qa-cube 0.16.0

First public release. Nothing is asked of the projects already running the engine: the
profile contract is untouched, so .claude/qa-profile.md stays as it is. This version also
folds in the patches 0.15.3–0.15.7, which were cut by retros without a section of their own.

Added

• The fixer's correction to the description of YOUR previous finding is quoted as theirs,
  never adopted as the round's expected state (manual-brief.md). A team that accepts a
  finding often amends how it was described, and the amendment arrives with the authority of
  whoever owns the code — so it slides into the brief and the executor ends up measuring
  against the author's model instead of against the requirement. Quote it verbatim, attribute
  it, name the observation that settles it. Precedent: a fix comment said a signing pause
  «never engaged once»; the retest found it engaging and clearing normally, and the whole
  block had been framed around the author's version.
• A lever that works can still be unable to produce the state a scenario needs — check
  what it CONSERVES, not only that it moves (planning.md). A transfer conserves the
  total, a reassignment conserves the count, a rename conserves everything but the label, so
  «empty both wallets by converting between them» is not hard but arithmetically impossible.
  Where the lever only redistributes, the state is usually reachable from the other side.
• A lever handed over BY THE USER is verified at preflight like any other, and a
  credential is only half of one (planning.md). The value's authority exempts it from the
  control experiment it most needs; and it is exercised through a contract of use — which
  header carries it, which bytes it signs, whether a timestamp participates — which has to be
  asked for in the same breath as the value.
• Provenance of the fixture is established before an autotest is promised, and a fresh
  deploy dates more than the code (planning.md). A manual round needs the lever to exist
  today; a test needs it to exist after every deploy. An object somebody configured by hand
  is a finding about the delivery, not a note about the round — and the deploy that makes the
  build verifiable is commonly the one that wiped the data the brief's fixtures name.
• Two numbers from different sections of the brief are multiplied while slicing
  (planning.md). A setting flipped inside a window of the process is unrunnable when its
  propagation lag exceeds the gap between the phases; a scenario whose running time
  approaches the lifetime of its access renews that access inside the scenario rather than
  around it. Both figures are normally already written down, in sections that never meet.
• A checklist item carries the framing its finding will inherit (planning.md). A
  regression checklist grows from requirements and from observations of how the product behaved
  last time; written down they read identically, and a finding then goes out as «violates clause
  N» when clause N never said that. Mark the source of every expectation, treat a mismatch on an
  observation-derived item as a question for the analyst rather than a defect, and re-read the
  cited clause verbatim before assigning a priority. Precedent: an item lifted «and the status»
  from a knowledge-base line and cited an access matrix that was silent on the screen's contents;
  the Major regression had to be requalified to Minor along with every derived artifact.
• A guard you could not satisfy is not a defect until the LEGITIMATE caller fails it too,
  and retest verdicts are transcribed from the executor's own table (report.md,
  SKILL.md). A trail of refused attempts establishes that this caller was refused, which is
  what a working guard does; one execution of the real thing dissolves the candidate into a
  blocker of the round. And on a retest the previous report is the richer document, which is
  exactly why a shifted row gets carried across in its old framing — copy the verdicts
  mechanically, then reconcile the totals against the executor's count.