not. And now comes the question the whole incident will orbit, the question that has no answer:
Which of the forty changes did it?
I call the thing that just got merged a change cloud: a diff whose parts cannot be verified independently, because the unit of change no longer matches the unit of verification. That mismatch is the entire disease. Everything else — the un-bisectable history, the blind blame, the revert that takes innocent work down with the guilty — is just symptoms.
What a cloud actually costs
Attribution dies first. Debugging is differential diagnosis: it works by comparing a known-good state against a known-bad one and narrowing the delta. A cloud destroys the method itself — the delta is everything. Your git bisect converges obediently onto one mega-commit and stops there, shrugging. The tool didn’t fail; you fed it a history with no resolution.
Blame goes blind. The formatter repainted half the files, so every line now attributes to the cloud. The archaeology tool that answers “when did this logic change and why” — gone, not for a week, but for the lifetime of the repository. Unless you knew the trick, and we’ll get to the trick.
Reverts take hostages. When the cloud breaks something, you can’t revert the guilty part — nobody knows which part is guilty. You revert the whole thing, and the innocent work — the formatter that was fine, the cleanup that was overdue — dies alongside. Then it all has to land again, which means the whole risk gets taken twice.
And the loud failure is the merciful one. A crash on startup is a gift: immediate, obvious, cheap. The expensive scenario is the dependency in the middle of the wagon that subtly changes behavior — a rounding mode, a timezone default, a serialization edge case. Checks stay green. Two weeks later a number is wrong somewhere, and the bisect lands on a forty-concern commit half of which is whitespace. That investigation costs more than all the time the bundling ever saved, and it costs it at the worst possible moment.
Why we keep doing it
Because bundling feels efficient. One branch, one review, one CI run — look how much we modernized in a day! The efficiency is real and it is borrowed — from the future, at compound interest. The lender is whoever debugs the incident.
There’s also the “while I’m here” gravity: you open a PR to add a linter, and while you’re here, the dependencies are old, and while you’re here, this file is ugly. Each addition is locally reasonable. The sum is a cloud. And the one big review that’s supposed to cover it all is an illusion — nobody meaningfully reviews forty concerns at once. Five small reviews are not overhead over one big one; the big one never actually happened.
The playbook
The law in one line: the unit of change must equal the unit of verification. Everything below is just that law applied.
One concern per change. Formatting, dependency upgrades, refactors, behavior changes — separate PRs, always. A revert should only ever take out the thing that failed.
No-op changes prove they’re no-ops. A format-only commit ships with mechanical proof — AST or bytecode equality before and after — not with the author’s assurance. And it goes into .git-blame-ignore-revs, the criminally underused git feature that makes blame and bisect read through the reformat forever. Do these two things and the “we’ll lose our history” objection to formatters evaporates — you keep the history, you skip the paint.
Dependencies travel alone, through a hermetic gate. Each upgrade (or tightly related group) in its own PR, carrying its lockfile diff, verified by CI that installs strictly from the manifest into a clean container and runs an import-and-smoke pass. Not on anyone’s laptop — laptops lie: globally installed packages quietly mask holes in the manifest, which is precisely how “works on my machine” becomes an outage. The gate lives in the pipeline, not in people’s habits — a rule that lives in habits is a wish; a rule that lives in CI is a fact.
Land in order, in daylight. Proven no-ops in quiet windows; risky slices when their owners are awake. Never the whole wagon on a Friday evening — the universe has a sense of humor about that.
The agent-era twist
Here’s why this old discipline suddenly matters more. Coding agents have made wide, plausible diffs nearly free to produce. “Modernize this service” returns a beautiful forty-file wagon in minutes — formatted, upgraded, cleaned, green. The cloud got cheap to manufacture, and the manufacturing now runs at machine speed.
Which means the discipline can’t live in exhortation anymore — it has to live in gates. In my own agent pipeline, the shape of a change is checked before its content: changes are sliced by spec, diff-scoped checks refuse mixed concerns, and one of my most reliable per-artifact signals is simply this — a PR without a spec behind it balloons unpredictably; a spec’d one stays reviewable. Cheap generation is a DoS on human attention, and the change cloud is its natural payload. The review funnel is the firewall, and slicing is the packet inspection.
The point
History is not a compliance artifact. It’s a debugging instrument — the only time machine you’ll ever get. Every bundled wagon you merge lowers its resolution, and you find out how much you needed the resolution exactly once: at 2 a.m., mid-incident, when the bisect stops on a commit called “refurbishing: linter, deps, cleanup” and the answer to “what changed?” is everything.
Keep the unit of change equal to the unit of verification, and the time machine stays sharp. Ship changes. Don’t ship weather.
Sixth in a series on running an AI software factory: the trust ladder (how autonomy is earned), pets-not-cattle (where agent sessions live), lights-on (why factories that delete review fail), the release button (how release autonomy is earned), and the unbounded gate (what machine review reveals about human review). A companion skill card — wide-change-playbook — lives in my open skills library.