From faf196eee8fc5132dcc05567bf88318a5366038c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:06:37 +0000
Subject: [PATCH 1/9] e2e: read OQL rows by alias; liveness for negative-only
 span claims; APP-DOWN between journeys

#154: helpers.js built OQL rows with Object.values(r) and oqlScalar read
rows[0][0]. mxcli v0.26.0 prints keys alphabetically, omits an all-null
column and, over a view entity, adds ID beside the alias, so columns
shifted and a view's count read as its ID. The brace counter ignored
strings, so a value holding ] or } returned null. Rows are now keyed by
the parsed SELECT aliases (SELECT order, explicit nulls), oqlScalar reads
the first alias, new oqlRows, string-aware slicing. Golden: the released
v0.26.0 binary's verbatim output against a stub admin API
(tests/wave2/fixtures/oql-json/); test-oql-rows.sh 15/15, 0/15 on master.

#150 remainder: a mustNotFire-only step with zero spans was INVALID on
every run. Rung 2 (now traceRung) waits the full window and requires a
declared spans.liveness span or any service span since the journey began
(otel.js liveness) before judging; the trace-negative mutant injects the
forbidden name after that check.

#285 harness half: probe baseUrl before each journey (APP-DOWN, not
walked) and after each (flag its FAIL rows). APP_PROBE=0 disables.
test-journey-liveness.sh 27/27 over the captured Jaeger trace.

No live-app field run yet.

Closes #154
Refs #150 #285

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   2 +
 project-tests/e2e/helpers.js                  | 151 ++++++++++---
 project-tests/e2e/journey-runner.js           | 181 +++++++++++++---
 project-tests/e2e/otel.js                     |  32 ++-
 skills/journey-proof.md                       |  36 +++-
 skills/learned-db-assertions.md               |  23 ++
 .../wave2/fixtures/oql-json/admin-api-stub.js |  27 +++
 tests/wave2/fixtures/oql-json/allnull.stderr  |   2 +
 tests/wave2/fixtures/oql-json/allnull.stdout  |   6 +
 tests/wave2/fixtures/oql-json/bracket.stderr  |   2 +
 tests/wave2/fixtures/oql-json/bracket.stdout  |   6 +
 tests/wave2/fixtures/oql-json/cases.txt       |   7 +
 tests/wave2/fixtures/oql-json/nullcol.stderr  |   2 +
 tests/wave2/fixtures/oql-json/nullcol.stdout  |  12 ++
 tests/wave2/fixtures/oql-json/view.stderr     |   2 +
 tests/wave2/fixtures/oql-json/view.stdout     |   6 +
 tests/wave2/test-journey-liveness.sh          | 198 ++++++++++++++++++
 tests/wave2/test-oql-rows.sh                  | 131 ++++++++++++
 18 files changed, 770 insertions(+), 56 deletions(-)
 create mode 100644 tests/wave2/fixtures/oql-json/admin-api-stub.js
 create mode 100644 tests/wave2/fixtures/oql-json/allnull.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/allnull.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/bracket.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/bracket.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/cases.txt
 create mode 100644 tests/wave2/fixtures/oql-json/nullcol.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/nullcol.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/view.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/view.stdout
 create mode 100644 tests/wave2/test-journey-liveness.sh
 create mode 100644 tests/wave2/test-oql-rows.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..9e69376c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (27 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/project-tests/e2e/helpers.js b/project-tests/e2e/helpers.js
index f0e0c53c..a4c9cb6e 100644
--- a/project-tests/e2e/helpers.js
+++ b/project-tests/e2e/helpers.js
@@ -631,10 +631,14 @@ async function computedStyles(page, checks) {
 // This project runs natively under Studio Pro, so `mxcli oql -p` would route
 // through `docker compose exec` and fail. --direct talks HTTP to the admin API.
 //
-// Two shapes come back depending on mxcli version: {rows:[[v]]} (positional) or
-// a bare array of column-keyed objects [{n: "30"}]. Normalise both to
-// {rows:[[v]]} so callers only deal with one shape. Note OQL requires every
-// select column to be aliased — `SELECT COUNT(*) AS n`, never `SELECT COUNT(*)`.
+// What `mxcli oql --direct --json` prints (captured from the released v0.26.0 binary, see
+// tests/wave2/fixtures/oql-json/): a bare array of objects keyed by column alias, keys in
+// ALPHABETICAL order (Go map encoding), a column that is null in every row LEFT OUT, a view
+// entity's `ID` key added beside the aliases, and "(n rows)" on stderr. So a row is never
+// read by position: oql() keys every row by the SELECT list's aliases, in SELECT order,
+// with an explicit null for an absent key (#154 — `Object.values(r)` read `ID` for a view's
+// count and shifted every column after a null one place left). OQL requires every select
+// column to be named — `SELECT COUNT(*) AS n`, never `SELECT COUNT(*)`.
 // The mxcli binary to spawn. Git Bash maps `mxcli` -> `mxcli.exe` transparently; Node does
 // not, so on Windows a configured './mxcli' that only exists as './mxcli.exe' is probed here
 // (CLAUDE.md "Shipping an instrument" rule 3). Shared by oql() and journey-runner's preflight
@@ -646,6 +650,7 @@ function mxcliBin() {
   return cfg.mxcli;
 }
 
+// Returns { columns, rows, objects } (see parseOqlOutput) or null when the query did not run.
 function oql(sql) {
   try {
     const out = execFileSync(mxcliBin(), [
@@ -653,43 +658,133 @@ function oql(sql) {
       '--host', cfg.adminHost, '--port', String(cfg.adminPort), '--token', cfg.adminToken,
       '--json', sql,
     ], { cwd: cfg.root, encoding: 'utf8', timeout: 20000 });
-    return parseOqlOutput(out);
+    return parseOqlOutput(out, sql);
   } catch (_) {}
   return null;
 }
 
+// The SELECT list's column names, in SELECT order: `AS <alias>` where given, else the last
+// segment of a bare attribute path (`c.Name` → Name). null for an item that has neither
+// (an expression the runtime would refuse as unnamed); null for the whole list when it
+// cannot be read (no SELECT, `*`). Commas inside parentheses and quoted strings are not
+// separators, so `COALESCE(a, b) AS x` and `'a, b' AS y` are one item each.
+function oqlAliases(sql) {
+  const s = String(sql || '');
+  const head = s.match(/^\s*SELECT\s+(?:DISTINCT\s+)?/i);
+  if (!head) return null;
+  const items = [];
+  let depth = 0, quote = null, cur = '';
+  for (let i = head[0].length; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      cur += c;
+      if (c === quote) { if (s[i + 1] === quote) { cur += s[++i]; } else quote = null; }
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; cur += c; continue; }
+    if (c === '(') depth++;
+    else if (c === ')') depth--;
+    if (depth === 0) {
+      if (c === ',') { items.push(cur); cur = ''; continue; }
+      if (/\s/.test(c) && /^FROM\b/i.test(s.slice(i + 1))) { items.push(cur); cur = null; break; }
+    }
+    cur += c;
+  }
+  if (cur !== null && cur.trim()) items.push(cur);   // no FROM: SELECT 1 AS n
+  if (!items.length) return null;
+  const names = items.map((raw) => {
+    const it = raw.trim();
+    const as = it.match(/\bAS\s+(?:"([^"]+)"|([A-Za-z_]\w*))\s*$/i);
+    if (as) return as[1] || as[2];
+    const bare = it.match(/^(?:[A-Za-z_][\w]*[./])*([A-Za-z_]\w*)$/);
+    return bare ? bare[1] : null;
+  });
+  return names.some((n) => n === '*') ? null : names;
+}
+
+// The first JSON value in mxcli's stdout, sliced string-aware: a `]` or `}` inside a string
+// value (a label such as "a]b}c") is not a bracket. The old depth counter ended the slice
+// there and JSON.parse failed, so the helper returned null — "no measurement" — on a real
+// answer (#154).
+function sliceJson(out) {
+  const start = out.search(/[[{]/);
+  if (start < 0) return null;
+  let depth = 0, inStr = false;
+  for (let i = start; i < out.length; i++) {
+    const c = out[i];
+    if (inStr) {
+      if (c === '\\') i++;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') inStr = true;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') { depth--; if (depth === 0) return out.slice(start, i + 1); }
+  }
+  return null;
+}
+
+// Look a column up in one row object: exact key first, then case-insensitively. An absent
+// key is null — the runtime leaves null columns out, it does not mean "no such column".
+function pick(obj, name) {
+  if (!obj || typeof obj !== 'object') return null;
+  if (Object.prototype.hasOwnProperty.call(obj, name)) return obj[name] ?? null;
+  const k = Object.keys(obj).find((x) => x.toLowerCase() === String(name).toLowerCase());
+  return k === undefined ? null : (obj[k] ?? null);
+}
+
 // The parsing half of oql(), split out so journey-runner's admin preflight reads a probe's
 // stdout with the same code the data rungs use (one parser, so the probe cannot pass on a
-// shape the rungs then reject).
-// mxcli prints a "Using project:" banner and a trailing "(n rows)" line
-// around the JSON — slice out the JSON body before parsing.
-function parseOqlOutput(out) {
+// shape the rungs then reject). mxcli prints a banner and "(n rows)" around the JSON —
+// slice out the JSON body before parsing.
+//
+// Returns { columns, rows, objects, keyed }:
+//   columns — the SELECT aliases (keyed: true), or, when `sql` is absent or unreadable, the
+//             union of the answer's keys (keyed: false — positions then mean nothing)
+//   rows    — [[v…]] in `columns` order, explicit null where a key was absent
+//   objects — one { alias: value } per row, every alias present
+// A legacy {rows:[[…]]} body passes through unchanged (keyed: false).
+function parseOqlOutput(out, sql) {
   try {
-    out = String(out || '');
-    const start = out.search(/[[{]/);
-    if (start < 0) return null;
-    let depth = 0, end = -1;
-    for (let i = start; i < out.length; i++) {
-      const c = out[i];
-      if (c === '[' || c === '{') depth++;
-      else if (c === ']' || c === '}') { depth--; if (depth === 0) { end = i + 1; break; } }
-    }
-    if (end < 0) return null;
-    const parsed = JSON.parse(out.slice(start, end));
-
+    const body = sliceJson(String(out || ''));
+    if (body === null) return null;
+    const parsed = JSON.parse(body);
     if (Array.isArray(parsed)) {
-      return { rows: parsed.map((r) => (r && typeof r === 'object' ? Object.values(r) : [r])) };
+      const aliases = oqlAliases(sql);
+      const keyed = !!(aliases && aliases.every((a) => a));
+      let columns = keyed ? aliases : [];
+      if (!keyed) for (const r of parsed) {
+        if (r && typeof r === 'object') for (const k of Object.keys(r)) if (!columns.includes(k)) columns.push(k);
+      }
+      if (!keyed && !columns.length) columns = ['value'];
+      const objects = parsed.map((r) => Object.fromEntries(columns.map((c) =>
+        [c, r && typeof r === 'object' ? pick(r, c) : (columns.length === 1 ? r : null)])));
+      return { columns, rows: objects.map((o) => columns.map((c) => o[c])), objects, keyed };
     }
-    if (parsed && parsed.rows !== undefined) return parsed;
+    if (parsed && parsed.rows !== undefined) return { keyed: false, ...parsed };
   } catch (_) {}
   return null;
 }
 
-// Convenience: first cell of the first row, or null.
-function oqlScalar(sql) {
+// Rows as alias-keyed objects ([{ n: "3", label: null }]), or null when the query did not run.
+function oqlRows(sql) {
   const r = oql(sql);
-  return r && r.rows && r.rows[0] !== undefined && r.rows[0][0] !== undefined
-    ? String(r.rows[0][0]) : null;
+  return r && r.objects ? r.objects : null;
+}
+
+// The FIRST SELECT alias of the first row, or null (no row, a null value, or no measurement).
+// Never `rows[0][0]` of whatever order the keys came back in: over a view entity the answer
+// carries `ID` too, and that sorts before a lower-case alias. When the SELECT list cannot be
+// read, a single-key answer is still unambiguous; anything wider is null — a guess between
+// columns is exactly the defect this replaces.
+function oqlScalar(sql) {
+  return scalarOf(oql(sql));
+}
+function scalarOf(r) {
+  if (!r || !r.rows || r.rows[0] === undefined) return null;
+  if (r.keyed === false && r.columns && r.columns.length !== 1) return null;
+  const v = r.rows[0][0];
+  return v === undefined || v === null ? null : String(v);
 }
 
 // ── Reporter ────────────────────────────────────────────────────────────────
@@ -733,6 +828,6 @@ module.exports = {
   humanMove, humanClick, humanType, humanTypeKeys, humanScroll,
   navTo, ensureSidebar, copilotText, askCopilot, approveConfirmCard,
   login, logout, assertIdentity, dismissModal, gotoTarget,
-  screenshotEl, fullPageShot, computedStyles, oql, oqlScalar, parseOqlOutput, mxcliBin, makeReporter,
+  screenshotEl, fullPageShot, computedStyles, oql, oqlRows, oqlScalar, oqlAliases, parseOqlOutput, scalarOf, mxcliBin, makeReporter,
   ensureDirs, parseTokens, path, fs,
 };
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index 1c954cab..b4ce1fd0 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -9,7 +9,8 @@
 // credential + reachability, required env vars, live sessions. Exit 2 = aborted there.
 // Env: TEST_USER / TEST_PASS (required; ALLOW_CONFIG_CREDENTIALS=1 to use the config
 // default), M2EE_ADMIN_PASS / M2EE_ADMIN_PORT, ALLOW_NO_DATA_RUNG=1, JOURNEY_SESSION_CAP=<n>,
-// ALLOW_SESSION_CAP=1. Journeys may declare requiresEnv / requires / leaves / consumes,
+// ALLOW_SESSION_CAP=1, APP_PROBE=0 (no app probe between journeys). Journeys may declare
+// requiresEnv / requires / leaves / consumes,
 // resetsData (refused under --protect-state) and assertLanding (or --assert-landing).
 //
 // WHY THIS EXISTS
@@ -319,6 +320,61 @@ async function act(page, a, vars, note) {
   else await settle(page, { timeout: 10000, stableMs: 300, networkIdleMs: 0, fallbackMs: 1200 });
 }
 
+// ── RUNG 2: ordered spans, as a function (called from runJourney) ───────────
+// Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with ordered
+// empty/absent) — a step whose whole proof is "this did NOT run" (#150). `capture` and
+// `live` are injected so tests/wave2/test-journey-negative-trace.sh drives it with a
+// captured Jaeger trace and no browser. `rec(name, verdict, detail)` records one row.
+//
+// NEGATIVE-ONLY NEEDS A LIVENESS REFERENCE. Zero spans in the step window is what a correct
+// Cancel looks like AND what Jaeger down / OTel off looks like. Before 2026-10-13 that was
+// INVALID "Jaeger down or OTel off" for both, so the claim could never pass; the opposite
+// fix (zero spans → PASS) would pass with tracing dead. So: wait the full capture window
+// (there is nothing to `until` on), then require evidence the pipeline was delivering —
+// the step's declared `spans.liveness` span, or any span from the service since the
+// journey began (otel.js liveness). No evidence → INVALID, naming which.
+async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
+  const claimed = (step.spans && step.spans.ordered) || [];
+  const mustNot = (step.spans && step.spans.mustNotFire) || [];
+  if (!claimed.length && !mustNot.length) return;
+  const negOnly = !claimed.length;
+  const probe = (step.spans && step.spans.liveness) || null;
+  const has = (sp, n) => O.microflowNames(sp).includes(n) || sp.some(x => x.op === n);
+  // Wait for the claimed microflows, not just any span — see otel.js capture() `until`.
+  const until = !negOnly ? sp => claimed.every(n => O.microflowNames(sp).includes(n))
+    : probe ? sp => has(sp, probe) : () => false;
+  let spans = capture ? await capture(t0, { min: 1, until })
+                      : await O.capture(t0, { min: 1, until: until });
+  const real = spans.length;
+  if (negOnly && (!real || probe)) {
+    const lv = await live(since, { name: probe, spans });
+    if (!lv.ok) {
+      rec(`${step.name}: spans`, 'INVALID',
+          `negative-only claim (${mustNot.join(', ')} must not run) with no liveness evidence: ${lv.detail}. ` +
+          '"Nothing ran" and "tracing is off" look the same here — trace rung did NOT run.');
+      return;
+    }
+    rec(`${step.name}: tracing live`, 'PASS', lv.detail);
+  } else if (!real) {
+    rec(`${step.name}: spans`, 'INVALID',
+        'zero spans captured — Jaeger down or OTel off. Trace rung did NOT run.');
+    return;
+  }
+  // Positive control only (controlMutants' trace-negative branch for a negative-only claim):
+  // the forbidden microflow is injected into the capture AFTER the liveness verdict, so the
+  // mutant proves assertNotFired can go red without being able to vouch for a dead pipeline.
+  const inject = (step.spans && step.spans._controlInjectFired) || [];
+  if (inject.length) spans = spans.concat(inject.map(n => ({ op: n, start: Date.now() * 1000, dur: 0,
+    traceID: 'positive-control', tags: { 'mx.microflow.name': n }, logs: [] })));
+  const rep = (name, ok, detail) => rec(name, ok ? 'PASS' : 'FAIL', detail);
+  if (real) {
+    O.guard(spans, rep, `${step.name}: capture non-empty`);
+    if (claimed.length) O.assertSequence(spans, claimed, rep, `${step.name}: ordered`);
+    O.assertNoErrors(spans, rep, `${step.name}: no ERROR at any level`);
+  }
+  for (const n of mustNot) O.assertNotFired(spans, new RegExp(n), rep, `${step.name}: ${n} did not run`);
+}
+
 // ── Rung 3 helpers ──────────────────────────────────────────────────────────
 // oql() swallows every error and returns null, so null must mean "no measurement",
 // never "zero". A count assertion that treats null as 0 passes when the instrument
@@ -491,6 +547,17 @@ const CONTROL_RUNGS = [
   'data-delta', 'data-target', 'outcome',
 ];
 
+// A microflow name the mustNotFire pattern matches: the pattern itself when it matches its
+// own text (the usual bare name, `Mod.ACT_X`), else the pattern with anchors and escapes
+// stripped; null when neither matches (the mutant is then reported unsupported, not faked).
+function forbiddenSample(pattern) {
+  let re;
+  try { re = new RegExp(pattern); } catch (_) { return null; }
+  if (re.test(pattern)) return pattern;
+  const plain = String(pattern).replace(/^\^|\$$/g, '').replace(/\\(.)/g, '$1');
+  return re.test(plain) ? plain : null;
+}
+
 function controlMutants(j) {
   const clone = () => JSON.parse(JSON.stringify(j));
   const out = [];
@@ -535,8 +602,16 @@ function controlMutants(j) {
   // any out-of-sequence microflow through unnoticed.
   add('trace-negative', 'assert a microflow that DID run must not have run', (c) => {
     const s = c.steps.find(x => x.spans && x.spans.ordered && x.spans.ordered.length);
-    if (!s) return false;
-    s.spans.mustNotFire = [s.spans.ordered[0].split('.').pop()];
+    if (s) { s.spans.mustNotFire = [s.spans.ordered[0].split('.').pop()]; return; }
+    // A negative-only claim has no microflow that is known to run, so the mutant makes one:
+    // the forbidden name is injected into the step's capture (after its liveness check) and
+    // assertNotFired must go red on it (#150).
+    const neg = c.steps.find(x => x.spans && (x.spans.mustNotFire || []).length);
+    if (!neg) return false;
+    const name = forbiddenSample(neg.spans.mustNotFire[0]);
+    if (name === null) return false;
+    neg.spans.mustNotFire = [neg.spans.mustNotFire[0]];
+    neg.spans._controlInjectFired = [name];
   }, named('did not run'));
 
   // Rung 4a — the row-count delta.
@@ -607,6 +682,9 @@ async function resetToStart(page) {
 }
 
 async function runJourney(page, j) {
+  // Journey start, a little before: the window a negative-only span claim's liveness check
+  // reads (the navigation that resetToStart just made counts as evidence tracing is live).
+  const jt0 = Date.now() - 30000;
   console.log(`\n=== JOURNEY ${j.id} — ${j.title || ''}`);
   console.log(`    persona: ${j.persona || cfg.user}   requirements: ${(j.requirement || []).join(', ') || '(none declared)'}`);
 
@@ -751,27 +829,8 @@ async function runJourney(page, j) {
     }
 
     // ── RUNG 2: ordered spans ────────────────────────────────────────────────
-    // Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with
-    // ordered empty/absent) — a step whose whole proof is "this did NOT run" (#150).
-    const claimed = (step.spans && step.spans.ordered) || [];
-    const mustNot = (step.spans && step.spans.mustNotFire) || [];
-    if (claimed.length || mustNot.length) {
-      // Wait for the claimed microflows, not just any span — see otel.js capture() `until`.
-      const spans = await O.capture(t0, { min: 1,
-        until: sp => { const got = O.microflowNames(sp); return claimed.every(n => got.includes(n)); } });
-      if (!spans.length) {
-        record('trace', `${step.name}: spans`, 'INVALID',
-               'zero spans captured — Jaeger down or OTel off. Trace rung did NOT run.', req);
-      } else {
-        O.guard(spans, otelReporter(req), `${step.name}: capture non-empty`);
-        if (claimed.length)
-          O.assertSequence(spans, claimed, otelReporter(req), `${step.name}: ordered`);
-        O.assertNoErrors(spans, otelReporter(req), `${step.name}: no ERROR at any level`);
-        for (const n of mustNot) {
-          O.assertNotFired(spans, new RegExp(n), otelReporter(req), `${step.name}: ${n} did not run`);
-        }
-      }
-    }
+    await traceRung(step, { t0, since: jt0,
+      rec: (name, verdict, detail) => record('trace', name, verdict, detail, req) });
 
     // ── RUNG 3: data effects ─────────────────────────────────────────────────
     const d = step.data;
@@ -931,9 +990,9 @@ function classifyAdminProbe(text, status) {
   if (auth) return { state: 'auth', http: Number(auth[1] || auth[2]) };
   if (/cannot connect to Mendix admin API|ECONNREFUSED|connection refused/i.test(t))
     return { state: 'unreachable' };
-  const parsed = H.parseOqlOutput(t);
+  const parsed = H.parseOqlOutput(t, ADMIN_PROBE_SQL);
   if (status === 0 && parsed && parsed.rows && parsed.rows[0] !== undefined) {
-    const n = Number(parsed.rows[0][0]);
+    const v = H.scalarOf(parsed), n = v === null ? NaN : Number(v);
     return { state: 'ok', sessions: Number.isFinite(n) ? n : null };
   }
   return { state: 'unknown', detail: t.trim().split('\n').filter(Boolean).slice(-1)[0] || `exit ${status}` };
@@ -1188,6 +1247,50 @@ function stateTracker(journeys) {
   };
 }
 
+// ── App liveness between journeys (#285) ────────────────────────────────────
+// The preflight probes the app once, before the first journey. Field run 2026-10-12: a watch
+// rebuild failed mid-suite (IO_PathNotFound on deployment/web/pages), the runtime went down,
+// and every remaining journey failed as if the features were broken — the suite owner had to
+// be told to rerun only the infrastructure failures. So the runner asks before each journey
+// whether the app still answers, and after each one whether it outlived it:
+//   down before a journey → that journey is APP-DOWN (INVALID, `appDown: true`), not walked;
+//   down after a journey  → its FAIL rows are flagged `appDown: true` and named in the summary
+//                            as "rerun before reading as findings" — the verdict stays FAIL,
+//                            because the app may have died of what the journey found.
+// "Up" is any HTTP answer below 500; a refused connection, a timeout or a 5xx is down. A few
+// short retries absorb a restart already in progress. APP_PROBE=0 turns it off.
+async function probeApp(url, { timeoutMs = 5000, fetchFn = globalThis.fetch } = {}) {
+  try {
+    const r = await fetchFn(url, { redirect: 'manual', signal: AbortSignal.timeout(timeoutMs) });
+    return r.status >= 500 ? { up: false, detail: `HTTP ${r.status}` } : { up: true, detail: `HTTP ${r.status}` };
+  } catch (e) {
+    return { up: false, detail: (e && e.cause && e.cause.code) || (e && e.name) || String(e) };
+  }
+}
+
+async function appGate(url, { probe = probeApp, tries = 3, waitMs = 5000, sleep = PAUSE } = {}) {
+  let last = null;
+  for (let i = 0; i < tries; i++) {
+    last = await probe(url);
+    if (last.up) return { up: true, detail: last.detail, tries: i + 1 };
+    if (i + 1 < tries) await sleep(waitMs);
+  }
+  return { up: false, detail: last.detail, tries };
+}
+
+// The rows a journey just produced, after the app was found down: flag every FAIL. Returns
+// how many were flagged.
+function flagAppDown(rows, detail) {
+  let n = 0;
+  for (const r of rows) {
+    if (r.verdict !== 'FAIL') continue;
+    r.appDown = true;
+    r.detail = `${r.detail ? r.detail + '  ' : ''}[APP-DOWN after this journey: ${detail} — rerun before reading as a finding]`;
+    n++;
+  }
+  return n;
+}
+
 // ── Exports for the rung-4 scope unit test ──────────────────────────────────
 // The SQL builders are pure and exported so their behaviour can be proven against
 // fixture rows without a running app. See tests/e2e/journey-rung4-scope.test.js.
@@ -1200,6 +1303,7 @@ module.exports = {
   runExitCode, personaMismatch,
   classifyAdminProbe, journeyNeedsAdmin, missingEnv, preflight, orderJourneys, stateTracker,
   judgeLanding,
+  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown,
 };
 
 // ── Main ────────────────────────────────────────────────────────────────────
@@ -1297,10 +1401,25 @@ const findingsFile = () => path.join(cfg.artifactsDir,
   if (assumed.length)
     console.log(`  requires that no journey in this run leaves (trusted to the fixture): ${assumed.join(', ')}`);
 
+  const appDown = [], appDiedIn = [];
+  const APP_PROBE = process.env.APP_PROBE !== '0';
   if (li.ok && !li.usedFallback) {
     for (const j of journeys) {
       // Already named once on the preflight SETUP line; no per-journey INVALID on top.
       if (pf.skip.has(j.id)) { state.settle(j, [], false); continue; }
+      if (APP_PROBE) {
+        const app = await appGate(cfg.baseUrl);
+        if (!app.up) {
+          console.log(`  APP-DOWN  ${j.id} — ${cfg.baseUrl} not answering (${app.detail}, ${app.tries} tries)`);
+          record('setup', `${j.id}: app up`, 'INVALID',
+            `APP-DOWN — ${cfg.baseUrl} did not answer before this journey (${app.detail}). Not walked; ` +
+            'not a feature failure. Restart the app and rerun the APP-DOWN journeys.', (j.requirement || []).join(', '));
+          results[results.length - 1].appDown = true;
+          appDown.push(j.id);
+          state.settle(j, [], false);
+          continue;
+        }
+      }
       const wrongPersona = personaMismatch(j, li.user);
       if (wrongPersona) {
         record('ui', `${j.id}: persona`, 'INVALID', wrongPersona, (j.requirement || []).join(', '));
@@ -1362,6 +1481,10 @@ const findingsFile = () => path.join(cfg.artifactsDir,
         const before = results.length;
         await resetToStart(page);
         await runJourney(page, j);
+        if (APP_PROBE) {
+          const after = await probeApp(cfg.baseUrl);
+          if (!after.up && flagAppDown(results.slice(before), after.detail)) appDiedIn.push(j.id);
+        }
         state.settle(j, results.slice(before), true);
       }
     }
@@ -1381,6 +1504,11 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     console.log('  ⚠ INVALID means an instrument did not run. Those checks are NOT green —');
     console.log('    they are absent. Fix the instrument before reading this report as coverage.');
   }
+  if (appDown.length)
+    console.log(`  APP-DOWN ${appDown.length} journey(s) not walked — the app stopped answering: ${appDown.join(', ')}. ` +
+                'Restart it and rerun only these.');
+  if (appDiedIn.length)
+    console.log(`  ⚠ the app was down when ${appDiedIn.join(', ')} ended — their FAIL rows are flagged APP-DOWN; rerun before reading them as findings.`);
 
   // The control run's own denominator. Without it, 4 of 7 rungs proven and 7 of 7
   // print the same, and the second claim is the one everyone reads.
@@ -1422,6 +1550,7 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     capturedAt: new Date().toISOString(),
     configuredUser: cfg.user, actualUser: li.user, usedFallback: !!li.usedFallback,
     baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, mutants, results, walks,
+    appDown, appDiedIn,
   }, null, 2));
   console.log(`  findings → ${path.relative(cfg.root, out)}`);
 
diff --git a/project-tests/e2e/otel.js b/project-tests/e2e/otel.js
index 1fc35c16..e86a6e96 100644
--- a/project-tests/e2e/otel.js
+++ b/project-tests/e2e/otel.js
@@ -113,6 +113,36 @@ async function capture(t0, { min = 1, retries = 8, waitMs = 1500, until = null }
   return out;
 }
 
+/**
+ * Is tracing alive right now? The reference a NEGATIVE-ONLY span claim needs (#150).
+ *
+ * A step whose whole proof is "X did not run" (Cancel on a reset confirmation) can rightly
+ * capture zero spans — and zero spans is also what Jaeger down or OTel off looks like. So
+ * an empty step capture proves nothing until something shows the pipeline was delivering:
+ *   - `name` given (the step's `spans.liveness`): that microflow or operation is in `spans`
+ *     — a span the step is known to produce, e.g. the page's data-source retrieve;
+ *   - otherwise: Jaeger answers, and the service emitted at least one span since `since`
+ *     (the journey's start, so the navigation into the step counts).
+ * Returns { ok, detail }. Never throws: an unreachable Jaeger is `ok: false`.
+ */
+async function liveness(since, { name = null, spans = [] } = {}) {
+  if (name) {
+    const hit = spans.some(s => s.tags['mx.microflow.name'] === name || s.op === name);
+    return { ok: hit, detail: hit
+      ? `liveness span ${name} captured in the step window`
+      : `declared liveness span ${name} not captured in the step window (${spans.length} spans)` };
+  }
+  let data;
+  try { ({ data } = await fetchSince(since)); }
+  catch (e) { return { ok: false, detail: `Jaeger unreachable at ${JAEGER} (${e.code || e.message})` }; }
+  let n = 0;
+  const sinceUs = since * 1000;
+  for (const t of data) for (const s of t.spans) if (s.startTime >= sinceUs) n++;
+  return { ok: n > 0, detail: n > 0
+    ? `tracing live: ${n} span(s) from ${SVC} since the journey started`
+    : `Jaeger answered, but ${SVC} emitted no span since the journey started — OTel off or exporter down` };
+}
+
 // --- shape helpers ---------------------------------------------------------
 
 const microflowSpans = spans => spans.filter(s => s.tags['mx.microflow.name']);
@@ -235,7 +265,7 @@ function assertSequence(spans, names, reporter, label = null) {
 }
 
 module.exports = {
-  capture, guard,
+  capture, guard, liveness,
   microflowSpans, activitySpans, microflowNames, errorSpans, describeError,
   assertFired, assertNoErrors, assertNotFired, assertLoopCount, assertSequence,
   JAEGER, SVC,
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index 09c908d3..d637880d 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -100,6 +100,19 @@ before every journey that consumes X. A journey whose precondition did not hold
 and is not walked. Without the headers it would show up as a seed INVALID. Journeys without
 headers run in file order, as before.
 
+**APP-DOWN is not FAIL (#285).** The preflight probes the app only once. In one field run a
+watch rebuild took the runtime down mid-suite, and every later journey FAILed as if its feature
+were broken. The runner now probes `baseUrl` before each journey: 3 tries, 5 s apart. Any HTTP
+answer below 500 counts as up.
+
+- **Down before a journey:** an `APP-DOWN` line. The journey is recorded `INVALID` with
+  `appDown: true` and is not walked.
+- **Down after a journey:** that journey's FAIL rows are flagged `[APP-DOWN after this journey …]`
+  and keep FAIL, because the app may have died of what the journey found.
+
+The summary names both lists. Restart the app and rerun only those journeys. `APP_PROBE=0` turns
+the probe off.
+
 Logout runs on every exit path: normal end, a crash, and SIGINT/SIGTERM. A run whose logout is
 not confirmed says so. Declared state does not make a rerun idempotent. A journey that consumes
 its own fixture still needs a reset/seed journey that `leaves` that state again.
@@ -148,7 +161,7 @@ prove. (#149: a journey declaring a non-admin persona walked green under the adm
 |---|---|---|---|
 | 1 | **Landing guard** | the step's `ready` widget is visible | Without it, every later assertion runs against the *previous* page and screenshots it under the new page's title |
 | 2 | **What the screen says** | `textPresent` / `textAbsent` | The machine can do the work correctly and the screen still lie about it. This is the rung that found the one real product defect in the pilot |
-| 3 | **Ordered spans** | microflows fired, **in order**, plus `mustNotFire` | `assertFired` is existence-only: it cannot tell a skipped step from a reordered one |
+| 3 | **Ordered spans** | microflows fired, **in order**, plus `mustNotFire` | `assertFired` is existence-only: it cannot tell a skipped step from a reordered one. A `mustNotFire`-only claim needs a liveness reference — see below |
 | 4 | **Data effects** | row-count delta, `assocMustBeSet`, `mustPointAt` | See below — three distinct claims that look like one |
 | 5 | **Outcome** | one OQL query over the end state | Per-step deltas can each be right while the journey's net result is wrong |
 
@@ -166,6 +179,27 @@ with no link to the unit it is for is a broken golden path even though it saved.
 
 `mustPointAt` is the third claim and the expensive one to skip. **Set-ness is not correctness.**
 
+### A negative-only span claim needs a liveness reference
+
+A step whose whole proof is "X did not run" declares `spans: { "mustNotFire": ["ACT_X_Reset"] }`
+with no `ordered`. Cancel on a "Reset all state?" confirmation is an example. Such a step can
+correctly capture **zero spans**. Jaeger down or OTel off also gives zero spans.
+
+- **Before #150:** both cases read `INVALID — zero spans captured`, so the claim could never pass.
+- **Wrong fix:** reading zero spans as PASS passes the claim with tracing dead.
+
+The runner waits the full capture window, then asks for evidence that tracing was live:
+
+| Evidence | Verdict |
+|---|---|
+| the step declares `"liveness": "<span>"` (a span the step is known to produce, such as the page's data-source retrieve) and it was captured | judged: `tracing live` PASS, then each `did not run` |
+| no declared span; the service emitted ≥1 span since the journey started (`otel.liveness`) | judged, same rows |
+| declared span missing, service silent, or Jaeger unreachable | `INVALID`: the claim is not judged |
+
+The `trace-negative` control mutant covers this shape too. It injects the forbidden name into the
+step's capture **after** the liveness check, so `did not run` must go red. With tracing dead the
+mutant reads INVALID and the rung stays unproven.
+
 ---
 
 ## Non-vacuity: one control per rung, never a boolean
diff --git a/skills/learned-db-assertions.md b/skills/learned-db-assertions.md
index 895cb625..1cf340e7 100644
--- a/skills/learned-db-assertions.md
+++ b/skills/learned-db-assertions.md
@@ -54,6 +54,29 @@ on every data rung (#286). The shipped `tests/e2e/config.js` now resolves the to
 as a guess. `journey-runner.js` probes the admin API once before the suite and aborts on 401/403,
 naming where the token came from.
 
+### Read the answer by alias, never by position
+
+`mxcli oql --direct --json` prints an array of objects. Captured from the v0.26.0 binary
+(`tests/wave2/fixtures/oql-json/`):
+
+```
+SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid …   →   [{"mid":"m1","zeta":"z1"}]
+SELECT b.AttentionCount AS n FROM <Module>.<ViewEntity> …    →   [{"ID":"2814…","n":"7"}]
+```
+
+The keys come back alphabetically. A column that is null in every row is left out. A view entity
+adds `ID` beside your alias. So a row read by position is wrong: `Object.values(row)[0]` is
+`"m1"` in the first query (not `zeta`) and the view's ID in the second (not the count). That is
+what `helpers.js` did until #154.
+
+- `H.oqlScalar(sql)` returns the **first alias in the SELECT list**, or null when there is no row
+  or the value is null. Null always means "no measurement", never 0.
+- `H.oqlRows(sql)` returns alias-keyed objects with **every alias present** (explicit `null`).
+- `H.oql(sql).rows` is in SELECT order with explicit nulls.
+- Name every column (`COUNT(*) AS n`). An unaliased bare path (`c.Name`) is read as `Name`. A
+  `SELECT *` or an unnamed expression has no alias, so `oqlScalar` returns null rather than
+  guess a column.
+
 ### Correction to the previous version of this skill
 
 This skill used to open with: *"`mxcli oql --direct` requires the M2EE admin token. In Mendix
diff --git a/tests/wave2/fixtures/oql-json/admin-api-stub.js b/tests/wave2/fixtures/oql-json/admin-api-stub.js
new file mode 100644
index 00000000..13bf4b41
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/admin-api-stub.js
@@ -0,0 +1,27 @@
+// Stub of the Mendix admin API's OQL preview endpoint (POST /dev/preview_execute_oql), used to
+// capture what the REAL mxcli binary prints for `oql --direct --json`. The runtime half (the
+// bodies below) is synthetic and follows mxcli's own tests (cmd/mxcli/docker/oql_test.go:
+// "the runtime omits a column from a row's JSON object when its value is null"); the
+// *.stdout / *.stderr files beside this are mxcli v0.26.0's verbatim output for them.
+// Re-capture on an mxcli upgrade:
+//   node admin-api-stub.js 18991 &
+//   mxcli oql --direct --host 127.0.0.1 --port 18991 --token stub --json "<sql from cases.txt>" \
+//     > <case>.stdout 2> <case>.stderr
+// The case is chosen by its marker string inside the query.
+const http = require('http');
+const bodies = {
+  NULLCOL: { data: [{ zeta: 'z1', mid: 'm1' }, { zeta: 'z2', alpha: 'a2', mid: 'm2' }] },
+  ALLNULL: { data: [{ zeta: 'z1', mid: 'm1' }] },
+  VIEW:    { data: [{ ID: '281474976710657', n: '7' }] },
+  BRACKET: { data: [{ label: 'a]b}c"d', n: '2' }] },
+};
+http.createServer((req, res) => {
+  let b = '';
+  req.on('data', (c) => { b += c; });
+  req.on('end', () => {
+    const q = JSON.parse(b).oql;
+    const k = Object.keys(bodies).find((x) => q.includes(x));
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(bodies[k] || { data: [] }));
+  });
+}).listen(Number(process.argv[2]), '127.0.0.1');
diff --git a/tests/wave2/fixtures/oql-json/allnull.stderr b/tests/wave2/fixtures/oql-json/allnull.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/allnull.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/allnull.stdout b/tests/wave2/fixtures/oql-json/allnull.stdout
new file mode 100644
index 00000000..ce5a8876
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/allnull.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "mid": "m1",
+    "zeta": "z1"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/bracket.stderr b/tests/wave2/fixtures/oql-json/bracket.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/bracket.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/bracket.stdout b/tests/wave2/fixtures/oql-json/bracket.stdout
new file mode 100644
index 00000000..30467459
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/bracket.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "label": "a]b}c\"d",
+    "n": "2"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/cases.txt b/tests/wave2/fixtures/oql-json/cases.txt
new file mode 100644
index 00000000..327bd03e
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/cases.txt
@@ -0,0 +1,7 @@
+# case<TAB>query — run through the released mxcli v0.26.0 binary (`mxcli version v0.26.0
+# (2026-10-11T18:37:07Z)`) against admin-api-stub.js; <case>.stdout / <case>.stderr are its
+# verbatim output (exit 0 for all four). Captured 2026-10-13.
+nullcol	SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c WHERE 'NULLCOL' = 'NULLCOL'
+allnull	SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c WHERE 'ALLNULL' = 'ALLNULL'
+view	SELECT b.AttentionCount AS n FROM M.V AS b WHERE 'VIEW' = 'VIEW'
+bracket	SELECT c.Label AS label, COUNT(c.ID) AS n FROM M.E AS c WHERE 'BRACKET' = 'BRACKET' GROUP BY c.Label
diff --git a/tests/wave2/fixtures/oql-json/nullcol.stderr b/tests/wave2/fixtures/oql-json/nullcol.stderr
new file mode 100644
index 00000000..0b241b13
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/nullcol.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(2 rows)
diff --git a/tests/wave2/fixtures/oql-json/nullcol.stdout b/tests/wave2/fixtures/oql-json/nullcol.stdout
new file mode 100644
index 00000000..01807192
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/nullcol.stdout
@@ -0,0 +1,12 @@
+[
+  {
+    "alpha": null,
+    "mid": "m1",
+    "zeta": "z1"
+  },
+  {
+    "alpha": "a2",
+    "mid": "m2",
+    "zeta": "z2"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/view.stderr b/tests/wave2/fixtures/oql-json/view.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/view.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/view.stdout b/tests/wave2/fixtures/oql-json/view.stdout
new file mode 100644
index 00000000..2fad5197
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/view.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "ID": "281474976710657",
+    "n": "7"
+  }
+]
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
new file mode 100644
index 00000000..50b5aaa2
--- /dev/null
+++ b/tests/wave2/test-journey-liveness.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# Usage: bash test-journey-liveness.sh [path-to-journey-runner.js]
+#
+# Fixture for the journey runner's liveness checks: rung 2's negative-only span claim
+# (traceRung + otel.js liveness, the trace-negative positive-control mutant — #150) and the
+# app probe between journeys (probeApp / appGate / flagAppDown — #285).
+#
+# #150 (card-disbursement requirements-driven build, 2026-09-26): a step whose whole proof is
+# "the reset microflow did NOT run" (Cancel on a confirmation) captures zero spans. The runner
+# read every empty capture as INVALID "Jaeger down or OTel off", so the claim could never pass,
+# and the control run's trace-negative mutant needed an `ordered` list, so the claim could
+# never be shown able to fail either. Now: zero spans + evidence tracing is live → the claim is
+# judged; no evidence → INVALID; the mutant injects the forbidden name after the liveness check.
+# #285 (field run 2026-10-12): a watch rebuild took the runtime down mid-suite and every later
+# journey FAILed as if the features were broken.
+#
+# Golden input: fixtures/otel-capture/jaeger-trace-refused-arm.json — a real Jaeger
+# /api/traces response (Mendix 11.13.0 → Jaeger v1.76, see test-otel-capture-until.sh), fed
+# through the real otel.js capture()/liveness() with fetch stubbed. The app probe runs against
+# a real local HTTP server and a closed port; a Mendix runtime that is down refuses the
+# connection, which is the closed-port case. Not fixtured: the main loop's wiring (needs a
+# browser and a live app).
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/journey-runner.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GOLDEN="$HERE/fixtures/otel-capture/jaeger-trace-refused-arm.json"
+[ -f "$GOLDEN" ] || { echo "FAIL — golden capture missing: $GOLDEN"; exit 1; }
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+for f in helpers.js otel.js config.js settle.js; do
+  [ -f "$E2E/$f" ] || { echo "FAIL — $f not beside $SUT"; exit 1; }
+done
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/journey-liveness.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$E2E/helpers.js" "$E2E/settle.js" "$E2E/otel.js" "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+IFS= read -r -d '' JS <<'JSEOF' || true
+const fs = require('fs');
+const http = require('http');
+const E = process.env;
+const full = JSON.parse(fs.readFileSync(E.GOLDEN, 'utf8'));
+const empty = { data: [] };
+let body = full, fail = false;
+const realFetch = globalThis.fetch.bind(globalThis);
+global.fetch = async (url, opts) => {
+  if (String(url).includes('/api/traces')) {
+    if (fail) { const e = new Error('fetch failed'); e.code = 'ECONNREFUSED'; throw e; }
+    return { json: async () => body };
+  }
+  return realFetch(url, opts);
+};
+const R = require('./journey-runner.js');
+const O = require('./otel.js');
+const out = (k, v) => console.log(`${k} ${typeof v === 'string' ? v : JSON.stringify(v)}`);
+if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { console.log('NOFN'); process.exit(0); }
+
+(async () => {
+  // capture() over the golden, the way the runner calls it (fast retries)
+  const cap = async () => O.capture(0, { retries: 1, waitMs: 1 });
+  const isMf = s => s.tags.some(t => t.key === 'mx.microflow.name');
+  const goldSpans = await cap();
+  const noMf = goldSpans.filter(s => !s.tags['mx.microflow.name']);
+
+  // liveness() itself
+  body = full;  out('L_LIVE', await O.liveness(0));
+  body = empty; out('L_QUIET', (await O.liveness(0)).ok);
+  fail = true;  out('L_DOWN', await O.liveness(0)); fail = false;
+  body = full;  out('L_LATER', (await O.liveness(Date.now())).ok);   // spans older than `since`
+  out('L_NAMED', (await O.liveness(0, { name: 'POST /*', spans: noMf })).ok);
+  out('L_NAMEDMISS', (await O.liveness(0, { name: 'Microflow X.DS_Page', spans: noMf })).ok);
+
+  // traceRung, driven with the golden capture
+  const run = async (step, spans, liveOk) => {
+    const rows = [];
+    await R.traceRung(step, { t0: 0, since: 0, rec: (n, v, d) => rows.push(`${v} ${n}${d ? ' :: ' + d : ''}`),
+      capture: async () => spans,
+      live: liveOk === undefined ? O.liveness : async (s, o) => (liveOk ? { ok: true, detail: 'live (stub)' } : { ok: false, detail: 'dead (stub)' }) });
+    return rows;
+  };
+  const neg = { name: 'Cancel reset', spans: { ordered: [], mustNotFire: ['ACT_Settings_ResetAll'] } };
+  body = full;
+  out('T_NEG_EMPTY_LIVE', await run(neg, [], undefined));            // golden says tracing is live
+  body = empty;
+  out('T_NEG_EMPTY_DEAD', await run(neg, [], undefined));            // Jaeger answers, nothing since
+  fail = true; out('T_NEG_EMPTY_DOWN', await run(neg, [], undefined)); fail = false;
+  out('T_NEG_SPANS_CLEAN', await run(neg, noMf, false));             // spans present: they are the evidence
+  const negHit = { name: 'Cancel arm', spans: { mustNotFire: ['ACT_MockScenario_Arm'] } };
+  out('T_NEG_HIT', await run(negHit, goldSpans, false));
+  const negDecl = { name: 'Cancel', spans: { mustNotFire: ['ACT_Settings_ResetAll'], liveness: 'POST /*' } };
+  out('T_DECL_OK', await run(negDecl, noMf, undefined));
+  const negDeclMiss = { name: 'Cancel', spans: { mustNotFire: ['ACT_Settings_ResetAll'], liveness: 'Microflow X.DS_Page' } };
+  out('T_DECL_MISS', await run(negDeclMiss, noMf, undefined));
+  const pos = { name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } };
+  out('T_POS_EMPTY', await run(pos, [], true));                      // positive claim: empty is INVALID, liveness not consulted
+  out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
+
+  // the trace-negative mutant for a negative-only journey
+  const jNeg = { id: 'J-neg', steps: [{ name: 'Cancel reset', ui: { ready: '.x' }, spans: { mustNotFire: ['ACT_Settings_ResetAll'] } }] };
+  const mNeg = R.controlMutants(jNeg).find(m => m.rung === 'trace-negative');
+  out('M_SUPPORTED', { supported: mNeg.supported, inject: mNeg.supported && mNeg.journey.steps[0].spans._controlInjectFired });
+  const mRows = await run(mNeg.journey.steps[0], [], true);
+  out('M_LIVE', { rows: mRows, caught: mRows.some(r => r.startsWith('FAIL') && mNeg.expectFail({ name: r.split(' :: ')[0].slice(5) })) });
+  out('M_DEAD', await run(mNeg.journey.steps[0], [], false));
+  const jPos = { id: 'J-pos', steps: [{ name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } }] };
+  const mPos = R.controlMutants(jPos).find(m => m.rung === 'trace-negative');
+  out('M_POS', { supported: mPos.supported, mustNot: mPos.journey.steps[0].spans.mustNotFire, inject: mPos.journey.steps[0].spans._controlInjectFired || null });
+  out('M_NONE', R.controlMutants({ id: 'J', steps: [{ name: 's' }] }).find(m => m.rung === 'trace-negative').supported);
+  out('F_SAMPLE', [R.forbiddenSample('Mod.ACT_X'), R.forbiddenSample('^Mod\\.ACT_X$'), R.forbiddenSample('(')]);
+
+  // #285: app probe against a real server and a closed port
+  let status = 200;
+  const srv = http.createServer((q, s) => { s.statusCode = status; s.end('x'); });
+  await new Promise(r => srv.listen(0, '127.0.0.1', r));
+  const url = `http://127.0.0.1:${srv.address().port}/`;
+  out('A_UP', await R.probeApp(url));
+  status = 302; out('A_REDIRECT', (await R.probeApp(url)).up);
+  status = 503; out('A_503', await R.probeApp(url));
+  srv.closeAllConnections && srv.closeAllConnections();
+  await new Promise(r => srv.close(r));
+  // a port nothing listens on: bind one, release it, probe it (no pooled socket to reuse)
+  const gone = http.createServer();
+  await new Promise(r => gone.listen(0, '127.0.0.1', r));
+  const goneUrl = `http://127.0.0.1:${gone.address().port}/`;
+  await new Promise(r => gone.close(r));
+  out('A_REFUSED', await R.probeApp(goneUrl, { timeoutMs: 2000 }));
+  const seq = (...ups) => { let i = 0; return async () => ({ up: ups[i++], detail: 'stub' }); };
+  out('G_RECOVER', await R.appGate(url, { probe: seq(false, false, true), waitMs: 0 }));
+  out('G_DOWN', await R.appGate(url, { probe: seq(false, false, false), waitMs: 0 }));
+  const rows = [{ verdict: 'PASS', detail: '' }, { verdict: 'FAIL', detail: 'x' }, { verdict: 'INVALID', detail: '' }];
+  out('G_FLAG', { n: R.flagAppDown(rows, 'ECONNREFUSED'), rows });
+})().catch(e => { console.log(`ERR ${e.stack}`); process.exit(3); });
+JSEOF
+
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 GOLDEN="$GOLDEN" JAEGER_URL=http://jaeger.invalid node - 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+if printf '%s\n' "$OUT" | grep -qx NOFN; then
+  bad "journey-runner.js exports no traceRung / otel.js no liveness — #150 not addressed"
+  echo ""; echo "PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+[ -n "$(line G_FLAG)" ] || { echo "FAIL — harness did not finish"; echo "$OUT" | tail -12; exit 1; }
+
+echo "== T1: otel.js liveness() =="
+case "$(line L_LIVE)" in '{"ok":true,"detail":"tracing live: 8 span(s)'*) ok "golden trace since the journey start → live, 8 spans counted" ;; *) bad "golden not read as live" "$(line L_LIVE)" ;; esac
+[ "$(line L_QUIET)" = false ] && ok "Jaeger answers with nothing → not live" || bad "empty Jaeger read as live" "$(line L_QUIET)"
+case "$(line L_DOWN)" in '{"ok":false,"detail":"Jaeger unreachable'*ECONNREFUSED*) ok "Jaeger refusing → not live, says unreachable" ;; *) bad "unreachable Jaeger mishandled" "$(line L_DOWN)" ;; esac
+[ "$(line L_LATER)" = false ] && ok "spans older than the journey start do not count" || bad "stale spans counted" "$(line L_LATER)"
+[ "$(line L_NAMED)" = true ] && [ "$(line L_NAMEDMISS)" = false ] && ok "a declared liveness span is looked for in the step capture" || bad "declared liveness span" "$(line L_NAMED) / $(line L_NAMEDMISS)"
+
+echo "== T2: rung 2, negative-only claim (#150) =="
+case "$(line T_NEG_EMPTY_LIVE)" in '["PASS Cancel reset: tracing live :: tracing live: 8 span(s)'*'","PASS [MF] NEGATIVE: Cancel reset: ACT_Settings_ResetAll did not run :: none ran"]') ok "zero step spans + live tracing → the claim is judged: PASS, with the liveness row" ;; *) bad "correct Cancel still unjudgeable" "$(line T_NEG_EMPTY_LIVE)" ;; esac
+case "$(line T_NEG_EMPTY_DEAD)" in '["INVALID Cancel reset: spans :: negative-only claim (ACT_Settings_ResetAll must not run) with no liveness evidence: Jaeger answered, but '*'emitted no span'*) ok "zero spans, service silent → INVALID, never PASS" ;; *) bad "dead tracing passed a negative claim" "$(line T_NEG_EMPTY_DEAD)" ;; esac
+case "$(line T_NEG_EMPTY_DOWN)" in '["INVALID Cancel reset: spans :: '*'Jaeger unreachable'*) ok "zero spans, Jaeger down → INVALID naming Jaeger" ;; *) bad "Jaeger down not named" "$(line T_NEG_EMPTY_DOWN)" ;; esac
+case "$(line T_NEG_SPANS_CLEAN)" in *'PASS [GUARD] Cancel reset: capture non-empty'*'PASS [MF] NEGATIVE: Cancel reset: ACT_Settings_ResetAll did not run'*) ok "spans present without the forbidden one → PASS (the capture is its own evidence)" ;; *) bad "clean capture misjudged" "$(line T_NEG_SPANS_CLEAN)" ;; esac
+case "$(line T_NEG_HIT)" in *'FAIL [MF] NEGATIVE: Cancel arm: ACT_MockScenario_Arm did not run :: MockServices.ACT_MockScenario_Arm'*) ok "forbidden microflow in the golden capture → FAIL naming it" ;; *) bad "forbidden microflow not caught" "$(line T_NEG_HIT)" ;; esac
+case "$(line T_DECL_OK)" in *'PASS Cancel: tracing live :: liveness span POST /* captured'*'PASS [MF] NEGATIVE: Cancel: ACT_Settings_ResetAll did not run'*) ok "declared spans.liveness present → judged" ;; *) bad "declared liveness ignored" "$(line T_DECL_OK)" ;; esac
+case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness span Microflow X.DS_Page not captured'*) ok "declared spans.liveness absent → INVALID" ;; *) bad "missing declared liveness passed" "$(line T_DECL_MISS)" ;; esac
+[ "$(line T_POS_EMPTY)" = '["INVALID Arm: spans :: zero spans captured — Jaeger down or OTel off. Trace rung did NOT run."]' ] \
+  && ok "positive claim with zero spans → INVALID as before" || bad "positive-claim behaviour changed" "$(line T_POS_EMPTY)"
+[ "$(line T_POS_OK)" = '["PASS [GUARD] Arm: capture non-empty","PASS [MF] Arm: ordered","PASS [MF] Arm: no ERROR at any level"]' ] \
+  && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
+
+echo "== T3: trace-negative positive control for a negative-only claim =="
+[ "$(line M_SUPPORTED)" = '{"supported":true,"inject":["ACT_Settings_ResetAll"]}' ] && ok "mutant supported, injects the forbidden name" || bad "negative-only journey still has no trace-negative mutant" "$(line M_SUPPORTED)"
+case "$(line M_LIVE)" in *'"caught":true}') ok "with tracing live the injected name turns 'did not run' red — the targeted check" ;; *) bad "mutant not caught by its targeted check" "$(line M_LIVE)" ;; esac
+case "$(line M_DEAD)" in '["INVALID '*) ok "with tracing dead the mutant is INVALID — injection cannot vouch for a dead pipeline" ;; *) bad "mutant faked a proof over dead tracing" "$(line M_DEAD)" ;; esac
+[ "$(line M_POS)" = '{"supported":true,"mustNot":["ACT_MockScenario_Arm"],"inject":null}' ] && ok "positive-claim journey: mutant unchanged (first ordered name, no injection)" || bad "positive mutant changed" "$(line M_POS)"
+[ "$(line M_NONE)" = false ] && ok "no span claim at all → still unsupported" || bad "phantom mutant" "$(line M_NONE)"
+[ "$(line F_SAMPLE)" = '["Mod.ACT_X","Mod.ACT_X",null]' ] && ok "regex pattern → a name it matches; invalid regex → null" || bad "forbiddenSample" "$(line F_SAMPLE)"
+
+echo "== T4: app probe between journeys (#285) =="
+[ "$(line A_UP)" = '{"up":true,"detail":"HTTP 200"}' ] && ok "HTTP 200 → up" || bad "200 not up" "$(line A_UP)"
+[ "$(line A_REDIRECT)" = true ] && ok "a redirect (login page) is up" || bad "redirect read as down" "$(line A_REDIRECT)"
+[ "$(line A_503)" = '{"up":false,"detail":"HTTP 503"}' ] && ok "HTTP 503 → down" || bad "5xx read as up" "$(line A_503)"
+[ "$(line A_REFUSED)" = '{"up":false,"detail":"ECONNREFUSED"}' ] && ok "refused connection (runtime stopped) → down, ECONNREFUSED" || bad "refused not down" "$(line A_REFUSED)"
+[ "$(line G_RECOVER)" = '{"up":true,"detail":"stub","tries":3}' ] && ok "a restart in progress is waited out (3 tries)" || bad "gate gave up early" "$(line G_RECOVER)"
+[ "$(line G_DOWN)" = '{"up":false,"detail":"stub","tries":3}' ] && ok "down after every try → APP-DOWN" || bad "gate passed a dead app" "$(line G_DOWN)"
+case "$(line G_FLAG)" in '{"n":1,'*'"verdict":"FAIL","detail":"x  [APP-DOWN after this journey: ECONNREFUSED'*'"appDown":true}'*) ok "only FAIL rows are flagged APP-DOWN, verdict kept" ;; *) bad "flagging wrong" "$(line G_FLAG)" ;; esac
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-oql-rows.sh b/tests/wave2/test-oql-rows.sh
new file mode 100644
index 00000000..f9aff927
--- /dev/null
+++ b/tests/wave2/test-oql-rows.sh
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Usage: bash test-oql-rows.sh [path-to-helpers.js]
+#
+# Fixture for project-tests/e2e/helpers.js's OQL reader — parseOqlOutput(), oqlScalar(),
+# oqlRows(), oqlAliases() (#154).
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26/27): oql() turned each
+# row of `mxcli oql --direct --json` into `Object.values(r)` and oqlScalar read rows[0][0].
+# mxcli prints the keys ALPHABETICALLY and leaves out a column that is null in every row, so
+# positions were not SELECT positions; over a view entity the answer carries `ID` beside the
+# alias, and rows[0][0] was the ID, not the count. A string value holding `]` or `}` ended the
+# brace-counting slice early and the helper returned null on a real answer.
+#
+# Golden input is CAPTURED: fixtures/oql-json/<case>.stdout|.stderr are the released mxcli
+# v0.26.0 binary's verbatim output for the queries in fixtures/oql-json/cases.txt, run against
+# fixtures/oql-json/admin-api-stub.js (the runtime half is synthetic, shaped after mxcli's own
+# tests: null columns omitted from a row object). mxcli's own JSON formatting is the real part.
+# Not captured: a live runtime's answer over a real view entity (no app reachable from the
+# session that wrote this); the view case's `ID` key is the shape the field report describes.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/helpers.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FIX="$HERE/fixtures/oql-json"
+for c in nullcol allnull view bracket; do
+  for x in stdout stderr; do [ -f "$FIX/$c.$x" ] || { echo "FAIL — golden missing: $FIX/$c.$x"; exit 1; }; done
+done
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/oql-rows.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e" "$WORK/stub"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$WORK/tests/e2e/helpers.js"
+cp "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+# A stub mxcli that replays a captured case: stdout and stderr verbatim, exit 0.
+cat > "$WORK/stub/mxcli" <<'EOF'
+#!/usr/bin/env bash
+cat "$FIXDIR/$CASE.stdout"; cat "$FIXDIR/$CASE.stderr" >&2
+EOF
+chmod +x "$WORK/stub/mxcli"
+
+sqlof() { awk -F'\t' -v c="$1" '$1==c{print $2}' "$FIX/cases.txt"; }
+export Q_NULLCOL="$(sqlof nullcol)" Q_ALLNULL="$(sqlof allnull)" Q_VIEW="$(sqlof view)" Q_BRACKET="$(sqlof bracket)"
+[ -n "$Q_NULLCOL" ] && [ -n "$Q_VIEW" ] && [ -n "$Q_BRACKET" ] && [ -n "$Q_ALLNULL" ] \
+  || { echo "FAIL — cases.txt lost a query"; exit 1; }
+
+IFS= read -r -d '' JS <<'JSEOF' || true
+const fs = require('fs');
+const H = require('./helpers.js');
+const E = process.env;
+const out = (k, v) => console.log(`${k} ${typeof v === 'string' ? v : JSON.stringify(v)}`);
+const cap = c => fs.readFileSync(`${E.FIXDIR}/${c}.stdout`, 'utf8');
+const P = (c, q) => { const r = H.parseOqlOutput(cap(c), q); return r && { rows: r.rows, objects: r.objects }; };
+
+// one parser over the captured stdout
+out('P_NULLCOL', P('nullcol', E.Q_NULLCOL));
+out('P_ALLNULL', P('allnull', E.Q_ALLNULL));
+out('P_VIEW', P('view', E.Q_VIEW));
+out('P_BRACKET', P('bracket', E.Q_BRACKET));
+// stdout + stderr together, as the admin preflight reads it
+out('P_MIXED', P('view', E.Q_VIEW) && H.parseOqlOutput(cap('view') + fs.readFileSync(`${E.FIXDIR}/view.stderr`, 'utf8'), E.Q_VIEW).rows);
+
+// through the real oql() spawn, the stub replaying each case
+const scal = (c, q) => { process.env.CASE = c; return JSON.stringify(H.oqlScalar(q)); };  // JSON: the string "null" is not null
+const rowsOf = (c, q) => { process.env.CASE = c; return typeof H.oqlRows === 'function' ? H.oqlRows(q) : 'NOFN'; };
+out('S_VIEW', scal('view', E.Q_VIEW));
+out('S_BRACKET', scal('bracket', E.Q_BRACKET));
+out('S_NULLFIRST', scal('nullcol', 'SELECT c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c'));
+out('S_NOSQLALIAS', scal('view', 'SELECT * FROM M.V'));
+out('R_NULLCOL', rowsOf('nullcol', E.Q_NULLCOL));
+
+// alias reading
+const A = q => (typeof H.oqlAliases === 'function' ? H.oqlAliases(q) : 'NOFN');
+out('A_PLAIN', A('SELECT COUNT(*) AS n FROM System.Session'));
+out('A_NESTED', A("SELECT COALESCE(c.A, 'x, y') AS a, (SELECT COUNT(o.ID) FROM M.O AS o WHERE o.X = c.ID) AS cnt, c/M.Assoc/M.T/Name FROM M.E AS c"));
+out('A_DISTINCT', A('select distinct c.Name as "Label" from M.E as c'));
+out('A_UNNAMED', A('SELECT COUNT(*) FROM M.E'));
+out('A_NOFROM', A('SELECT 1 AS n'));
+JSEOF
+
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 MXCLI="$WORK/stub/mxcli" FIXDIR="$FIX" node - 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+[ -n "$(line P_NULLCOL)" ] || { echo "FAIL — harness could not require $SUT"; echo "$OUT" | tail -8; exit 1; }
+
+echo "== T1: rows keyed by SELECT alias, in SELECT order, explicit nulls =="
+[ "$(line P_NULLCOL)" = '{"rows":[["z1",null,"m1"],["z2","a2","m2"]],"objects":[{"zeta":"z1","alpha":null,"mid":"m1"},{"zeta":"z2","alpha":"a2","mid":"m2"}]}' ] \
+  && ok "alphabetical keys back in SELECT order (zeta, alpha, mid); row 1's null alpha explicit" \
+  || bad "rows not in SELECT order" "$(line P_NULLCOL)"
+[ "$(line P_ALLNULL)" = '{"rows":[["z1",null,"m1"]],"objects":[{"zeta":"z1","alpha":null,"mid":"m1"}]}' ] \
+  && ok "a column mxcli left out entirely (null in every row) keeps its slot — mid is not shifted left" \
+  || bad "all-null column shifted the row (the #154 positional read)" "$(line P_ALLNULL)"
+[ "$(line P_VIEW)" = '{"rows":[["7"]],"objects":[{"n":"7"}]}' ] \
+  && ok "view answer: the ID key is not a column of SELECT … AS n" || bad "view's ID read as a column" "$(line P_VIEW)"
+[ "$(line P_BRACKET)" = '{"rows":[["a]b}c\"d","2"]],"objects":[{"label":"a]b}c\"d","n":"2"}]}' ] \
+  && ok "string value holding ] } and \" parses (string-aware slice)" || bad "bracket in a string broke the slice" "$(line P_BRACKET)"
+[ "$(line P_MIXED)" = '[["7"]]' ] && ok "stdout + stderr (warning, row count) still parses" || bad "mixed streams misread" "$(line P_MIXED)"
+
+echo "== T2: oqlScalar reads the FIRST alias, through the real spawn =="
+[ "$(line S_VIEW)" = '"7"' ] && ok "COUNT over a view entity → 7, not the view row's ID" || bad "oqlScalar over a view read the ID" "$(line S_VIEW)"
+[ "$(line S_BRACKET)" = '"a]b}c\"d"' ] && ok "first alias (label) of the bracket case, not null" || bad "bracket case lost" "$(line S_BRACKET)"
+[ "$(line S_NULLFIRST)" = null ] && ok "first alias null in row 1 → null (no measurement), not the next column" || bad "null first alias read a neighbour" "$(line S_NULLFIRST)"
+[ "$(line S_NOSQLALIAS)" = null ] && ok "SELECT * over a two-key answer → null, never a guessed column" || bad "guessed a column" "$(line S_NOSQLALIAS)"
+[ "$(line R_NULLCOL)" = '[{"zeta":"z1","alpha":null,"mid":"m1"},{"zeta":"z2","alpha":"a2","mid":"m2"}]' ] \
+  && ok "oqlRows → alias-keyed objects with every alias present" || bad "oqlRows wrong or missing" "$(line R_NULLCOL)"
+
+echo "== T3: the SELECT list is read, not split on every comma =="
+[ "$(line A_PLAIN)" = '["n"]' ] && ok "COUNT(*) AS n → n" || bad "plain alias" "$(line A_PLAIN)"
+[ "$(line A_NESTED)" = '["a","cnt","Name"]' ] && ok "commas in parens/strings and a subquery's FROM ignored; bare path → its last segment" || bad "nested list misread" "$(line A_NESTED)"
+[ "$(line A_DISTINCT)" = '["Label"]' ] && ok "lower-case keywords, DISTINCT, quoted alias" || bad "distinct/quoted alias" "$(line A_DISTINCT)"
+[ "$(line A_UNNAMED)" = '[null]' ] && ok "an unnamed expression is null, not invented" || bad "unnamed column named" "$(line A_UNNAMED)"
+[ "$(line A_NOFROM)" = '["n"]' ] && ok "SELECT without FROM" || bad "no-FROM select" "$(line A_NOFROM)"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From b5731a467f3b502e1e28061b5a661cae79f95ebe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:10:51 +0000
Subject: [PATCH 2/9] e2e: validator accepts negative-only span claims; empty
 spans block is a loud INVALID

#150 item 3: a spans block declaring neither ordered nor mustNotFire
(e.g. the array shape [{mf,status}]) is now recorded INVALID by
traceRung instead of being skipped silently.

examples/validate-journeys.js rejected a mustNotFire-only claim as
"NEVER checked", which contradicted the runner since the liveness change.
It now accepts it, validates the new spans.liveness field (read only for
a negative-only claim) and rejects a mustNotFire that is not a regex;
selftest 19 rules red, 3 clean cases green. skills/journey-examples.md
documents the liveness rule and the INVALID for an empty spans block.

Fixtures: test-validate-journeys-spans.sh 12/12 (8 fail on master's
validator); test-journey-liveness.sh 30/30.

Closes #150

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                |  2 +-
 examples/validate-journeys.js               | 33 +++++++--
 project-tests/e2e/journey-runner.js         | 10 ++-
 skills/journey-examples.md                  | 29 ++++++--
 tests/wave2/test-journey-liveness.sh        | 11 ++-
 tests/wave2/test-validate-journeys-spans.sh | 81 +++++++++++++++++++++
 6 files changed, 151 insertions(+), 15 deletions(-)
 create mode 100644 tests/wave2/test-validate-journeys-spans.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e69376c..802837f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (27 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/examples/validate-journeys.js b/examples/validate-journeys.js
index c080deb2..992ee237 100755
--- a/examples/validate-journeys.js
+++ b/examples/validate-journeys.js
@@ -14,7 +14,7 @@
 // rule below encodes a way a journey can be wrong that the runner cannot tell
 // apart from a defect: a placeholder that reaches the page as the literal string
 // "{{supplierCode}}", an OQL check with no bar that is recorded INVALID forever, a
-// `mustNotFire` the runner never evaluates.
+// `spans` block that declares nothing the runner reads.
 //
 // WHAT IT IS NOT
 // It cannot tell you whether a selector, entity, microflow or requirement pointer
@@ -107,13 +107,27 @@ function validate(j, brds) {
         if (typeof t !== 'string')
           add(`${at}.ui.${key}`, 'contains a non-string — comment objects inside these arrays become assertions');
 
+    // A negative-only claim (`mustNotFire` with no `ordered`) is evaluated since #150: the
+    // runner judges it once tracing is shown live — the step's `liveness` span, or any span from
+    // the service since the journey began. `liveness` is read only for such a claim.
     const sp = st.spans;
     if (sp) {
       const ordered = sp.ordered || [];
-      if (!Array.isArray(ordered) || !ordered.length) {
-        if ((sp.mustNotFire || []).length)
-          add(`${at}.spans`, 'declares `mustNotFire` with no non-empty `ordered` — the runner evaluates the whole trace block only when `ordered` is non-empty, so this claim is NEVER checked');
-        else add(`${at}.spans`, 'is present but declares nothing the runner reads');
+      const mustNot = sp.mustNotFire || [];
+      if (!Array.isArray(ordered)) add(`${at}.spans.ordered`, 'must be an array');
+      if (!Array.isArray(mustNot)) add(`${at}.spans.mustNotFire`, 'must be an array');
+      const hasOrdered = Array.isArray(ordered) && ordered.length > 0;
+      const hasMustNot = Array.isArray(mustNot) && mustNot.length > 0;
+      if (!hasOrdered && !hasMustNot)
+        add(`${at}.spans`, 'is present but declares nothing the runner reads (neither `ordered` nor `mustNotFire`) — the runner records it INVALID');
+      for (const n of hasMustNot ? mustNot : []) {
+        try { new RegExp(n); } catch (e) { add(`${at}.spans.mustNotFire`, `"${n}" is not a valid regex — the runner compiles it with new RegExp()`); }
+      }
+      if (sp.liveness !== undefined) {
+        if (typeof sp.liveness !== 'string' || !sp.liveness.trim())
+          add(`${at}.spans.liveness`, 'must be a non-empty string: a microflow name or span operation the step is known to produce');
+        else if (hasOrdered)
+          add(`${at}.spans.liveness`, 'is only read for a negative-only claim (`mustNotFire` with no `ordered`) — with `ordered`, the claimed microflows are the liveness evidence');
       }
       for (const n of ordered)
         if (!String(n).includes('.'))
@@ -206,7 +220,12 @@ function selftest() {
     ['outcome with no sql', j => { delete j.outcome.sql; return j; }, 'reads `outcome.sql`'],
     ['ready given a bare widget name', j => { j.steps[0].ui.ready = 'dvThing'; return j; }, 'is not a CSS selector'],
     ['checks given a selector', j => { j.steps[0].ui.checks = ['.mx-name-btnGo']; return j; }, 'looks like a selector'],
-    ['mustNotFire with no ordered', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'] }; return j; }, 'NEVER checked'],
+    ['negative-only spans claim is accepted', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'] }; return j; }, null],
+    ['negative-only claim with liveness is accepted', j => { j.steps[0].spans = { ordered: [], mustNotFire: ['ACT_Del'], liveness: 'M.DS_Page' }; return j; }, null],
+    ['spans block declaring nothing', j => { j.steps[0].spans = { ordered: [] }; return j; }, 'declares nothing the runner reads'],
+    ['liveness not a string', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'], liveness: 5 }; return j; }, 'must be a non-empty string'],
+    ['liveness beside ordered', j => { j.steps[0].spans.liveness = 'M.DS_Page'; return j; }, 'only read for a negative-only claim'],
+    ['mustNotFire not a regex', j => { j.steps[0].spans.mustNotFire = ['ACT_(Del']; return j; }, 'not a valid regex'],
     ['unqualified ordered span', j => { j.steps[0].spans.ordered = ['ACT_Go']; return j; }, 'is unqualified'],
     ['unknown action', j => { j.steps[0].actions[0].do = 'swipe'; return j; }, 'unknown action'],
     ['wait using settleMs', j => { j.steps[0].actions = [{ do: 'wait', settleMs: 500 }]; return j; }, 'reads `ms`'],
@@ -224,7 +243,7 @@ function selftest() {
     console.log(`${ok ? 'ok  ' : 'FAIL'} ${name}${ok ? '' : `\n       got: ${problems.join('\n            ') || '(no problems reported)'}`}`);
   }
   console.log(bad ? `\n${bad} rule(s) could not be shown failing — do not trust a green from this tool.`
-                  : `\n${cases.length - 1} rules each watched going red; the clean case stays green.`);
+                  : `\n${cases.filter(c => c[2] !== null).length} rules each watched going red; ${cases.filter(c => c[2] === null).length} clean case(s) stay green.`);
   return bad ? 1 : 0;
 }
 
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index b4ce1fd0..5b0f20d4 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -336,7 +336,15 @@ async function act(page, a, vars, note) {
 async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
   const claimed = (step.spans && step.spans.ordered) || [];
   const mustNot = (step.spans && step.spans.mustNotFire) || [];
-  if (!claimed.length && !mustNot.length) return;
+  if (!step.spans) return;
+  // A spans block that declares nothing this rung reads reads as a trace claim in the journey
+  // file and proves nothing — said out loud, never skipped (#150 item 3).
+  if (!claimed.length && !mustNot.length) {
+    rec(`${step.name}: spans`, 'INVALID',
+        'spans block declares neither `ordered` nor `mustNotFire` — nothing to evaluate; trace rung did NOT run. ' +
+        'Declare the claim or remove the block.');
+    return;
+  }
   const negOnly = !claimed.length;
   const probe = (step.spans && step.spans.liveness) || null;
   const has = (sp, n) => O.microflowNames(sp).includes(n) || sp.some(x => x.op === n);
diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index 4c8592f4..e12859c1 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -172,10 +172,27 @@ and landing guard, before text/trace/data.
 |---|---|
 | `ordered[]` | Matched **exactly** against the `mx.microflow.name` tag, so **module-qualified**. Subsequence check over span start time: incidental flows between them are tolerated, a reorder or a skip is not. Spans sharing a start time are treated as concurrent. |
 | `mustNotFire[]` | Compiled with `new RegExp(n)` against the same tag, so an unqualified name works as a substring. |
+| `liveness` | Optional, read **only for a negative-only claim** (`mustNotFire` with no `ordered`). It names a microflow (`mx.microflow.name`) or a span operation that the step is known to produce, such as the page's data-source retrieve. |
 
-**Verified trap: the entire trace block runs only when `ordered` is present and non-empty.** Capture,
-the non-empty guard, `assertNoErrors` *and* `mustNotFire` all live inside that `if`. A step declaring
-only `mustNotFire` is silently never checked. Always pair them. `validate-journeys.js` fails on it.
+**A negative-only claim is judged only when tracing is shown to be live (#150).** A step whose whole
+proof is "X did not run" declares `mustNotFire` alone. Cancel on a reset confirmation is one such step:
+
+```json
+"spans": { "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": "Settings.DS_Settings_Get" }
+```
+
+The step can rightly capture zero spans, and so does Jaeger down. So the runner waits the full
+capture window and then needs one piece of evidence that tracing was live:
+- the `liveness` span was captured; or, with no `liveness` declared,
+- any span from the service since the journey began.
+
+With no evidence the step is `INVALID`, never a pass. If the step's capture is non-empty and no
+`liveness` is declared, those spans count as the evidence. Declare `liveness` whenever the step has
+a span it always produces; it is the stronger reference.
+
+**A `spans` block that declares neither `ordered` nor `mustNotFire` is `INVALID`.** The array
+shape `[{ "mf": …, "status": … }]` is one example. The runner no longer skips it, and
+`validate-journeys.js` reports it.
 
 Declaring `ordered` buys `assertNoErrors` for free, and that is the check worth having: it walks
 **activity** spans, so it sees a caught error that leaves the microflow span `OK` while the work did
@@ -258,7 +275,8 @@ Each of these is either an error path in the runner or a correction recorded in
 | Mistake | How it presents | Fix |
 |---|---|---|
 | `checks` given a selector, or `ready` given a bare widget name | a missing-button `FAIL` that sends you to the page instead of the contract | `ready` = selector, `checks` = bare names |
-| `mustNotFire` with no `ordered` | silence — the claim is never evaluated and nothing says so | pair it with a non-empty `ordered` |
+| `mustNotFire` with no `ordered`, on an app whose tracing is down | `INVALID — negative-only claim … with no liveness evidence` | fix Jaeger/OTel, or declare `spans.liveness` with a span the step always produces |
+| `spans` block with neither `ordered` nor `mustNotFire` | `INVALID — spans block declares neither …` | declare the claim, or remove the block |
 | Unqualified name in `ordered` | `FAIL` on a microflow that did run | qualify it; `ordered` is an exact match on `mx.microflow.name` |
 | `ready` guessing where a commit lands | one real journey expected the commit to return to the home page; it stays put and updates in place. The guard failed loudly and marked the rest `INVALID` | that is the guard working — fix the contract, not the app |
 | `oql` / `outcome` with no `expect` or `atLeast` | `INVALID` on every run, forever | declare a bar; prefer `atLeast` on a fixture with history |
@@ -297,7 +315,8 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 2. **Rung numbering does not agree.** `journey-proof.md` numbers landing/text/spans/data/outcome 1–5;
    the runner's header says "four rungs" and its inline comments label spans as rung 2, data as 3 and
    outcome as 4. The emitted `rung` field is a string enum (`ui`/`trace`/`data`/`outcome`/`control`).
-3. **`mustNotFire` is gated on `ordered`.** The spec presents it as an independent rung-3 claim.
+3. ~~**`mustNotFire` is gated on `ordered`.**~~ Resolved (#150): a negative-only claim is evaluated
+   against a liveness reference (see `spans` above).
 4. **Rung 4's queries are whole-table**, so `mustPointAt` is a weaker claim than "the row this run
    created points at the seed" unless the fixture is reset.
 5. **A journey that bails early emits no outcome row at all** — silence, where the spec's discipline
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
index 50b5aaa2..3d9d4fbc 100644
--- a/tests/wave2/test-journey-liveness.sh
+++ b/tests/wave2/test-journey-liveness.sh
@@ -3,7 +3,8 @@
 #
 # Fixture for the journey runner's liveness checks: rung 2's negative-only span claim
 # (traceRung + otel.js liveness, the trace-negative positive-control mutant — #150) and the
-# app probe between journeys (probeApp / appGate / flagAppDown — #285).
+# app probe between journeys (probeApp / appGate / flagAppDown — #285), and the loud INVALID
+# for a spans block that declares neither `ordered` nor `mustNotFire` (#150 item 3).
 #
 # #150 (card-disbursement requirements-driven build, 2026-09-26): a step whose whole proof is
 # "the reset microflow did NOT run" (Cancel on a confirmation) captures zero spans. The runner
@@ -109,6 +110,10 @@ if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { con
   out('T_DECL_MISS', await run(negDeclMiss, noMf, undefined));
   const pos = { name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } };
   out('T_POS_EMPTY', await run(pos, [], true));                      // positive claim: empty is INVALID, liveness not consulted
+  // #150 item 3: a spans block declaring nothing is a loud INVALID, never a silent skip
+  out('T_NOTHING', await run({ name: 'Save', spans: { ordered: [] } }, goldSpans, true));
+  out('T_LEGACY', await run({ name: 'Save', spans: [{ mf: 'M.ACT_Save', status: 'OK' }] }, goldSpans, true));
+  out('T_NOSPANS', await run({ name: 'Save' }, goldSpans, true));
   out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
 
   // the trace-negative mutant for a negative-only journey
@@ -176,6 +181,10 @@ case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness s
 [ "$(line T_POS_OK)" = '["PASS [GUARD] Arm: capture non-empty","PASS [MF] Arm: ordered","PASS [MF] Arm: no ERROR at any level"]' ] \
   && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
 
+case "$(line T_NOTHING)" in '["INVALID Save: spans :: spans block declares neither `ordered` nor `mustNotFire`'*) ok "spans block with neither field → loud INVALID (#150 item 3)" ;; *) bad "empty spans block skipped silently" "$(line T_NOTHING)" ;; esac
+case "$(line T_LEGACY)" in '["INVALID Save: spans :: '*) ok "array-shaped spans (a shape the runner does not read) → INVALID" ;; *) bad "unreadable spans shape skipped" "$(line T_LEGACY)" ;; esac
+[ "$(line T_NOSPANS)" = '[]' ] && ok "no spans block → no trace rows (nothing claimed)" || bad "a step without spans produced trace rows" "$(line T_NOSPANS)"
+
 echo "== T3: trace-negative positive control for a negative-only claim =="
 [ "$(line M_SUPPORTED)" = '{"supported":true,"inject":["ACT_Settings_ResetAll"]}' ] && ok "mutant supported, injects the forbidden name" || bad "negative-only journey still has no trace-negative mutant" "$(line M_SUPPORTED)"
 case "$(line M_LIVE)" in *'"caught":true}') ok "with tracing live the injected name turns 'did not run' red — the targeted check" ;; *) bad "mutant not caught by its targeted check" "$(line M_LIVE)" ;; esac
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
new file mode 100644
index 00000000..d87ce0a7
--- /dev/null
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Usage: bash test-validate-journeys-spans.sh [path-to-validate-journeys.js]
+#
+# Fixture for examples/validate-journeys.js's `spans` rules after #150: the runner now
+# evaluates a negative-only claim (`mustNotFire` with no `ordered`) against a liveness
+# reference, so the validator must accept it — it used to reject it as "NEVER checked", which
+# made the contract checker contradict the runner. `spans.liveness` is the new optional field
+# (read only for a negative-only claim); a spans block declaring neither field is still a
+# problem, and the runner now records it INVALID instead of skipping it.
+#
+# Input: journey files shaped like the toolkit's own journeys (the validator's selftest base),
+# written here and checked through the real CLI. Also runs the validator's --selftest, which
+# watches every rule go red.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/examples/validate-journeys.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/validate-spans.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+# One journey per case; only the step's `spans` differs.
+mk() {
+  cat > "$WORK/$1.journey.json" <<EOF
+{ "id": "J-$1", "requirement": [],
+  "seeds": [{ "name": "a", "sql": "SELECT X AS x FROM M.E LIMIT 1" }],
+  "steps": [{ "name": "Cancel reset", "actions": [{ "do": "click", "widget": "btnCancel" }],
+              "ui": { "ready": ".mx-name-dvSettings", "textPresent": ["{{a}}"] },
+              "spans": $2 }] }
+EOF
+}
+mk negonly   '{ "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk negempty  '{ "ordered": [], "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk negdecl   '{ "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": "Settings.DS_Settings_Get" }'
+mk positive  '{ "ordered": ["Settings.ACT_Save"], "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk nothing   '{ "ordered": [] }'
+mk legacy    '[{ "mf": "Settings.ACT_Save", "status": "OK" }]'
+mk livenum   '{ "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": 5 }'
+mk livepos   '{ "ordered": ["Settings.ACT_Save"], "liveness": "Settings.DS_Settings_Get" }'
+mk badre     '{ "mustNotFire": ["ACT_(Reset"] }'
+
+run() { OUT="$(node "$SUT" "$WORK/$1.journey.json" 2>&1)"; RC=$?; }
+
+echo "== T1: negative-only claims are accepted (the runner evaluates them since #150) =="
+for c in negonly negempty negdecl positive; do
+  run "$c"
+  [ "$RC" -eq 0 ] && ok "$c → no problems" || bad "$c rejected" "$OUT"
+done
+run negonly
+printf '%s' "$OUT" | grep -q 'NEVER checked' && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
+
+echo "== T2: what the runner cannot read is still a problem =="
+run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
+  && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
+printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
+run legacy; [ "$RC" -eq 1 ] && ok "array-shaped spans (no ordered/mustNotFire) → problem" || bad "legacy array shape accepted" "$OUT"
+run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
+  && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
+run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \
+  && ok "liveness beside ordered → problem (never read)" || bad "unread liveness accepted" "$OUT"
+run badre; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'not a valid regex'; } \
+  && ok "mustNotFire that is not a regex → problem" || bad "invalid regex accepted" "$OUT"
+
+echo "== T3: the validator's own selftest =="
+ST="$(node "$SUT" --selftest 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "--selftest: every rule watched going red, clean cases green" || bad "--selftest failed" "$(printf '%s' "$ST" | grep -A2 '^FAIL' | head -12)"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From fc966d74107cb3b3e7c34333ca85c4b36a474d50 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:14:03 +0000
Subject: [PATCH 3/9] e2e: rewrite example.journey.json into the shape the
 runner reads

The shipped example had drifted from journey-runner.js: name/role instead
of id/persona, a `value` seed instead of `sql`, page/expectPage/
expectText/click instead of actions + ui.ready/textPresent, spans as an
array of {mf,status} (now a loud INVALID), and SQL-style
<module>$<entity> queries where the runner sends OQL. validate-journeys.js
reported 3 problems on it; now 0. All 7 positive-control mutants are
supported on it; journey-runner.selftest.js (which falls back to it) and
test-journey-preflight.sh (back-compat cases) pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                           |  2 +-
 project-tests/e2e/example.journey.json | 68 ++++++++++++++++++--------
 2 files changed, 48 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 802837f1..100899d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/project-tests/e2e/example.journey.json b/project-tests/e2e/example.journey.json
index 27cd39e9..f25e08f8 100644
--- a/project-tests/e2e/example.journey.json
+++ b/project-tests/e2e/example.journey.json
@@ -20,63 +20,89 @@
     "so a single good historical row carries the assertion. A data block that carries",
     "assocMustBeSet with no scope must be reported [WEAK EVIDENCE], never silently accepted.",
     "",
-    "Names below are placeholders. Replace <Module>/<Entity>/<Page> with your own."
+    "Names below are placeholders. Replace <Module>/<Entity>/<Widget>/<Microflow> with your own.",
+    "Every key here is one journey-runner.js reads (examples/validate-journeys.js reports 0",
+    "problems on this file). The field-by-field tour is skills/journey-examples.md.",
+    "Add \"persona\": \"<TEST_USER>\" when the journey proves one role's access path — a run signed in as anyone else records the journey INVALID and does not walk it."
   ],
-
-  "name": "Example",
-  "role": "<the persona who performs this journey>",
-  "goal": "One sentence in the user's language. Not 'the microflow succeeds'.",
-
+  "id": "J-EXAMPLE-01",
+  "title": "Example — open the overview, submit the form, see the row on its parent",
+  "requirement": [],
   "seeds": [
     {
       "name": "parentKey",
-      "$comment": "Referenced later as {{parentKey}}. Seeds are the only values a step may assume exist.",
-      "value": "EXAMPLE-0001"
+      "$comment": "Referenced later as {{parentKey}}. Seeds are the only values a step may assume exist; they are read from the live DB, never hardcoded. Every OQL column is aliased.",
+      "sql": "SELECT p.<KeyAttribute> AS k FROM <Module>.<Parent> AS p LIMIT 1"
     }
   ],
-
   "steps": [
     {
       "name": "Open the overview and see the seeded row",
-      "page": "<Module>.<Page_Overview>",
       "$comment": "rung 1 landing guard + rung 2 what the screen says. Without the guard an assertion grades the PREVIOUS page.",
-      "expectPage": "<Module>.<Page_Overview>",
-      "expectText": ["{{parentKey}}"]
+      "actions": [
+        {
+          "do": "nav",
+          "item": "<menu item title>"
+        }
+      ],
+      "ui": {
+        "ready": ".mx-name-<overviewGrid>",
+        "textPresent": [
+          "{{parentKey}}"
+        ]
+      }
     },
     {
       "name": "Submit the form",
-      "click": "<button label or selector>",
-      "$comment": "rung 3 ordered spans, rung 4 data effects. An empty span list is a fault, never a pass — [].every() is true.",
-      "spans": [
-        { "mf": "<Module>.<Microflow>", "status": "OK" }
+      "$comment": "rung 3 ordered spans, rung 4 data effects. A capture with zero spans is a fault, never a pass — [].every() is true. A step whose only proof is that something did NOT run declares mustNotFire alone (plus spans.liveness); see journey-examples.md.",
+      "actions": [
+        {
+          "do": "click",
+          "widget": "<btnSubmit>"
+        }
       ],
+      "ui": {
+        "ready": ".mx-name-<detailView>"
+      },
+      "spans": {
+        "ordered": [
+          "<Module>.<Microflow>"
+        ],
+        "mustNotFire": [
+          "<Microflow that must not run, e.g. a delete>"
+        ]
+      },
       "data": {
         "creates": "<Module>.<Entity>",
         "delta": 1,
-        "scope": { "newRowsBy": "id" },
+        "scope": {
+          "newRowsBy": "id"
+        },
         "assocMustBeSet": [
           {
             "entity": "<Module>.<Entity>",
             "assoc": "<Module>.<Entity>_<Parent>",
             "target": "<Module>.<Parent>",
-            "mustPointAt": { "attr": "<KeyAttribute>", "value": "{{parentKey}}" }
+            "mustPointAt": {
+              "attr": "<KeyAttribute>",
+              "value": "{{parentKey}}"
+            }
           }
         ],
         "oql": [
           {
             "label": "the new row exists and is not a draft",
-            "sql": "SELECT COUNT(*) AS n FROM <module>$<entity> WHERE status <> 'Draft'",
+            "sql": "SELECT COUNT(e.ID) AS n FROM <Module>.<Entity> AS e WHERE e.<Status> != 'Draft'",
             "atLeast": 1
           }
         ]
       }
     }
   ],
-
   "outcome": {
     "$comment": "rung 5. The thing the user actually came for, asserted once, in their terms.",
     "label": "the parent shows the submitted row",
-    "sql": "SELECT COUNT(*) AS n FROM <module>$<entity> e JOIN <module>$<parent> p ON e.parent_id = p.id WHERE p.<keyattribute> = '{{parentKey}}'",
+    "sql": "SELECT COUNT(e.ID) AS n FROM <Module>.<Entity> AS e WHERE e/<Module>.<Entity>_<Parent>/<Module>.<Parent>/<KeyAttribute> = '{{parentKey}}'",
     "atLeast": 1
   }
 }

From 4110b928da18856ec597266a1e92490a3ed74b26 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:38:48 +0000
Subject: [PATCH 4/9] =?UTF-8?q?e2e:=20review=20fixes=20=E2=80=94=20livenes?=
 =?UTF-8?q?s=20window,=20stale=20otel.js=20guard,=20old=20spans=20shape=20?=
 =?UTF-8?q?named?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- journey-runner.js: the negative-only liveness window starts at this
  journey's own start (LIVENESS_SKEW_MS = 2 s clock-skew margin), not 30 s
  earlier where the previous journey's spans counted.
- A project otel.js older than the runner (hand-edited, kept by sync)
  has no liveness(): the step reads INVALID naming the stale otel.js
  instead of a TypeError.
- spans as an array (old example shape) or {} gets an INVALID that names
  the shape; validate-journeys.js names the array shape too.
- Comment cited a non-existent fixture; "first cell" wording -> "first
  SELECT alias" (journey-examples.md, validate-journeys.js,
  full.journey.json); "16 rules" -> 19.
- CHANGELOG: callout that oqlScalar now returns the first SELECT alias.

Fixtures: test-journey-liveness.sh 36/36 (cases for the skew window, the
stale otel.js and the named shapes), test-validate-journeys-spans.sh 12/12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                |  4 +-
 examples/journeys/full.journey.json         |  4 +-
 examples/validate-journeys.js               |  6 ++-
 project-tests/e2e/journey-runner.js         | 44 ++++++++++++++++-----
 skills/journey-examples.md                  |  8 ++--
 skills/journey-proof.md                     |  2 +-
 tests/wave2/test-journey-liveness.sh        | 27 ++++++++++++-
 tests/wave2/test-validate-journeys-spans.sh |  2 +-
 8 files changed, 74 insertions(+), 23 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 100899d0..635ac9b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/examples/journeys/full.journey.json b/examples/journeys/full.journey.json
index 14e81794..59eebc2c 100644
--- a/examples/journeys/full.journey.json
+++ b/examples/journeys/full.journey.json
@@ -39,8 +39,8 @@
       "name": "supplierCode",
       "sql": "SELECT SupplierCode AS c FROM Procurement.Supplier WHERE Active = true LIMIT 1",
       "_note": [
-        "Every OQL column must be aliased — helpers.oqlScalar reads the first cell of the first",
-        "row, and mxcli rejects an unaliased SELECT. A seed that returns null or an empty",
+        "Every OQL column must be aliased — helpers.oqlScalar reads the first SELECT alias of the",
+        "first row, and mxcli rejects an unaliased SELECT. A seed that returns null or an empty",
         "string aborts the journey as INVALID (instrument absent), never FAIL (feature broken)."
       ]
     },
diff --git a/examples/validate-journeys.js b/examples/validate-journeys.js
index 992ee237..2d87dd21 100755
--- a/examples/validate-journeys.js
+++ b/examples/validate-journeys.js
@@ -51,7 +51,7 @@ function validate(j, brds) {
     if (!s.sql) add(at, 'no `sql`');
     if (s.name && seen.has(s.name)) add(at, `duplicate seed name "${s.name}"`);
     if (s.sql && !/\bAS\b/i.test(s.sql))
-      add(at, 'SQL has no column alias — oqlScalar reads the first cell and mxcli rejects an unaliased SELECT');
+      add(at, 'SQL has no column alias — oqlScalar reads the first SELECT alias and mxcli rejects an unaliased SELECT');
     for (const k of [...String(s.sql || '').matchAll(/\{\{(\w+)\}\}/g)].map(m => m[1]))
       if (!seen.has(k)) add(at, `references {{${k}}}, which is not an EARLIER seed — seeds resolve in array order`);
     if (s.name) seen.add(s.name);
@@ -111,7 +111,9 @@ function validate(j, brds) {
     // runner judges it once tracing is shown live — the step's `liveness` span, or any span from
     // the service since the journey began. `liveness` is read only for such a claim.
     const sp = st.spans;
-    if (sp) {
+    if (Array.isArray(sp)) {
+      add(`${at}.spans`, 'is an array — the old shape [{ mf, status }], which the runner never read (it records it INVALID); use { "ordered": [...], "mustNotFire": [...] }');
+    } else if (sp) {
       const ordered = sp.ordered || [];
       const mustNot = sp.mustNotFire || [];
       if (!Array.isArray(ordered)) add(`${at}.spans.ordered`, 'must be an array');
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index 5b0f20d4..a6133b23 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -127,6 +127,8 @@ const subst = (v, vars) =>
 // meant to stay declarative enough to generate from a module brief's golden-path
 // table.
 const PAUSE = ms => new Promise(r => setTimeout(r, ms));
+// Clock-skew margin for the liveness window (see runJourney's jt0).
+const LIVENESS_SKEW_MS = 2000;
 // The combobox waits below used to be fixed sleeps (400/1200/120/500 ms per field). Each now
 // waits for the thing it was sleeping for; SETTLE_MODE=fixed keeps the old sleeps for an A/B run.
 const FIXED = process.env.SETTLE_MODE === 'fixed';
@@ -323,7 +325,7 @@ async function act(page, a, vars, note) {
 // ── RUNG 2: ordered spans, as a function (called from runJourney) ───────────
 // Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with ordered
 // empty/absent) — a step whose whole proof is "this did NOT run" (#150). `capture` and
-// `live` are injected so tests/wave2/test-journey-negative-trace.sh drives it with a
+// `live` are injected so tests/wave2/test-journey-liveness.sh drives it with a
 // captured Jaeger trace and no browser. `rec(name, verdict, detail)` records one row.
 //
 // NEGATIVE-ONLY NEEDS A LIVENESS REFERENCE. Zero spans in the step window is what a correct
@@ -334,15 +336,24 @@ async function act(page, a, vars, note) {
 // the step's declared `spans.liveness` span, or any span from the service since the
 // journey began (otel.js liveness). No evidence → INVALID, naming which.
 async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
-  const claimed = (step.spans && step.spans.ordered) || [];
-  const mustNot = (step.spans && step.spans.mustNotFire) || [];
   if (!step.spans) return;
   // A spans block that declares nothing this rung reads reads as a trace claim in the journey
-  // file and proves nothing — said out loud, never skipped (#150 item 3).
+  // file and proves nothing — said out loud, never skipped (#150 item 3). The array shape
+  // [{ mf, status }] is the old example.journey.json shape, named as such.
+  const shape = Array.isArray(step.spans) ? 'array'
+    : typeof step.spans !== 'object' ? typeof step.spans : 'object';
+  const claimed = (shape === 'object' && Array.isArray(step.spans.ordered)) ? step.spans.ordered : [];
+  const mustNot = (shape === 'object' && Array.isArray(step.spans.mustNotFire)) ? step.spans.mustNotFire : [];
   if (!claimed.length && !mustNot.length) {
+    const why = shape === 'array'
+      ? 'spans is an array — the old shape [{ mf, status }], which the runner never read; use { "ordered": [...], "mustNotFire": [...] }'
+      : shape !== 'object'
+        ? `spans is a ${shape} — use { "ordered": [...], "mustNotFire": [...] }`
+        : !Object.keys(step.spans).length
+          ? 'spans is {} — declares neither `ordered` nor `mustNotFire`'
+          : 'spans block declares neither `ordered` nor `mustNotFire`';
     rec(`${step.name}: spans`, 'INVALID',
-        'spans block declares neither `ordered` nor `mustNotFire` — nothing to evaluate; trace rung did NOT run. ' +
-        'Declare the claim or remove the block.');
+        `${why} — nothing to evaluate; trace rung did NOT run. Declare the claim or remove the block.`);
     return;
   }
   const negOnly = !claimed.length;
@@ -355,6 +366,16 @@ async function traceRung(step, { t0, since, rec, capture = null, live = O.livene
                       : await O.capture(t0, { min: 1, until: until });
   const real = spans.length;
   if (negOnly && (!real || probe)) {
+    // A project whose otel.js was hand-edited keeps it across a sync (it is not in the hold
+    // set with this file), so a new runner can meet an otel.js older than liveness(). Say so,
+    // never TypeError.
+    if (typeof live !== 'function') {
+      rec(`${step.name}: spans`, 'INVALID',
+          'negative-only claim needs otel.js liveness(), which this project\'s tests/e2e/otel.js does not export — ' +
+          'it is older than journey-runner.js (a locally edited copy kept by sync). Merge the toolkit\'s otel.js. ' +
+          'Trace rung did NOT run.');
+      return;
+    }
     const lv = await live(since, { name: probe, spans });
     if (!lv.ok) {
       rec(`${step.name}: spans`, 'INVALID',
@@ -690,9 +711,12 @@ async function resetToStart(page) {
 }
 
 async function runJourney(page, j) {
-  // Journey start, a little before: the window a negative-only span claim's liveness check
-  // reads (the navigation that resetToStart just made counts as evidence tracing is live).
-  const jt0 = Date.now() - 30000;
+  // Journey start: the window a negative-only span claim's liveness check reads. Only this
+  // journey's own spans count — never the previous journey's, nor other users' from before
+  // it began. LIVENESS_SKEW_MS (2 s) absorbs clock skew between this host and the runtime's
+  // span timestamps (Jaeger stamps with the runtime's clock); it is far shorter than any
+  // journey, so a span from the previous one cannot fall inside it in practice.
+  const jt0 = Date.now() - LIVENESS_SKEW_MS;
   console.log(`\n=== JOURNEY ${j.id} — ${j.title || ''}`);
   console.log(`    persona: ${j.persona || cfg.user}   requirements: ${(j.requirement || []).join(', ') || '(none declared)'}`);
 
@@ -1311,7 +1335,7 @@ module.exports = {
   runExitCode, personaMismatch,
   classifyAdminProbe, journeyNeedsAdmin, missingEnv, preflight, orderJourneys, stateTracker,
   judgeLanding,
-  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown,
+  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown, LIVENESS_SKEW_MS,
 };
 
 // ── Main ────────────────────────────────────────────────────────────────────
diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index e12859c1..5ac49cdc 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -25,7 +25,7 @@ The domain is invented (purchase requests and a supplier catalogue). Nothing in
 any real project.
 
 ```bash
-node examples/validate-journeys.js --selftest                                  # 16 rules, each watched going red
+node examples/validate-journeys.js --selftest                                  # 19 rules, each watched going red
 node examples/validate-journeys.js --brd examples/brd examples/journeys/*.json # the examples themselves
 node examples/validate-journeys.js --brd <brdDir> journeys/*.journey.json      # your project
 ```
@@ -91,7 +91,7 @@ none of the fields run exactly as before.
 | Field | Required? | Behaviour |
 |---|---|---|
 | `name` | yes | becomes `{{name}}` |
-| `sql` | yes | run through `helpers.oqlScalar` — **first cell of the first row**. Every column must be aliased (`AS n`); mxcli rejects an unaliased `SELECT`. |
+| `sql` | yes | run through `helpers.oqlScalar` — **the first SELECT alias of the first row** (never the alphabetically-first key mxcli prints). Every column must be aliased (`AS n`); mxcli rejects an unaliased `SELECT`. |
 
 - Seeds resolve **in array order** and may reference **earlier** seeds. That is the whole reason
   `supplierName` is keyed off `supplierCode` rather than being a second `LIMIT 1`: two unordered
@@ -184,7 +184,7 @@ proof is "X did not run" declares `mustNotFire` alone. Cancel on a reset confirm
 The step can rightly capture zero spans, and so does Jaeger down. So the runner waits the full
 capture window and then needs one piece of evidence that tracing was live:
 - the `liveness` span was captured; or, with no `liveness` declared,
-- any span from the service since the journey began.
+- any span from the service since this journey began (a 2 s clock-skew margin; the previous journey's spans do not count).
 
 With no evidence the step is `INVALID`, never a pass. If the step's capture is non-empty and no
 `liveness` is declared, those spans count as the evidence. Declare `liveness` whenever the step has
@@ -329,7 +329,7 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 ## Honesty note
 
 The three example journeys **have never been executed.** There is no app behind
-`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 16 rules
+`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 19 rules
 in `validate-journeys.js`, whose own `--selftest` shows each of those rules going red on a
 deliberately broken input. Everything stated about runner behaviour was read out of
 `tests/e2e/journey-runner.js`, `helpers.js` and `otel.js`; anything that could not be settled by
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index d637880d..87b9d0ca 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -193,7 +193,7 @@ The runner waits the full capture window, then asks for evidence that tracing wa
 | Evidence | Verdict |
 |---|---|
 | the step declares `"liveness": "<span>"` (a span the step is known to produce, such as the page's data-source retrieve) and it was captured | judged: `tracing live` PASS, then each `did not run` |
-| no declared span; the service emitted ≥1 span since the journey started (`otel.liveness`) | judged, same rows |
+| no declared span; the service emitted ≥1 span since this journey started (2 s clock-skew margin, so the previous journey's spans do not count; `otel.liveness`) | judged, same rows |
 | declared span missing, service silent, or Jaeger unreachable | `INVALID`: the claim is not judged |
 
 The `trace-negative` control mutant covers this shape too. It injects the forbidden name into the
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
index 3d9d4fbc..6995c869 100644
--- a/tests/wave2/test-journey-liveness.sh
+++ b/tests/wave2/test-journey-liveness.sh
@@ -114,6 +114,25 @@ if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { con
   out('T_NOTHING', await run({ name: 'Save', spans: { ordered: [] } }, goldSpans, true));
   out('T_LEGACY', await run({ name: 'Save', spans: [{ mf: 'M.ACT_Save', status: 'OK' }] }, goldSpans, true));
   out('T_NOSPANS', await run({ name: 'Save' }, goldSpans, true));
+  out('T_EMPTYOBJ', await run({ name: 'Save', spans: {} }, goldSpans, true));
+
+  // review item 5: the liveness window starts at THIS journey's start (small skew margin only)
+  const newest = Math.max(...goldSpans.map(s => s.start)) / 1000;   // ms
+  const skew = R.LIVENESS_SKEW_MS;
+  body = full;
+  out('W_SKEW', skew);
+  out('W_PREV', (await O.liveness(newest + 30000 - skew)).ok);   // spans from 30 s before the journey: not evidence
+  out('W_OWN', (await O.liveness(newest - skew)).ok);            // a span right at the journey start: evidence
+
+  // review item 4: a project's older otel.js without liveness() — runner says so, never TypeError
+  const saved = O.liveness;
+  delete O.liveness;
+  try {
+    const rows = [];
+    await R.traceRung(neg, { t0: 0, since: 0, rec: (n, v, d) => rows.push(`${v} ${n} :: ${d}`), capture: async () => [] });
+    out('T_STALE_OTEL', rows);
+  } catch (e) { out('T_STALE_OTEL', `THREW ${e.constructor.name}: ${e.message}`); }
+  O.liveness = saved;
   out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
 
   // the trace-negative mutant for a negative-only journey
@@ -182,7 +201,13 @@ case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness s
   && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
 
 case "$(line T_NOTHING)" in '["INVALID Save: spans :: spans block declares neither `ordered` nor `mustNotFire`'*) ok "spans block with neither field → loud INVALID (#150 item 3)" ;; *) bad "empty spans block skipped silently" "$(line T_NOTHING)" ;; esac
-case "$(line T_LEGACY)" in '["INVALID Save: spans :: '*) ok "array-shaped spans (a shape the runner does not read) → INVALID" ;; *) bad "unreadable spans shape skipped" "$(line T_LEGACY)" ;; esac
+case "$(line T_LEGACY)" in '["INVALID Save: spans :: spans is an array — the old shape'*'use { \"ordered\": [...], \"mustNotFire\": [...] }'*) ok "array-shaped spans → INVALID that names the old shape and the new one" ;; *) bad "array shape not named" "$(line T_LEGACY)" ;; esac
+case "$(line T_EMPTYOBJ)" in '["INVALID Save: spans :: spans is {}'*) ok "spans {} → INVALID that says it is empty" ;; *) bad "empty object not named" "$(line T_EMPTYOBJ)" ;; esac
+case "$(line T_STALE_OTEL)" in '["INVALID Cancel reset: spans :: negative-only claim needs otel.js liveness()'*'older than journey-runner.js'*) ok "older otel.js without liveness() → INVALID naming the stale otel.js, no TypeError" ;; *) bad "stale otel.js not handled" "$(line T_STALE_OTEL)" ;; esac
+S="$(line W_SKEW)"; { [ -n "$S" ] && [ "$S" -gt 0 ] && [ "$S" -le 5000 ]; } && ok "liveness skew margin is small ($S ms)" || bad "skew margin missing or wide" "$S"
+[ "$(line W_PREV)" = false ] && ok "spans from 30 s before the journey began are NOT liveness evidence" || bad "previous journey's spans counted" "$(line W_PREV)"
+[ "$(line W_OWN)" = true ] && ok "a span at the journey's own start is evidence" || bad "own span not counted" "$(line W_OWN)"
+if grep -q 'const jt0 = Date.now() - LIVENESS_SKEW_MS;' "$SUT"; then ok "runJourney's liveness window starts at the journey start minus the skew margin"; else bad "runJourney's liveness window is not the journey start"; fi
 [ "$(line T_NOSPANS)" = '[]' ] && ok "no spans block → no trace rows (nothing claimed)" || bad "a step without spans produced trace rows" "$(line T_NOSPANS)"
 
 echo "== T3: trace-negative positive control for a negative-only claim =="
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
index d87ce0a7..0c55ee6c 100644
--- a/tests/wave2/test-validate-journeys-spans.sh
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -64,7 +64,7 @@ echo "== T2: what the runner cannot read is still a problem =="
 run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
   && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
 printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
-run legacy; [ "$RC" -eq 1 ] && ok "array-shaped spans (no ordered/mustNotFire) → problem" || bad "legacy array shape accepted" "$OUT"
+run legacy; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'is an array — the old shape'; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
 run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
   && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
 run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \

From 7f73f8d5e3e4b6d3a181cf36186374afd55f6bc3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:40:49 +0000
Subject: [PATCH 5/9] docs(journey-examples): rule count 19, without rewriting
 the example-domain line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 skills/journey-examples.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index 5ac49cdc..4b02ee96 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -329,8 +329,8 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 ## Honesty note
 
 The three example journeys **have never been executed.** There is no app behind
-`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 19 rules
-in `validate-journeys.js`, whose own `--selftest` shows each of those rules going red on a
+`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 16 rules
+in `validate-journeys.js` (19 since #150), whose own `--selftest` shows each of those rules going red on a
 deliberately broken input. Everything stated about runner behaviour was read out of
 `tests/e2e/journey-runner.js`, `helpers.js` and `otel.js`; anything that could not be settled by
 reading is marked *not verified* rather than guessed.

From cc56d9bc5021a0b486fa7b3f6389672aeee37ef8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:51:36 +0000
Subject: [PATCH 6/9] =?UTF-8?q?journeys:=20#302=20follow-up=20=E2=80=94=20?=
 =?UTF-8?q?accept=20a=20project-set=20password,=20SIGINT=20findings,=20set?=
 =?UTF-8?q?up=20kind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- config.js reports passSource (env / project.config.js / template
  placeholder); the preflight refuses only the template placeholder
  (Demo2025!, or credentials() source 'template default'). As shipped,
  #302 refused every non-env password, though the template tells projects
  to put their real one in DEFAULT_PASS and nothing loads an env file
  before verify-module — every journeys rung would FAULT after a sync.
  An admin object without passSource keeps the #302 rule.
- SIGINT/SIGTERM write the findings slot as aborted ("signal SIGINT")
  instead of leaving the previous run's file there.
- report-normalize.js: rung 'setup' rows keep kind 'setup' (were 'ui').
- CHANGELOG names ALLOW_CONFIG_CREDENTIALS and the 403 verdict change
  (data rungs INVALID exit 1 -> suite aborts exit 2).

test-journey-preflight.sh 74/74 (9 new cases fail on master: project-set
password runs, placeholder refuses, env wins, SIGINT end to end);
report-normalize --selftest new setup-kind case.

Refs #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |  1 +
 project-tests/e2e/config.js           | 28 ++++++++++---
 project-tests/e2e/journey-runner.js   | 59 +++++++++++++++++++--------
 project-tests/e2e/report-normalize.js | 11 ++++-
 skills/journey-proof.md               |  2 +-
 tests/wave2/test-journey-preflight.sh | 56 ++++++++++++++++++++++++-
 6 files changed, 133 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c8ad4b1..cd92119d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the placeholder (`Demo2025!`, or a `credentials()` reporting `source: 'template default'`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and a `report-normalize.js --selftest` case. Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/config.js b/project-tests/e2e/config.js
index badbac59..ee7c4d38 100644
--- a/project-tests/e2e/config.js
+++ b/project-tests/e2e/config.js
@@ -81,6 +81,22 @@ const PORT = STACK.port;
 // and page-audit.js cannot end up running as two different identities.
 const CREDS = PROJ.credentials();
 
+// Where the test password came from, never the password itself (#278, #302 follow-up).
+//   env                  — TEST_PASS (or its APP_PASS alias)
+//   project.config.js    — a password the project set there (the template tells every
+//                          project to put its real demo password in DEFAULT_PASS)
+//   template placeholder — the value the shipped template carries, i.e. nobody set one
+// Only the last is refused by journey-runner's preflight. Refusing every non-env password
+// (as #302 first did) broke every project whose real password lives in project.config.js,
+// because nothing in the toolkit loads an env file before verify-module runs the journeys.
+// A credentials() that reports `source: 'template default'` is honoured as well.
+const TEMPLATE_PASSWORDS = ['Demo2025!'];   // project.config.template.js DEFAULT_PASS
+function passwordSource({ env = process.env, creds = CREDS } = {}) {
+  if (env.TEST_PASS || env.APP_PASS) return 'env';
+  if (creds.source === 'template default' || TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
+  return 'project.config.js';
+}
+
 // ── M2EE admin credential: where it came from, never what it is ──────────────
 // Every data rung, seed and outcome query goes through `mxcli oql --direct` with this
 // token. It used to be `M2EE_ADMIN_PASS || '1'`: a literal default that silently differed
@@ -156,11 +172,13 @@ const cfg = {
   // is wrong: the login page shows the same generic message either way.
   user: CREDS.user,
   pass: CREDS.pass,
-  // Whether the test password came from the environment (TEST_PASS, or its APP_PASS alias)
-  // rather than project.config.js's default. journey-runner's preflight refuses to log in on a
-  // default (#278): a runner started without the project's env-loading step submitted the
-  // template password, then the admin fallback, and locked two demo accounts for ~5 min each.
+  // Whether the test password came from the environment (TEST_PASS, or its APP_PASS alias),
+  // and passSource (see passwordSource above). journey-runner's preflight refuses to log in on
+  // the TEMPLATE PLACEHOLDER only (#278): a runner started without the project's env-loading
+  // step submitted the template password, then the admin fallback, and locked two demo
+  // accounts for ~5 min each. A password the project set in project.config.js is accepted.
   passFromEnv: !!(process.env.TEST_PASS || process.env.APP_PASS),
+  passSource: passwordSource(),
   // Last-resort identity so a credential problem degrades to a reported finding
   // instead of a zero-coverage run. Set FALLBACK_USER='' to disable.
   fallbackUser: CREDS.fallbackUser,
@@ -213,4 +231,4 @@ function resolveTarget() {
   return t;
 }
 
-module.exports = { cfg, NAV, TARGETS, resolveTarget, resolveAdmin };
+module.exports = { cfg, NAV, TARGETS, resolveTarget, resolveAdmin, passwordSource, TEMPLATE_PASSWORDS };
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index a6133b23..a9eb64f3 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -1078,17 +1078,26 @@ function preflight(journeys, { env = process.env, probe = runAdminProbe, admin =
     rows.push({ rung: 'setup', name: `preflight: ${name}`, verdict: 'INVALID', detail, requirement: '' });
   };
 
-  // 0. login credential (#278). Unset TEST_PASS means the run would submit project.config's
-  // default and then the admin fallback. Each rejected submit counts toward Mendix's
-  // 3-attempt lockout, and in the field two demo accounts were locked for ~5 min each. So no
-  // login is attempted at all. The override exists for a project whose config default IS its
-  // real demo password.
-  if (!admin.passFromEnv && env.ALLOW_CONFIG_CREDENTIALS !== '1') {
+  // 0. login credential (#278). A run that would submit the TEMPLATE PLACEHOLDER password
+  // (nobody set TEST_PASS, nobody edited project.config.js's DEFAULT_PASS) then tries the admin
+  // fallback; each rejected submit counts toward Mendix's 3-attempt lockout, and in the field
+  // two demo accounts were locked for ~5 min each. So no login is attempted at all.
+  // A password the PROJECT set in project.config.js is accepted: the template tells every
+  // project to put its real demo password there, and nothing in the toolkit loads an env file
+  // before verify-module runs the journeys — refusing it (#302 as first shipped) faulted every
+  // journeys rung after the next sync. ALLOW_CONFIG_CREDENTIALS=1 overrides when the
+  // placeholder really is the demo password. An admin object without passSource (older
+  // config.js) keeps the #302 rule: refuse unless the password came from the env.
+  const placeholder = admin.passSource !== undefined
+    ? admin.passSource === 'template placeholder'
+    : !admin.passFromEnv;
+  if (placeholder && env.ALLOW_CONFIG_CREDENTIALS !== '1') {
     setup('credentials', `TEST_PASS is unset — the run would log in as "${admin.user}" with ` +
-      "project.config.js's default password and then try the fallback account, and each rejected " +
-      'attempt counts toward the account lockout. Load the project env first (export TEST_USER / ' +
+      "project.config.template.js's placeholder password and then try the fallback account, and each " +
+      'rejected attempt counts toward the account lockout. Put the real demo password in ' +
+      "project.config.js's DEFAULT_PASS, or load the project env first (export TEST_USER / " +
       'TEST_PASS, e.g. `set -a; . ./.env; set +a`), or set ALLOW_CONFIG_CREDENTIALS=1 if the ' +
-      'config default is the real demo password. Suite ABORTED before any login');
+      'placeholder is the real demo password. Suite ABORTED before any login');
     return { lines, rows, skip, abort: 2 };
   }
 
@@ -1355,8 +1364,29 @@ function armRelease(page, li) {
     if (!ok) console.log('  ⚠ logout NOT confirmed — this run\'s session may still be open on the runtime ' +
                          '(trial licences cap live sessions; a restart clears them)');
   };
+}
+
+// An interrupted run (SIGINT/SIGTERM) writes its findings slot as aborted, with whatever it
+// measured so far. Exiting without writing left the PREVIOUS run's file in the slot, reading
+// as this run — the same stale-slot defect the preflight abort already guards against.
+function writeAbortedFindings(reason, extra = {}) {
+  try {
+    fs.mkdirSync(cfg.artifactsDir, { recursive: true });
+    fs.writeFileSync(findingsFile(), JSON.stringify({
+      capturedAt: new Date().toISOString(), aborted: reason,
+      configuredUser: cfg.user, actualUser: extra.actualUser ?? null, usedFallback: !!extra.usedFallback,
+      baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, results, walks,
+    }, null, 2));
+  } catch (e) { console.error(`  ⚠ could not write the aborted findings file: ${e.message}`); }
+}
+let SIGNAL_CTX = {};
+function armSignals() {
   for (const sig of ['SIGINT', 'SIGTERM']) {
-    process.once(sig, () => { RELEASE().finally(() => process.exit(2)); });
+    process.once(sig, () => {
+      console.log(`\n  ABORTED by ${sig} — findings written as aborted; this run is not a result.`);
+      writeAbortedFindings(`signal ${sig}`, SIGNAL_CTX);
+      RELEASE().finally(() => process.exit(2));
+    });
   }
 }
 
@@ -1383,20 +1413,17 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     console.log(`  ABORTED at preflight — 0 of ${journeys.length} journeys walked. Fix the SETUP line(s) above.`);
     // Written, not skipped: an aborted run must not leave the previous run's file in the slot
     // reading as this one.
-    fs.mkdirSync(cfg.artifactsDir, { recursive: true });
-    fs.writeFileSync(findingsFile(), JSON.stringify({
-      capturedAt: new Date().toISOString(), aborted: 'preflight',
-      configuredUser: cfg.user, actualUser: null, usedFallback: false,
-      baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, results, walks,
-    }, null, 2));
+    writeAbortedFindings('preflight');
     console.log(`  findings → ${path.relative(cfg.root, findingsFile())}`);
     process.exit(pf.abort);
   }
 
+  armSignals();
   const { browser, page } = await H.launchBrowser();
 
   const li = await H.login(page);
   armRelease(page, li);
+  SIGNAL_CTX = { actualUser: li.user, usedFallback: li.usedFallback };
 
   // Landing check: once per run, right after login, before any click. One run signs in as
   // one role, so "N of N roles" is the count over the per-role runs.
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index d51a8255..4a1a9710 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -118,7 +118,9 @@ const INPUTS = {
   wireframeDir:    'design/wireframes',
 };
 
-const KINDS = new Set(['ui', 'trace', 'data', 'outcome', 'control',
+// 'setup': journey-runner's preflight / precondition / APP-DOWN rows (rung 'setup'). They are
+// not UI checks; before 2026-10-13 they fell back to 'ui' and read as a screen finding.
+const KINDS = new Set(['ui', 'trace', 'data', 'outcome', 'control', 'setup',
                        'build', 'lint', 'coverage', 'conformance', 'stack']);
 
 // ── Verdict maps — one table per source dialect, nothing inline ──────────────
@@ -2600,6 +2602,13 @@ function selftest() {
   t('and emits no product checks from it',
     jCtl.checks.filter(c => c.instrument === 'journey-runner').length, 0);
 
+  // A setup row (preflight, precondition, APP-DOWN) keeps its own kind, never 'ui'.
+  const jSetup = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
+    data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false,
+            results: [{ rung: 'setup', name: 'preflight: admin', verdict: 'INVALID', detail: 'x', requirement: '' }] } } });
+  t('a setup row is kind "setup", not "ui"',
+    jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
+
   // ---- 3b. the control instrument is per-rung, and a copied real run is not one ----
   const ctlRow = (rung, verdict) => ({
     rung: 'control', verdict, detail: `d-${rung}`,
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index 87b9d0ca..c15ce2f3 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -86,7 +86,7 @@ each one was knowable before the first click.
 
 | Line | Meaning | Do |
 |---|---|---|
-| `SETUP  credentials: TEST_PASS is unset` | aborted, exit 2, **no login attempted** | load the project env (`TEST_USER`/`TEST_PASS`). A run without it submitted the config default and then the admin fallback, and locked two demo accounts for ~5 min each (#278). `ALLOW_CONFIG_CREDENTIALS=1` only when the config default is the real password |
+| `SETUP  credentials: TEST_PASS is unset … placeholder password` | aborted, exit 2, **no login attempted** | the run would submit the **template placeholder** (nobody set `TEST_PASS` and `project.config.js`'s `DEFAULT_PASS` is still the template value), then the admin fallback. That locked two demo accounts for ~5 min each (#278). Put the real demo password in `DEFAULT_PASS`, or export `TEST_PASS`. A password the project set in `project.config.js` is accepted. `ALLOW_CONFIG_CREDENTIALS=1` only when the placeholder really is the demo password |
 | `SETUP  admin: … refused the credential (HTTP 403); credential from <source>` | suite **aborted**, exit 2, nothing walked | fix the credential at the named source. Resolution order: `M2EE_ADMIN_PASS` env → this app's `.mxcli/run-local.json` (`mxcli run --local`) → `.docker/.env` → a labelled guess. The value is never printed |
 | `SETUP  admin: admin API unreachable at host:port` | aborted, exit 2 | app down, or set `M2EE_ADMIN_PORT`. `ALLOW_NO_DATA_RUNG=1` runs anyway with every data rung INVALID |
 | `SETUP  env: missing MOCK_X (needed by J1, J3)` | **one** line, those journeys not walked | export the vars a journey names in `requiresEnv` |
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index dde33248..20875d1a 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -112,6 +112,23 @@ p = R.preflight([data, ui], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT
 out('CRED', { abort: p.abort, calls, lines: p.lines, rows: p.rows.length });
 p = R.preflight([ui], { env: { ALLOW_CONFIG_CREDENTIALS: '1' }, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false } });
 out('CREDOVR', { abort: p.abort, rows: p.rows.length });
+// #302 follow-up: only the TEMPLATE PLACEHOLDER is refused; a project-set password runs
+calls = 0;
+p = R.preflight([data], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false, passSource: 'project.config.js' } });
+out('CRED_PROJ', { abort: p.abort, calls, cred: p.lines.some(l => l.includes('credentials')) });
+p = R.preflight([data], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false, passSource: 'template placeholder' } });
+out('CRED_TPL', { abort: p.abort, line: p.lines[0] || '' });
+// passwordSource: env wins, a project-set password is the project's, the template value is the placeholder
+const ps = typeof C.passwordSource === 'function' ? C.passwordSource : () => 'NOFN';
+out('PS', [
+  ps({ env: { TEST_PASS: 'x' }, creds: { pass: 'Demo2025!' } }),
+  ps({ env: { APP_PASS: 'x' }, creds: { pass: 'Real-Proj-Pass' } }),
+  ps({ env: {}, creds: { pass: 'Real-Proj-Pass' } }),
+  ps({ env: {}, creds: { pass: 'Demo2025!' } }),
+  ps({ env: {}, creds: { pass: 'anything', source: 'template default' } }),
+]);
+// the shipped template's DEFAULT_PASS is the placeholder this list names
+out('TPL_LISTED', (C.TEMPLATE_PASSWORDS || []).includes(E.TPL_PASS));
 
 // #279: resetsData tag printed; --protect-state refuses tagged journeys only
 const rs = { id: 'J-reset', resetsData: true, steps: [] };
@@ -214,8 +231,9 @@ sed -e "s/^M2EE_ADMIN_PASS=.*/M2EE_ADMIN_PASS=$MARK/" "$DENV" > "$CRED/.docker/.
 cp "$(dirname "$SUT")/example.journey.json" "$WORK/tests/e2e/" 2>/dev/null \
   || cp "$HERE/../../project-tests/e2e/example.journey.json" "$WORK/tests/e2e/"
 
+TPL_PASS="$(sed -n "s/^const DEFAULT_PASS = '\(.*\)';.*/\1/p" "$CFG" | head -1)"
 OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | env -u M2EE_ADMIN_PASS -u M2EE_ADMIN_PORT \
-       APP_PORT=1 MARK="$MARK" CRED_ROOT="$CRED" BARE_ROOT="$BARE" node - 2>&1)"
+       APP_PORT=1 MARK="$MARK" TPL_PASS="$TPL_PASS" CRED_ROOT="$CRED" BARE_ROOT="$BARE" node - 2>&1)"
 line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
 if printf '%s\n' "$OUT" | grep -qx NOFN; then
   bad "journey-runner.js exports no preflight/orderJourneys — #286 not addressed"
@@ -245,6 +263,12 @@ echo "== T2b: unset TEST_PASS refuses before any login (#278) =="
 case "$(line CRED)" in *'"abort":2,"calls":0'*'SETUP  credentials: TEST_PASS is unset'*demo_user*ALLOW_CONFIG_CREDENTIALS*'"rows":1'*) ok "aborts, names the user and the override, probe never called" ;; *) bad "unset TEST_PASS not refused" "$(line CRED)" ;; esac
 [ "$(line CREDOVR)" = '{"abort":null,"rows":0}' ] && ok "ALLOW_CONFIG_CREDENTIALS=1 proceeds" || bad "override ignored" "$(line CREDOVR)"
 
+echo "== T2b': only the template placeholder is refused (#302 follow-up) =="
+[ "$(line CRED_PROJ)" = '{"abort":null,"calls":1,"cred":false}' ] && ok "password set in project.config.js → no refusal, probe runs" || bad "project-set password refused (breaks every project after sync)" "$(line CRED_PROJ)"
+case "$(line CRED_TPL)" in *'"abort":2'*'placeholder password'*DEFAULT_PASS*) ok "template placeholder → refused, names DEFAULT_PASS as the fix" ;; *) bad "placeholder not refused" "$(line CRED_TPL)" ;; esac
+[ "$(line PS)" = '["env","env","project.config.js","template placeholder","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; template value / 'template default' is the placeholder" || bad "passwordSource wrong" "$(line PS)"
+[ -n "$TPL_PASS" ] && [ "$(line TPL_LISTED)" = true ] && ok "the shipped template's DEFAULT_PASS is the listed placeholder" || bad "template DEFAULT_PASS not in TEMPLATE_PASSWORDS (got '$TPL_PASS')" "$(line TPL_LISTED)"
+
 echo "== T2c: resetsData / --protect-state (#279) =="
 case "$(line RS)" in *'"abort":null'*'SETUP  resetsData: J-reset reset or reload demo data'*'"rows":0,"skip":0'*) ok "tag printed at start, journey still runs without the flag" ;; *) bad "tag not printed / journey refused" "$(line RS)" ;; esac
 case "$(line RSP)" in *'"abort":null'*'SETUP  protect-state: refused J-reset'*'"rows":1,"skip":["J-reset"]'*) ok "--protect-state refuses only the tagged journey, one row" ;; *) bad "--protect-state wrong" "$(line RSP)" ;; esac
@@ -355,6 +379,36 @@ E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_C
 printf '%s\n' "$E2EOUT" | grep -qiE 'login as|FAULTED|launch' && bad "a login was attempted" "$E2EOUT" || ok "no login attempted (browser never opened)"
 [ -f "$WORK/argv" ] && bad "admin probe ran" || ok "no admin probe either"
 
+echo "== T11b: real runner — TEST_PASS unset but DEFAULT_PASS set by the project → not refused =="
+rm -f "$WORK/argv"
+PROJ_CFG="$WORK/tests/e2e/project.config.js"; cp "$PROJ_CFG" "$WORK/cfg.bak"
+sed -e "s/^const DEFAULT_PASS = '.*';/const DEFAULT_PASS = 'fixture-project-pass';/" "$WORK/cfg.bak" > "$PROJ_CFG"
+E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_CREDENTIALS -u M2EE_ADMIN_PORT APP_PORT=1 M2EE_ADMIN_PASS="$MARK" \
+          MXCLI="$WORK/stub/mxcli" STUB_ARGV="$WORK/argv" node journey-runner.js "$J/J-one.journey.json" 2>&1)"; RC=$?
+printf '%s\n' "$E2EOUT" | grep -q 'SETUP  credentials' && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
+[ -f "$WORK/argv" ] && ok "went on to the admin probe (the stub answers 403 → exit $RC)" || bad "probe never ran" "$E2EOUT"
+cp "$WORK/cfg.bak" "$PROJ_CFG"
+
+echo "== T11c: real runner — SIGINT after preflight writes the findings slot as aborted =="
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$OKOUT"\n' > "$WORK/stub/mxcli-ok"
+chmod +x "$WORK/stub/mxcli-ok"
+# Hold the run where a real one waits on the browser: launchBrowser never resolves, and a timer
+# keeps the event loop alive the way a live browser process does.
+printf "const H = require('./helpers.js'); H.launchBrowser = () => new Promise(() => { setInterval(() => {}, 1 << 30); });\n" > "$WORK/tests/e2e/hold-browser.js"
+FJ2="$WORK/tests/e2e/artifacts/journey-findings.json"
+mkdir -p "$WORK/tests/e2e/artifacts"
+printf '{"capturedAt":"STALE-PREVIOUS-RUN","results":[]}' > "$FJ2"
+LOG="$WORK/sigint.log"
+( cd "$WORK/tests/e2e" && exec env -u M2EE_ADMIN_PORT APP_PORT=1 TEST_PASS=fixture-pass M2EE_ADMIN_PASS="$MARK" MXCLI="$WORK/stub/mxcli-ok" \
+    node -r ./hold-browser.js journey-runner.js "$J/J-one.journey.json" > "$LOG" 2>&1 ) &
+PID=$!
+for _ in $(seq 1 100); do grep -q 'SETUP  admin: OK' "$LOG" 2>/dev/null && break; sleep 0.1; done
+sleep 0.5; kill -INT "$PID" 2>/dev/null; wait "$PID"; RC=$?
+[ "$RC" -eq 2 ] && ok "SIGINT → exit 2" || bad "rc=$RC" "$(tail -5 "$LOG")"
+node -e 'const f=require(process.argv[1]); process.exit(f.aborted==="signal SIGINT" && f.capturedAt!=="STALE-PREVIOUS-RUN" ? 0 : 1)' "$FJ2" 2>/dev/null \
+  && ok "findings slot overwritten as aborted by SIGINT (no stale previous run left)" || bad "previous run's findings left in the slot" "$(head -c 200 "$FJ2")"
+grep -q 'ABORTED by SIGINT' "$LOG" && ok "says ABORTED by SIGINT" || bad "no abort line" "$(tail -5 "$LOG")"
+
 echo "== T12: real runner — --protect-state with every journey tagged → refused, no login =="
 rm -f "$WORK/argv"
 printf '{"id":"J-demo-reset","resetsData":true,"steps":[{"name":"s","data":{"creates":"M.E"}}]}\n' > "$J/J-demo-reset.journey.json"

From ba461e5906afaf45cdb7a33daa8d4e1f4f88fcde Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:07:51 +0000
Subject: [PATCH 7/9] report: honour aborted findings; setup kind in the
 schema; drop dead credentials branch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- report-normalize.js: a findings file with `aborted` (preflight refusal or
  a signal) yields a report with top-level `aborted`, every kept journey
  row flagged notAResult/abortedRun, and the journey-runner instrument a
  fault — an aborted run never reads as results. --selftest cases; and
  test-journey-preflight.sh runs the real runner's aborted file through
  the real normalizer (fails on master's normalizer).
- skills/report-schema.md: kind enum gains `setup`; `aborted` documented.
- config.js: drop the `credentials().source === 'template default'`
  branch no template emits; the Demo2025! placeholder rule stays.

Refs #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |  2 +-
 project-tests/e2e/config.js           |  3 +--
 project-tests/e2e/report-normalize.js | 23 +++++++++++++++++++++++
 skills/report-schema.md               |  6 +++++-
 tests/wave2/test-journey-preflight.sh | 15 +++++++++++++--
 5 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd92119d..1d9cf912 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the placeholder (`Demo2025!`, or a `credentials()` reporting `source: 'template default'`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and a `report-normalize.js --selftest` case. Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/config.js b/project-tests/e2e/config.js
index ee7c4d38..d0c72b1b 100644
--- a/project-tests/e2e/config.js
+++ b/project-tests/e2e/config.js
@@ -89,11 +89,10 @@ const CREDS = PROJ.credentials();
 // Only the last is refused by journey-runner's preflight. Refusing every non-env password
 // (as #302 first did) broke every project whose real password lives in project.config.js,
 // because nothing in the toolkit loads an env file before verify-module runs the journeys.
-// A credentials() that reports `source: 'template default'` is honoured as well.
 const TEMPLATE_PASSWORDS = ['Demo2025!'];   // project.config.template.js DEFAULT_PASS
 function passwordSource({ env = process.env, creds = CREDS } = {}) {
   if (env.TEST_PASS || env.APP_PASS) return 'env';
-  if (creds.source === 'template default' || TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
+  if (TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
   return 'project.config.js';
 }
 
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index 4a1a9710..f6400ce4 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -549,6 +549,16 @@ function collectJourney(input, contracts, ctx) {
     note: 'PASS/FAIL/INVALID are distinct at the source; INVALID → fault',
     checksEmitted: checks.length,
   });
+  // An ABORTED run (journey-runner wrote `aborted: "preflight"` or `"signal SIGINT"`) is not
+  // a result: the suite stopped before or while walking. Its rows are kept so the reader sees
+  // why, but each is flagged notAResult and the instrument is a fault — never a green or a
+  // finding about the app.
+  if (d.aborted) {
+    for (const c of checks) { c.notAResult = true; c.abortedRun = String(d.aborted); }
+    Object.assign(instruments[instruments.length - 1], { verdict: 'fault', aborted: String(d.aborted),
+      reason: `${input.path} is an ABORTED run (${d.aborted}) — the suite stopped before or while walking; ` +
+              'its rows are kept and flagged notAResult, none of them is a result. Fix the cause and re-run.' });
+  }
   return { checks, instruments, walks: collectWalks(d, checks) };
 }
 
@@ -2272,6 +2282,9 @@ function normalize(inputs) {
 
   return {
     schemaVersion: SCHEMA_VERSION,
+    // The journey run was aborted (preflight refusal or a signal): its rows are kept and
+    // flagged notAResult, and nothing in this report is a journey result.
+    aborted: (jf && jf.aborted) ? String(jf.aborted) : null,
     project: {
       id: m.projectId || null,
       displayName: m.displayName || null,
@@ -2609,6 +2622,16 @@ function selftest() {
   t('a setup row is kind "setup", not "ui"',
     jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
 
+  // An aborted run (preflight / signal) is kept but is never a result.
+  const jAb = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
+    data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false, aborted: 'preflight',
+            results: [{ rung: 'setup', name: 'preflight: admin', verdict: 'INVALID', detail: 'x', requirement: '' }] } } });
+  t('an aborted run marks the report aborted', jAb.aborted, 'preflight');
+  t('and faults the journey-runner instrument', inst(jAb, 'journey-runner').verdict, 'fault');
+  t('and flags every kept row notAResult',
+    jAb.checks.filter(c => c.instrument === 'journey-runner').every(c => c.notAResult === true && c.abortedRun === 'preflight'), true);
+  t('a completed run is not aborted', jSetup.aborted, null);
+
   // ---- 3b. the control instrument is per-rung, and a copied real run is not one ----
   const ctlRow = (rung, verdict) => ({
     rung: 'control', verdict, detail: `d-${rung}`,
diff --git a/skills/report-schema.md b/skills/report-schema.md
index b564068e..3148b9fe 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -57,6 +57,9 @@ any real project. The **Deriving the values** section says where each one actual
 ```jsonc
 {
   "schemaVersion": "1.2",              // renderer refuses on major mismatch, warns on newer minor
+  "aborted": null,                     // "preflight" | "signal SIGINT" | … when journey-findings.json is an
+                                       // aborted run: its checks carry notAResult: true + abortedRun, and the
+                                       // journey-runner instrument is a fault. None of them is a result.
 
   "project": {
     "id": "acme-procurement",          // stable key; a fleet index groups on this
@@ -97,8 +100,9 @@ any real project. The **Deriving the values** section says where each one actual
     {
       "id": "journey/J-PR-01/step5/landing",     // stable, sortable, unique
       "instrument": "journey-runner",            // WHO measured
-      "kind": "ui",                              // ui | trace | data | outcome | control
+      "kind": "ui",                              // ui | trace | data | outcome | control | setup
                                                  // | build | lint | coverage | conformance | stack
+                                                 // setup = journey-runner preflight / precondition / APP-DOWN rows
       "module": "Procurement",                   // null for cross-cutting
       "journey": "J-PR-01",                      // null when not a journey check
       "stepIndex": 5,                            // ordinal position on the path
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index 20875d1a..ba8755b9 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -125,7 +125,6 @@ out('PS', [
   ps({ env: { APP_PASS: 'x' }, creds: { pass: 'Real-Proj-Pass' } }),
   ps({ env: {}, creds: { pass: 'Real-Proj-Pass' } }),
   ps({ env: {}, creds: { pass: 'Demo2025!' } }),
-  ps({ env: {}, creds: { pass: 'anything', source: 'template default' } }),
 ]);
 // the shipped template's DEFAULT_PASS is the placeholder this list names
 out('TPL_LISTED', (C.TEMPLATE_PASSWORDS || []).includes(E.TPL_PASS));
@@ -266,7 +265,7 @@ case "$(line CRED)" in *'"abort":2,"calls":0'*'SETUP  credentials: TEST_PASS is
 echo "== T2b': only the template placeholder is refused (#302 follow-up) =="
 [ "$(line CRED_PROJ)" = '{"abort":null,"calls":1,"cred":false}' ] && ok "password set in project.config.js → no refusal, probe runs" || bad "project-set password refused (breaks every project after sync)" "$(line CRED_PROJ)"
 case "$(line CRED_TPL)" in *'"abort":2'*'placeholder password'*DEFAULT_PASS*) ok "template placeholder → refused, names DEFAULT_PASS as the fix" ;; *) bad "placeholder not refused" "$(line CRED_TPL)" ;; esac
-[ "$(line PS)" = '["env","env","project.config.js","template placeholder","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; template value / 'template default' is the placeholder" || bad "passwordSource wrong" "$(line PS)"
+[ "$(line PS)" = '["env","env","project.config.js","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; the template value is the placeholder" || bad "passwordSource wrong" "$(line PS)"
 [ -n "$TPL_PASS" ] && [ "$(line TPL_LISTED)" = true ] && ok "the shipped template's DEFAULT_PASS is the listed placeholder" || bad "template DEFAULT_PASS not in TEMPLATE_PASSWORDS (got '$TPL_PASS')" "$(line TPL_LISTED)"
 
 echo "== T2c: resetsData / --protect-state (#279) =="
@@ -357,6 +356,18 @@ FJ="$WORK/tests/e2e/artifacts/journey-findings.json"
 node -e 'const f=require(process.argv[1]); process.exit(f.aborted==="preflight" && f.results.length===1 && f.results[0].verdict==="INVALID" ? 0 : 1)' "$FJ" 2>/dev/null \
   && ok "findings slot overwritten with the aborted run (no stale file reads as this run)" || bad "findings file not written as aborted"
 grep -qF "$MARK" "$FJ" 2>/dev/null && bad "credential written to the findings file" || ok "credential not in the findings file"
+# The aborted findings file through the real normalizer: a report, marked aborted, no results.
+if [ -f "$E2E/report-normalize.js" ]; then
+  cp "$E2E/report-normalize.js" "$WORK/tests/e2e/"
+  ( cd "$WORK/tests/e2e" && APP_PORT=1 node report-normalize.js --out docs/report.json ) > "$WORK/rn.out" 2>&1
+  node -e 'const r=require(process.argv[1]); const j=r.checks.filter(c=>c.instrument==="journey-runner");
+    const i=r.instruments.find(x=>x.name==="journey-runner");
+    process.exit(r.aborted==="preflight" && j.length>0 && j.every(c=>c.notAResult===true) && i.verdict==="fault" ? 0 : 1)' "$WORK/docs/report.json" 2>/dev/null \
+    && ok "report-normalize marks the aborted run: report.aborted, rows flagged notAResult, instrument fault" \
+    || bad "aborted run normalised as results" "$(tail -3 "$WORK/rn.out"; node -e 'const r=require(process.argv[1]);console.log(r.aborted)' "$WORK/docs/report.json" 2>&1)"
+else
+  echo "  skip — report-normalize.js not beside $SUT"
+fi
 
 echo "== T10: real runner — missing env var, every journey affected → one SETUP line, no probe =="
 rm -f "$WORK/argv"

From 57bf81b9d265388c24d57101aee495cd03e2175f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:20:27 +0000
Subject: [PATCH 8/9] report: read per-BRD conformance reports
 (report-<date>-<BRD>.tsv)

conformance-check now writes one report per BRD (#307), but
report-normalize.js kept only report-<date>.tsv, so per-BRD modules never
reached report.json and a stale base file could read as measured. It now
takes the newest date among report-<date>[-<BRD>].tsv and concatenates
every file of that date; single-file projects are unchanged.
pickConformanceFiles is exported; --selftest cases and case 3 of
test-report-normalize-two-tree.sh (fails on master: reads the stale file).

Also: the new fixtures use here-strings instead of `printf | grep -q`,
which under pipefail can SIGPIPE and flip a check (seen once under load).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-tests/e2e/report-normalize.js         | 61 +++++++++++++------
 skills/report-schema.md                       |  3 +
 tests/wave2/test-journey-preflight.sh         |  2 +-
 tests/wave2/test-report-normalize-two-tree.sh | 20 +++++-
 tests/wave2/test-validate-journeys-spans.sh   | 14 ++---
 6 files changed, 75 insertions(+), 27 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d9cf912..7f103734 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date and aggregates every file of that date; single-file projects are unchanged (`--selftest` cases plus case 3 of `test-report-normalize-two-tree.sh`). Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index f6400ce4..21b8e895 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -1366,7 +1366,7 @@ function collectLoop(summaries) {
 }
 
 // ============================================================================
-// SOURCE 4 — docs/conformance/report-<date>.tsv (newest by filename)
+// SOURCE 4 — docs/conformance/report-<date>[-<BRD>].tsv (newest date by filename, all BRDs)
 // ============================================================================
 function collectConformance(input, ctx) {
   const checks = [];
@@ -1430,6 +1430,17 @@ function collectConformance(input, ctx) {
   };
 }
 
+// Which conformance files make up the newest run: the newest date among report-<date>.tsv
+// and report-<date>-<BRD>.tsv, and every file of that date (sorted). A per-BRD run and an
+// older single-file run never mix: only the newest date is read.
+function pickConformanceFiles(names) {
+  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-[A-Za-z0-9_.-]+)?\.tsv$/;
+  const hits = names.map(n => [n, re.exec(n)]).filter(([, m]) => m);
+  if (!hits.length) return { date: null, files: [] };
+  const date = hits.map(([, m]) => m[1]).sort().pop();
+  return { date, files: hits.filter(([, m]) => m[1] === date).map(([n]) => n).sort() };
+}
+
 // ============================================================================
 // SOURCE 5 — architecture/modules/*/coverage-ledger.md
 // ============================================================================
@@ -2440,21 +2451,24 @@ function loadInputs(outFile) {
     return { module: mod, file: readFileInput(rel), mtime };
   });
 
-  // Newest conformance report BY FILENAME — the names are ISO dates, so lexical sort
-  // is chronological, and mtime would reorder on a git checkout.
-  let confRel = null, confDate = null;
-  try {
-    const files = fs.readdirSync(abs(INPUTS.conformanceDir))
-      .filter(f => /^report-\d{4}-\d{2}-\d{2}\.tsv$/.test(f)).sort();
-    if (files.length) {
-      confRel = `${INPUTS.conformanceDir}/${files[files.length - 1]}`;
-      confDate = files[files.length - 1].slice(7, 17);
-    }
-  } catch { /* handled below */ }
-  const conformance = confRel
-    ? readFileInput(confRel)
-    : { status: 'missing', path: `${INPUTS.conformanceDir}/report-<date>.tsv`,
-        error: 'no report-<date>.tsv found' };
+  // Newest conformance report date BY FILENAME — the names are ISO dates, so lexical sort
+  // is chronological, and mtime would reorder on a git checkout. Every file of that date is
+  // read: the single report-<date>.tsv and/or the per-BRD report-<date>-<BRD>.tsv files
+  // conformance-check writes (one per BRD); their rows are concatenated.
+  let confPick = { date: null, files: [] };
+  try { confPick = pickConformanceFiles(fs.readdirSync(abs(INPUTS.conformanceDir))); }
+  catch { /* handled below */ }
+  const confDate = confPick.date;
+  let conformance;
+  if (!confPick.files.length) {
+    conformance = { status: 'missing', path: `${INPUTS.conformanceDir}/report-<date>.tsv`,
+                    error: 'no report-<date>.tsv or report-<date>-<BRD>.tsv found' };
+  } else {
+    const parts = confPick.files.map(n => readFileInput(`${INPUTS.conformanceDir}/${n}`));
+    const broken = parts.find(p => p.status !== 'ok');
+    conformance = broken || (parts.length === 1 ? parts[0]
+      : { status: 'ok', path: parts.map(p => p.path).join(', '), text: parts.map(p => p.text).join('\n') });
+  }
 
   const ledgers = listDirs(INPUTS.modulesDir)
     .map(mod => ({ module: mod, file: readFileInput(`${INPUTS.modulesDir}/${mod}/coverage-ledger.md`) }))
@@ -2622,6 +2636,19 @@ function selftest() {
   t('a setup row is kind "setup", not "ui"',
     jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
 
+  // Conformance: newest date wins; per-BRD files of that date are all read; single file unchanged.
+  t('one base file → that file', pickConformanceFiles(['report-2026-10-01.tsv', 'notes.md']),
+    { date: '2026-10-01', files: ['report-2026-10-01.tsv'] });
+  t('per-BRD files of the newest date, all of them; a stale older base file is ignored',
+    pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F002.tsv', 'report-2026-10-12-F001.tsv', 'report-2026-10-01-F001.tsv']),
+    { date: '2026-10-12', files: ['report-2026-10-12-F001.tsv', 'report-2026-10-12-F002.tsv'] });
+  t('no report files → none', pickConformanceFiles(['readme.txt']), { date: null, files: [] });
+  const confMulti = normalize({ ...base, conformance: { status: 'ok', path: 'a, b',
+    text: 'module\tpointer\tstored\tobserved\tverdict\nOrders\t/x\t1\t1\tOK\n' +
+          '\nmodule\tpointer\tstored\tobserved\tverdict\nBilling\t/y\t2\t3\tSTALE\n' } });
+  t('concatenated per-BRD reports yield both modules',
+    confMulti.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance').map(c => c.module).sort(), ['Billing', 'Orders']);
+
   // An aborted run (preflight / signal) is kept but is never a result.
   const jAb = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
     data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false, aborted: 'preflight',
@@ -3122,5 +3149,5 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { normalize, normReq, declaredChecks, parseLedger,
+module.exports = { normalize, normReq, declaredChecks, parseLedger, pickConformanceFiles,
                    V_JOURNEY, V_LOOP, V_WALK, V_CONF, selftest };
diff --git a/skills/report-schema.md b/skills/report-schema.md
index 3148b9fe..29365c6f 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -143,6 +143,9 @@ any real project. The **Deriving the values** section says where each one actual
     { "name": "positive-control", "verdict": "fault",   "reason": "not requested (--positive-control absent)" },
     { "name": "monkey",           "verdict": "skipped", "reason": "--skip-monkey" },
     { "name": "conformance",      "verdict": "pass",    "log": "docs/conformance/report-<date>.tsv" }
+      // conformance reads the NEWEST date among report-<date>.tsv and the per-BRD
+      // report-<date>-<BRD>.tsv files, and every file of that date (rows concatenated;
+      // "log" then lists them comma-separated). An older date is never mixed in.
   ],
 
   // Rollups have denominators, so they are not checks.
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index ba8755b9..c4848aa1 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -396,7 +396,7 @@ PROJ_CFG="$WORK/tests/e2e/project.config.js"; cp "$PROJ_CFG" "$WORK/cfg.bak"
 sed -e "s/^const DEFAULT_PASS = '.*';/const DEFAULT_PASS = 'fixture-project-pass';/" "$WORK/cfg.bak" > "$PROJ_CFG"
 E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_CREDENTIALS -u M2EE_ADMIN_PORT APP_PORT=1 M2EE_ADMIN_PASS="$MARK" \
           MXCLI="$WORK/stub/mxcli" STUB_ARGV="$WORK/argv" node journey-runner.js "$J/J-one.journey.json" 2>&1)"; RC=$?
-printf '%s\n' "$E2EOUT" | grep -q 'SETUP  credentials' && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
+grep -q 'SETUP  credentials' <<< "$E2EOUT" && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
 [ -f "$WORK/argv" ] && ok "went on to the admin probe (the stub answers 403 → exit $RC)" || bad "probe never ran" "$E2EOUT"
 cp "$WORK/cfg.bak" "$PROJ_CFG"
 
diff --git a/tests/wave2/test-report-normalize-two-tree.sh b/tests/wave2/test-report-normalize-two-tree.sh
index f8bcea97..203581ae 100644
--- a/tests/wave2/test-report-normalize-two-tree.sh
+++ b/tests/wave2/test-report-normalize-two-tree.sh
@@ -9,7 +9,8 @@
 # step then showed 8 of 9 instruments FAULT ("design-audit.json does not exist", "no
 # coverage-ledger.md under architecture/modules/*/") over artefacts that were on disk, and wrote
 # the report into a stray app/docs/report.json — so the render step found nothing to render.
-# Case 1 is that shape in miniature; case 2 is the single-tree regression guard.
+# Case 1 is that shape in miniature; case 2 is the single-tree regression guard; case 3 reads
+# per-BRD conformance reports (report-<date>-<BRD>.tsv, PR #307).
 #
 # The artefacts here are SYNTHETIC and minimal. That is deliberate and allowed: the field-proof
 # rule's "golden input is captured" governs parsers of tool output, and nothing below exercises a
@@ -91,6 +92,23 @@ else
   bad "single tree: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out2" | cut -c1-300)"
 fi
 
+# --- 3. per-BRD conformance reports (conformance-check writes report-<date>-<BRD>.tsv) ---------
+# The newest date wins and every BRD file of that date is read; an older single-file report is
+# not mixed in (it used to be the ONLY file read, shown as measured although stale).
+P="$WORK/perbrd"; lay_out "$P" "$P"
+rm -f "$P/docs/conformance/"report-*.tsv
+printf 'module\tclaim\tstored\tobserved\tverdict\nStale\t/old\t1\t1\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
+printf 'module\tclaim\tstored\tobserved\tverdict\nOrders\t/useCases\t3\t3\tOK\n' > "$P/docs/conformance/report-2026-10-12-F001.tsv"
+printf 'module\tclaim\tstored\tobserved\tverdict\nBilling\t/pages\t2\t4\tUNDERSTATED\n' > "$P/docs/conformance/report-2026-10-12-F002.tsv"
+( cd "$P/tests/e2e" && node report-normalize.js --out docs/report.json ) >"$WORK/out3" 2>&1
+if [ -s "$P/docs/report.json" ]; then
+  mods="$(node -e 'const r=require(process.argv[1]); console.log(r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance").map(c=>c.module).sort().join(","))' "$P/docs/report.json")"
+  [ "$mods" = "Billing,Orders" ] && ok "per-BRD reports of the newest date are all read (Billing, Orders); the older single file is not" \
+    || bad "per-BRD conformance reports not aggregated" "$mods"
+else
+  bad "per-BRD: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out3" | cut -c1-300)"
+fi
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
index 0c55ee6c..30ba6a2a 100644
--- a/tests/wave2/test-validate-journeys-spans.sh
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -58,18 +58,18 @@ for c in negonly negempty negdecl positive; do
   [ "$RC" -eq 0 ] && ok "$c → no problems" || bad "$c rejected" "$OUT"
 done
 run negonly
-printf '%s' "$OUT" | grep -q 'NEVER checked' && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
+grep -q 'NEVER checked' <<< "$OUT" && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
 
 echo "== T2: what the runner cannot read is still a problem =="
-run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
+run nothing; { [ "$RC" -eq 1 ] && grep -q 'declares nothing the runner reads' <<< "$OUT"; } \
   && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
-printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
-run legacy; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'is an array — the old shape'; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
-run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
+grep -q 'records it INVALID' <<< "$OUT" && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
+run legacy; { [ "$RC" -eq 1 ] && grep -q 'is an array — the old shape' <<< "$OUT"; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
+run livenum; { [ "$RC" -eq 1 ] && grep -q 'liveness: must be a non-empty string' <<< "$OUT"; } \
   && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
-run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \
+run livepos; { [ "$RC" -eq 1 ] && grep -q 'only read for a negative-only claim' <<< "$OUT"; } \
   && ok "liveness beside ordered → problem (never read)" || bad "unread liveness accepted" "$OUT"
-run badre; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'not a valid regex'; } \
+run badre; { [ "$RC" -eq 1 ] && grep -q 'not a valid regex' <<< "$OUT"; } \
   && ok "mustNotFire that is not a regex → problem" || bad "invalid regex accepted" "$OUT"
 
 echo "== T3: the validator's own selftest =="

From 84dc6b6ade1e3d8e5c084289574cc7a77689df15 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:29:25 +0000
Subject: [PATCH 9/9] =?UTF-8?q?report:=20per-BRD=20conformance=20=E2=80=94?=
 =?UTF-8?q?=20any=20suffix,=20BRD-prefixed=20pointers,=20captured=20golden?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pickConformanceFiles accepts report-<date>-<any suffix>.tsv: the
  narrower class dropped "report-<date>-F003 shipping.tsv" (a BRD id with
  a space, which #307's own fixture writes) and fell back to an older
  base file — the stale-report bug again.
- collectConformance strips a leading "<BRD>:" from the pointer, so a
  per-BRD row keeps requirement "/x" (was null for every per-BRD row);
  the BRD stays in the check id, so one pointer in two BRDs stays two.
- Golden: tests/wave2/fixtures/conformance-per-brd/ is conformance-check.sh's
  real output (PR #307, 8fc7c6a) on that PR's per-BRD fixture layout;
  case 3 of test-report-normalize-two-tree.sh reads it (fails on master
  and on the previous commit). report-schema.md: any suffix of the newest
  date is joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-tests/e2e/report-normalize.js         | 23 +++++++++++++++++--
 skills/report-schema.md                       |  8 ++++---
 .../fixtures/conformance-per-brd/CAPTURE.txt  |  9 ++++++++
 .../report-2026-10-13-F001-orders.tsv         |  3 +++
 .../report-2026-10-13-F002-invoicing.tsv      |  3 +++
 .../report-2026-10-13-F003 shipping.tsv       |  3 +++
 tests/wave2/test-report-normalize-two-tree.sh | 20 +++++++++-------
 8 files changed, 57 insertions(+), 14 deletions(-)
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f103734..c08dde8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date and aggregates every file of that date; single-file projects are unchanged (`--selftest` cases plus case 3 of `test-report-normalize-two-tree.sh`). Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date among `report-<date>[-<any suffix>].tsv` and aggregates every file of that date, including BRD ids that contain a space. A per-BRD pointer `<BRD>:`/x`` keeps its requirement `/x`. Single-file projects are unchanged. Golden input: conformance-check.sh's real per-BRD output on #307's own fixture layout (`tests/wave2/fixtures/conformance-per-brd/`), plus `--selftest` cases and case 3 of `test-report-normalize-two-tree.sh`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index 21b8e895..3082887b 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -1391,8 +1391,12 @@ function collectConformance(input, ctx) {
     // the decoration is reading it, not inventing it (rule 4). Anything that does not
     // start with "/" after stripping is NOT treated as a pointer — better null than a
     // synthesised one.
+    // Per-BRD reports prefix the pointer with its BRD: "F001-orders:`/microflows/0`" (a BRD id
+    // may hold a space). The prefix is stripped for the requirement and kept in the id, so the
+    // same pointer in two BRDs stays two checks.
     const cleaned = pointerRaw.replace(/`/g, '').replace(/\s*\(\d+\)\s*$/, '').trim();
-    const requirement = cleaned.startsWith('/') ? cleaned : null;
+    const pointer = cleaned.replace(/^[^/:]+:(?=\/)/, '');
+    const requirement = pointer.startsWith('/') ? pointer : null;
 
     let id = `conformance/${slug(mod)}/${slug(cleaned || pointerRaw)}`;
     let bump = 1;
@@ -1434,7 +1438,9 @@ function collectConformance(input, ctx) {
 // and report-<date>-<BRD>.tsv, and every file of that date (sorted). A per-BRD run and an
 // older single-file run never mix: only the newest date is read.
 function pickConformanceFiles(names) {
-  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-[A-Za-z0-9_.-]+)?\.tsv$/;
+  // Any suffix: a BRD id may hold a space (conformance-check writes report-<date>-F003 shipping.tsv);
+  // a narrower class dropped that file and the stale-report bug came back.
+  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-.+)?\.tsv$/;
   const hits = names.map(n => [n, re.exec(n)]).filter(([, m]) => m);
   if (!hits.length) return { date: null, files: [] };
   const date = hits.map(([, m]) => m[1]).sort().pop();
@@ -2642,10 +2648,23 @@ function selftest() {
   t('per-BRD files of the newest date, all of them; a stale older base file is ignored',
     pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F002.tsv', 'report-2026-10-12-F001.tsv', 'report-2026-10-01-F001.tsv']),
     { date: '2026-10-12', files: ['report-2026-10-12-F001.tsv', 'report-2026-10-12-F002.tsv'] });
+  t('a BRD id with a space is a per-BRD file, never dropped for an older base file',
+    pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F003 shipping.tsv']),
+    { date: '2026-10-12', files: ['report-2026-10-12-F003 shipping.tsv'] });
   t('no report files → none', pickConformanceFiles(['readme.txt']), { date: null, files: [] });
   const confMulti = normalize({ ...base, conformance: { status: 'ok', path: 'a, b',
     text: 'module\tpointer\tstored\tobserved\tverdict\nOrders\t/x\t1\t1\tOK\n' +
           '\nmodule\tpointer\tstored\tobserved\tverdict\nBilling\t/y\t2\t3\tSTALE\n' } });
+  const confBrd = normalize({ ...base, conformance: { status: 'ok', path: 'r.tsv',
+    text: 'module\tpointer\tstored\tobserved\tverdict\tcommand\n' +
+          'Shipping\tF003 shipping:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW S.A\n' +
+          'Orders\tF001-orders:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW O.A\n' +
+          'Orders\tF002-invoicing:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW O.B\n' } });
+  const brdChecks = confBrd.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance');
+  t('a per-BRD pointer "<BRD>:`/x`" keeps its requirement (/x), BRD id with a space included',
+    brdChecks.map(c => c.requirement), ['/microflows/0', '/microflows/0', '/microflows/0']);
+  t('the same pointer in two BRDs stays two distinct checks (BRD kept in the id)',
+    new Set(brdChecks.map(c => c.id)).size === 3 && brdChecks.every(c => !/~/.test(c.id)), true);
   t('concatenated per-BRD reports yield both modules',
     confMulti.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance').map(c => c.module).sort(), ['Billing', 'Orders']);
 
diff --git a/skills/report-schema.md b/skills/report-schema.md
index 29365c6f..890d5ccd 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -143,9 +143,11 @@ any real project. The **Deriving the values** section says where each one actual
     { "name": "positive-control", "verdict": "fault",   "reason": "not requested (--positive-control absent)" },
     { "name": "monkey",           "verdict": "skipped", "reason": "--skip-monkey" },
     { "name": "conformance",      "verdict": "pass",    "log": "docs/conformance/report-<date>.tsv" }
-      // conformance reads the NEWEST date among report-<date>.tsv and the per-BRD
-      // report-<date>-<BRD>.tsv files, and every file of that date (rows concatenated;
-      // "log" then lists them comma-separated). An older date is never mixed in.
+      // conformance reads the NEWEST date among report-<date>.tsv and report-<date>-<suffix>.tsv
+      // (any suffix — conformance-check writes one per BRD, and a BRD id may hold a space), and
+      // joins EVERY file of that date (rows concatenated; "log" lists them comma-separated). An
+      // older date is never mixed in. A per-BRD pointer "<BRD>:`/x`" gives requirement "/x";
+      // the BRD stays in the check id.
   ],
 
   // Rollups have denominators, so they are not checks.
diff --git a/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt b/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
new file mode 100644
index 00000000..61afad9c
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
@@ -0,0 +1,9 @@
+Captured 2026-10-13, verbatim: the three report-<date>-<BRD>.tsv files that
+project-bin/conformance-check.sh writes on PR #307's branch (fix/graph-sweep-conformance,
+commit 8fc7c6a), run unscoped (`conformance-check.sh --quiet`, rc 0, "measured 6") on the
+single-tree layout that PR's own fixture builds (tests/wave2/test-conformance-per-brd-ledger.sh,
+setup single: Orders with per-BRD ledgers F001-orders and F002-invoicing, Shipping with
+"F003 shipping" — a BRD id with a space). The ledgers and the mxcli stub there are that
+fixture's; the TSVs are conformance-check.sh's real output. Pointers are written
+<BRD>:`/json/pointer`. Read by tests/wave2/test-report-normalize-two-tree.sh case 3.
+Re-capture when conformance-check.sh's report format changes.
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
new file mode 100644
index 00000000..4653011f
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Orders	F001-orders:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Orders.Order
+Orders	F001-orders:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Orders.ACT_Order_Save
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
new file mode 100644
index 00000000..bda59b28
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Orders	F002-invoicing:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Orders.Invoice
+Orders	F002-invoicing:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Orders.ACT_Invoice_Send
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv
new file mode 100644
index 00000000..ef161808
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv	
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Shipping	F003 shipping:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Shipping.Parcel
+Shipping	F003 shipping:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Shipping.ACT_Parcel_Send
diff --git a/tests/wave2/test-report-normalize-two-tree.sh b/tests/wave2/test-report-normalize-two-tree.sh
index 203581ae..6438c14e 100644
--- a/tests/wave2/test-report-normalize-two-tree.sh
+++ b/tests/wave2/test-report-normalize-two-tree.sh
@@ -93,18 +93,22 @@ else
 fi
 
 # --- 3. per-BRD conformance reports (conformance-check writes report-<date>-<BRD>.tsv) ---------
-# The newest date wins and every BRD file of that date is read; an older single-file report is
-# not mixed in (it used to be the ONLY file read, shown as measured although stale).
+# Golden: fixtures/conformance-per-brd/ — conformance-check.sh's real output on PR #307's own
+# per-BRD fixture layout (see its CAPTURE.txt), including a BRD id with a space. The newest date
+# wins and every file of that date is read; the older single-file report is not mixed in (it
+# used to be the ONLY file read, shown as measured although stale).
+GOLD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fixtures/conformance-per-brd"
 P="$WORK/perbrd"; lay_out "$P" "$P"
 rm -f "$P/docs/conformance/"report-*.tsv
-printf 'module\tclaim\tstored\tobserved\tverdict\nStale\t/old\t1\t1\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
-printf 'module\tclaim\tstored\tobserved\tverdict\nOrders\t/useCases\t3\t3\tOK\n' > "$P/docs/conformance/report-2026-10-12-F001.tsv"
-printf 'module\tclaim\tstored\tobserved\tverdict\nBilling\t/pages\t2\t4\tUNDERSTATED\n' > "$P/docs/conformance/report-2026-10-12-F002.tsv"
+cp "$GOLD"/report-*.tsv "$P/docs/conformance/"
+printf 'module\tpointer\tstored\tobserved\tverdict\nStale\t`/old`\tbuilt\tPRESENT\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
 ( cd "$P/tests/e2e" && node report-normalize.js --out docs/report.json ) >"$WORK/out3" 2>&1
 if [ -s "$P/docs/report.json" ]; then
-  mods="$(node -e 'const r=require(process.argv[1]); console.log(r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance").map(c=>c.module).sort().join(","))' "$P/docs/report.json")"
-  [ "$mods" = "Billing,Orders" ] && ok "per-BRD reports of the newest date are all read (Billing, Orders); the older single file is not" \
-    || bad "per-BRD conformance reports not aggregated" "$mods"
+  got="$(node -e 'const r=require(process.argv[1]); const c=r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance");
+    console.log([c.length, [...new Set(c.map(x=>x.module))].sort().join(","), c.every(x=>x.requirement && x.requirement.startsWith("/")), c.some(x=>/shipping/i.test(x.id))].join("|"))' "$P/docs/report.json")"
+  [ "$got" = "6|Orders,Shipping|true|true" ] \
+    && ok "all 3 per-BRD reports of the newest date read (6 rows, incl. 'F003 shipping'); every row keeps its /pointer requirement; the stale file is not read" \
+    || bad "per-BRD conformance reports not read as captured (rows|modules|requirements set|space BRD read)" "$got"
 else
   bad "per-BRD: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out3" | cut -c1-300)"
 fi