diff --git a/.wolf/buglog.json b/.wolf/buglog.json
index 1b3c686d..11c07423 100644
--- a/.wolf/buglog.json
+++ b/.wolf/buglog.json
@@ -16605,9 +16605,9 @@
     },
     {
       "id": "bug-1895",
-      "status": "open",
+      "status": "fixed",
       "status_updated": "2026-09-30",
-      "status_note": "newly logged",
+      "status_note": "",
       "component": "build",
       "severity": "wrong-result",
       "timestamp": "2026-09-30T04:23:48Z",
@@ -16615,8 +16615,8 @@
       "occurrences": 1,
       "error_message": "xce-build.sh apiserver/all: a failing apiserver Go test does not fail the build\n\n**Observed:** `bash src/tools/xce-build.sh apiserver asan <dir> --incremental` exited 0 although its Go unit tests failed:\n```\nFAIL\tapiserver/backend [build failed]\nFAIL\tapiserver/store [build failed]\n... exit=0\n```\n**Expected:** a failing unit test fails the build (non-zero exit), as for every C suite.\n**Impact:** apiserver Go test failures are silently ignored by /xce-build (and by `all`); a regression in apiserver/store, utils, controllers or backend can pass the build unnoticed. xcecli's tests are unaffected when they are the ones failing, but are skipped entirely when the apiserver tests fail.\n**Found by:** review of the build output while doing bug-1894's RED step, 2026-09-29.",
       "file": "src/tools/xce-build.sh (apiserver and all test steps)",
-      "root_cause": "TODO: required for fixed/partial",
-      "fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
+      "root_cause": "src/tools/xce-build.sh ran the frontend Go tests for the apiserver and all components as a single && list: `cd frontend/apiserver && go test ... && cd ../xcecli && go test ...`, under `set -euo pipefail`. Bash's errexit does not apply to a failing command in an && list unless it is the last one, so a failing apiserver `go test` merely short-circuited the list: the xcecli tests were skipped, the script carried on, and it exited 0 with `=== Done`. Only an xcecli failure (the list's last command) failed the build.",
+      "fix": "src/tools/xce-build.sh: in the apiserver and all components, each Go suite now runs as its own command in a subshell -- `(cd frontend/apiserver && go test ...)` then `(cd frontend/xcecli && go test ...)` -- so a failure of either exits the script under set -e, and the cd no longer changes the script's working directory. The xcecli component's single suite got the same subshell for consistency.\n\nVerification:\n- Test: live probe -- a temporary failing test (TestBug1895DeliberateFailure, t.Fatal) dropped into src/frontend/apiserver/utils/ and, separately, src/frontend/xcecli/cmd/, then `xce-build.sh apiserver asan <dir> --incremental`. RED before the fix: `FAIL apiserver/utils` yet exit 0 with `=== Done` and no xcecli tests run. GREEN after: apiserver probe -> exit 1, no Done line; xcecli probe -> exit 1; clean tree -> exit 0 with all 10 xcecli packages tested. The probe files were removed (never committed)\n- Suites: n/a -- build-script change; `bash -n` clean\n- Live: n/a -- the three builds above are the end-to-end check",
       "tags": [
         "build",
         "xce-build",
@@ -16627,7 +16627,9 @@
       "related_bugs": [
         "bug-1894"
       ],
-      "fix_commits": [],
+      "fix_commits": [
+        "4e484629"
+      ],
       "record": ".wolf/bugs/bug-1895.md"
     }
   ]
diff --git a/.wolf/bugs/bug-1895.md b/.wolf/bugs/bug-1895.md
index f40a2ff4..c236449f 100644
--- a/.wolf/bugs/bug-1895.md
+++ b/.wolf/bugs/bug-1895.md
@@ -1,8 +1,8 @@
 ---
 id: "bug-1895"
-status: "open"
+status: "fixed"
 status_updated: "2026-09-30"
-status_note: "newly logged"
+status_note: ""
 component: "build"
 severity: "wrong-result"
 timestamp: "2026-09-30T04:23:48Z"
@@ -11,6 +11,7 @@ occurrences: 1
 files: ["src/tools/xce-build.sh (apiserver and all test steps)"]
 tags: ["build", "xce-build", "go", "tests", "set-e"]
 related: ["bug-1894"]
+fix_commits: ["4e484629"]
 ---
 
 # bug-1895: xce-build.sh apiserver/all: a failing apiserver Go test does not fail the build
@@ -41,15 +42,16 @@ FAIL	apiserver/store [build failed]
 - Evidence: the mechanism is in src/tools/xce-build.sh lines ~390 and ~437: `cd frontend/apiserver && go test ... && cd ../xcecli && go test ...` under `set -euo pipefail`; bash's errexit ignores a failure of any command in an && list except the last, so a failing apiserver `go test` just short-circuits the list and the script carries on to exit 0
 
 ## Root cause
-TODO: required for fixed/partial
+src/tools/xce-build.sh ran the frontend Go tests for the apiserver and all components as a single && list: `cd frontend/apiserver && go test ... && cd ../xcecli && go test ...`, under `set -euo pipefail`. Bash's errexit does not apply to a failing command in an && list unless it is the last one, so a failing apiserver `go test` merely short-circuited the list: the xcecli tests were skipped, the script carried on, and it exited 0 with `=== Done`. Only an xcecli failure (the list's last command) failed the build.
 
 ## Fix
-TODO: required for fixed/partial
+src/tools/xce-build.sh: in the apiserver and all components, each Go suite now runs as its own command in a subshell -- `(cd frontend/apiserver && go test ...)` then `(cd frontend/xcecli && go test ...)` -- so a failure of either exits the script under set -e, and the cd no longer changes the script's working directory. The xcecli component's single suite got the same subshell for consistency.
 
 ## Verification
-- Test: TODO: name + file; RED before the fix, GREEN after
-- Suites: TODO: suite results and build profile
-- Live: TODO: soak/deploy run, or n/a and why
+- Test: live probe -- a temporary failing test (TestBug1895DeliberateFailure, t.Fatal) dropped into src/frontend/apiserver/utils/ and, separately, src/frontend/xcecli/cmd/, then `xce-build.sh apiserver asan <dir> --incremental`. RED before the fix: `FAIL apiserver/utils` yet exit 0 with `=== Done` and no xcecli tests run. GREEN after: apiserver probe -> exit 1, no Done line; xcecli probe -> exit 1; clean tree -> exit 0 with all 10 xcecli packages tested. The probe files were removed (never committed)
+- Suites: n/a -- build-script change; `bash -n` clean
+- Live: n/a -- the three builds above are the end-to-end check
 
 ## References
-- Related: none
+- Fix commit: 4e484629
+- Related: bug-1894 (found during its RED step)