Do LLMs understand backend data-layer semantics? A controlled study of cross-endpoint issues

Evaluating Large Language Models (LLMs) on code review requires moving beyond local syntax to assess system-wide semantic reasoning. We investigate whether LLMs can detect semantic data-layer issues: latent bugs requiring cross-endpoint reasoning over persistent state. We introduce a controlled benchmark of 216 minimal database-backed tasks, derived from 18 independent hand-written scenarios, to evaluate five frontier and open-weights models under two settings: open-ended review versus targeted detection. Our evaluation reveals a stark discovery gap: while models reliably recognize explicitly described issues, they struggle to discover them unprompted, with average F1 dropping from 0.91 to 0.85 for the easiest category and from 0.73 to 0.03 for the hardest. Furthermore, models exhibit a hierarchy of detectability across issue types, and for retention issues, a compliance bias where explicit definitions lead to over-flagging of structurally similar but semantically correct code. Our findings demonstrate that targeted defect detection substantially overestimates true open-ended review capabilities, underscoring the need to evaluate LLMs on latent intent recovery.