Recurring Patterns Sweep

# Recurring-Patterns Sweep — Full Codebase

A standing routine ([playbook chapter 07](../playbook/07-standing-routines.md))
that hunts the [5 recurring bug patterns](../playbook/04-bug-patterns.md) and
re-runs the [phantom checks A–H](../playbook/05-phantom-checks.md) across the
**entire codebase** — not one diff. The pipeline checks these per-change;
this sweep catches every instance that merged *before* a pattern was known.

**How to run it:** paste the `## PROMPT` block into a fresh session (or spawn
it to a read-only QA-type agent). Detection only — the sweep never fixes.
Expect 30–45 minutes for a full pass.

## Cadence

| Scenario | Run |
| :--- | :--- |
| After each large merge (50+ files) | Immediately after merging |
| Before a major release (`X.Y.0`) | Mandatory |
| Routine maintenance | Monthly |
| A user-facing bug matching one of the patterns appears | Immediately |

---

## PROMPT

~~~text
## Task: full-codebase sweep for the 5 recurring bug patterns — {{PROJECT_NAME}}

**Branch:** {{MAIN_BRANCH}} (or the currently active branch)
**Time box:** 30–45 minutes

### Rules
- **Do NOT fix anything** — detect and report only. Never run git write
  operations. Never reset any database except {{TEST_DB_NAME}}.
- **Do not run the full test suite** — this sweep is grep + code reading.
- **Stay inside the 5 patterns + checks A–H** — no open-ended exploration.
- **Exclusions:** vendor/dependency directories (`vendor/`, `node_modules/`),
  build artifacts (`public/build/`, `dist/`), caches/storage, and any legacy
  directories your project quarantines. Sweep tracked files only
  (`git ls-files`).
- **Read the relevant agents' memory first**
  (`.claude/agent-memory/qa-engineer/MEMORY.md`,
  `.claude/agent-memory/integration-agent/MEMORY.md`) — Approved Exceptions
  and Disproven Findings there are known false positives. Do not re-report
  them.
- **When in doubt, read the file** — a grep hit is a candidate, not a finding.
- Report ≤ 3000 words, in the required format below.

### PATTERN-1 — Frontend ↔ API contract mismatch
For each frontend component/hook that calls the API:
1. Grep {{FRONTEND_DIR}}/src/ for HTTP calls (your client or data-access
   modules).
2. For each URL, find the route registration, then the controller/handler.
3. Read the literal response keys the controller emits.
4. Read the keys the frontend consumes (property access, destructuring,
   typed interfaces, mapped arrays).
5. Report every key read but never emitted, and every shape mismatch
   (wrapper-vs-bare, object-vs-array, snake_case-vs-nested).
Prioritize: dashboards, chart-feeding components, forms that POST.
This is the slowest pattern — run it last.

### PATTERN-2 — Enum / config-key string mismatch