# Correctness Lens

Attack the changed behavior, not every subsystem in the repository.

- Trace new error paths to the caller. Inject the ignored/wildcard variants and
  verify they cannot become success, not-found, or a plausible default.
- Exercise zero/empty/missing, maximum, and exact-boundary inputs for every
  changed count, size, index, page limit, or optional value.
- For aggregation/quorum changes, test exactly quorum and quorum-minus-one with
  mixed disk errors and nil/placeholder entries.
- For listing/pagination, test `n == max`, `n == max + 1`, delimiter folding,
  continuation markers, and object/prefix name collisions.
- For EC/read/streaming changes, inject failure after partial output and verify
  the client receives an error rather than a clean truncated body. Assert exact
  bytes and length.
- For multipart/object commits, fail before/after rename and cleanup; committed
  data must remain readable and pre-commit cleanup must not destroy parts.
- For version/index ordering, test `len - 1`, `len`, equal timestamps, missing
  versions, and deterministic tie-breaking.
- For directory-object behavior, trace `__XLDIR__` at the store layer; branches
  below the layer that sees trailing slashes are dead.
- For binary UUID metadata, absent, empty, and nil all mean no value. Never send
  nil/empty `versionId` to an unversioned tier.
- For agent rules/skill routers, test a trigger matrix covering ordinary
  inquiry, low-risk implementation, explicit review, high-risk code, PR
  creation, release, and post-PR monitoring. Each case must select only the
  intended workflow and retain required safety/authorization boundaries.

Null verdicts name only the probes relevant to the diff.