qa-cube 0.19.61

Added

• A label or a deploy only minutes old is re-read right before the start question and again at the launch: planning.md,
  «Dating the build» — the environment a fresh task names can still move, and a job listing can lag a finished deploy.
• A Playwriter screenshot on a high-DPR wide viewport is taken at CSS scale and cropped: browser/playwriter.md, «Screenshots» —
  device scale with a clip comes back blank.
• What a round leaves on a shared environment is judged against the automated runs' preconditions: manual-brief.md, the
  «harmless» write line — a test that waits for «no live record of that kind» times out on a leftover it never reads.
• A deadline the executor holds during a pause is sized from the other side's step and counted from the request: manual-brief.md,
  the «Pause protocol» line.
• A host class's hooks that change shared state without restoring it go into the automator's brief: a «Host class» slot in
  templates/4-automator-task.md, ruled by automation.md's line on a test new to its host class — with the snapshot to take and the
  restore after each run.
• A carrier that only a paid or irreversible operation can manufacture is first looked for among the background writers:
  planning.md, «nothing to show» — the history of a subscription or sync that writes such records is read before the probe is
  priced, and the population is re-scanned right before each paid call.
• /qa --preflight <task> — a preflight run: references/preflight-run.md, pointers from SKILL.md — prepares the
  round unattended (plan, preflight, brief) and stops before the first executor with a decision card; no report, no retro, no
  tracker write, no question that waits. 0-session.md gains the statuses preflight-done and dropped.
• A long run on a laptop starts with a read of the lid and the power source: shell-pitfalls.md — a closed lid on battery
  sleeps the machine and the sleep reads as a network fault; a run killed from outside skips its teardown, so the fixture's
  mutations are restored by hand from its log; manual-brief.md, «The executor stopped», names the same case beside a killed executor.
• A seconds-long state whose verdict is about a composed view is polled through that view: planning.md, the stuck-state
  family — a narrow single-value probe plus a control read of the view arrives after the state has left.
• The call that disarms a shared fixture is held to the rule for a probe's body: manual-brief.md, the «Disarm after» line —
  each value checked against the knowledge base's latest measurement, not a test helper's default, and a second route named for a refusal.
• A receiver the round sends to is checked against the system's own registry of receivers before the brief calls it neutral:
  manual-brief.md, «What goes into the brief» — a receiver the system knows turns every outgoing operation into an inbound event
  with its side effects.
• A gate before a write is a call of its own; in a series it lives inside the write helper: executor.md, «The round's
  limits» — a gate packed into the write's call reports after the write has already gone out.
• The step-1 search runs by the noun of every requirement and through the project's own findings registry by the screen's name:
  planning.md, «The tracker is searched at step 1», pointer from SKILL.md step 1 — a cross-cutting ask is often owned elsewhere,
  and a filed mechanism today's data hides makes the requirement partial, not pass.
• A start question names the source of a premise the task never states: SKILL.md, step 1 (where the start question is
  asked), and planning.md, «What the plan rests on» — options built on an implementation limit or an earlier measurement say where
  the fact comes from and that the task is silent on it.
• The object a sanction question names is checked free first: manual-brief.md, «A sanctioned mutating probe», and the
  «Probe» line of templates/2-manual-task.md — the test code, the object's description and the environment snapshot are read
  before the user is asked, so no swap follows the answer.

Changed

• The bundle fingerprint is taken only from a tab on the application's own origin: browser-techniques.md, the stale-bundle
  entry — a relative fetch('/index.html') from a tab redirected to a return URL reads a foreign SPA and fakes a redeploy.
• An error substitution in the fail-closed wrapper stays armed for every request of the click, and the requests are counted:
  browser-techniques.md — a client may repeat an erroring mutation on its own; a one-shot arm shows the stub's text on screen.
• A multipart upload is read by a wrapper installed before the bundle runs (browser/playwriter.md): a spy set on a loaded
  page sees nothing; without a reload, the file count is proven by the server's trace of the request.
• A verdict with a narrowing qualifier is partial (agents/qa-manual.md): «pass (desktop)» against an expected outcome that also
  named mobile goes into the totals as partial, with the breakdown.
• The status list is read before the automation question, and the report holds the round first: automation.md, «The decision»;
  the Claude Code adapter's «Ask the user»; a red flag in SKILL.md — no dialog in the turn that prints the list, and verdict rows and
  analyst questions go into the report at acceptance even in a round with no finding.
• The dated bundle is kept, not only read: planning.md, «Dating the build», and the «Build fingerprint» line of
  templates/2-manual-task.md — where the target is served from a branch that keeps being redeployed, each fingerprint saves the
  bundle into the session folder, so the next retest can diff builds; the browser cache is the fallback, not the store.
• One Playwriter tab group per task, shared by every actor and round: browser/playwriter.md, «Connect and pick the tab», and the
  «Tab group» line of templates/2-manual-task.md — qa-<task> with no role or round suffix; the actors stay apart by session and marker.

Fixed

• check_session.py no longer flags 📎 markers inside quoted lines: a tracker comment quoted into the raw source names another
  session's screenshots.
• A Playwriter round's loggers are removed by the reference kept when they were attached, never removeAllListeners:
  browser/playwriter.md, «Page scripts and their budget» — the old advice also stripped the tool's own listeners and contradicted
  the CLI's skill, so executors had to overrule the brief.

qa-cube 0.19.42

Added

• A substituted success carries the real response's shape: manual-brief.md, «A retest round» — a dry run of the client's
  reaction to success uses the contract's ids, not {}, since the client may branch on them; the brief template's «Substituted
  responses» line says so.
• A merge into an existing test is offered with what its host needs to reach the new step: automation.md, «The decision» — the
  host's skip reason and the unmerged changes its earlier steps rest on are read before the question; where no build carries both,
  the option says «written, not run until both land» and a standalone test that runs today stands beside it.
• A lever named in the automator's brief is checked for a window in the host test first: automation.md, «The brief» — the
  window is computed from the host test's own rates, fees and earlier filters before the lever is named, and where the arithmetic
  already predicts the existing test's outcome, it replaces the confirming run.
• A burst that proves «served while supply lasts» is sized by the per-caller maximum: manual-brief.md, «What goes into
  the brief», the «Fixture» entry — where one caller may take several units, supply must outlast what the earlier callers may
  legally take, or a correct product fails the burst by design.
• A third party's paid outcome is priced by its population first: planning.md, «A scenario already blocked by a SANCTION» — where
  the state a scenario needs is an outcome a vendor decides after a paid action, the environment's earlier real outcomes are read before
  the price question and their count goes into it; a count arriving after the sanction re-opens it before the first press.
• Playwriter cuts long output: browser/playwriter.md, «Known failures» — about 10 000 characters on 0.9.0, silently; a dump goes to
  a file and only its summary is printed.
• A paid burst is rehearsed free before its one attempt: manual-brief.md, «A sanctioned mutating probe» — a timed burst of
  calls runs first with the paid mutation swapped for a harmless read under its alias, no budget flag, nothing stored; the brief
  template's «Sanctioned probe» block gets a «Timed burst» line.
• Playwriter: a function kept in state returns its result: browser/playwriter.md, «Page scripts and their budget» — its own
  console.log stays in the call that defined it; the caller prints the return value.
• A failing call prints the access in its arguments: browser-techniques.md, «Responses carry access» — a call carrying
  cookies or tokens runs inside a catch that masks the error before printing; the value never stands in the call's text — the call's
  code reads it from its file, or from the page's localStorage where the tool's scripts cannot read files.
• A new branch's refuting check is its first trigger: manual-brief.md, «What goes into the brief», scenario 0 — where the round
  rests on «the task's new branch fires», scenario 0 triggers it once on a minimal fixture before the round's fixture is built, in the
  requirement's central case rather than at an edge of its input range; a proof of deployment does not replace it.
• Playwriter: dead page handles with live tabs: browser/playwriter.md, «Known failures» — a call that returns «Target page… has been
  closed» while context.pages() still lists the tabs is the channel failing; re-bind by the window.name marker, readings in the gap are
  «observed after the event».
• A UI round compares the screens with the linked design: manual-brief.md, «What goes into the brief» — the manager names the
  frames per screen (a slot of the brief template), the screen verdicts get a «design» column; a look the design prescribes is a
  question for the analyst, not a defect.
• A case's expected results reach the automator by step number: automation.md, «The brief» — where the scenarios are steps
  of an existing case, the brief cites the steps instead of retelling them; the brief template's case column carries the step numbers.
• Several guards over several creation paths are planned as a grid: planning.md, «The order of the server-side checks» — guards
  × paths, every cell its own probe failing on a later check; a guard found on one path no longer stands for the others.
• A behaviour seen for the first time is not read as a sign of delivery: manual-brief.md, «Accepting the result», the no-deploy
  entry — where no earlier round reached its condition, it is «first observed», dated only by a release note that names it.
• An unpublished previous comment carries its questions forward: session-folder.md, «Date the round's trigger» — «posted» is
  checked in the thread itself, a paste of the tables alone included; questions never asked go into the new comment in full,
  re-rated against the thread and the spec.
• Round 2+ first checks that the previous round was finished: session-folder.md, «The previous round is read whole» — a retro,
  the automation decision and the report's promises (registry rows, the tracker comment) are checked; what was left undone is done
  in the new round, with one retro for both.
• A carrier reached through a form's picker is checked in that picker: manual-brief.md, the «Fixture» entry — typed into each
  form's picker before any irreversible sanction and in every later round, the limit recorded against the population; where the fix
  RAISES the limit, re-typed at the round's end with the count at both moments.
• Playwriter: route globs and leftover listeners: browser/playwriter.md — a string route pattern matches the whole URL, query
  included, so routes match by a function on the pathname; loggers and pollers in state are removed at the round's end.
• Several tabs prepared for one pause series carry numbered titles: the brief template's «Pause protocol» — each tab's
  document.title names its number and step, and the request asks the user not to close the tab.
• A long planning pass counts as a wait before the launch: manual-brief.md, the thread re-read entry — the thread is re-read
  right before the executor is launched, and the brief's timestamp is that read's.
• A guard held by an in-flight state is judged by reads that bracket the repeat: planning.md, overlapping operations — the
  state is read before and after the repeat in the same call, so a window shortened by a failing dependency no longer voids the probe.
• A change that feeds an existing branch reads that branch's documented outcome as its requirement: planning.md, the
  no-requirements entry — a new rejection routed into «no suitable candidate» is checked against that path before the round is recording-only.
• A negative control of a new step names the assert it is aimed at: automation.md, «The brief» — the step's precondition asserts
  are suspended for the control run, so the red proves the step rather than its precondition.
• The entry state's time carries a measured zone: manual-brief.md, the preflight state entry, and the «Entry state» heading of
  templates/2-manual-task.md — the stamp comes from date -u, never from the conversation's local clock.
• Every identity the plan uses is signed in at preflight: manual-brief.md, «under another role» — one sign-in per role, a dead
  one becomes a start question for a human instead of a «check it is alive» line in the brief.
• «Was the data wiped» is read off the named fixtures and the count: planning.md, dating the build — seeded records keep their
  original dates through a wipe, so the oldest record proves nothing.
• Playwriter: an entry around a login page that closes from outside: browser/playwriter.md, «Known failures» — the auth
  requests go from a same-origin page that does not boot the app (a GET endpoint's JSON answer, a static asset); failed attempts count
  against the link budget.
• A window that needs two states at once: planning.md, the stuck-state family — the second trigger's own duration is compared
  with the shortest run first; where it does not fit, one trigger is watched through a view prepared before it.
• A control the fix renames or merges: manual-brief.md, retest, and the «Value as quoted» column of
  templates/2-manual-task.md — the retest table carries each option's previous raw request value, so a value dropped under a
  surviving caption reads as a regression.
• Playwriter: WebSocket frames logged from Node: browser/playwriter.md, «Network» — page.on('websocket') survives navigation
  and shows subscribe / complete / close, so «never subscribed» is told from «no event came»; browser-techniques.md points there.
• Playwriter page scripts: two limits, the relay's cwd, the [log] prefix: browser/playwriter.md — --timeout does not
  lift the harness's own shell-call limit, so both are set above a wait; page-script code runs with the relay process's cwd, so every
  path in it is absolute; every printed line comes prefixed with [log] , stripped before decoding JSON.
• An edited contract is a new source: report.md — when the fix comment says the spec was corrected, the served contract is
  pulled again and diffed before behaviour is rated against the previous round's copy; an unchanged version header proves nothing.
• A retested property late in the flow: manual-brief.md and a slot of the «Retest» section in templates/2-manual-task.md —
  the brief says what an unforeseen earlier failure gets: the bare failure reproduced twice and kept as a candidate, the checks on a
  scaffold that removes only that obstacle, every result marked.
• The request logger records every response ≥400 whole from its first call: browser-techniques.md — status, headers and body,
  so a throttling answer is told from an expired session on the first refusal; qa-manual.md's probe helper keeps a ≥400's headers too.
• **A text for an earlier round's finding i...

qa-cube 0.19.15

Added

• Playwriter: multipart bodies, route.fetch(), downloads: browser/playwriter.md — a file upload's body is read
  by an in-page fetch wrapper, route.fetch() is replaced by route.fulfill (it crashed the relay once), and saveAs falls back to
  the download folder.
• A requirement's text beside its label is the plan's, word for word: report.md — a qualifier dropped while
  retyping flips the verdict.
• A number the user reads says what it is: SKILL.md, next to the language rule, and a «Red flags» row — a task, merge
  request or pipeline number carries its kind and title in brackets, in the chat at every mention; report.md points there.
• The manager presses in the executor's tab through the executor's Playwriter session: browser/playwriter.md — one call
  checks the page marker, the identity and the armed interceptor before the click; the request carries session id, marker, selector.
• A mock that pads a list from a real row keeps its template from a non-empty response: browser-techniques.md;
  browser/playwriter.md — a route is re-installed only after unroute(pattern) with no handler.
• A Playwriter CLI upgraded mid-round restarts the relay and drops every session: browser/playwriter.md — the preflight
  version goes into the fingerprint, the restart is dated as a tool incident, tabs are recovered by an in-page marker
  (window.name, which survives a reload).
• A sanctioned probe's body is written out whole: manual-brief.md and a «Body» line in the template's «Sanctioned probe»
  block — each field checked against the knowledge base for a value known to crash or page someone; planning.md's made-up-id
  probe points there.
• textContent returns the tail an ellipsis hides: browser-techniques.md, pointed to from executor.md — an
  inventory of visible text checks clipping per item or by screenshot.
• A call quoted into an automator's brief uses the signature's types: automation.md.
• A closed task with no body is not «related»: report.md and SKILL.md step 4 — a defect is anchored on the
  document that states it, never on a closed task whose title alone shares a word with the defect's source.
• «Requires context C» is tested by C's absence, not by omitting it: planning.md — a gateway may fill a missing tenant from
  the identity's only membership; one probe at planning, and an identity with zero or several memberships as a start question.
• A relayed answer to a pause carries a clock time: manual-brief.md — never an estimate, and a late answer is flagged against
  the deadline the pause rested on.
• A gate is phrased by the property its side effect consumes: planning.md — a gate protecting other objects names what
  is at risk and exempts the snapshot's permanent residues, instead of stopping on a whole class of objects.
• A mechanism fact names the branch it was read on: manual-brief.md and the brief template — a process history read off a
  success says nothing about the failure path a fix may live in.
• A retest reads every thread the previous findings went into: session-folder.md — the customer's triage of a layer's
  findings lives in the task where that table was pasted; report.md points there.
• A replicated client artifact is proven first: executor.md — a copy of what a client builds (a wallet's envelope) carries a
  verdict only after the incident's own instance is rebuilt from its parts byte for byte.
• Version 0.19: the engine runs in any agent harness through its adapters, and Playwriter is the default browser — the
  harness, browser and install entries of this section.
• Lessons from the live Playwriter round: browser/playwriter.md — a tab closed from outside is read from inside the page
  (addInitScript + exposeBinding); harness/claude-code.md — print mode stops background subagents after 10 minutes.
• Onboarding picks and checks the browser: /qa-setup recommends Playwriter, offers Claude in Chrome and Playwright MCP
  only where they are connected, installs the chosen tool as a channel and opens a tab through it in the live check.
• The profile names the browser tool: browser: playwriter | claude-in-chrome | playwright-mcp | none; the older
  default/dedicated read as claude-in-chrome, no contract bump. A tool the harness cannot run falls back to Playwriter.
• Browser adapters, Playwriter by default: skills/qa/references/browser/ — Playwriter, Claude in Chrome, Playwright MCP;
  what is true of one tool only (budgets, the output filter, the tab group) left browser-techniques.md for its adapter.
• Install on any agent harness: README gives Claude Code, Codex (.codex-plugin/, .agents/plugins/marketplace.json) and
  opencode (.opencode/INSTALL.md) routes, plus INSTALL.md an agent follows in any other harness; Playwriter is the default browser.
• The engine speaks through the harness adapter: SKILL.md, qa-setup, qa-day and the references name an action
  by its role — «launch the role», «ask the user», <plugin root> — and the adapter says how; 0-session.md records the harness.
• Harness adapters: skills/qa/references/harness/ — how each harness launches a role, asks the user, finds the
  plugin root and its transcripts; the README says how to tell the harness and the fallbacks when a capability is missing.
• An invalidation is verified by replaying the old credential: report.md — a sign-out, a revocation or a role change
  that should end sessions passes only when the credential captured before it is refused after it.
• A customer's order to file a bug is not a violated clause: report.md — where the spec is silent on the ordered aspect, the
  finding goes to the second table with the customer's priority, and the cell asks whether the order outlived the fix.
• A red flag for the liveness oracle: SKILL.md — «I'll read the task first» is the thought before skipping step 1's first call.
• Inducing a race deterministically: browser-techniques.md — the spy's wrapper delays one selected response.
• An issue file for an older finding starts from its latest verdict: report.md — the id is grepped across later reports and
  the knowledge base before the text is written; a requalified finding filed by order names the two clauses that disagree.
• Tool parameters decode \uXXXX: shell-pitfalls.md — an escape typed into a file's content lands as the invisible character;
  double the backslash and scan the file before handing it over.
• A «no browser selected» reply after a successful selection is the tool losing it: browser-techniques.md, beside «No tab
  group exists» — list the connected browsers before asking the user; the chosen one may already be in use.
• A title that names the model («as in X») binds every row, refusals included: planning.md, beside the twin search — the
  scope of the model is decided once at planning; a row passed by the model cannot sit next to its refusal declared «not required».
• The retest table's «Was» names what already held: templates/2-manual-task.md — for a fail row, the previous round's control,
  so old behaviour is not reported as the fix narrowing.

Changed

• The report holds a round's findings before its status list goes out: automation.md — the list names ids the user opens the
  report to read; only the automation section waits for the answer.
• A backgrounded Python script buffers its stdout: shell-pitfalls.md — long scripts run as python3 -u.
• A regression run that fails early leaves its later steps unverified: automation.md — the brief names the step the run reached,
  and the old negatives after it are replayed by hand before the automator starts.
• A seeding route through the project's test framework: manual-brief.md — the framework's own preconditions (hosts it pings,
  channels its asserts read) are checked at preflight, one call each.
• A «dead» session is re-checked from a new tab every time, not only on the first probe: the tab that answered 401 is a
  leftover from then on (SKILL.md step 1, manual-brief.md).
• A journal count is read against its scope — the namespace holding the records on this build — not only its window (planning.md).
• A secret captured only in the page rests where the tool can put it: a file written unprinted (Playwriter) or page storage under a
  named key (Claude in Chrome) — the route is in browser/<tool>.md (manual-brief.md, qa-manual.md).
• A stale build can render whole, not only as a white page: a deep route served from a long-lived cache runs the previous
  build complete — compare document.scripts per directly navigated screen and cache-bust each direct navigation
  (browser-techniques.md, «Bundle and route discovery»).
• A non-ASCII Python script starts with a coding line: the system Python rejects even a valid UTF-8 file written by Write
  when its lines are long (shell-pitfalls.md).

Fixed

• session.py max-id reads the side-findings registry too: an id assigned only there was handed out again as «next».
• Review of the multi-harness work: Claude Code is told by AskUserQuestion (older Task too); its plugin root comes from the
  skill's base directory; the browser preflight reads the tool adapter first; a clone bump moves both manifests; transcripts.py
  exits 1 where no Claude Code transcripts exist; /qa-setup offers Playwriter to a default/dedicated profile.

qa-cube 0.18.44

Added

• A «harmless» write is a mutation when a concurrent run reads the newest of its kind: manual-brief.md, what goes into
  the brief — report requests or exports go behind the same «run finished» gate as the other mutations, or carry a discriminator.

• Capturing the page's request bodies from outside the page: browser-techniques.md, intercepting network — where a page-script
  hook runs in an isolated world and sees nothing, a debugger-protocol listener on the tab captures bodies and trace ids.

• A neighbouring build is «without the task» only when proven: planning.md, the reference environment — dated before the task or
  excluded by a merge base; a task with no merge request is never excluded, and nothing stronger is built on the comparison.

• An operation the brief misread: executor.md, the round's limits — when the schema shows a write is not what the brief took it
  for, the executor stops that probe instead of inventing a «safer» body under a role the guard admits.

• An empty list is not junk, and a schema-only operation is placed by its domain doc: planning.md, the order of the
  server-side checks — [] may make a handler create defaults; an operation found by introspection enters a sweep by its docs, not its name.

• A fix that moves a boundary: planning.md, the bug-task checklist — the new boundary (an inclusive end, a new cut-off)
  is a neighbour of its own, probed at the store's precision by closing a window at an existing record's whole unit.

• A reverse that answers success where a refusal was expected: planning.md, the gate before an irreversible step — such a
  gate is phrased by its effect (the object read back unchanged), and dry-called on the round's own object before a shared fixture.

• Every entry point of a frontend feature: planning.md, recon — presence is checked by the feature's UI strings across the
  served bundle, and every screen they land on gets a scenario of its own.

• A helper handed to the executor prints the trace id: the brief's «Carriers» slot — body to stdout, status code and trace id
  to stderr.

• A run that resumes after a gap reconstructs it first: executor.md — what finished and whether anyone acted is read from the
  object (state, last-modified), then the system's history, before any action, the gap is recorded, and a background logger's
  ceiling is the operation's end plus an hour.

• A click timed against a running multi-step operation: the brief's pause protocol gets a «Window in time» line — anchored at
  the previous step's observed start plus the shortest («during») or longest («after») observed duration, never the mean.

• Four shell pitfalls: shell-pitfalls.md — a buffering stage after grep --line-buffered silences a monitor; "$tx:e…"
  is a zsh history modifier; a credential header never rides curl's argv; a helper resolves its path arguments before its cd.

• The fail-closed wrapper is removed right after its last guarded click: browser-techniques.md — a tab that leaves the tool's
  group otherwise keeps blocking, the user's own actions included.

• automation.md — a change that removes or renames a contract element: the automator's brief lists every existing test it
  breaks, from a scheduled run on the build with the change plus a search of all test classes, not only the test the manual result named.

• transcripts.py — the retro's numbers from the transcripts on disk: per manager and executor, time, context peak,
  tool errors, refusals, retries after a failure, compactions. Step 7 runs it, keeps the table in 7-retro.md (transcripts
  expire) and answers every note: a lesson or a «normal, because».

• check_session.py matches the brief's scenarios against the result's headings: a scenario id from the brief's # column
  that no heading names is reported; the lines that ask a question are listed for the manager. qa-manual.md: headings carry the ids.
  A brief that numbers its scenarios bare (| 3 |, | 0a | with a letter in any script) is answered by S3 / S0a headings.

• session.py shot: a candidate's screenshot takes the finding's id, its 📎 markers in the folder follow — a marker that
  ends a sentence (📎 c1.png.) included.

• A «Red flags» table at the end of SKILL.md: nine thoughts that come just before a known rule is broken, each with
  what it actually is and the step that holds the rule; engine-edits.md sends such a lesson there.

• Processes are stopped by PID, never by a pattern: shell-pitfalls.md — pkill -f/killall on the user's machine
  matches their own applications; a hung foreground call is left to time out.

• An automation price includes the host class's fixed cost: SKILL.md step 5 — provisioning, per-test hooks and
  stabilising reads, read off a neighbouring test's run log.

• A launch after a wait on the environment re-reads the comment thread first: manual-brief.md («Preflight and
  access») — the team that fixes the environment often posts the contract in the same motion.

• When and how wide a round runs is a start question (planning.md, «What the plan rests on», pointed to from step 1
  of SKILL.md, since the answer decides the folder): a task in testing
  whose other layer is still in development, or a parent with several siblings in testing, is put to the user before planning.
  A layer word the user ties to an instrument («the frontend, in profile X») names where to observe it, not a narrowing.

• An identity switch that passed before is not cleared for the next one (manual-brief.md, «Your own harness refuses
  a call»; a slot in the brief template's «Pause protocol»): the brief names the fallback for every switch, and an
  irreversible step waits for the switch it depends on. The first fallback is the manager's own session — the executor
  asks with «LOGIN NEEDED: » — and the user logs in by hand only when that attempt is refused too.

• Two new shapes of «The tracker is searched at step 1» (planning.md): a task's contract may sit in a SIBLING's
  comment thread, searched by the task's own operation and field names before the requirements are rated; and a description
  REPLACED by a sibling's text is recovered from its edit history before «no requirements of its own» is written anywhere.

• Two output-reading riders (browser-techniques.md, «Output censorship»): a form's state is read as its whole visible
  text, not through a whitelist of expected words; a link that may not be printed is checked inside the tab it opens (status, sha256).

• A wallet signature request is a human click too, free typed-data signatures included: manual-brief.md
  («Your own harness refuses a call») — a page script records or refuses wallet calls, never originates them.

• An irreversible step the user sanctioned in chat is the user's click or the manager's call, never the executor's:
  manual-brief.md («A sanctioned mutating probe») and a «Who presses» slot in the brief's «Sanctioned probe» block.

• A size budget for every catalogue and agent instruction (check_engine_edits.py): each is read whole, so an
  edit past its budget makes room — folds a family, merges a precedent — instead of growing; engine-edits.md says so.

• The form of a rule is chosen by what failed (engine-edits.md, «Before writing»): a rule broken under pressure,
  an output of the wrong shape, an omitted element, a mechanical slip and a situational case each get their own form —
  an entry, a recipe, a template slot, a script check, a condition.

• scripts/session.py: next-file names a round-2+ file, max-id finds the highest finding id assigned across
  every report, sweep archives past months' folders, rewrites their links and checks every session path resolves
  (links on its own); SKILL.md step 2 and the ID numbering call it instead of counting by hand.

• Two files of a session folder on one number are refused by check_session.py over the folder; round-2+ names come from
  session.py next-file, one call per file (SKILL.md step 2, session-folder.md «Continuing a session»).

• The read channel for a sanctioned probe's effect is a question of the sanction (manual-brief.md, «A sanctioned mutating
  probe», now eight questions; a «Read channel» slot in the brief template).

• A mock-up board is read through its structure (browser-techniques.md, «Design mock-ups»): one structure-listing call, read
  from the file the tool saves; frame captions often sit in neighbouring title frames and are matched by coordinates; text layers'
  names are their text, so no code-generation call is needed.

Changed

• A bounded poll also exits on an error response: shell-pitfalls.md — a wait loop that only tests its condition spins to
  the limit on a malformed request.
• The status list precedes the automation question: automation.md and step 5 — before the automation dialog, the round's
  🟢/🟡/🔴/⚪ status list goes to the chat as a message of its own; the dialog's three lines no longer stand in for it. A red flag row added.
• A fix with a condition of its own is a partial fix, not a new finding (manual-brief.md, the brief template's «Fix scope»):
  the inputs the fix leaves out keep the finding open under its id, narrowed; a new id is only for what it never covered.
• «Observable» in the automation decision means distinguishable from the build without the task (planning.md): where only
  the branch that behaves as before can be reached, the answer is «no automation» straight from recon — no round is offered to
  look for an oracle.
• The automator reads executor.md too: its «Contents» is on every automator brief's reading list, read before the first
  assertion — a computed reference value, rendered text and a refused request bite a test as they bite a manual run.
• qa-manual.md holds the executor's procedure again (29k ...

qa-cube 0.17.56

Added

• A device-class branch reached by spoofing detection: report.md (the appearance entry) — proves the branch
  exists, not what that device's user sees; check the screen at that device's width before writing findings there.
• The pause protocol: a session that dies, a human's reload, a chain: manual-brief.md — re-entry in a separate
  tab, the page holding an unsaved artifact is never navigated or reloaded; an in-page recorder is guarded by «do not
  reload» and re-armed after; the request names the only network on which confirming is allowed.
• A probe that is accepted and starts a background process: manual-brief.md («A sanctioned mutating probe»,
  now six questions) — the executor records the process and leaves the decision to the team.
• Asking the user to create an instrument: planning.md («The human's instrument has PROPERTIES») — say what
  it is for, what to name it, and that its secret is not wanted.
• A blocked value is unmeasured, a lost tab group is reselected by device id, a tiled hidden-tab screenshot
  is retaken with scale: browser-techniques.md.
• The manager reads the shell pitfalls too: SKILL.md step 0, shell-pitfalls.md header.
• A scenario that needs a NEW login is a human step: planning.md («A step that requires typing a
  financial or credential-shaped value») — a sub-user or a narrower-role account the environment lacks is
  registered by the user before the round; the brief hands over the identity, not the sign-up recipe.
• A no-requirements round: its twin first, a case on invariants: planning.md («the task has NO
  requirements at all») — a twin found by title in a neighbouring project gives the reference spec; the case
  holds only the invariants, behaviour awaiting the analyst stays out.
• A check with two carriers of one proof is probed with the pair that disagrees: planning.md («The main
  run and its control») — the required carrier wrong beside the old one right shows whether the server
  combines them by «or»; single-carrier matrices cannot.
• The result's headings are listed against the brief's steps before acceptance: manual-brief.md
  («Accepting the result») — a step with no section is missing evidence, whatever the summary cites.
• Mid-file edits of the result go through Edit, not a slicing script: qa-manual — a forgotten tail
  term silently truncates the file; re-list the headings after any scripted write.
• A contradiction between the task and a later neighbour is reconciled before it is asked: planning.md
  («The tracker is searched at step 1») — a later text by the requirements' owner is the answer; only its residue
  becomes a question, and the reading a preflight check.
• An automation price is computed, not guessed: SKILL.md step 5 — the waited-on operations times the
  durations the manual result measured, plus propagation lags, before the figure is put to the user.
• A manual scenario keeps its discrimination in the autotest only if the brief restates it: planning.md
  («The main run and its control», degenerate oracle) — ask of every step whether it would fail on the
  build without the task, given the state the host test leaves behind.
• A recon link between two records is joined by id, never by time: manual-brief.md («What you
  have not checked yourself is handed over as a question») — a value matched to an event, or a change
  to an actor, by a coincidence on the clock goes into the brief as an unjoined hypothesis.
• No session-folder paths in test code: qa-automator — comments, javadoc and disable reasons
  name the fact, not the folder it was found in; the way back to the evidence is the case link and
  the task id.
• The restore of a shared fixture is timed by the decision, not the trigger: planning.md (flipping a
  setting inside a window) — a disarm «right after the operation» re-arms the setting before a lagging
  decision reads it; manual-brief.md's «disarmed the moment its scenario is done» now points there.
• Every carrier of one state is counted from the schema: planning.md («The main run and its
  control», «the field is not saved») — a scan for every field returning the type, not only the
  endpoints the task names.
• Screenshots of on-screen defects: the manual tester saves one per candidate into the session's
  screenshots/, the manager renames it to the finding's id and the report cell names it as
  📎 <ID>.png; check_session.py confirms every marker resolves to a file.
• Reading-list partition and the bulk dump on a page-session contour: manual-brief.md —
  the shell pitfalls stay before the session-bound block whenever it touches the shell; a dump
  reachable only through the page lives in the page's memory, derivatives go to disk.
• A precision fix is calibrated on the old build first: planning.md («The reference
  environment») — when the fixed build rounds its own read channel, the old build is the only
  place the oracle can be calibrated; accumulating series, one account per series.
• The automation question travels with the round's result: SKILL.md step 5 — three
  lines (the change and its merge state, the verdict, what the test would assert) above the
  options, since the user has not seen the delivery yet; a reply that is itself a question is answered,
  then the choice is put again — it is not acted on.
• The old build's own logs as a reference: planning.md («The reference environment») —
  a low-traffic service may still hold the previous build's records on the environment itself.
• zsh's special parameters (path, status, argv) that a helper must not use as names, local
  included: shell-pitfalls.md.

Changed

• The SKILL.md budget is 70k characters (from 66k) — the file had reached 65.8k.
• An unnamed finding is read as «left out of the fix» only if it ever reached the tracker —
  one the customer never pasted stays in the table and goes into this round's comment.
• Tabs of headless libraries: focus() and a real click after the pointer sequence, since
  which one works changes with the library's build.
• Dating the build: the replaced bundle can be pulled from a browser cache, and two builds
  are diffed by their literals, not by minified code.

qa-cube 0.17.39

See the commit history for what changed.

qa-cube 0.16.0

First public release. Nothing is asked of the projects already running the engine: the
profile contract is untouched, so .claude/qa-profile.md stays as it is. This version also
folds in the patches 0.15.3–0.15.7, which were cut by retros without a section of their own.

Added

• The fixer's correction to the description of YOUR previous finding is quoted as theirs,
  never adopted as the round's expected state (manual-brief.md). A team that accepts a
  finding often amends how it was described, and the amendment arrives with the authority of
  whoever owns the code — so it slides into the brief and the executor ends up measuring
  against the author's model instead of against the requirement. Quote it verbatim, attribute
  it, name the observation that settles it. Precedent: a fix comment said a signing pause
  «never engaged once»; the retest found it engaging and clearing normally, and the whole
  block had been framed around the author's version.
• A lever that works can still be unable to produce the state a scenario needs — check
  what it CONSERVES, not only that it moves (planning.md). A transfer conserves the
  total, a reassignment conserves the count, a rename conserves everything but the label, so
  «empty both wallets by converting between them» is not hard but arithmetically impossible.
  Where the lever only redistributes, the state is usually reachable from the other side.
• A lever handed over BY THE USER is verified at preflight like any other, and a
  credential is only half of one (planning.md). The value's authority exempts it from the
  control experiment it most needs; and it is exercised through a contract of use — which
  header carries it, which bytes it signs, whether a timestamp participates — which has to be
  asked for in the same breath as the value.
• Provenance of the fixture is established before an autotest is promised, and a fresh
  deploy dates more than the code (planning.md). A manual round needs the lever to exist
  today; a test needs it to exist after every deploy. An object somebody configured by hand
  is a finding about the delivery, not a note about the round — and the deploy that makes the
  build verifiable is commonly the one that wiped the data the brief's fixtures name.
• Two numbers from different sections of the brief are multiplied while slicing
  (planning.md). A setting flipped inside a window of the process is unrunnable when its
  propagation lag exceeds the gap between the phases; a scenario whose running time
  approaches the lifetime of its access renews that access inside the scenario rather than
  around it. Both figures are normally already written down, in sections that never meet.
• A checklist item carries the framing its finding will inherit (planning.md). A
  regression checklist grows from requirements and from observations of how the product behaved
  last time; written down they read identically, and a finding then goes out as «violates clause
  N» when clause N never said that. Mark the source of every expectation, treat a mismatch on an
  observation-derived item as a question for the analyst rather than a defect, and re-read the
  cited clause verbatim before assigning a priority. Precedent: an item lifted «and the status»
  from a knowledge-base line and cited an access matrix that was silent on the screen's contents;
  the Major regression had to be requalified to Minor along with every derived artifact.
• A guard you could not satisfy is not a defect until the LEGITIMATE caller fails it too,
  and retest verdicts are transcribed from the executor's own table (report.md,
  SKILL.md). A trail of refused attempts establishes that this caller was refused, which is
  what a working guard does; one execution of the real thing dissolves the candidate into a
  blocker of the round. And on a retest the previous report is the richer document, which is
  exactly why a shifted row gets carried across in its old framing — copy the verdicts
  mechanically, then reconcile the totals against the executor's count.