The checklist bound severity to its passes (Pass 1 CRITICAL, Pass 2 INFORMATIONAL)
and the core floor had no security clause, so GSTA-11's replay saw real bugs filed
INFORMATIONAL. One floor sentence now reaches every reviewer prompt; the passes set
check order only; shell injection covers shell sinks; a state-swap-before-failure
check joins Pass 1 (GSTA-159); the Testing specialist reports a floor-level product
defect as category correctness so classify keeps it blocking.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>