bug-reportinglisted

# Bug Reporting This is the shared reporting spine for every testing skill in this harness — [[manual-testing]], [[functional-testing]], [[api-testing]], [[security-testing]], [[performance-testing]], [[accessibility-testing]], [[mobile-testing]], [[regression-testing]] all file through this format. Canonical source: `~/qa-agent/QA_RULES.md`. ## Verification standard before filing Never declare a defect (or a passing test) based on assumption: - Verify HTTP status codes, not just "the page looked wrong." - Verify actual DOM/element state, not a screenshot glance. - Verify database mutations or backend state for anything claiming data was/wasn't persisted. - Capture console errors and network request/response evidence, not just a description. - In browser testing, wait for network-idle or selector-availability before asserting — a false failure from a race condition wastes everyone's time. ## Severity scale - **Blocker (Sev 1)**: system crash, core transaction impossible, data loss, catastrophic resource leak. - **Critical (Sev 2)**: core functionality severely impaired, no acceptable workaround (auth broken, checkout broken, cross-tenant data leak). - **Major (Sev 3)**: non-critical feature failure, or a high-frequency edge case with a workaround. - **Minor (Sev 4)**: cosmetic, copy error, low-impact UX annoyance. Severity is about real-world impact and exploitability/frequency — not how the bug was found. A cosmetic misalignment stays Minor even if found during a securit