QA Sweep — multi-lens agent QA of the live product

Read projects/<name>/qa/README.md FIRST (the protocol SSOT: environment rules · the five lens briefs · findings format · triage) — the lens briefs in agent prompts come verbatim from there, and the account/mutation policy it sets is a hard rail, not advice. A project that predates this layout may keep its protocol elsewhere — wherever its CLAUDE.md points, or at docs/qa/README.md, context/qa/PROTOCOL.md, .claude/rules/qa-sweep.md, or in a project-local qa-sweep skill. Look there before scaffolding: an existing protocol is the SSOT wherever it lives, its run records go next to it, and a second protocol must never be created beside it. Only when no protocol exists anywhere, create one from the layer's protocol template (${CLAUDE_PLUGIN_ROOT}/reference/qa-PROTOCOL-TEMPLATE.md in the kit repo — copy it from there if this project only adopted the layer's .claude/ files) and fill the placeholders before sweeping.