Prove the bug before you fix it

An architectural review of go-tool-base came back with twenty-one critical and high findings, which is rather more than I fancied working through on my own. So they went out to a fleet of agents, roughly one finding each, and I sat back with a coffee and watched merge requests arrive. They arrived fast, and all twenty-one were green. And somewhere around the fourth or fifth I realised I had no idea whether any of it was real. The work didn't look bad, quite the opposite: sensible diffs, tests included, tidy descriptions explaining what had been wrong and how it was now right.