bug-huntlisted

# bug-hunt A correctness sweep that only reports bugs it failed to refute. Finders generate candidates; verifiers try to kill them; survivors make the report. The single biggest failure mode of agent bug-hunting is plausible-but-wrong findings, so verification is not optional. **Read-only.** Finding bugs and fixing them are separate engagements. ## Lenses Sweep with each lens. With parallel subagents available, one finder per lens; otherwise sequential passes. | Lens | Hunting for | |------|-------------| | Logic | Inverted conditions, off-by-one, wrong operator, unreachable branches, broken invariants | | Error handling | Swallowed exceptions, missing error paths, errors that corrupt state before propagating, misleading messages | | Edge cases | Empty/nil/zero inputs, unicode, huge inputs, boundary values, first/last iteration | | Concurrency | Races, missing locks, shared mutable state, TOCTOU, async ordering assumptions | | API misuse | Contract violations against libraries and the project's own interfaces, ignored return values, resource leaks, lifecycle errors | Focus finders on code that is reachable and load-bearing: entry points, hot paths, recently changed files (`git log --since` is a good prior). A bug in dead code is info, not a finding. Two deep lenses live as their own skills: [latent-premises](../latent-premises/SKILL.md) for unguarded assumptions that hold today with no trigger yet, and [retry-safety](../retry-safety/SKILL.md) for side effects that doub