qol-debuglisted

# qol-debug A first-pass bug or vulnerability hunt is an evidence loop, not a code read: establish a clean baseline, mine the live runtime, scan for known bug and attack shapes, verify every suspect in source, confirm runtime-dependent impact in a guest, and report only findings that survive verification. ## Scope discipline Classify the request before touching anything: - **Locate / identify / report**: read-only. No fixes, no edits, no commits. - **Locate then fix**: deliver the findings first, then fix under the standard delivery rules. - **Ambiguous**: hunt read-only; ask before editing product code. **Report only high-confidence findings.** A finding qualifies when it has all four: (1) a concrete location, (2) evidence (a log line, command output, or a provable contradiction in the code path), (3) a root cause that survives re-reading the code and its callers, and (4) an impact statement. Drop anything below that bar unless the user explicitly asks for a low-confidence list. ## The loop ### 1. Baseline (start early; scan while it runs) These commands apply to Rust workspace roots (qol-monorepo). Adapt the baseline to the target repo's toolchain elsewhere: a Node repo runs its own test suite and has no `target/` cache. - Check for a warm `target/` directory first: clippy and tests reuse it. - `cargo clippy --workspace --all-targets`: zero warnings means the bugs are logic-level, not lint-level. Host clippy only proves the host platform; the recurring regression c