# Exact-tree read-only diff review

Use for a findings-only final review of an uncommitted working tree against a named base.

## Review sequence

1. Freeze scope with branch/status, base SHA, diff stat/name-status, untracked-file inventory, and diff-check. Untracked files are part of the candidate.
2. Read repository instructions. Do not edit, access productive data, run imports/provider refreshes, or trigger write paths.
3. Trace every changed contract end to end: backend producer → validated route schema → frontend type/client → rendered behavior → tests → documentation.
4. Validate schema/read-only safety separately: no DDL/DML, migration, provider call, hidden refresh, or sensitive generated artifact. Use synthetic/in-memory fixtures.
5. Run focused tests and safe static gates. A focused green run does not override a failing exact-tree gate. For HTTP safety tests, first prove the asserted route exists in the router/OpenAPI contract and then call that exact canonical path. Global write-blocking middleware may return the expected `403` for an unknown POST path before routing, creating a false-positive security test that validates neither route registration nor the real endpoint.
   - For session cookies widened from an API-only path to `/`, enumerate every mutating form/queue route in the dispatcher. A `Set-Cookie` path assertion proves delivery only; it does not prove handlers enforce authentication. Require a table-driven negative matrix with valid same-origin and CSRF material but a missing or expired session, expecting `401` and no queue mutation for every route family. Flag documentation claiming a wildcard route family is authenticated when any branch checks only CSRF/origin.
6. Add deterministic counterexample probes for likely semantic gaps:
   - same-day timestamp versus date-only `as_of` converted to midnight;
   - `ready` paired with non-empty `missing_sources`;
   - consumer fields absent from the producer contract;
   - selected-period readiness derived from lifetime coverage;
   - empty/unvalued containers represented as known zero;
   - ordinary rows exercising newly introduced aggregation keys.
7. Re-read changed hotspots and rerun status/diff-check immediately before reporting. Concurrent edits can invalidate earlier evidence; bind findings to the final observed tree.
8. Calibrate severity: P0 security/data loss/irreversible critical impact; P1 release-blocking crash or materially false domain/API semantics; P2 bounded contract, UX, test, or documentation gap.
9. For findings-only requests, output only P0/P1/P2 groups with file/line, impact, concrete fix, and explicit per-severity plus total counts. Omit process narration and passing checks.

## Pitfalls

- `git diff --check` omits untracked files.
- A frontend TypeScript type is not a validated backend API contract.
- Generic all-history coverage cannot prove a selected reporting period.
- Never issue the final verdict from an earlier snapshot when the working tree changed during review.
- Do not persist environment-specific command failures as workflow rules.