The lockfile case is the one that bites hardest, because CI is literally testing the new dependency tree and calling it fine. A rule that helped me: any agent PR touching lockfiles, CI config, or auth code gets a forced human diff read, no matter how green it is. Do you track which of your 8 stop rules actually fire most often?

iin1005h1928