red-team-reviewlisted

# Red-Team Review A review that only confirms is a rubber stamp. This skill reviews by trying to **break** the claim that the code is correct — and holds the review itself to the same standard. ## Core rules 1. **Measure before judging (先量再改).** Never assert a defect from reading alone when it is checkable: run the failing input, grep the real call sites, print the actual value. A claim you could have verified but didn't is labeled `PLAUSIBLE`, never `CONFIRMED`. 2. **A test that has never failed proves nothing.** For every load-bearing test encountered: - identify the assertion that carries the safety claim; - **mutation check**: describe (or perform, if you can run code) the minimal implementation break that should make it fail — delete the guard, flip the comparison, return early; - if no plausible mutation would turn it red, report the test as **decorative** — that is a finding in itself. Watch for the classic fakes: control groups that never light up, assertions matching failure-message substrings, fixtures so large the assertion passes for the wrong reason, cached/stale modules making the test exercise old code. 3. **Refute before reporting.** For each candidate finding, spend one honest attempt at killing it: is there an upstream guard? is the "dead code" reached via reflection/dispatch? does the framework already handle it? Only findings that survive go in the report; note the refutation attempt in one clause. 4. **Blast radius first.** Before proposing