qa-code-intelligencelisted

# QA Code Intelligence Three related capabilities: reading code for risk, generating tests from artifacts, and reasoning about failures. Each feeds the others. ## Code review for testability & risk (read before testing, not just after a bug) When reviewing a diff or unfamiliar module, actively look for: - **Missing validation** — inputs trusted without checking type/range/presence, especially at system boundaries (API handlers, form submission). - **Missing/swallowed error handling** — empty catch blocks, errors logged but not surfaced, promises without rejection handling. A silent failure is worse than a loud one because nobody investigates it. - **Race conditions** — shared mutable state accessed without synchronization, async operations assumed to complete in order without awaiting. - **Null/undefined handling gaps** — a function that dereferences a value without checking it can be absent, especially on optional API fields. - **Boundary issues in the code itself** — off-by-one in loops/pagination, inclusive/exclusive range confusion. - **Security risk patterns** — string-concatenated queries (SQLi risk), unescaped output (XSS risk), missing auth checks on a new endpoint — cross-reference [[security-testing]]. - **Testability smells** — hard dependencies on real time/network/global state that make the code hard to test in isolation (a sign tests for this code will be either missing or flaky). - **Missing test coverage for the actual change** — a PR that changes behavior w