Use the specified diff, branch, PR, or working tree and its intended behavior. Remain read-only unless fixes are also requested.

Understand the trigger and expected result before judging the implementation. Read tests to learn which claims are actually exercised.
Check the in-scope review dimensions, including docs/README when behavior changed. Spawn 2–3 read-only explorers that split those dimensions. Concentrate on changed behavior, callers, and failure paths. Skip dimensions that are out of scope and say so.
Validate suspected defects with a concrete execution path, failing case, or source evidence. Do not invent timings or vulnerabilities from appearances.
Challenge verification claims. Order findings by impact with file/line, trigger, consequence, and smallest useful remedy. An inspection is not proof that tests passed and is not approval to merge.

w-review