Checklist:
- API compatibility & error handling
- AuthN/AuthZ assumptions
- Input validation & logging (no secrets)
- Tests added/updated and what’s missing
- Frontend performance/regressions (renders, memoization, data fetching)
- DX: docs, scripts, onboarding
Output:
- “Must fix” (blockers)
- “Should fix”
- “Nice to have”