From 4294759eb6976bf7243e23f4201fc72882962811 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:09:36 +0000
Subject: [PATCH 1/7] exec.sh: warn on stale-DESCRIBE and co-owned
 restatements; roll back an mxbuild crash on the written model

- project-bin/script-owners.sh (new): lists the documents each mdlsource/ script creates or
  restates; report/count of co-owned documents; check <script> names every other owner not
  settled by a `-- supersedes:` / `-- superseded-by:` header (#269).
- project-bin/describe-baseline.sh (new): stamp writes `-- baseline: <Doc> sha256=<hash of
  DESCRIBE>` per restated document; verify re-DESCRIBEs and reports drift with a diff (#261).
- exec.sh runs both before the snapshot. Warn by default, the warning lands in the BUILD-LOG
  row; refuse (nothing written) under MXTK_RESTATE_GUARD=refuse or exec approval `ask`.
- exec.sh: mxbuild exits non-zero with no errors file after the write while the baseline was
  measured -> snapshot restore + BUILD-LOG row, so the next exec does not write on top of an
  unloadable model (#309 inbox finding). Unmeasured baseline keeps today's behaviour.
- gate-check.sh prints the co-owned count (information only, only when > 0).
- learned-mdl-preflight.md: STOP 21 covers draft-ahead batches and ownership; STOP 29
  (DESCRIBE omits role and layout-row visibility, #309); Step 0 "edit the owning script or alter".
- install-manifest registers both scripts.

Fixture tests/wave2/test-restatement-guard.sh: 48 ok on this branch, 38 of 50 fail against
master's exec.sh. Golden input: mxcli v0.23.0 DESCRIBE captures already in the repo, the
StyleGallery mdlsource tree, skills/agents-examples. No field run on a project yet.

Refs #309
Refs #261 (field run owed)
Refs #269 (field run and trend owed)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |   2 +
 bin/gate-check.sh                     |  12 ++
 bin/lib/install-manifest.sh           |   5 +-
 project-bin/describe-baseline.sh      | 139 +++++++++++++++
 project-bin/exec.sh                   |  91 +++++++++-
 project-bin/script-owners.sh          | 202 ++++++++++++++++++++++
 skills/learned-mdl-preflight.md       |   5 +-
 tests/wave2/test-restatement-guard.sh | 237 ++++++++++++++++++++++++++
 8 files changed, 687 insertions(+), 6 deletions(-)
 create mode 100755 project-bin/describe-baseline.sh
 create mode 100755 project-bin/script-owners.sh
 create mode 100644 tests/wave2/test-restatement-guard.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..18854c22 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
+- fix(exec): **when mxbuild ran on the baseline and then crashes on the written model (no errors file, non-zero exit), the write is rolled back like a failed gate; the kept-write message now says STOP and names `restore-mpr.sh`; preflight STOP 29: DESCRIBE omits module-role and layout-row visibility, so a page restated from it silently loses them.** Field: a two-hop data source passed check, mxbuild's loader crashed, the write was kept and the next script ran on a model nothing could load; one page had 19 role-locked widgets DESCRIBE did not print, a snippet 56 row-visibility rules (refs [#309](https://github.com/MendixMau/mxcli-project-toolkit/pull/309)). — AlvinnYeo
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index d24a021c..b910cc75 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -2731,6 +2731,18 @@ else
 fi
 printf "Report disposition (findings filed?): %s — %s\n" "$DISP_STATUS" "$DISP_NOTE"
 
+# Script ownership (#269) — INFORMATION, never a verdict and never a block. A document created by
+# more than one mdlsource/ script reverts whenever an older script is replayed; field apps carried
+# 99/579, 130/357 and 38/159. exec.sh warns per write; this prints the project-wide count so a
+# slice close can see whether it is falling. Only when mdlsource/ exists.
+if [ -d "$PROJECT_DIR/mdlsource" ] && [ -f "$TOOLKIT_DIR/project-bin/script-owners.sh" ]; then
+  OWN_CNT="$(bash "$TOOLKIT_DIR/project-bin/script-owners.sh" count "$PROJECT_DIR" 2>/dev/null || true)"
+  case "$OWN_CNT" in
+    0\ *|"") ;;
+    *) printf "Script ownership (warn only): %s of %s document(s) are created by more than one mdlsource/ script — project-bin/script-owners.sh report lists them\n" "${OWN_CNT%% *}" "${OWN_CNT#* }" ;;
+  esac
+fi
+
 # Stage P is checked outside the numeric loop (bash 3.2 arrays need integer indices).
 N_PASS=0; N_PENDING=0; N_WAIVED=0; N_FAIL=0; N_MANUAL=0; NEXT_UP=""; NEXT_UP_STATUS=""; ATTENTION=""
 APPROVED_OVER_FAIL=""
diff --git a/bin/lib/install-manifest.sh b/bin/lib/install-manifest.sh
index b969693d..acb17cb8 100644
--- a/bin/lib/install-manifest.sh
+++ b/bin/lib/install-manifest.sh
@@ -114,7 +114,10 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # may run itself (stops only the pid run --local recorded for THIS project), and `mxcli test` on a
 # scratch copy under the test-port lock. exec.sh names app-restart.sh in its watch advisory, so
 # it has to be installed beside it.
-MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh session-check.sh constants-audit.sh context-pack.sh"
+# script-owners.sh and describe-baseline.sh joined on 2026-10-13 (#269, #261): exec.sh runs both
+# as its siblings before every MDL write (co-owned documents, stale-DESCRIBE restatements), and
+# describe-baseline.sh calls script-owners.sh's parser as ITS sibling, so the three install together.
+MXTK_PROJECT_BIN="app-restart.sh test-scratch.sh script-owners.sh describe-baseline.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py mxunit_bson.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh session-check.sh constants-audit.sh context-pack.sh"
 
 # Files in project-bin/ that are deliberately NOT installed into projects. The reverse check
 # below flags anything named by NEITHER list, so a new file in project-bin/ has to be either
diff --git a/project-bin/describe-baseline.sh b/project-bin/describe-baseline.sh
new file mode 100755
index 00000000..fea7c056
--- /dev/null
+++ b/project-bin/describe-baseline.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# describe-baseline.sh — record, at draft time, what each document a script restates looked like;
+# say, at exec time, whether it still looks that way.
+#
+#   bin/describe-baseline.sh stamp  <script.mdl>   DESCRIBE every document the script restates and
+#                                                 write one header line per document at the top:
+#                                                   -- baseline: Module.Doc sha256=<hex>
+#                                                   -- baseline: Module.Doc absent
+#                                                 Re-stamping replaces the old lines. Run it right
+#                                                 after the DESCRIBE you drafted from.
+#   bin/describe-baseline.sh verify <script.mdl>   re-DESCRIBE each baselined document and compare.
+#                                                 exit 0 all match · 1 drift (one DRIFT row each)
+#                                                 · 2 no baseline header · 3 could not DESCRIBE
+#
+# "Restates" = `create or modify|create or replace microflow|nanoflow|page|snippet` — the
+# statements whose body replaces whatever is live (script-owners.sh docs, one parser). A plain
+# `create` fails on an existing name, so it needs no baseline.
+#
+# WHY (#261, field 2026-10-10, Mendix 11.14.0, mxcli v0.24.0). Script A changed the messages of
+# three microflows. Script B, drafted in the same batch from a DESCRIBE taken BEFORE A ran,
+# restated them whole; executing B put four old messages back. check --references, mxbuild
+# (0 errors) and lint all passed: a whole restatement is valid MDL whatever it replaces. Caught
+# later by a module review and a failing end-to-end journey. The draft-ahead pattern (agents
+# drafting later rows while earlier rows execute) makes this the default outcome, not a fluke.
+#
+# The hash is of the DESCRIBE text (CR stripped). Any change — another script, Studio Pro, a
+# hand fix — moves it. A moved hash is not proof of loss, only that the drafter's picture is
+# stale: re-DESCRIBE, merge, re-stamp. The DESCRIBE text itself is kept beside the snapshots
+# (.claude/loop/describe-baseline/<hash>.mdl) so verify can print the first lines of the diff.
+#
+# What a baseline cannot see: anything DESCRIBE does not print. Module-role visibility and
+# layout-grid row visibility are absent from DESCRIBE (v0.25.0, #309), so a restatement drops
+# them with the hash unchanged — learned-mdl-preflight.md has the STOP row for that.
+#
+# DESCRIBE runs through the project's own ./mxcli: `mxcli -p <app>.mpr -c "DESCRIBE <KIND> <Doc>"`.
+# A document that does not exist exits non-zero ("... not found"), recorded as `absent`.
+# Golden DESCRIBE output: mxcli v0.23.0 captures in tests/wave2/fixtures/context-pack/capture/.
+# Consumer: exec.sh runs `verify` before every MDL write that carries a baseline header
+# (warn-first; MXTK_RESTATE_GUARD=refuse or exec approval `ask` makes drift a refusal).
+# Producer: this script's `stamp`, run by whoever drafts the script (learned-mdl-preflight.md
+# STOP 21). Bash 3.2 / Git Bash; no Python.
+set -u
+
+usage() {
+  sed -n '3,14p' "$0" | sed 's/^# \{0,1\}//' >&2
+  exit 2
+}
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+. "$HERE/_common.sh"
+
+CMD="${1:-}"; SCRIPT="${2:-}"
+case "$CMD" in stamp|verify) ;; *) usage ;; esac
+[ -f "$SCRIPT" ] || usage
+OWNERS="$HERE/script-owners.sh"
+[ -f "$OWNERS" ] || { echo "describe-baseline: $OWNERS is not installed (run sync-project.sh)" >&2; exit 3; }
+
+CACHE="$PROJECT_ROOT/.claude/loop/describe-baseline"
+
+# KIND <tab> Doc for every restated document, first occurrence order, unique.
+restated() {
+  bash "$OWNERS" docs "$SCRIPT" | awk -F'\t' '$4 == "modify" || $4 == "replace" { k = $1 "\t" $2; if (!(k in s)) { s[k] = 1; print k } }'
+}
+
+MXCLI=""
+MPR=""
+need_mxcli() {
+  [ -n "$MXCLI" ] && return 0
+  MXCLI="$(find_project_mxcli)" || { echo "describe-baseline: no ./mxcli in $PROJECT_ROOT — cannot DESCRIBE" >&2; return 1; }
+  MPR="$(find_mpr)" || return 1
+}
+
+# Prints the hash (or "absent") of DESCRIBE <kind> <doc>; keeps the text in the cache.
+# Returns 1 when DESCRIBE failed for a reason other than "not found".
+describe_hash() {  # $1 = KIND, $2 = Doc
+  local out err rc h
+  err="$(mktemp "${TMPDIR:-/tmp}/dbl-err.XXXXXX")"
+  out="$("$MXCLI" -p "$MPR" -c "DESCRIBE $1 $2" 2>"$err")"; rc=$?
+  if [ "$rc" -ne 0 ]; then
+    if grep -qi 'not found' "$err"; then rm -f "$err"; echo absent; return 0; fi
+    sed 's/^/    mxcli: /' "$err" >&2; rm -f "$err"; return 1
+  fi
+  rm -f "$err"
+  h="$(printf '%s\n' "$out" | tr -d '\r' | mxtk_sha256)"
+  mkdir -p "$CACHE" 2>/dev/null && printf '%s\n' "$out" | tr -d '\r' > "$CACHE/$h.mdl" 2>/dev/null
+  echo "sha256=$h"
+}
+
+if [ "$CMD" = stamp ]; then
+  need_mxcli || exit 3
+  DOCS="$(restated)"
+  if [ -z "$DOCS" ]; then echo "describe-baseline: $SCRIPT restates no document — nothing to stamp"; exit 0; fi
+  HDR=""
+  while IFS='	' read -r kind doc; do
+    [ -n "$doc" ] || continue
+    v="$(describe_hash "$kind" "$doc")" || { echo "describe-baseline: DESCRIBE $kind $doc failed — nothing stamped" >&2; exit 3; }
+    HDR="$HDR-- baseline: $doc $v
+"
+    echo "  $doc $v"
+  done <<EOF
+$DOCS
+EOF
+  TMP="$(mktemp "${TMPDIR:-/tmp}/dbl-script.XXXXXX")"
+  { printf '%s' "$HDR"; grep -vE '^[[:space:]]*--[[:space:]]*baseline:' "$SCRIPT"; } > "$TMP"
+  cat "$TMP" > "$SCRIPT"; rm -f "$TMP"
+  echo "describe-baseline: stamped $(printf '%s' "$HDR" | grep -c .) document(s) in $SCRIPT"
+  exit 0
+fi
+
+# ── verify ───────────────────────────────────────────────────────────────────
+LINES="$(sed -nE 's/^[[:space:]]*--[[:space:]]*baseline:[[:space:]]*([A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*)[[:space:]]+(sha256=[0-9a-f]{64}|absent).*$/\1 \2/p' "$SCRIPT")"
+if [ -z "$LINES" ]; then
+  echo "NOBASELINE	$(restated | wc -l | tr -d ' ')"
+  exit 2
+fi
+need_mxcli || exit 3
+KINDS="$(restated)"
+RC=0
+while read -r doc want; do
+  [ -n "$doc" ] || continue
+  kind="$(printf '%s\n' "$KINDS" | awk -F'\t' -v d="$doc" '$2 == d { print $1; exit }')"
+  if [ -z "$kind" ]; then echo "STALEHEADER	$doc	the script no longer restates it — re-stamp"; continue; fi
+  have="$(describe_hash "$kind" "$doc")" || { echo "UNKNOWN	$doc	DESCRIBE failed"; [ "$RC" -eq 0 ] && RC=3; continue; }
+  if [ "$have" = "$want" ]; then echo "SAME	$doc"; continue; fi
+  case "$want/$have" in
+    absent/*) why="created since the script was drafted" ;;
+    */absent) why="deleted since the script was drafted" ;;
+    *)        why="changed since the script was drafted" ;;
+  esac
+  echo "DRIFT	$doc	$why"
+  old="$CACHE/${want#sha256=}.mdl"; new="$CACHE/${have#sha256=}.mdl"
+  if [ -f "$old" ] && [ -f "$new" ] && command -v diff >/dev/null 2>&1; then
+    diff -u "$old" "$new" | sed -n '3,14p' | sed 's/^/    /'
+  fi
+  RC=1
+done <<EOF
+$LINES
+EOF
+exit "$RC"
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index dd25f3c1..5e2be3e5 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -400,7 +400,7 @@ HDR2
   # The gate cell is read from GATE_STATE rather than passed in, so no caller
   # can omit it — a blank cell in this table reads as "fine", which is the exact
   # false-green the gate exists to prevent.
-  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}$_EXEC_APPROVAL_SUFFIX"
+  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${RESTATE_NOTE:+ · ⚠ $RESTATE_NOTE}$_EXEC_APPROVAL_SUFFIX"
   printf '| %s | `%s` | %s | %s | %s |\n' \
     "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$LOG_NAME" \
     "${GATE_STATE:-not-run}" "$1" "$_detail" >> "$BUILD_LOG"
@@ -819,6 +819,68 @@ elif [ "${SKIP_CHECK:-0}" != "1" ] && [ -n "$PMXCLI" ]; then
   echo "  ✓ check clean"
 fi
 
+# ── Restatement guards (warn-first, added 2026-10-13) ────────────────────────
+# A whole restatement (`create or modify|replace microflow|page|...`) is valid MDL whatever it
+# replaces, so check, mxbuild and lint stay green while it reverts someone else's work. Two
+# ways that happened in the field, one guard each:
+#   stale draft (#261)  — a script drafted from a DESCRIBE taken BEFORE an earlier script in the
+#                         batch ran put four old messages back. bin/describe-baseline.sh verify
+#                         compares the script's `-- baseline:` header to a fresh DESCRIBE.
+#   co-owners (#269)    — 99/579, 130/357 and 38/159 documents on three apps were created by more
+#                         than one mdlsource/ script; replaying an older one reverts the newer.
+#                         bin/script-owners.sh check names every other owner with no
+#                         `-- supersedes:` header settling who wins.
+# Both WARN by default and the warning lands in this run's BUILD-LOG row. They REFUSE (nothing
+# written) when MXTK_RESTATE_GUARD=refuse, or when exec approval is `ask` (bin/exec-approval.sh)
+# — set MXTK_RESTATE_GUARD=warn for one run to go ahead there. MXTK_RESTATE_GUARD=off skips both.
+# Neither can see what DESCRIBE does not print (role and layout-row visibility, #309).
+RESTATE_NOTE=""
+RESTATE_MODE="${MXTK_RESTATE_GUARD:-}"
+[ -z "$RESTATE_MODE" ] && { [ "${_ea_mode:-}" = "ask" ] && RESTATE_MODE=refuse || RESTATE_MODE=warn; }
+if [ "$PATCH_MODE" != "1" ] && [ "$RESTATE_MODE" != "off" ] && [ -f "$SCRIPT" ]; then
+  _rs_hit=0
+  _rs_bin="$(dirname "$0")"
+  if [ -f "$_rs_bin/script-owners.sh" ]; then
+    _so_rc=0
+    _so_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$_rs_bin/script-owners.sh" check "$SCRIPT" "$PROJECT_ROOT" 2>/dev/null)" || _so_rc=$?
+    if [ "$_so_rc" -eq 1 ] && [ -n "$_so_out" ]; then
+      _rs_hit=1
+      _so_n="$(printf '%s\n' "$_so_out" | cut -f2 | sort -u | grep -c . || true)"
+      echo "⚠ Restatement: $_so_n document(s) this script restates are also owned by another mdlsource/ script:"
+      printf '%s\n' "$_so_out" | awk -F'\t' '{ printf "    %s — %s\n", $2, $4 }'
+      echo "  → edit the owning script or use alter; if this script is the new owner, add '-- supersedes: <older script>'"
+      echo "    (bash bin/script-owners.sh report lists every co-owned document; learned-mdl-preflight.md STOP 21)"
+      RESTATE_NOTE="co-owned: $(printf '%s\n' "$_so_out" | cut -f2 | sed 's/^[A-Z]* //' | sort -u | head -3 | tr '\n' ' ' | sed 's/ $//')"
+      if [ "$_so_n" -gt 3 ]; then RESTATE_NOTE="$RESTATE_NOTE +$((_so_n - 3))"; fi
+    fi
+  fi
+  if [ -f "$_rs_bin/describe-baseline.sh" ]; then
+    _db_rc=0
+    _db_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$_rs_bin/describe-baseline.sh" verify "$SCRIPT" 2>&1)" || _db_rc=$?
+    case "$_db_rc" in
+      1)
+        _rs_hit=1
+        echo "⚠ Stale draft: document(s) this script restates changed since its '-- baseline:' DESCRIBE was taken:"
+        printf '%s\n' "$_db_out" | grep -v '^SAME' | sed -E 's/^DRIFT	([^	]*)	/    \1 — /; s/^(STALEHEADER|UNKNOWN)	([^	]*)	/    \2 — /'
+        echo "  → DESCRIBE it again, merge the live body into the script, re-stamp: bash bin/describe-baseline.sh stamp $SCRIPT"
+        RESTATE_NOTE="${RESTATE_NOTE:+$RESTATE_NOTE; }stale baseline: $(printf '%s\n' "$_db_out" | awk -F'\t' '$1 == "DRIFT" { print $2 }' | head -3 | tr '\n' ' ' | sed 's/ $//')"
+        ;;
+      2)
+        _db_n="$(printf '%s\n' "$_db_out" | awk -F'\t' '$1 == "NOBASELINE" { print $2 }')"
+        [ "${_db_n:-0}" -gt 0 ] 2>/dev/null && echo "  note: $_db_n restated document(s), no '-- baseline:' header — drafted ahead of earlier scripts? stamp at draft time: bash bin/describe-baseline.sh stamp <script>"
+        ;;
+      3) echo "  note: baseline header present but DESCRIBE could not run — drift not checked" ;;
+    esac
+  fi
+  if [ "$_rs_hit" = 1 ] && [ "$RESTATE_MODE" = "refuse" ]; then
+    echo ""
+    echo "  ✗ REFUSING (MXTK_RESTATE_GUARD=refuse or exec approval 'ask'). NOTHING was written to the model."
+    echo "    To write anyway after reading the above: MXTK_RESTATE_GUARD=warn ./bin/exec.sh $SCRIPT"
+    log_build "🚫 blocked" "restatement guard refused — nothing written"
+    exit 1
+  fi
+fi
+
 # ── Gate must be able to run ─────────────────────────────────────────────────
 # Discovery happens BEFORE the snapshot and the write, because the answer decides whether
 # there is a write at all. Until 2026-09-17 a missing mxbuild produced a warning and the
@@ -1379,9 +1441,30 @@ EOF
     echo "  ✗ mxbuild failed to run (exit $MXBUILD_EXIT) — gate could not verify the model."
     [ -n "$MXB_WHY" ] && echo "    mxbuild says: $MXB_WHY"
     echo "$MXBUILD_OUT" | grep -v "^$\|icon\|Microsoft\|Assembly\|__" | head -20 || true
-    echo "  → Snapshot preserved. Open in SP to verify manually before proceeding."
-    # --patch logs its own row below, after rolling back; one row per run.
-    [ "$PATCH_MODE" = "1" ] || log_build "❌ gate could not run" "mxbuild exit $MXBUILD_EXIT"
+    # mxbuild CRASHED ON THE WRITTEN MODEL (#309 inbox, field 2026-10-13, Mendix 11.14.0, mxcli
+    # v0.25.0): a two-hop data source passed `check`, then mxbuild's loader died ("An error
+    # occurred when trying to set the 'DestinationEntity' property ...") with no errors file.
+    # This branch kept the write, the next exec printed "Baseline NOT measured" and wrote on top
+    # of a model nothing could load, and each later script snapshotted the broken state.
+    # BASE_KNOWN=1 means mxbuild ran on this model a moment ago (measured baseline, or a clean
+    # verification stamp), so the crash is a property of the WRITE, not of the machine: roll it
+    # back like a failed gate. Without a measured baseline it may be the machine (wrong version,
+    # JDK), and the old behaviour stays: kept, flagged, no stamp.
+    if [ "$PATCH_MODE" != "1" ] && [ "${BASE_KNOWN:-0}" = "1" ]; then
+      echo "  ✗ mxbuild ran on this model before the write and crashed after it — rolling the write back."
+      restore_snapshot
+      if [ "$RESTORED" -eq 1 ]; then
+        log_build "❌ gate could not run" "mxbuild exit $MXBUILD_EXIT on the written model (ran on the baseline) — script rolled back${MXB_WHY:+; mxbuild: $MXB_WHY}"
+      else
+        echo "  STOP: the model may not load. Restore it before the next exec: ./bin/restore-mpr.sh <newest .mpr-snapshots/ dir>"
+        log_build "❌ gate could not run" "mxbuild exit $MXBUILD_EXIT on the written model — NOT rolled back (restore did not run)"
+      fi
+    else
+      echo "  → Snapshot preserved. STOP: the model may not load. Before the next exec, restore it"
+      echo "    (./bin/restore-mpr.sh <newest .mpr-snapshots/ dir>) or prove it builds (./bin/verify-model.sh)."
+      # --patch logs its own row below, after rolling back; one row per run.
+      [ "$PATCH_MODE" = "1" ] || log_build "❌ gate could not run" "mxbuild exit $MXBUILD_EXIT"
+    fi
   else
     GATE_STATE="pass"; GATE_ERRORS=0
     echo "  ✓ mxbuild: 0 errors — model is clean."
diff --git a/project-bin/script-owners.sh b/project-bin/script-owners.sh
new file mode 100755
index 00000000..c9cc162d
--- /dev/null
+++ b/project-bin/script-owners.sh
@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# script-owners.sh — which mdlsource/ scripts create or restate each document.
+#
+#   bin/script-owners.sh docs   <script.mdl>   one row per document the script creates or restates:
+#                                              KIND <tab> Module.Name <tab> line <tab> create|modify|replace
+#   bin/script-owners.sh report [project-root] every document owned by more than one script, with
+#                                              its scripts in run order, then a summary line
+#   bin/script-owners.sh count  [project-root] "<multi-owner> <documents>" — gate-check.sh reads it
+#   bin/script-owners.sh check  <script.mdl> [project-root]
+#                                              exit 1 when the script restates a document that
+#                                              another script also owns and no supersedes header
+#                                              settles who wins; exec.sh calls this before a write
+#
+# A document is a microflow, nanoflow, page or snippet named by a `create`, `create or modify`
+# or `create or replace` statement. `alter page` / `alter snippet` is NOT ownership: it edits in
+# place, which is the write this script steers people towards.
+#
+# WHY (#269, field evidence 2026-10-05..09, mxcli v0.25.0). Three toolkit-built apps counted
+# 99 of 579, 130 of 357 and 38 of 159 documents created by more than one script — worst case a
+# published-API microflow restated in 5 scripts. Re-running an older script (a replay, a rebuild
+# from a fresh .mpr, an agent "re-applying slice 2") silently puts back every change the later
+# scripts made: the older body is valid MDL, so check, mxbuild and lint all stay green. Nothing
+# recorded which script owns a document. #261 is the same loss inside one batch (a script
+# drafted from a DESCRIBE taken before an earlier script ran) — describe-baseline.sh covers that.
+#
+# HOW A SCRIPT SAYS WHO WINS. Header comments, anywhere in the file, basenames or paths:
+#   -- supersedes: 05-orders.mdl, 07-orders-fix.mdl    (in the NEW script: it owns these docs now)
+#   -- superseded-by: 12-orders-v2.mdl                 (in the OLD script: do not replay me)
+# `check` on script S, for each document S restates that another script O also restates:
+#   S supersedes O (either header says so)  → fine, S is the owner
+#   O supersedes S                          → CONFLICT: replaying S reverts O's later work
+#   neither header                          → CONFLICT: two unrecorded owners; the row says
+#                                             whether O sorts before S (S is a new restatement
+#                                             that needs a supersedes header) or after it
+#                                             (S is an older script being replayed)
+# Run order is the path order under mdlsource/ (LC_ALL=C sort), which is how numbered scripts
+# are run. A script outside mdlsource/ (a scratch file) owns nothing; every owner is "other".
+#
+# Not a parser: the same comment/string/$$-body blanking and bracket depth as exec.sh's change
+# class lexer, then only statement heads at depth 0 are read, so a caption saying "create page"
+# or a widget line never counts. Unlike that lexer, a string literal may span lines (a real
+# `find($Clean, '<newline>')` in skills/agents-examples/single-call.example.mdl hid the next
+# microflow from a per-line lexer: the open quote left the bracket depth at 1). Golden input is real MDL: mxcli v0.23.0 DESCRIBE captures
+# (tests/wave2/fixtures/context-pack/capture/describe/), the shipped StyleGallery mdlsource tree
+# and skills/agents-examples/*.mdl (tests/wave2/test-script-owners.sh). `*.test.mdl` files are
+# skipped: they are microflow tests, not build steps.
+#
+# Producer for every consumer (CLAUDE.md "Shipping an instrument" rule 5): the input is the
+# project's own mdlsource/, written by every build step; the consumers are exec.sh (check, every
+# MDL write) and gate-check.sh (count, every gate run). Read-only: it never edits a script.
+# Plain bash + awk: bash 3.2, BSD awk, Git Bash.
+set -u
+
+usage() {
+  sed -n '3,12p' "$0" | sed 's/^# \{0,1\}//' >&2
+  exit 2
+}
+
+_SO_AWK='
+    function lex_line(line,    n, i, c, c2, tmp, o, cl) {
+      clean = ""; n = length(line); i = 1
+      while (i <= n) {
+        c = substr(line, i, 1); c2 = substr(line, i, 2)
+        if (instr)     { if (c == "\047") instr = 0; i++; continue }
+        if (inblock)   { if (c2 == "*/") { inblock = 0; i += 2 } else i++; continue }
+        if (indollar)  { if (c2 == "$$") { indollar = 0; i += 2 } else i++; continue }
+        if (c2 == "/*") { inblock = 1; i += 2; continue }
+        if (c2 == "$$") { indollar = 1; i += 2; continue }
+        if (c2 == "--" || c2 == "//") break
+        if (c == "\047") {                        # a literal may span lines: find(\$s, newline)
+          i++; while (i <= n && substr(line, i, 1) != "\047") i++
+          if (i > n) instr = 1
+          i++; clean = clean "\047\047"; continue
+        }
+        if (c == "\"") { i++; continue }
+        clean = clean c; i++
+      }
+      start_depth = depth
+      tmp = clean; o = gsub(/[({]/, "", tmp); tmp = clean; cl = gsub(/[)}]/, "", tmp)
+      depth += o - cl; if (depth < 0) depth = 0
+    }
+    {
+      sub(/\r$/, "")
+      lex_line($0)
+      if (start_depth != 0) next
+      s = clean; sub(/^[ \t]+/, "", s)
+      low = tolower(s)
+      if (low !~ /^create[ \t]/) next
+      rest = substr(s, 7); sub(/^[ \t]+/, "", rest)
+      verb = "create"
+      if (tolower(rest) ~ /^or[ \t]+(modify|replace)[ \t]/) {
+        sub(/^[Oo][Rr][ \t]+/, "", rest)
+        verb = tolower(rest); sub(/[ \t].*$/, "", verb)
+        sub(/^[A-Za-z]+[ \t]+/, "", rest)
+      }
+      kind = tolower(rest); sub(/[ \t(].*$/, "", kind)
+      if (kind != "microflow" && kind != "nanoflow" && kind != "page" && kind != "snippet") next
+      sub(/^[A-Za-z]+[ \t]+/, "", rest)
+      if (!match(rest, /^[A-Za-z_][A-Za-z0-9_]*[ \t]*\.[ \t]*[A-Za-z_][A-Za-z0-9_]*/)) next
+      name = substr(rest, 1, RLENGTH); gsub(/[ \t]/, "", name)
+      printf "%s\t%s\t%d\t%s\n", toupper(kind), name, FNR, verb
+    }'
+
+so_docs() {  # $1 = script
+  awk "$_SO_AWK" "$1"
+}
+
+# Header values: `-- supersedes: a.mdl, b.mdl` → one basename per line.
+so_header() {  # $1 = script, $2 = supersedes|superseded-by
+  sed -nE "s/^[[:space:]]*--[[:space:]]*$2:[[:space:]]*(.*)$/\1/p" "$1" 2>/dev/null \
+    | tr ',' '\n' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//; s/[[:space:]].*$//' \
+    | sed -E 's#.*/##' | grep -v '^$' || true
+}
+
+so_root() {  # $1 = optional project root
+  if [ -n "${1:-}" ]; then (cd "$1" 2>/dev/null && pwd) || echo "$1"
+  elif [ -n "${PROJECT_ROOT:-}" ]; then echo "$PROJECT_ROOT"
+  else pwd
+  fi
+}
+
+so_scripts() {  # $1 = root → every build script under mdlsource/, run order, root-relative
+  [ -d "$1/mdlsource" ] || return 0
+  ( cd "$1" && find mdlsource -type f -name '*.mdl' ! -name '*.test.mdl' 2>/dev/null | LC_ALL=C sort )
+}
+
+so_index() {  # $1 = root → "doc <tab> script" for every owner, run order
+  local f
+  so_scripts "$1" | while IFS= read -r f; do
+    so_docs "$1/$f" | awk -F'\t' -v s="$f" '{ print $1 " " $2 "\t" s }' | LC_ALL=C sort -u
+  done
+}
+
+cmd="${1:-}"
+case "$cmd" in
+  docs)
+    [ -f "${2:-}" ] || usage
+    so_docs "$2"
+    ;;
+  report|count)
+    ROOT="$(so_root "${2:-}")"
+    IDX="$(so_index "$ROOT")"
+    SUMMARY="$(printf '%s\n' "$IDX" | awk -F'\t' 'NF == 2 {
+        if (!($1 in seen)) { seen[$1] = 1; order[++n] = $1 }
+        c[$1]++; s[$1] = s[$1] (c[$1] > 1 ? ", " : "") $2
+      }
+      END {
+        m = 0
+        for (i = 1; i <= n; i++) if (c[order[i]] > 1) { m++; printf "  %s — %d scripts: %s\n", order[i], c[order[i]], s[order[i]] }
+        printf "SUMMARY\t%d\t%d\n", m, n
+      }')"
+    M="$(printf '%s\n' "$SUMMARY" | awk -F'\t' '$1 == "SUMMARY" { print $2 }')"
+    N="$(printf '%s\n' "$SUMMARY" | awk -F'\t' '$1 == "SUMMARY" { print $3 }')"
+    if [ "$cmd" = count ]; then echo "${M:-0} ${N:-0}"; exit 0; fi
+    if [ ! -d "$ROOT/mdlsource" ]; then echo "no mdlsource/ under $ROOT — nothing to report"; exit 0; fi
+    printf '%s\n' "$SUMMARY" | grep -v '^SUMMARY' || true
+    echo "multi-owner: ${M:-0} of ${N:-0} document(s) created by more than one mdlsource/ script"
+    [ "${M:-0}" -gt 0 ] && echo "  → edit the owning script, use alter, or mark the winner: -- supersedes: <older script> (skills/learned-mdl-preflight.md STOP 21)"
+    exit 0
+    ;;
+  check)
+    [ -f "${2:-}" ] || usage
+    S="$2"
+    ROOT="$(so_root "${3:-}")"
+    # The script's own path relative to ROOT, when it lives under it, so it is not its own co-owner.
+    S_ABS="$(cd "$(dirname "$S")" && pwd)/$(basename "$S")"
+    S_REL="${S_ABS#"$ROOT"/}"
+    [ "$S_REL" = "$S_ABS" ] && S_REL=""
+    S_BASE="$(basename "$S")"
+    MY_SUP="$(so_header "$S" supersedes)"
+    MY_SUPBY="$(so_header "$S" superseded-by)"
+    DOCS="$(so_docs "$S" | awk -F'\t' '{ print $1 " " $2 }' | LC_ALL=C sort -u)"
+    [ -n "$DOCS" ] || exit 0
+    IDX="$(so_index "$ROOT")"
+    OUT="$(while IFS= read -r d; do
+      [ -n "$d" ] || continue
+      printf '%s\n' "$IDX" | awk -F'\t' -v d="$d" '$1 == d { print $2 }' | while IFS= read -r o; do
+        [ "$o" = "$S_REL" ] && continue
+        ob="$(basename "$o")"
+        if printf '%s\n' "$MY_SUP" | grep -qxF "$ob" || so_header "$ROOT/$o" superseded-by | grep -qxF "$S_BASE"; then
+          continue
+        fi
+        if printf '%s\n' "$MY_SUPBY" | grep -qxF "$ob" || so_header "$ROOT/$o" supersedes | grep -qxF "$S_BASE"; then
+          echo "CONFLICT	$d	$o	superseded: $o supersedes this script — replaying it reverts $o"
+        elif [ -z "$S_REL" ]; then
+          echo "CONFLICT	$d	$o	owned by $o; this script is outside mdlsource/"
+        elif [ "$(printf '%s\n%s\n' "$o" "$S_REL" | LC_ALL=C sort | head -1)" = "$o" ]; then
+          echo "CONFLICT	$d	$o	older owner $o — a new restatement needs '-- supersedes: $ob'"
+        else
+          echo "CONFLICT	$d	$o	newer owner $o — replaying this script reverts it"
+        fi
+      done
+    done <<EOF
+$DOCS
+EOF
+)"
+    [ -n "$OUT" ] || exit 0
+    printf '%s\n' "$OUT"
+    exit 1
+    ;;
+  *) usage ;;
+esac
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index 69993014..92975d19 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -24,6 +24,8 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 
 **Also decide, per document, where it lands.** Any operation that *creates* a document — page, snippet, microflow, nanoflow — needs its folder chosen now and written into the `folder` property of the same statement, not fixed afterwards. Read the path off the brief's `### Document folder plan`; when there is no row for it, derive it per `module-folder-convention.md` ("Deciding the path"), and escalate rather than guess when the feature group is unclear. Omitting `folder` is legal MDL that silently drops the document at module root — no error, no gate, and a cleanup job later that nobody schedules.
 
+**And decide which script owns each document.** Change a document in the script that created it, or with `alter` — a second full restatement makes every replay of the older script a silent revert (STOP 21).
+
 **Companion skills:** `bug-logs/mxcli-bugs.md` (bug detail), `iterative-build-loop.md` (exec discipline), `learned-microflow-patterns.md` (annotation and association rules)
 
 ---
@@ -53,13 +55,14 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 17 | *(retired 2026-09-30 — uppercase `AND`/`OR` with `!=` builds at 0 errors)* | | |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | v0.24.0: with the callee already in the model, `check` and `exec` refuse a call-microflow with an unmapped parameter, a missing callee, and a `JUMP TO` that is not a real activity name (MDL-WF05). With the callee created **in the same script**, `check --references` skips the call and `exec` auto-fills the `WITH` mapping — a non-context parameter gets `(Name = '$WorkflowContext')` — and `mx check` fails with CE0117 at the call. A context-typed parameter auto-maps fine. `mxcli lint` does not flag it. Earlier incidents: 2026-07-24 ×2, 2026-08-21, 2026-08-31 (`learned-workflow-patterns.md` §7, §13, §14, §21). |
 | 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | This is genuinely invalid Mendix XPath, not an mxcli-specific bug — `CE0161` "Error(s) in XPath constraint" is Mendix correctly rejecting it every time it's checked, which is why it kept resurfacing across three separate incidents on a PLM parts-flow project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) that were originally misdiagnosed as mxcli corrupting the domain model on unrelated grant rewrites. In fact the "unrelated entity broke too" symptom was just two independently-broken rules (both using the same invalid CurrentUser-path form) surfacing together once a full `mx check` ran — not one rule corrupting the other. Once rewritten to the correct bare-CurrentUser/full-LHS-chain form, the earlier "Studio Pro GUI only, module-wide" restriction no longer applies — **confirmed mxcli-safe 2026-07-23** via `test-05-currentuser-xpath-chain.mdl` (rebuilt all 4 role grants on the affected entity through mxcli exec, reproducing the corrected XPath verbatim, `mx check: 0 errors`). Use mxcli directly for this pattern; no GUI fallback needed. |
-| 21 | `DROP` + `CREATE` (or `CREATE OR REPLACE`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". |
+| 21 | `DROP` + `CREATE` (or `create or modify` / `create or replace`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile — **or any restatement drafted while earlier scripts of the same batch have not run yet** | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** Drafting ahead of earlier scripts in a batch: DESCRIBE after they ran, or `alter`. Stamp what you drafted from (`bin/describe-baseline.sh stamp <script>`); `exec.sh` warns when it moved. A new owner of a document says `-- supersedes: <older script>`, else `exec.sh` warns (`bin/script-owners.sh report`). mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". #261 (2026-10-10): a script drafted before an earlier one ran put four old messages back, all gates green. #269: 99/579, 130/357, 38/159 documents had several owning scripts. |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is not run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.24.0: `check` passes; `exec` now fails loudly (`Error: attribute 'Note' already exists on entity Mod.Order`, exit 1) and a later `CREATE MICROFLOW` in the script is **not created** — the earlier statements stay written. `mx check` reports 0 errors on the partial model, so the only signal is the exit code: never ignore it. Field case (2026-08-31, mxcli v0.20.0): script `09b` re-ran after its attributes existed, died on statement 1, and two microflows at the end were never applied; `ACT_Version_Delete` quietly lost a call, found by `DESCRIBE MICROFLOW` on a hunch. Compounded by rule 21 one level up: six scripts held a grant on the same three entities, so whichever ran last decided their security. The fix for both is the same: one owner per document, `create or modify` throughout, and a from-empty replay in CI or at wrap-up. |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (a dashboard-publishing migration, mxcli v0.20.0). A new script declared `create or modify non-persistent entity DashboardPublishing."ViewerContext"` with one attribute, believing the name unused. The entity already existed, owned by an earlier page script, carrying four attributes — `VersionLabel`, `HasContent`, `Html`, `DashboardTitle` — which are the entire datasource of the app's viewing page. `diff --format struct` reported `+ Attribute SharedCount` and **four `- Attribute` lines**, i.e. `create or modify` on an entity does not merge into the attribute set, it **replaces** it. Renaming the new entity took ten seconds; the alternative was a page that renders nothing, on a model that would have passed `mx check` and mxbuild clean, since an entity losing four attributes is a perfectly valid model. **This is the cheapest guard in the file — the whole rule is `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` and `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY` before trusting or dismissing it. |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | Greenfield pilot 2026-09-04, mxcli v0.20.0, Mendix 11.13.0, signal theme: `DesignProperties: ['Form orientation': 'Vertical']` on a DataView → exec ok, CE6083 at the gate, auto-restored. `Class: 'form-vertical'` built clean — and then changed nothing on screen, because in that theme the form layout is decided by the theme's own dataview rules, not the class (ui-loop.md "which side is wrong", row 1). The look caught it; no gate could. |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
+| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → scan the unit first** (`project-bin/mxunit_bson.py`) for `ConditionalVisibilitySettings` with `ModuleRoles`, or on a `LayoutGridRow`/`Column`. None: restate. Otherwise rewrite each rule as container `Visible:` or flow access, or use `alter page` / Studio Pro. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): a page with 19 role-locked widgets, a snippet with 56 row rules — none printed; restated, all gates pass and the rules vanish. The STOP 21 baseline hashes DESCRIBE, so it cannot see this. |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).
 
diff --git a/tests/wave2/test-restatement-guard.sh b/tests/wave2/test-restatement-guard.sh
new file mode 100644
index 00000000..638a3d45
--- /dev/null
+++ b/tests/wave2/test-restatement-guard.sh
@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# test-restatement-guard.sh — exec.sh's restatement guards (#261 stale DESCRIBE, #269 co-owned
+# documents) and its rollback when mxbuild crashes on the written model (#309 inbox).
+#
+# Usage: bash tests/wave2/test-restatement-guard.sh [path-to-exec.sh]
+#        script-owners.sh and describe-baseline.sh are taken from the same directory as exec.sh.
+#
+# Covers
+#   owners:   `docs` over REAL MDL — the mxcli v0.23.0 DESCRIBE captures, the shipped StyleGallery
+#             mdlsource tree, skills/agents-examples — matches a plain grep of statement heads
+#             (34); the StyleGallery tree reports 0 of 20 co-owned. `check`: an unrecorded older
+#             owner, an unrecorded newer owner (a replay), `-- supersedes:` settles it, and a
+#             superseded script replayed is a conflict; `superseded-by:` in the old script works.
+#   baseline: `stamp` writes one header per restated document from a DESCRIBE (the captures,
+#             replayed by a fake mxcli); `verify` is SAME on the same model, DRIFT when the live
+#             microflow's message changed (the #261 shape), DRIFT when an absent doc appeared,
+#             and NOBASELINE (exit 2) without a header.
+#   exec.sh:  warns by default and still writes, with the warning in the BUILD-LOG row;
+#             MXTK_RESTATE_GUARD=refuse and exec approval `ask` refuse with nothing written;
+#             MXTK_RESTATE_GUARD=warn overrides ask; =off is silent.
+#   crash:    mxbuild clean on the baseline, exit 1 with no errors file after the write → the
+#             model on disk equals the snapshot again and the BUILD-LOG row says rolled back.
+#             Without a measured baseline (SKIP_BASELINE) the write is still kept, as before.
+#
+# Against master's exec.sh every exec.sh/crash case fails, and the owners/baseline cases fail
+# because the two scripts do not exist there. NOTHING here touches a real .mpr, mxcli or mxbuild.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SUBJECT="${1:-$TOOLKIT/project-bin/exec.sh}"
+case "$SUBJECT" in /*) ;; *) SUBJECT="$PWD/$SUBJECT" ;; esac
+BIN="$(dirname "$SUBJECT")"
+OWNERS="$BIN/script-owners.sh"
+BASEL="$BIN/describe-baseline.sh"
+CAP="$TOOLKIT/tests/wave2/fixtures/context-pack/capture/describe"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/restate.XXXXXX")" || exit 2
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+has() { case "$2" in *"$3"*) ok "$1" ;; *) bad "$1 — missing '$3' in: $(printf '%s' "$2" | tail -4)" ;; esac; }
+hasnt() { case "$2" in *"$3"*) bad "$1 — unexpected '$3'" ;; *) ok "$1" ;; esac; }
+echo "== subject: $SUBJECT"
+for f in "$OWNERS" "$BASEL"; do [ -f "$f" ] || bad "[setup] $(basename "$f") not found beside exec.sh"; done
+
+# ── owners: parser over real MDL ─────────────────────────────────────────────
+echo "-- owners: docs over real MDL"
+REAL="$(ls "$CAP"/*.out "$TOOLKIT"/examples/stylegallery/mdlsource/gallery/*.mdl "$TOOLKIT"/skills/agents-examples/*.mdl)"
+GREP_N=0; DOCS_N=0
+for f in $REAL; do
+  g="$(grep -ciE '^[[:space:]]*create[[:space:]]+(or[[:space:]]+(modify|replace)[[:space:]]+)?(microflow|nanoflow|page|snippet)[[:space:]]' "$f" || true)"
+  d="$(bash "$OWNERS" docs "$f" 2>/dev/null | grep -c . || true)"
+  GREP_N=$((GREP_N + g)); DOCS_N=$((DOCS_N + d))
+done
+[ "$GREP_N" -eq 34 ] && ok "[setup] 34 statement heads in the golden files" || bad "[setup] golden grep found $GREP_N, expected 34"
+[ "$DOCS_N" -eq "$GREP_N" ] && ok "docs lists every head ($DOCS_N)" || bad "docs listed $DOCS_N, grep $GREP_N"
+OUT="$(bash "$OWNERS" docs "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" 2>&1)"
+has "a DESCRIBE capture parses as a modify of its microflow" "$OUT" "MICROFLOW	Sales.ACT_ApprovalStep_Reject	"
+OUT="$(bash "$OWNERS" count "$TOOLKIT/examples/stylegallery" 2>&1)"
+[ "$OUT" = "0 20" ] && ok "StyleGallery tree: 0 of 20 co-owned" || bad "StyleGallery count '$OUT', expected '0 20'"
+
+# ── owners: check ────────────────────────────────────────────────────────────
+echo "-- owners: check"
+O="$WORK/own"; mkdir -p "$O/mdlsource"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/05-reject.mdl"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Approve.out" "$O/mdlsource/06-approve.mdl"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/09-reject-fix.mdl"
+OUT="$(bash "$OWNERS" report "$O" 2>&1)"
+has "report names the co-owned microflow and both scripts" "$OUT" "MICROFLOW Sales.ACT_ApprovalStep_Reject — 2 scripts: mdlsource/05-reject.mdl, mdlsource/09-reject-fix.mdl"
+has "report summary" "$OUT" "multi-owner: 1 of 2"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && has "new restatement without a header: older owner named" "$OUT" "older owner mdlsource/05-reject.mdl" || bad "check rc $RC on an unrecorded older owner"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/05-reject.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && has "replaying the older script: newer owner named" "$OUT" "newer owner mdlsource/09-reject-fix.mdl" || bad "check rc $RC on a replay"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/06-approve.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "a sole owner passes" || bad "sole owner rc $RC: $OUT"
+{ echo "-- supersedes: 05-reject.mdl"; cat "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; } > "$O/mdlsource/09-reject-fix.mdl"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "-- supersedes: settles it for the new owner" || bad "supersedes ignored (rc $RC): $OUT"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/05-reject.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && has "replaying a superseded script is a conflict" "$OUT" "superseded: mdlsource/09-reject-fix.mdl supersedes this script" || bad "superseded replay rc $RC"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/09-reject-fix.mdl"
+{ echo "-- superseded-by: 09-reject-fix.mdl"; cat "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; } > "$O/mdlsource/05-reject.mdl"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "-- superseded-by: in the old script settles it too" || bad "superseded-by ignored (rc $RC): $OUT"
+
+# ── fixture project for baseline + exec.sh ───────────────────────────────────
+P="$WORK/proj"
+mkdir -p "$P/bin" "$P/mprcontents" "$P/mdlsource" "$P/live"
+printf 'not a real model\n' > "$P/Fixture.mpr"
+printf 'bson\n' > "$P/mprcontents/a.mxunit"
+cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/restore-mpr.sh" "$P/bin/"
+cp "$SUBJECT" "$P/bin/exec.sh"
+for f in "$OWNERS" "$BASEL"; do [ -f "$f" ] && cp "$f" "$P/bin/"; done
+cat > "$P/bin/snapshot-mpr.sh" <<'SNAP'
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/.."
+D=".mpr-snapshots/$(date +%Y%m%d-%H%M%S)-$$"
+mkdir -p "$D"; cp Fixture.mpr "$D/"; cp -r mprcontents "$D/"
+echo "Snapshot saved: $D"
+SNAP
+# Fake mxcli: check passes, exec appends to the model, DESCRIBE replays live/<KIND>__<Name>.out
+# (copies of the v0.23.0 captures) and answers "not found" for anything else, as the real one did.
+cat > "$P/mxcli" <<'MXCLI'
+#!/usr/bin/env bash
+D="$(cd "$(dirname "$0")" && pwd)"
+case "${1:-}" in
+  check) exit 0 ;;
+  exec)  echo "fake mxcli exec"; echo "written by the script" >> "$D/Fixture.mpr"; exit 0 ;;
+esac
+q="${4:-}"; q="${q#DESCRIBE }"; name="${q##* }"; kind="${q% *}"
+f="$D/live/${kind}__${name}.out"
+[ -f "$f" ] && { cat "$f"; exit 0; }
+echo "Error: $(printf '%s' "$kind" | tr 'A-Z' 'a-z') not found: $name" >&2; exit 1
+MXCLI
+cat > "$WORK/mxbuild" <<'MXB'
+#!/usr/bin/env bash
+OUT=""; for a in "$@"; do case "$a" in --write-errors=*) OUT="${a#--write-errors=}" ;; esac; done
+n=$(( $(cat "$MXB_COUNT" 2>/dev/null || echo 0) + 1 )); echo "$n" > "$MXB_COUNT"
+if [ "${MODE_BUILD:-clean}" = crash-after-write ] && grep -q 'written by the script' "$MXB_MPR"; then
+  rm -f "$OUT"; echo "An error occurred when trying to set the 'DestinationEntity' property of a Entity ref step in a Page."; exit 1
+fi
+[ -n "$OUT" ] && printf '{"problems":[]}' > "$OUT"; exit 0
+MXB
+chmod +x "$P/bin/"*.sh "$P/mxcli" "$WORK/mxbuild"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Approve.out" "$P/live/"
+( cd "$P" && git init -q . && printf '.mpr-snapshots/\ndocs/\n.claude/\n' > .gitignore && git add -A \
+  && git -c user.email=t@t -c user.name=t commit -qm fixture ) >/dev/null 2>&1
+LOG="$P/docs/BUILD-LOG.md"
+export MXB_COUNT="$WORK/mxb.count" MXB_MPR="$P/Fixture.mpr"
+commit_model() { ( cd "$P" && git add -A && git -c user.email=t@t -c user.name=t commit -qm m ) >/dev/null 2>&1; }
+
+# ── baseline: stamp / verify ─────────────────────────────────────────────────
+echo "-- baseline: stamp and verify"
+S="$P/mdlsource/10-reject-msg.mdl"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$S"
+cat "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Approve.out" >> "$S"
+sed 's/ACT_ApprovalStep_Approve/ACT_ApprovalStep_Hold/g' "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Approve.out" >> "$S"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$S" 2>&1)"; RC=$?
+[ "$RC" -eq 2 ] && has "no header: NOBASELINE with the restated count" "$OUT" "NOBASELINE	3" || bad "verify without header rc $RC: $OUT"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh stamp "$S" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "stamp rc 0" || bad "stamp rc $RC: $OUT"
+[ "$(grep -c '^-- baseline: ' "$S" 2>/dev/null)" = 3 ] && ok "three header lines" || bad "header lines: $(grep -c '^-- baseline: ' "$S" 2>/dev/null)"
+grep -q '^-- baseline: Sales.ACT_ApprovalStep_Hold absent' "$S" && ok "a document not in the model is stamped absent" || bad "no absent line"
+grep -qE '^-- baseline: Sales.ACT_ApprovalStep_Reject sha256=[0-9a-f]{64}' "$S" && ok "existing document stamped with a sha256" || bad "no sha256 line"
+( cd "$P" && bash bin/describe-baseline.sh stamp "$S" ) >/dev/null 2>&1
+[ "$(grep -c '^-- baseline: ' "$S" 2>/dev/null)" = 3 ] && ok "re-stamp replaces, never duplicates" || bad "re-stamp duplicated headers"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$S" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "unchanged model: verify rc 0" || bad "verify on unchanged model rc $RC: $OUT"
+# The #261 shape: an earlier script changed the live message after this one was drafted.
+sed "s/A comment is required to reject./Please add a comment before rejecting./" "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" > "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Approve.out" "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Hold.out"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$S" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && ok "changed live body: verify rc 1" || bad "verify rc $RC after drift"
+has "DRIFT row names the changed microflow" "$OUT" "DRIFT	Sales.ACT_ApprovalStep_Reject	changed since the script was drafted"
+has "the diff shows the live message the script would revert" "$OUT" "+    validation feedback \$ApprovalStep/Comments message 'Please add a comment before rejecting.'"
+has "absent at draft, present now" "$OUT" "DRIFT	Sales.ACT_ApprovalStep_Hold	created since the script was drafted"
+hasnt "the unchanged microflow is not reported" "$OUT" "DRIFT	Sales.ACT_ApprovalStep_Approve"
+rm -f "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Hold.out"
+
+# ── exec.sh: warn / refuse / ask / off ───────────────────────────────────────
+run() {  # env... ; runs exec.sh on $S; prints output; rc in $WORK/rc
+  ( cd "$P" && SKIP_BASELINE=1 SKIP_DOCTOR=1 SP_RESTART=0 MXTK_NO_INSTALL=1 MXTK_NO_SCORE=1 \
+      MXBUILD_PATH="$WORK/mxbuild" ./bin/exec.sh "${RUN_SCRIPT:-mdlsource/10-reject-msg.mdl}" ) > "$WORK/out" 2>&1
+  echo $? > "$WORK/rc"; cat "$WORK/out"
+}
+reset_model() { ( cd "$P" && git checkout -q -- Fixture.mpr mprcontents ) 2>/dev/null; }
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$P/mdlsource/05-reject.mdl"
+commit_model
+
+echo "-- exec.sh: default warns and writes"
+OUT="$(run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 0 ] && ok "warn mode: exit 0" || bad "warn mode rc $RC: $(tail -3 "$WORK/out")"
+has "co-owner warning" "$OUT" "also owned by another mdlsource/ script"
+has "  names the older owner" "$OUT" "older owner mdlsource/05-reject.mdl"
+has "stale-draft warning" "$OUT" "Stale draft"
+has "  names the drifted microflow" "$OUT" "Sales.ACT_ApprovalStep_Reject — changed since the script was drafted"
+has "the write happened" "$OUT" "fake mxcli exec"
+ROW="$(grep '10-reject-msg.mdl' "$LOG" 2>/dev/null | tail -1)"
+has "BUILD-LOG row carries the stale-baseline warning" "$ROW" "stale baseline: Sales.ACT_ApprovalStep_Reject"
+has "BUILD-LOG row carries the co-owner warning" "$ROW" "co-owned: Sales.ACT_ApprovalStep_Reject"
+reset_model
+
+echo "-- exec.sh: MXTK_RESTATE_GUARD=refuse"
+OUT="$(MXTK_RESTATE_GUARD=refuse run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 1 ] && ok "refuse: exit 1" || bad "refuse rc $RC"
+hasnt "refuse: nothing written" "$OUT" "fake mxcli exec"
+hasnt "refuse: no snapshot taken" "$OUT" "Snapshot saved"
+grep -q 'restatement guard refused' "$LOG" 2>/dev/null && ok "refusal logged" || bad "no refusal row"
+
+echo "-- exec.sh: exec approval ask refuses; MXTK_RESTATE_GUARD=warn overrides"
+OUT="$(MXTK_ROOT="$TOOLKIT" CLAUDE_EXEC_APPROVAL=ask run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 1 ] && hasnt "ask: nothing written" "$OUT" "fake mxcli exec" || bad "ask mode rc $RC (expected refusal)"
+OUT="$(MXTK_ROOT="$TOOLKIT" CLAUDE_EXEC_APPROVAL=ask MXTK_RESTATE_GUARD=warn run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 0 ] && has "ask + warn override: written" "$OUT" "fake mxcli exec" || bad "override rc $RC"
+reset_model
+
+echo "-- exec.sh: off is silent"
+OUT="$(MXTK_RESTATE_GUARD=off run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 0 ] && hasnt "off: no warning" "$OUT" "Stale draft" || bad "off rc $RC"
+reset_model
+
+echo "-- exec.sh: a fresh stamp after the drift is clean"
+( cd "$P" && bash bin/describe-baseline.sh stamp "$S" ) >/dev/null 2>&1
+{ echo "-- supersedes: 05-reject.mdl"; cat "$S"; } > "$S.tmp" && mv "$S.tmp" "$S"
+commit_model
+OUT="$(run)"; RC=$(cat "$WORK/rc")
+[ "$RC" -eq 0 ] && hasnt "re-stamped + supersedes: no warning" "$OUT" "⚠ Restatement" || bad "rc $RC"
+hasnt "  and no stale-draft warning" "$OUT" "Stale draft"
+reset_model
+
+# ── crash: mxbuild ran on the baseline, crashed after the write ──────────────
+echo "-- crash: mxbuild crashes on the written model"
+printf 'CREATE MODULE "Nope";\n' > "$P/mdlsource/20-crash.mdl"; commit_model
+BEFORE="$(cat "$P/Fixture.mpr")"; rm -f "$MXB_COUNT"
+( cd "$P" && SKIP_DOCTOR=1 SP_RESTART=0 MXTK_NO_INSTALL=1 MXTK_NO_SCORE=1 MODE_BUILD=crash-after-write \
+    MXBUILD_PATH="$WORK/mxbuild" ./bin/exec.sh mdlsource/20-crash.mdl ) > "$WORK/out" 2>&1; RC=$?
+OUT="$(cat "$WORK/out")"
+[ "$(cat "$MXB_COUNT" 2>/dev/null)" -ge 2 ] && ok "[setup] baseline measured, then the gate ran" || bad "[setup] mxbuild ran $(cat "$MXB_COUNT" 2>/dev/null) time(s)"
+[ "$RC" -eq 1 ] && ok "crash: exit 1" || bad "crash rc $RC"
+[ "$(cat "$P/Fixture.mpr")" = "$BEFORE" ] && ok "crash: model on disk equals the snapshot" || bad "crash: the write was KEPT on a model mxbuild cannot load"
+ROW="$(grep '20-crash.mdl' "$LOG" 2>/dev/null | tail -1)"
+has "crash: BUILD-LOG row says rolled back" "$ROW" "script rolled back"
+reset_model
+
+echo "-- crash without a measured baseline keeps the write (machine may be the cause)"
+( cd "$P" && SKIP_BASELINE=1 SKIP_DOCTOR=1 SP_RESTART=0 MXTK_NO_INSTALL=1 MXTK_NO_SCORE=1 MODE_BUILD=crash-after-write \
+    MXBUILD_PATH="$WORK/mxbuild" ./bin/exec.sh mdlsource/20-crash.mdl ) > "$WORK/out" 2>&1; RC=$?
+[ "$RC" -eq 1 ] && ok "[guard] exit 1" || bad "[guard] rc $RC"
+grep -q 'written by the script' "$P/Fixture.mpr" && ok "[guard] unmeasured baseline: write kept, as before" || bad "unmeasured baseline rolled back"
+has "  and the message says STOP, not 'Open in SP'" "$(cat "$WORK/out")" "STOP: the model may not load"
+reset_model
+
+echo ""
+echo "== $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

From dc951263f2e25006e26d01bfd2958f227cdfa5ed Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:17:59 +0000
Subject: [PATCH 2/7] chore(context): free baseline word budget without
 dropping rules

The always-on baseline tier counted by bin/render-routing.sh --check was
at 79,735 of its 80,000-word cap. This frees 3,772 words (now 75,964)
by moving narrative and setup-only text out of baseline files, keeping
every rule, STOP, denominator and gate cell in place, each rule still
paired with a one-line failure example plus a pointer to the full text.

- conversion-runbook.md, source-triage.md, interview-protocol.md: long
  incident narratives -> one line + pointer; originals verbatim in new
  on-demand process/baseline-incident-history.md (R1-R20, AR1, ST1-ST4,
  IP1-IP3). Runbook's duplicate open-questions status table now defers
  to interview-protocol.md section 4.
- agent-roles.md: the six template shapes (setup-only) moved to
  agents/README.md, which installers never copy (explicit MXTK_AGENTS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                         |   1 +
 agents/README.md                     | 258 +++++++++++++++++++++++++
 process/baseline-incident-history.md | 270 +++++++++++++++++++++++++++
 skills/agent-roles.md                | 262 ++------------------------
 skills/conversion-runbook.md         | 122 ++++--------
 skills/interview-protocol.md         |  34 ++--
 skills/source-triage.md              |  57 ++----
 7 files changed, 607 insertions(+), 397 deletions(-)
 create mode 100644 agents/README.md
 create mode 100644 process/baseline-incident-history.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..982e7f1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/agents/README.md b/agents/README.md
new file mode 100644
index 00000000..e5b9b46c
--- /dev/null
+++ b/agents/README.md
@@ -0,0 +1,258 @@
+# Agent template shapes — illustrative bodies for the six dev-process agents
+
+**Not an agent.** This file is documentation that sits next to the six stubs; the installers copy
+the named list in `bin/lib/install-manifest.sh` (`MXTK_AGENTS`), never a glob over this folder, so
+it is never installed into a project's `.claude/agents/`.
+
+**Read it at setup only** — when completing a stub per `skills/agent-roles.md` → "How to generate
+these for a new project". The shipped stubs (`agents/<name>-agent.md`) are what `bin/init-agents.sh`
+copies and what `bin/sync-project.sh` refreshes; where a stub and a shape below disagree, the stub
+wins. The shapes are kept because they state the role's rules compactly (for example ba-agent's
+extraction vs translation mode, and which half of a module brief each role writes).
+
+Moved out of `skills/agent-roles.md` (2026-10-13; verbatim except the `model:` lines, which now name the tier and defer to the stub that pins it) so the always-on baseline does not carry
+setup-time text every session (CLAUDE.md skill-authoring rule 6).
+
+## Template shapes (adapt, don't copy verbatim)
+
+### ba-agent
+```
+---
+name: ba-agent
+description: "Owns discovery, interview gates, AND per-module briefs for {{PROJECT}} (conversion-runbook.md Stages P, 0-2, 4, 7). Two modes: EXTRACTION (P-2, no spec yet -> produce BRDs) and TRANSLATION (Stage 4 -> turn validation-clean BRDs into module briefs). Use for intake, triage, requirements, any proposal-with-evidence interview, and authoring module briefs."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You run discovery, the interview gates, and module-brief authoring for {{PROJECT}}. You never touch the `.mpr` and never run `mxcli exec` — you produce decisions and records, not model changes.
+
+**Paths:** resolve all project paths (KB, BRDs, wireframes, briefs, architecture, stage HTML) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
+
+## Your two modes
+- **Extraction (Stages P–2):** no spec exists yet. Produce BRDs from source/SME via the interview protocol.
+- **Translation (Stage 4, per module):** BRDs exist. Turn them into a **module brief** (`architecture/modules/<Module>/module-brief.md`, per `module-brief.md`) — the `mdl-agent`'s single entry point. **Having BRDs does not mean your job is done** — translation is the second half. If briefs don't exist, this mode was skipped.
+
+## Ground rules
+- Follow `query-the-model.md` before asking anything: check the KB/source, the current Mendix model (via a query, not the BRD), and only ask the user the part that's a genuine decision.
+- Run the full interview protocol from `conversion-runbook.md` §1 at every gate: homework first, 2-4 options with evidence, assumptions stated out loud, user answers in the terminal, decision written to the stage HTML *and* `PROJECT.md`, unknowns default + `ASSUMED` + proceed.
+- Never invent legacy intent from code alone — that's what Path C (the SME interview) is for. Log it as an open question if no SME is available, don't guess.
+- `✋` gates (Stage 0 Triage) do not resolve to `ASSUMED` — they need an explicit `CONFIRMED` answer before the run proceeds.
+- **Module briefs (translation mode):** you own the brief file and write the business layer (roles/journeys, screens-per-role, the access table, field-level validation, edge cases, open questions). Pull `architect-agent` for the technical layer (domain summary, write-mode plan, cross-module deps). Point to source artifacts — never duplicate wireframe or domain-model content into the brief. Produce briefs just-in-time (module N after N−1 gates), not all upfront.
+
+## Workflow (extraction / gate mode)
+1. Identify which stage's gate you're running (from `conversion-runbook.md` §2).
+2. Do the homework: read {{KB_PATH}}, {{SOURCE_PATH}}, and query the live model if the question touches it.
+3. Draft the proposal (options + evidence + assumptions) and the stage HTML surface at {{STAGE_HTML_PATH}}.
+4. Ask the user; record the answer in {{STAGE_HTML_PATH}} and `PROJECT.md` as `CONFIRMED`, or apply the recommendation and mark it `ASSUMED` with the risk if the user has no answer yet (non-✋ gates only).
+5. Update `PROJECT.md`'s open-questions register.
+
+## Workflow (translation mode — authoring a module brief)
+1. Read `module-brief.md` for the format and ownership rules.
+2. Read the module's BRDs, wireframes, and the build-plan access-table slice. Query the live model for exact names.
+3. Write the business layer of `architecture/modules/<Module>/module-brief.md`; request the technical layer from `architect-agent`.
+4. Run the brief's ready-check. Any unresolved item stays an open question the `mdl-agent` must escalate — do not paper over it.
+
+## Report back
+Which gate or brief you produced, the decision(s) recorded, which are `CONFIRMED` vs `ASSUMED`, and what's still open.
+```
+
+### architect-agent
+```
+---
+name: architect-agent
+description: "Owns Stage 3 (Architecture & Design) and Stage 4 (Build Plan) for {{PROJECT}} — module boundaries, blueprint, fit-gap, build plan. Use once BRDs are validation-clean. Never touches mxcli."
+model: <strong tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You own architecture and build-plan decisions for {{PROJECT}}. Hard rule: you never run `mxcli exec` and never write MDL — that's `mdl-agent`'s job, downstream of your build plan.
+
+**Paths:** resolve all project paths (BRDs, architecture, design, briefs, build plan) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
+
+## Ground rules
+- Follow `modularize-domain.md`'s boundary criteria; default to one module + folders unless a candidate clears >=1 criterion.
+- Run the Stage 3/4 interview gates from `conversion-runbook.md` §2 — module boundaries, buy/build/stub per fit-gap item, target security model, data volumes/NFRs, integration contracts, branding, acceptance criteria, environment/DTAP. These are `✋` gates: no `ASSUMED` past them, only `CONFIRMED`.
+- Query the live model (`query-the-model.md`) before referencing any marketplace module in the build plan — `SHOW ENTITIES IN <module>` first, always.
+- **Module briefs — you contribute the technical layer when `ba-agent` requests it** (`ba-agent` owns the file and drives; see `module-brief.md`). Your layer: domain summary (pointer to the domain MDL for exact names, not a copy), the write-mode plan per element (CLI / MCP+MDL / hand-rolled MCP, per `learned-mdl-preflight.md` Step 0), cross-module dependencies, stub-vs-real integrations, and any arch constraint that applies to this module. Point to source artifacts; never duplicate them into the brief.
+
+## Workflow
+1. Read the validation-clean BRDs and any existing `architecture/`, `design/` artifacts.
+2. Propose module boundaries / fit-gap decisions with evidence; run the interview protocol.
+3. Write `.mx-brd.json`, `architecture/` (blueprint, wiring diagrams, fit-gap.md), and once approved, `architecture/build-plan.md` — numbered, dependency-ordered.
+4. Record every decision in `PROJECT.md`.
+
+## Report back
+Boundaries/decisions proposed vs. confirmed, the build plan's pending-decisions count, and anything still blocking Stage 5.
+```
+
+### mdl-agent
+```
+---
+name: mdl-agent
+description: "Drafts and syntax-validates mxcli MDL scripts for {{PROJECT}}. Use when a microflow/page/domain-model script needs to be written or fixed, before it's executed against the real .mpr."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You write MDL scripts for {{PROJECT}}. You draft and validate — you never execute against the real `.mpr`.
+
+## Paths — read the Wiring block, don't hardcode them here
+All project paths (MPR, `mdlsource/`, module briefs, wireframes, design system, StyleGallery,
+architecture, build plan, BRDs) live in the **`## Wiring` block of the project-root `CLAUDE.local.md`** —
+the single source of truth. Read it at the start of every task and resolve paths from it. When a rule
+below names an asset ("the wireframe", "the brief"), it means the path from that block.
+
+## Ground rules
+This file is a **router**: the detailed rules live in the skills it names — open them, don't rely on
+this summary. The hard STOPs below are inline on purpose; never route around them.
+
+- **Read the module brief first — your single entry point.** Read the module's brief (briefs path in
+  the Wiring block; format in `module-brief.md`): roles/access, screens, validation, write-mode plan,
+  pointers. **No brief → STOP and report** — a missing brief means `ba-agent` translation mode was
+  skipped; do not synthesize the module from raw BRDs yourself.
+- **An unchecked open question in the brief is a stop sign.** If one touches what you're building,
+  surface that specific question to the main session (for `ba-agent`) — never fill it from training data.
+- Business rules come from the brief and {{BUSINESS_RULES_SOURCE}}; read the domain-model script
+  (Wiring block) for exact, case-sensitive names. Don't guess names or rules.
+- **Write mode, per operation, up front:** run `learned-mdl-preflight.md` Step 0 — the default is the
+  CLI through `bin/exec.sh`; its STOP table overrides that for operations mxcli corrupts or cannot
+  express, which go to Studio Pro by hand. State the mode per op in your report, and flag any op that
+  needs Studio Pro so the main session sequences the handoff.
+- Annotate selectively (`learned-microflow-patterns.md`); always annotate a CE-error fix.
+- **Pages/snippets — run the full pre-flight in `ui-preflight-pages.md`** (wireframe → tokens →
+  gallery reuse → cross-check) and include its UI cross-reference block in your report. **No wireframe
+  → STOP** — do not guess layout or bindings. Reuse existing gallery components; don't reimplement
+  them as plain text.
+- **Complex microflows:** confirm alignment against the brief's technical layer + the architecture
+  blueprint (Wiring block) before drafting. Report any mismatch.
+- **Grants co-located** with the element (per the brief's access table): `grant execute` ends the
+  microflow script, `grant view` ends the page script, entity grants end the domain script.
+
+### Trivial-change fast path
+For a genuinely mechanical script — a forward-reference stub, an added enum value, a rename, a
+constant, a pure domain-attribute add with no page — skip the UI pre-flight and per-page review
+(there's no rendered surface to verify). Still required: read the brief for names, the
+`learned-mdl-preflight.md` STOP check, `mxcli check`, and the mxbuild gate. Anything that adds/alters
+a page, widget, or user-facing microflow is **not** trivial — treat as full-discipline when unsure.
+
+## Workflow
+1. **Read the `## Wiring` block** in the project-root `CLAUDE.local.md` — resolve all paths from it.
+2. **Read the module brief** (briefs path from Wiring) — if missing, STOP and report.
+3. Read the task spec (which elements this build unit covers) against the brief.
+4. Read the necessary skill file(s) and existing MDL for exact names (the brief points to them).
+5. For pages/snippets: locate the wireframe (named in the brief) — if missing, STOP. Then complete `ui-preflight-pages.md` in full.
+6. For complex microflows: confirm alignment against the brief + architecture blueprint.
+7. Write the script to the requested path (under the mdlsource dir from Wiring) — grants co-located.
+8. Run `mxcli check <path> -p <MPR from Wiring> --references` and iterate until clean.
+8a. **Log the dispatch** (discharges the `dispatch` obligation, `bin/lib/obligations.tsv`): under the
+    project root, `mkdir -p .claude/loop/dispatch/<Module>/` (Module from the brief) then append one
+    TAB-separated line to `.claude/loop/dispatch/<Module>/scripts.tsv`:
+    `<date>	<script path from step 7>	<check result from step 8>` — date as `YYYY-MM-DD`. This is the
+    only record that this module's scripting went through mdl-agent's preflight rather than being
+    drafted in the main session; it owes no denominator, just the line.
+9. Do NOT run `mxcli exec` — that stays in the main session under the user's confirmation.
+
+## Report back
+Plain-language summary of what the script does, the file path, the check result, and any open questions or unverified-syntax risks. For page scripts, include the full UI cross-reference block.
+```
+
+### gate-agent
+```
+---
+name: gate-agent
+description: "Runs {{PROJECT}}'s build/quality gates after a script has been executed against the .mpr, and reports pass/fail with a digested error list. Use after any mxcli exec, not before."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You verify {{PROJECT}} after changes have already been applied to the `.mpr`. Read-only / verification-only — never write files, never run `mxcli exec`.
+
+## Gates to run (in order)
+1. **Model check**: {{MODEL_CHECK_COMMAND}}. Expect 0 CE errors.
+2. **Compile gate** (if applicable): {{COMPILE_GATE_COMMAND}}.
+3. **Lint, always**: read the lint cell `bin/exec.sh` wrote into the BUILD-LOG row (it runs
+   `bin/lint-gate.sh` after every clean mxbuild); a `LINT ROSE` cell fails the script. Re-run
+   {{LINT_COMMAND}} only for the per-document list. Never re-baseline to make a row green.
+
+## Known gotchas
+{{PROJECT_SPECIFIC_GOTCHAS — e.g. stale .mpr.lock files, access-grant drops after CREATE OR REPLACE, stale proxy folders after a module rename}}
+
+## Report back
+Pass/fail per gate, the exact error list if any, and whether failures match a known-gotcha pattern. Terse — a status report, not a narrative.
+```
+
+### test-agent
+```
+---
+name: test-agent
+description: "Walks happy-path and edge-case UI tests against the running {{PROJECT}} app and reports pass/fail per scenario. Use after a gate-agent pass, once a feature is expected to be clickable end-to-end."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You test {{PROJECT}}'s running UI. Verification-only — never edit MDL, never touch the `.mpr`, never run `mxcli exec`.
+
+## Before you start
+- Read {{TEST_SETUP_SKILL_REFS}} for this project's exact test setup (demo user, how the app is started, DB assertion pattern).
+- Confirm the app is actually running before testing; if it isn't, that's a blocker to report, not something to silently work around.
+
+## Workflow
+1. Take the scenario list you were given.
+2. Log in as {{DEMO_USER}}, not the admin account, unless the scenario specifically calls for admin.
+3. Walk each scenario step, capturing what happened.
+4. Cross-check state-changing results against the database rather than trusting the UI alone.
+
+## Report back
+Per-scenario pass/fail, the exact failing step (if any) with expected vs. observed, and any UI/data mismatches. Don't narrate every click.
+```
+
+### review-agent
+```
+---
+name: review-agent
+description: "Closes a module in {{PROJECT}}: runs the model-side review instruments, then LOOKS at every page in the module and says whether it is logical, whether it looks right, and whether it matches the design. Use when a module's build and gate stages are done. Diagnostic only — never fixes anything."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You run `skills/module-review.md` for {{PROJECT}}. Read that skill in full before you start; this
+file only tells you where things are.
+
+## What you own
+Stage 3's model-side instruments, and **stage 4 — the LOOK**. Stage 4 is the reason you exist.
+Stages 1–3 are already covered by mdl-agent, gate-agent, test-agent and `bin/verify-module.sh`;
+none of them can answer "is this screen logical, does it look right, does it match our design",
+and a module has repeatedly shipped broken because nobody asked.
+
+## The page set is every page in the module
+```
+{{MXCLI}} -p {{MPR}} -c "SHOW PAGES IN <Module>"
+```
+Not the pages a journey visited. A page no test touches is the highest-risk page in the module.
+Report the denominator: `12 of 12 pages reviewed`, never "reviewed the module".
+
+## Order
+1. `bin/verify-module.sh <Module>` results — read them, do not re-run them.
+2. `node tests/e2e/design-audit.js` — the mechanical sweep (classes, a11y, overflow). Where it
+   and your eye overlap, it wins.
+3. **Then look**, page by page, per module-review.md §4c/§4d/§4e. Navigate via the nav menu or a
+   button, never a direct URL.
+4. Write the report to `design/ui-reviews/ui-review-<YYYY-MM-DD>.html` and append every P1/P2 to
+   `docs/improvement-register.md`.
+
+## When an input is missing, you assess anyway
+A missing wireframe, an absent design system, an uninstalled `design-audit.js`, a module with no
+brief — none of these is permission to skip a page. Follow module-review.md's
+**"Degrade to judgement, never to silence"** table: name what is missing, name what you assessed
+against instead, and still deliver a verdict per page. Reduced fidelity is reported as reduced
+fidelity. It is never reported as a pass, and never reported as nothing.
+
+## You never fix
+No MDL, no `mxcli exec`, no edits to the model or the theme. You have no Write or Edit tool. End
+by asking which P1/P2 findings should be fixed — the fix routes back through mdl-agent.
+
+## Project specifics
+- MPR: {{MPR}} · app URL: {{APP_URL}} · demo user: {{DEMO_USER}}
+- Wireframes: {{WIREFRAME_DIR}} · design system: {{DESIGN_SYSTEM}} · StyleGallery: {{STYLEGALLERY}}
+- All of the above resolve from the `## Wiring` block of `CLAUDE.local.md` — read it at task start.
+```
diff --git a/process/baseline-incident-history.md b/process/baseline-incident-history.md
new file mode 100644
index 00000000..9a3fe133
--- /dev/null
+++ b/process/baseline-incident-history.md
@@ -0,0 +1,270 @@
+# Baseline incident history — the full stories behind the always-on rules
+
+**Read on demand, never at session start.** The always-on (baseline) skills state each rule
+with a one-line failure example and a pointer here. This file holds the long form: the
+incident narratives, measurements and design history that used to sit inline in those skills,
+moved verbatim so the evidence survives while the baseline stays inside the
+`bin/render-routing.sh --check` word budget (CLAUDE.md skill-authoring rule 6, "write for the
+trigger, then stop").
+
+Each section id (`R1`, `AR2`, …) is what the pointer in the skill cites. The section text is
+the original wording, unedited — when a rule's justification is challenged, cite from here.
+Nothing in this file is a rule on its own; the rule lives in the skill that points here.
+
+## R1 — Entry-mode misrouting incidents
+
+_From `skills/conversion-runbook.md`._
+
+(Real misrouting incident, 2026-07-14: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate," proposing to skip 0–4 — exactly what rules 2–3 exist to prevent. Second incident, 2026-09-22: `intake.md` Q1 offered only three modes, so a session changing a live app could not pick the fourth even though `gate-check.sh` already recognised it — rule 1 and the table row below are the fix.)
+
+## R2 — Why Stage 0 runs in every entry mode (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+This distinction was implicit until 2026-08-20, when a customer round made the cost of leaving it
+implicit measurable. A project whose source was markdown files plus database tables was classified
+requirements-driven — reasonably, given the rules above. The mode's row then said "skip 0", so
+Stage 0 was skipped **whole**: no source characterisation, no `analysis/` folder, no triage
+artifact, and — the expensive one — **no scope conversation**, because CAC-1 fires after Stage 0
+and Stage 0 never ran. Extraction was then run anyway and pulled in far more than the subsystems
+under discussion, which nothing downstream was positioned to notice: Stage 2's gate checks that
+BRDs are *validation-clean*, and a hundred clean BRDs describing things nobody asked for pass it.
+
+## R3 — Why the docs-ready path exists (2026-09-09)
+
+_From `skills/conversion-runbook.md`._
+
+**Why this path exists (2026-09-09).** A project of exactly this shape was slow and token-hungry
+through Stages 1–4, for measured reasons: every session read the raw HTML (3–10× the tokens of
+its text), and the ledger asked for one disposition per file — every sidecar `.png`, `.css` and
+`.js` included — for a corpus nothing extracts. Nothing below skips a gate; it names the shortest
+honest route through them, and every command here was run against the gates before it was written.
+
+## R4 — The accumulated open-questions stream that rotted (2026-08-12)
+
+_From `skills/conversion-runbook.md`._
+
+**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks. But the pipeline generates a second stream all the time: every `openQuestions` entry a BRD records, every row added to `analysis/sme-questions.md`. Those were never wired to anything, and they rotted. Measured on one real project (2026-08-12): 46 rows in `sme-questions.md` against 7 mentions of an answer, ~35 unresolved BRD `openQuestions`, one status reading *"Open — routed to sme-questions.md F1/F2"* — routed to a file nobody opens. Several were not merely unasked but already **decided**: *"ASSUMED drafting position (a), hardcode — taken to keep this BRD buildable… NOT a settled product decision"* is a real product choice (hardcode vs. build a configurable rules engine) taken unilaterally and never shown to anyone. And 23 distinct free-text status strings meant nothing could count them, which is why nothing ever surfaced them.
+
+## R5 — Attended run with no questions (2026-07-14)
+
+_From `skills/conversion-runbook.md`._
+
+(Real incident, 2026-07-14: an attended run produced architecture diagrams and a design system through Stage 3 without a single question reaching the user — "a solo run never stalls" was read as "never ask." It means "an *authorized* solo run doesn't deadlock," nothing more.)
+
+## R8 — Settled change routed through three subagents (2026-07-23)
+
+_From `skills/conversion-runbook.md`._
+
+(Real incident, 2026-07-23: a "flip 2 entities to persistent + add 2 new entities" change — already fully settled in conversation — was routed through ba-agent twice and architect-agent once, ~270k combined tokens, for what was fundamentally a handful of document edits. The user called it out directly. The fix isn't skipping the record, it's skipping the dispatch when there's nothing left to decide.)
+
+## R9 — Gate script never run through a full Stage 5 (2026-09-19)
+
+_From `skills/conversion-runbook.md`._
+
+**Why (measured, 2026-09-19, two field builds of the same app).** A full Stage-5 build closed with all seven screens built, a green mxbuild
+   gate, and 11 of 37 acceptance rows confirmed. `gate-check.sh` had run exactly once, at
+   scaffold time. The `look` obligation, the wiring sweep, journeys and coherence were all
+   `PENDING` and nobody saw it, because nothing asked. When the gate was finally run as a
+   deliberate second pass, the seven screens scored 0, 18, 40, 40, 58, 58 and 69 percent against
+   their own wireframes on an element checklist — one screen matched none of its wireframe's
+   elements at all. Every one of those defects was visible to a gate that never ran.
+
+## R10 — Why dispatch is written down (2026-09-14)
+
+_From `skills/conversion-runbook.md`._
+
+**Why this is written down (2026-09-14).** The six agent stubs have carried model tiers since
+they were generated (`architect-agent` on the strong tier, the other five on the mid tier), and
+§2's Owner rows name who is accountable for each stage. Nothing said *when* the main session
+hands work over — so in the token-path A/B (nine runs, Stages P–4) the main session did nearly
+everything itself, at its own model's price, and only two skills (`brd-generation.md`,
+`image-transcription.md`) ever asked for a fan-out. Owner is accountability; this table is the
+runtime rule.
+
+## R12 — Checkpoints named nowhere in the runbook (until 2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+**Every stage transition has a packaged checkpoint. Here is where they attach.** The `skills/checkpoints/`
+CAC files run the §1 interview protocol at the busiest transitions; they write to `PROJECT.md`,
+never to a separate state file. Until 2026-08-20 this runbook — the file every session is required
+to read — **named none of them**, and they were reachable only from `skills/migration-pipeline.md`.
+A requirements-driven session never loads that skill, so it never fired a single checkpoint, and
+CAC-1's scope brainstorm silently did not exist outside migration mode. Checkpoints are wired to
+*stages* here, not to pipeline phases, precisely so that a project running no pipeline still gets
+them.
+
+## R16 — Grade before inventory: a rubric question instead of a scope conversation (2026-08-19)
+
+_From `skills/conversion-runbook.md`._
+
+Doing this out of order is a real, reported failure (2026-08-19): a Stage 0 run on a four-file
+documents-only corpus produced a correct ten-dimension grade and then asked the user a closed,
+rubric-shaped gate question — because the grade was the only artifact in front of it. The
+instruction to present a source map already existed here; nothing produced the map, so the agent
+asked what the tooling gave it something to ask about.
+
+## R17 — Documents plus a database misrouted as prose (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+(The paragraph below followed "Does not apply stops at the extraction rows" and restated the rule of the preceding "Decide that on evidence" paragraph; it was merged into that paragraph.)
+
+**A source that is documents plus a database is not a documents-only source.** A schema, a table
+dump, or an ORM model file is extractable structure and grades as such — the presence of markdown
+alongside it does not downgrade it. This is the shape that misroutes most often in presales
+(2026-08-20): the corpus *reads* like requirements, so it gets treated as prose, and the entities
+that were sitting right there in the schema get re-derived by hand later.
+
+## R18 — Why CAC-1b exists: extraction over-reach (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+**Closes with CAC-1b** (`skills/checkpoints/checkpoint-extraction.md`) — the scope-out
+confirmation. It is a checkpoint you run, not a gate that stops you, and the reason is worth
+keeping in front of you.
+
+Stage 0 confirms scope *in*: what we intend to cover. It cannot confirm scope *out*, because
+nobody knows what extraction will actually produce until it has produced it. On the customer round
+that prompted this, extraction ran across the whole corpus rather than the subsystems under
+discussion, and the over-reach was invisible until modules were being built — every downstream
+gate measured *quality*, and the output was perfectly good BRDs about the wrong things. A
+validation-clean BRD for a subsystem nobody asked for is a clean pass at every remaining gate in
+this runbook.
+
+So before any BRD is written: put the extraction result next to the Stage 0 scope decision, name
+the delta, and get a decision on it. Do it before the BRDs rather than after — writing them first
+makes narrowing feel expensive, which is exactly when people stop narrowing.
+
+**Nothing enforces this and nothing should.** A script can only check that a `CONFIRMED` row
+exists in `PROJECT.md`, and an agent can type that row without asking anyone — so the check
+cannot tell the conversation from the string, which is the only thing worth telling apart. (A
+blocking version of this gate existed for part of 2026-08-20 and was removed the same day; see
+`skills/skills-over-scripts.md`.) If the checkpoint gets skipped, run it late against the BRD set
+you already have — with the extraction report in hand you can see what actually came out, which
+is better input than the triage map ever was.
+
+## R19 — Stage 1 surface history (until 2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+Until 2026-08-20 this was `node generate-report.js` inside each pipeline, so requirements-driven and greenfield projects could not produce the file their own Stage 1 gate requires, despite this row promising it.
+
+## R20 — Stage 2 surface history (until 2026-08-19)
+
+_From `skills/conversion-runbook.md`._
+
+Until 2026-08-19 this was `enrichment-summary.html`, built three times inside three pipelines against three different BRD key shapes — each copy rendered blanks for the other two’s output, and non-migration projects got no surface at all despite this row promising one.
+
+## AR1 — "Five" agents, and the review that never looked (2026-08-20)
+
+_From `skills/agent-roles.md`._
+
+> **This file said "five" until 2026-08-20, and that cost the review.** `review-agent` — the owner
+> of `module-review.md` stage 4, the LOOK — has been scaffolded by `bin/lib/install-manifest.sh`
+> and routed to its skills for some time, but this file never listed it. So every session that set
+> agents up "per `agent-roles.md`" completed five, left the sixth an inert stub, and then ran a
+> module review with no configured owner for the one stage that finds the escaped defects.
+> Measured consequence: an end-to-end run that executed journeys, DB/OQL assertions and the monkey
+> pass, reported them, and never looked at a single page. **The count is load-bearing. It is six.**
+
+## ST1 — "Already used as triage input" — the deck nobody read (2026-09-02)
+
+_From `skills/source-triage.md`._
+
+> **A claim that another document already handled a file is a claim to verify, not an
+> answer.** Real incident, 2026-09-02, a VBA migration: intake Q4 ("documents not yet accounted
+> for?") was closed with *"the .pptx is already inside `source/` and was already used as triage
+> input by the Group A–D triage pass"*. The triage was derived from the `.cls` exports and never
+> named the deck; its 22 diagrams — the only place the workflow engine's X/M/E semantics were
+> written down — went unread for two months of BRDs, blueprint and build plan, and a `CONFIRMED`
+> architecture decision had to be reversed. The wrong answer *reads* right because it cites a
+> document. The right form is the ledger's: **name the artifact, and let the gate grep it.** A
+> text read of a deck is not the deck either — a 25-slide, 22-image container is consumed when
+> the disposition says `--pages 25 --media 22`, not when its title appears in a summary.
+
+## ST2 — Mixed corpora routed wholesale down the document path
+
+_From `skills/source-triage.md`._
+
+Mixed corpora are where this goes wrong, and they are the normal case in presales. The folder
+*reads* like requirements, so the whole thing is sent down the document path (`kb-generation.md`,
+Path B) and comes back as prose — including the entities that were sitting in the schema, which
+then get re-derived by hand three stages later. Prose is the right reading method for prose and
+the wrong one for structure. Choosing per artifact is this step's job; routing a whole corpus by
+how it looks at a glance is the failure it exists to prevent.
+
+## ST3 — Field evidence for read-vs-parse: one export, one spec, one inventory (2026-09-07)
+
+_From `skills/source-triage.md`._
+
+**Field evidence, 2026-09-07** — a no-code app replacement whose corpus was one data export
+(`.ods`), one 3.5 MB reverse-engineering spec (`.html`) and one workflow inventory (`.md`):
+
+- The **export parser corrected the documents written about it**: 53 stored columns against
+  128–175 documented (~120 are computed in the platform — neither attributes to model nor data to
+  migrate), four different spellings of one foreign key across four sheets, 15 sheets where the
+  spec documented 17, plus per-sheet volumes. No reading of any document produces one of those.
+- A **regex classifier over the spec's prose scored ~50% precision and ~50% recall** against a
+  user-confirmed sample, and was deleted the same day. It read the spec's "what the recording
+  covered" bullets as requirements, truncated sentences at inline HTML tags, and matched none of
+  the negative-form statements ("there is no role model", "no reminders, no escalation") that
+  carried some of the sharpest requirements in the document. The same agent's plain read of the
+  same file, at intake, was better in one pass.
+- The user's question is the rule in one line: *"do we need an extractor for html & md files?
+  Can't we just analyse and conclude what it should be? But when it's ppt and images better yes?"*
+
+## ST4 — Why "both, not either" is spelled out (2026-09-07)
+
+_From `skills/source-triage.md`._
+
+**Why this is spelled out (2026-09-07).** `conversion-runbook.md`'s Stage-0 applicability table
+said the extraction call was **`N/A` for requirements-driven**, flatly — while this skill and the
+shipped `triage.md` header said `N/A` only where the corpus holds no extractable structure, "on
+evidence, never on the entry-mode label". The runbook is the file every session is required to
+read first, so the unconditional version was the one that got followed. On the project that
+surfaced it — requirements-driven, corpus of one spec, one workflow inventory and **one platform
+data export** — following the runbook literally would have marked extraction `N/A` and left the
+export unparsed. That parser went on to correct the very documents written about the app: 53
+stored columns against 128–175 documented, four spellings of one foreign key across four sheets,
+15 sheets where the spec said 17. Same shape as the `toolkit-guide.html` first-touch incident in
+`CLAUDE.md`: a rule stated conditionally in its owning file and unconditionally in the front
+door, where the front door wins. The runbook now defers here.
+
+## IP1 — Branding question batch-approved as a recommended default (2026-08-19)
+
+_From `skills/interview-protocol.md`._
+
+*Real incident, 2026-08-19 (PROJECT-B).* "Are there branding inputs?" went in as line 7
+of a seven-item Stage 3 gate batch, carrying the recommended default *"no branding assets
+provided — use Atlas defaults."* The user approved the batch. There was in fact a real art
+direction — top-bar layout, industrial look, grey background, cool colours, the client wordmark in
+the shell — and a WCAG 2.1 AA target, and neither had ever been asked for. Both surfaced only
+when the user challenged the finished design system and asked why nobody had checked. The
+question had been treated as a `gap`. The recommendation was the entire defect: it converted
+"I don't know" into "I've decided", and a batch approval swallowed it.
+
+## IP2 — "AskUserQuestion doesn't seem installed" — the Copilot dry run (2026-08-19)
+
+_From `skills/interview-protocol.md`._
+
+*Why this is spelled out (real incident, 2026-08-19).* A dry run of this toolkit on GitHub
+Copilot on Windows produced the question *"AskUserQuestion doesn't seem installed, is that
+something we can include in the setup?"* It cannot be. Until then every call site here named
+the tool as **the** mechanism, so on a non-Claude agent the instruction was simply
+unfollowable — and an unfollowable gate is not a loud failure, it is a silent skip. Same shape
+as the Stage P false-green: the enforcement quietly evaporates and nothing says so.
+
+## IP3 — "X already covers this" — the verbatim intake answer (2026-09-02)
+
+_From `skills/interview-protocol.md`._
+
+Verbatim, from a real intake (2026-09-02, Q4 "documents not yet accounted for?"):
+
+> the `.pptx` is already inside `source/<track>/` and was already used as triage input by the
+> Group A–D triage pass (see `<track>-triage.md`) — nothing additional exists outside the folder.
+
+The triage never named the deck. Two months of downstream artifacts inherited the gap, because
+once Q4 read "answered" nothing had a reason to look again. The answer *cited a document*, which
+is exactly why it was believed.
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index 01ba7ba4..d9aca394 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -18,19 +18,15 @@
 
 **Mechanical scaffolding exists:** `bin/init-agents.sh <session-root> [p|build|all]` copies stub versions of all **six** agents (from the toolkit's `agents/` folder) into the project's `.claude/agents/` — `p` for the Stage-P pair (ba/architect), `build` for the Stage-5 quartet (mdl/gate/test/**review**). The stubs are safe by construction: each refuses to run while `{{PLACEHOLDER}}`s remain, so "downloaded but never configured" fails loudly instead of verifying nothing. Your job after scaffolding is Steps 1–4 below: fill every placeholder from the *actual* project, including the **Domain context** block.
 
-> **This file said "five" until 2026-08-20, and that cost the review.** `review-agent` — the owner
-> of `module-review.md` stage 4, the LOOK — has been scaffolded by `bin/lib/install-manifest.sh`
-> and routed to its skills for some time, but this file never listed it. So every session that set
-> agents up "per `agent-roles.md`" completed five, left the sixth an inert stub, and then ran a
-> module review with no configured owner for the one stage that finds the escaped defects.
-> Measured consequence: an end-to-end run that executed journeys, DB/OQL assertions and the monkey
-> pass, reported them, and never looked at a single page. **The count is load-bearing. It is six.**
+> **The count is load-bearing. It is six.** Failure when this file said "five": sessions left
+> `review-agent` an inert stub, and a module review ran journeys, DB assertions and the monkey pass
+> but never looked at a single page (2026-08-20, `process/baseline-incident-history.md` §AR1).
 
 ---
 
 **When to dispatch, in what batch, on which tier:** `conversion-runbook.md` §1c is the single source. **How to dispatch** — the four harness defaults to override on every call — is the next section. The rest of this file is the setup.
 
-The `model:` line in each template below is pinned to match the shipped stub at `agents/<name>-agent.md` — see `conversion-runbook.md` §1c for the why.
+The `model:` line of every completed agent is pinned to the shipped stub at `agents/<name>-agent.md` (never inherited) — see `conversion-runbook.md` §1c for the tiers.
 
 ## Dispatching — override four defaults on every call
 
@@ -170,247 +166,13 @@ works.
 
 ## Template shapes (adapt, don't copy verbatim)
 
-### ba-agent
-```
----
-name: ba-agent
-description: "Owns discovery, interview gates, AND per-module briefs for {{PROJECT}} (conversion-runbook.md Stages P, 0-2, 4, 7). Two modes: EXTRACTION (P-2, no spec yet -> produce BRDs) and TRANSLATION (Stage 4 -> turn validation-clean BRDs into module briefs). Use for intake, triage, requirements, any proposal-with-evidence interview, and authoring module briefs."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You run discovery, the interview gates, and module-brief authoring for {{PROJECT}}. You never touch the `.mpr` and never run `mxcli exec` — you produce decisions and records, not model changes.
-
-**Paths:** resolve all project paths (KB, BRDs, wireframes, briefs, architecture, stage HTML) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
-
-## Your two modes
-- **Extraction (Stages P–2):** no spec exists yet. Produce BRDs from source/SME via the interview protocol.
-- **Translation (Stage 4, per module):** BRDs exist. Turn them into a **module brief** (`architecture/modules/<Module>/module-brief.md`, per `module-brief.md`) — the `mdl-agent`'s single entry point. **Having BRDs does not mean your job is done** — translation is the second half. If briefs don't exist, this mode was skipped.
-
-## Ground rules
-- Follow `query-the-model.md` before asking anything: check the KB/source, the current Mendix model (via a query, not the BRD), and only ask the user the part that's a genuine decision.
-- Run the full interview protocol from `conversion-runbook.md` §1 at every gate: homework first, 2-4 options with evidence, assumptions stated out loud, user answers in the terminal, decision written to the stage HTML *and* `PROJECT.md`, unknowns default + `ASSUMED` + proceed.
-- Never invent legacy intent from code alone — that's what Path C (the SME interview) is for. Log it as an open question if no SME is available, don't guess.
-- `✋` gates (Stage 0 Triage) do not resolve to `ASSUMED` — they need an explicit `CONFIRMED` answer before the run proceeds.
-- **Module briefs (translation mode):** you own the brief file and write the business layer (roles/journeys, screens-per-role, the access table, field-level validation, edge cases, open questions). Pull `architect-agent` for the technical layer (domain summary, write-mode plan, cross-module deps). Point to source artifacts — never duplicate wireframe or domain-model content into the brief. Produce briefs just-in-time (module N after N−1 gates), not all upfront.
-
-## Workflow (extraction / gate mode)
-1. Identify which stage's gate you're running (from `conversion-runbook.md` §2).
-2. Do the homework: read {{KB_PATH}}, {{SOURCE_PATH}}, and query the live model if the question touches it.
-3. Draft the proposal (options + evidence + assumptions) and the stage HTML surface at {{STAGE_HTML_PATH}}.
-4. Ask the user; record the answer in {{STAGE_HTML_PATH}} and `PROJECT.md` as `CONFIRMED`, or apply the recommendation and mark it `ASSUMED` with the risk if the user has no answer yet (non-✋ gates only).
-5. Update `PROJECT.md`'s open-questions register.
-
-## Workflow (translation mode — authoring a module brief)
-1. Read `module-brief.md` for the format and ownership rules.
-2. Read the module's BRDs, wireframes, and the build-plan access-table slice. Query the live model for exact names.
-3. Write the business layer of `architecture/modules/<Module>/module-brief.md`; request the technical layer from `architect-agent`.
-4. Run the brief's ready-check. Any unresolved item stays an open question the `mdl-agent` must escalate — do not paper over it.
-
-## Report back
-Which gate or brief you produced, the decision(s) recorded, which are `CONFIRMED` vs `ASSUMED`, and what's still open.
-```
-
-### architect-agent
-```
----
-name: architect-agent
-description: "Owns Stage 3 (Architecture & Design) and Stage 4 (Build Plan) for {{PROJECT}} — module boundaries, blueprint, fit-gap, build plan. Use once BRDs are validation-clean. Never touches mxcli."
-model: opus
-tools: Read, Grep, Glob, Bash
----
-
-You own architecture and build-plan decisions for {{PROJECT}}. Hard rule: you never run `mxcli exec` and never write MDL — that's `mdl-agent`'s job, downstream of your build plan.
-
-**Paths:** resolve all project paths (BRDs, architecture, design, briefs, build plan) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
-
-## Ground rules
-- Follow `modularize-domain.md`'s boundary criteria; default to one module + folders unless a candidate clears >=1 criterion.
-- Run the Stage 3/4 interview gates from `conversion-runbook.md` §2 — module boundaries, buy/build/stub per fit-gap item, target security model, data volumes/NFRs, integration contracts, branding, acceptance criteria, environment/DTAP. These are `✋` gates: no `ASSUMED` past them, only `CONFIRMED`.
-- Query the live model (`query-the-model.md`) before referencing any marketplace module in the build plan — `SHOW ENTITIES IN <module>` first, always.
-- **Module briefs — you contribute the technical layer when `ba-agent` requests it** (`ba-agent` owns the file and drives; see `module-brief.md`). Your layer: domain summary (pointer to the domain MDL for exact names, not a copy), the write-mode plan per element (CLI / MCP+MDL / hand-rolled MCP, per `learned-mdl-preflight.md` Step 0), cross-module dependencies, stub-vs-real integrations, and any arch constraint that applies to this module. Point to source artifacts; never duplicate them into the brief.
-
-## Workflow
-1. Read the validation-clean BRDs and any existing `architecture/`, `design/` artifacts.
-2. Propose module boundaries / fit-gap decisions with evidence; run the interview protocol.
-3. Write `.mx-brd.json`, `architecture/` (blueprint, wiring diagrams, fit-gap.md), and once approved, `architecture/build-plan.md` — numbered, dependency-ordered.
-4. Record every decision in `PROJECT.md`.
-
-## Report back
-Boundaries/decisions proposed vs. confirmed, the build plan's pending-decisions count, and anything still blocking Stage 5.
-```
-
-### mdl-agent
-```
----
-name: mdl-agent
-description: "Drafts and syntax-validates mxcli MDL scripts for {{PROJECT}}. Use when a microflow/page/domain-model script needs to be written or fixed, before it's executed against the real .mpr."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You write MDL scripts for {{PROJECT}}. You draft and validate — you never execute against the real `.mpr`.
-
-## Paths — read the Wiring block, don't hardcode them here
-All project paths (MPR, `mdlsource/`, module briefs, wireframes, design system, StyleGallery,
-architecture, build plan, BRDs) live in the **`## Wiring` block of the project-root `CLAUDE.local.md`** —
-the single source of truth. Read it at the start of every task and resolve paths from it. When a rule
-below names an asset ("the wireframe", "the brief"), it means the path from that block.
-
-## Ground rules
-This file is a **router**: the detailed rules live in the skills it names — open them, don't rely on
-this summary. The hard STOPs below are inline on purpose; never route around them.
-
-- **Read the module brief first — your single entry point.** Read the module's brief (briefs path in
-  the Wiring block; format in `module-brief.md`): roles/access, screens, validation, write-mode plan,
-  pointers. **No brief → STOP and report** — a missing brief means `ba-agent` translation mode was
-  skipped; do not synthesize the module from raw BRDs yourself.
-- **An unchecked open question in the brief is a stop sign.** If one touches what you're building,
-  surface that specific question to the main session (for `ba-agent`) — never fill it from training data.
-- Business rules come from the brief and {{BUSINESS_RULES_SOURCE}}; read the domain-model script
-  (Wiring block) for exact, case-sensitive names. Don't guess names or rules.
-- **Write mode, per operation, up front:** run `learned-mdl-preflight.md` Step 0 — the default is the
-  CLI through `bin/exec.sh`; its STOP table overrides that for operations mxcli corrupts or cannot
-  express, which go to Studio Pro by hand. State the mode per op in your report, and flag any op that
-  needs Studio Pro so the main session sequences the handoff.
-- Annotate selectively (`learned-microflow-patterns.md`); always annotate a CE-error fix.
-- **Pages/snippets — run the full pre-flight in `ui-preflight-pages.md`** (wireframe → tokens →
-  gallery reuse → cross-check) and include its UI cross-reference block in your report. **No wireframe
-  → STOP** — do not guess layout or bindings. Reuse existing gallery components; don't reimplement
-  them as plain text.
-- **Complex microflows:** confirm alignment against the brief's technical layer + the architecture
-  blueprint (Wiring block) before drafting. Report any mismatch.
-- **Grants co-located** with the element (per the brief's access table): `grant execute` ends the
-  microflow script, `grant view` ends the page script, entity grants end the domain script.
-
-### Trivial-change fast path
-For a genuinely mechanical script — a forward-reference stub, an added enum value, a rename, a
-constant, a pure domain-attribute add with no page — skip the UI pre-flight and per-page review
-(there's no rendered surface to verify). Still required: read the brief for names, the
-`learned-mdl-preflight.md` STOP check, `mxcli check`, and the mxbuild gate. Anything that adds/alters
-a page, widget, or user-facing microflow is **not** trivial — treat as full-discipline when unsure.
-
-## Workflow
-1. **Read the `## Wiring` block** in the project-root `CLAUDE.local.md` — resolve all paths from it.
-2. **Read the module brief** (briefs path from Wiring) — if missing, STOP and report.
-3. Read the task spec (which elements this build unit covers) against the brief.
-4. Read the necessary skill file(s) and existing MDL for exact names (the brief points to them).
-5. For pages/snippets: locate the wireframe (named in the brief) — if missing, STOP. Then complete `ui-preflight-pages.md` in full.
-6. For complex microflows: confirm alignment against the brief + architecture blueprint.
-7. Write the script to the requested path (under the mdlsource dir from Wiring) — grants co-located.
-8. Run `mxcli check <path> -p <MPR from Wiring> --references` and iterate until clean.
-8a. **Log the dispatch** (discharges the `dispatch` obligation, `bin/lib/obligations.tsv`): under the
-    project root, `mkdir -p .claude/loop/dispatch/<Module>/` (Module from the brief) then append one
-    TAB-separated line to `.claude/loop/dispatch/<Module>/scripts.tsv`:
-    `<date>	<script path from step 7>	<check result from step 8>` — date as `YYYY-MM-DD`. This is the
-    only record that this module's scripting went through mdl-agent's preflight rather than being
-    drafted in the main session; it owes no denominator, just the line.
-9. Do NOT run `mxcli exec` — that stays in the main session under the user's confirmation.
-
-## Report back
-Plain-language summary of what the script does, the file path, the check result, and any open questions or unverified-syntax risks. For page scripts, include the full UI cross-reference block.
-```
-
-### gate-agent
-```
----
-name: gate-agent
-description: "Runs {{PROJECT}}'s build/quality gates after a script has been executed against the .mpr, and reports pass/fail with a digested error list. Use after any mxcli exec, not before."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You verify {{PROJECT}} after changes have already been applied to the `.mpr`. Read-only / verification-only — never write files, never run `mxcli exec`.
-
-## Gates to run (in order)
-1. **Model check**: {{MODEL_CHECK_COMMAND}}. Expect 0 CE errors.
-2. **Compile gate** (if applicable): {{COMPILE_GATE_COMMAND}}.
-3. **Lint, always**: read the lint cell `bin/exec.sh` wrote into the BUILD-LOG row (it runs
-   `bin/lint-gate.sh` after every clean mxbuild); a `LINT ROSE` cell fails the script. Re-run
-   {{LINT_COMMAND}} only for the per-document list. Never re-baseline to make a row green.
-
-## Known gotchas
-{{PROJECT_SPECIFIC_GOTCHAS — e.g. stale .mpr.lock files, access-grant drops after CREATE OR REPLACE, stale proxy folders after a module rename}}
-
-## Report back
-Pass/fail per gate, the exact error list if any, and whether failures match a known-gotcha pattern. Terse — a status report, not a narrative.
-```
-
-### test-agent
-```
----
-name: test-agent
-description: "Walks happy-path and edge-case UI tests against the running {{PROJECT}} app and reports pass/fail per scenario. Use after a gate-agent pass, once a feature is expected to be clickable end-to-end."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You test {{PROJECT}}'s running UI. Verification-only — never edit MDL, never touch the `.mpr`, never run `mxcli exec`.
-
-## Before you start
-- Read {{TEST_SETUP_SKILL_REFS}} for this project's exact test setup (demo user, how the app is started, DB assertion pattern).
-- Confirm the app is actually running before testing; if it isn't, that's a blocker to report, not something to silently work around.
-
-## Workflow
-1. Take the scenario list you were given.
-2. Log in as {{DEMO_USER}}, not the admin account, unless the scenario specifically calls for admin.
-3. Walk each scenario step, capturing what happened.
-4. Cross-check state-changing results against the database rather than trusting the UI alone.
-
-## Report back
-Per-scenario pass/fail, the exact failing step (if any) with expected vs. observed, and any UI/data mismatches. Don't narrate every click.
-```
-
-### review-agent
-```
----
-name: review-agent
-description: "Closes a module in {{PROJECT}}: runs the model-side review instruments, then LOOKS at every page in the module and says whether it is logical, whether it looks right, and whether it matches the design. Use when a module's build and gate stages are done. Diagnostic only — never fixes anything."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You run `skills/module-review.md` for {{PROJECT}}. Read that skill in full before you start; this
-file only tells you where things are.
-
-## What you own
-Stage 3's model-side instruments, and **stage 4 — the LOOK**. Stage 4 is the reason you exist.
-Stages 1–3 are already covered by mdl-agent, gate-agent, test-agent and `bin/verify-module.sh`;
-none of them can answer "is this screen logical, does it look right, does it match our design",
-and a module has repeatedly shipped broken because nobody asked.
-
-## The page set is every page in the module
-```
-{{MXCLI}} -p {{MPR}} -c "SHOW PAGES IN <Module>"
-```
-Not the pages a journey visited. A page no test touches is the highest-risk page in the module.
-Report the denominator: `12 of 12 pages reviewed`, never "reviewed the module".
-
-## Order
-1. `bin/verify-module.sh <Module>` results — read them, do not re-run them.
-2. `node tests/e2e/design-audit.js` — the mechanical sweep (classes, a11y, overflow). Where it
-   and your eye overlap, it wins.
-3. **Then look**, page by page, per module-review.md §4c/§4d/§4e. Navigate via the nav menu or a
-   button, never a direct URL.
-4. Write the report to `design/ui-reviews/ui-review-<YYYY-MM-DD>.html` and append every P1/P2 to
-   `docs/improvement-register.md`.
-
-## When an input is missing, you assess anyway
-A missing wireframe, an absent design system, an uninstalled `design-audit.js`, a module with no
-brief — none of these is permission to skip a page. Follow module-review.md's
-**"Degrade to judgement, never to silence"** table: name what is missing, name what you assessed
-against instead, and still deliver a verdict per page. Reduced fidelity is reported as reduced
-fidelity. It is never reported as a pass, and never reported as nothing.
-
-## You never fix
-No MDL, no `mxcli exec`, no edits to the model or the theme. You have no Write or Edit tool. End
-by asking which P1/P2 findings should be fixed — the fix routes back through mdl-agent.
-
-## Project specifics
-- MPR: {{MPR}} · app URL: {{APP_URL}} · demo user: {{DEMO_USER}}
-- Wireframes: {{WIREFRAME_DIR}} · design system: {{DESIGN_SYSTEM}} · StyleGallery: {{STYLEGALLERY}}
-- All of the above resolve from the `## Wiring` block of `CLAUDE.local.md` — read it at task start.
-```
+The illustrative body for each of the six roles — frontmatter, ground rules, workflow, report-back —
+is in **`agents/README.md`**; read it when completing a stub (step 2 above). The shipped stubs
+`agents/<name>-agent.md` are the live templates and win where the two disagree. The rules every
+completed agent must keep regardless of shape are in this file: the tool scoping (step 3), the one
+rule on `.mpr` mutation, and the anti-patterns below. ba-agent works in two modes — **extraction**
+(Stages P–2: produce BRDs via the interview protocol) and **translation** (Stage 4: turn BRDs into
+module briefs, just-in-time, module N after N−1 gates); having BRDs does not mean its job is done.
 
 ---
 
@@ -419,5 +181,5 @@ by asking which P1/P2 findings should be fixed — the fix routes back through m
 - **Don't give any of these six agents `Write`/`Edit` directly.** File writes happen via `Bash` so the mutation boundary stays visible in the tool list, not buried in a general-purpose write permission.
 - **Don't let gate-agent or test-agent run `mxcli exec`, ever** — they exist specifically to check work the main session already committed.
 - **Don't let ba-agent or architect-agent skip the interview protocol to move faster.** A boundary or role model decided without the proposal-and-question loop in `conversion-runbook.md` §1 is exactly the failure this split exists to prevent — it just moves the unowned-decision problem into a subagent instead of fixing it.
-- **Don't copy the template shapes above verbatim into a new project.** A gate-agent checking the wrong `.mpr` filename, a test-agent logging in as a demo user that doesn't exist, or a ba-agent pointed at the wrong `PROJECT.md` path will report false confidence instead of failing loudly.
+- **Don't copy the template shapes (`agents/README.md`) verbatim into a new project.** A gate-agent checking the wrong `.mpr` filename, a test-agent logging in as a demo user that doesn't exist, or a ba-agent pointed at the wrong `PROJECT.md` path will report false confidence instead of failing loudly.
 - **Scaffold all six on day one; don't *complete* an agent before its stage starts.** The stubs are inert (refuse-to-run while placeholders remain), so having all six in `.claude/agents/` from kickoff is safe and avoids the "where's my mdl-agent?" confusion. The discipline moves to completion time: fill ba/architect at Stage P, mdl/gate/test/review at Stage 5 kickoff — completing a gate-agent before any build exists means filling its commands from guesses, which is exactly the false-confidence failure the placeholders exist to prevent. (A greenfield build starting at Stage 5 may simply never complete ba/architect — that's fine, they stay inert.)
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index cc80daa8..852f3ff2 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -123,7 +123,7 @@ The stages are the same for everyone; what differs is where you enter and which
 3. **Any requirements artifacts exist** — specs, BRDs, context docs, wireframes, workshop outputs → **Requirements-driven**. Having "complete" specs does *not* mean skipping to Stage 5: stages 2–4 are where those specs become validated BRDs, an architecture, module boundaries, a design system, and an ordered plan. Skipping them means improvising all of that mid-build.
 4. **None of the above** — you're genuinely starting from a conversation → **Greenfield**. This is the narrowest mode, not the default for "no legacy system."
 
-(Real misrouting incident, 2026-07-14: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate," proposing to skip 0–4 — exactly what rules 2–3 exist to prevent. Second incident, 2026-09-22: `intake.md` Q1 offered only three modes, so a session changing a live app could not pick the fourth even though `gate-check.sh` already recognised it — rule 1 and the table row below are the fix.)
+(Failure: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate" and proposed skipping 0–4 — `process/baseline-incident-history.md` §R1.)
 
 | You're starting from… | Mode | Stages that run | What changes |
 |---|---|---|---|
@@ -137,14 +137,9 @@ The stages are the same for everyone; what differs is where you enter and which
 **Stage 0 is the scope stage. It is not the extractor stage.** Reuse-vs-build-new is one question
 *inside* it, and it is the only part that needs a codebase.
 
-This distinction was implicit until 2026-08-20, when a customer round made the cost of leaving it
-implicit measurable. A project whose source was markdown files plus database tables was classified
-requirements-driven — reasonably, given the rules above. The mode's row then said "skip 0", so
-Stage 0 was skipped **whole**: no source characterisation, no `analysis/` folder, no triage
-artifact, and — the expensive one — **no scope conversation**, because CAC-1 fires after Stage 0
-and Stage 0 never ran. Extraction was then run anyway and pulled in far more than the subsystems
-under discussion, which nothing downstream was positioned to notice: Stage 2's gate checks that
-BRDs are *validation-clean*, and a hundred clean BRDs describing things nobody asked for pass it.
+Failure it prevents: a requirements-driven project skipped Stage 0 whole — no triage, and no
+scope conversation, since CAC-1 never fired — then extracted far beyond the subsystems in scope; a
+hundred validation-clean BRDs about things nobody asked for passed Stage 2 (2026-08-20, `process/baseline-incident-history.md` §R2).
 
 So: **no entry mode may skip Stage 0, because no entry mode may skip the scope conversation.**
 What varies is how much of the stage is applicable, and inapplicability is *recorded*, never
@@ -171,11 +166,9 @@ their `_files/` sidecars), no legacy code, no Office/PDF containers. A corpus wi
 `.pdf` in it takes the ordinary requirements-driven row above, because those containers carry
 embedded images that owe their own accounting (`bin/lib/source-formats.tsv`, `media = yes`).
 
-**Why this path exists (2026-09-09).** A project of exactly this shape was slow and token-hungry
-through Stages 1–4, for measured reasons: every session read the raw HTML (3–10× the tokens of
-its text), and the ledger asked for one disposition per file — every sidecar `.png`, `.css` and
-`.js` included — for a corpus nothing extracts. Nothing below skips a gate; it names the shortest
-honest route through them, and every command here was run against the gates before it was written.
+**Why (2026-09-09):** a project of this shape read raw HTML every session (3–10× the tokens) and
+owed a ledger disposition per sidecar file (`process/baseline-incident-history.md` §R3). Nothing below skips a gate; it is the
+shortest honest route through them, each command run against the gates before it was written.
 
 | Stage | Docs-ready form |
 |---|---|
@@ -216,7 +209,7 @@ Every gate in §2 runs the same six-step shape. This is the thing that should be
 5. **The decision is written to two places**: the stage's HTML proposal doc (the artifact, customer-showable) and `PROJECT.md` (the register), marked `CONFIRMED`.
 6. **`ASSUMED` is earned by asking, never by skipping.** An answer may be recorded `ASSUMED` only after the question was actually posed and the user said "don't know" / "you decide" — that is delegation-by-consent, recorded with the risk if wrong. Deriving an answer yourself and not asking is a protocol violation, not an `ASSUMED`.
 
-**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks. But the pipeline generates a second stream all the time: every `openQuestions` entry a BRD records, every row added to `analysis/sme-questions.md`. Those were never wired to anything, and they rotted. Measured on one real project (2026-08-12): 46 rows in `sme-questions.md` against 7 mentions of an answer, ~35 unresolved BRD `openQuestions`, one status reading *"Open — routed to sme-questions.md F1/F2"* — routed to a file nobody opens. Several were not merely unasked but already **decided**: *"ASSUMED drafting position (a), hardcode — taken to keep this BRD buildable… NOT a settled product decision"* is a real product choice (hardcode vs. build a configurable rules engine) taken unilaterally and never shown to anyone. And 23 distinct free-text status strings meant nothing could count them, which is why nothing ever surfaced them.
+**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks; the pipeline also accumulates a second stream — every BRD `openQuestions` entry, every `analysis/sme-questions.md` row — and unwired, it rots. Failure: 46 SME rows with 7 answered, ~35 unresolved BRD questions, and a hardcode-vs-rules-engine product choice taken as a "drafting position" nobody was shown (2026-08-12, `process/baseline-incident-history.md` §R4).
 
 So, **as a required step at every gate, before the gate's own questions**:
 
@@ -234,16 +227,9 @@ bin/questions-report.sh <project-root> --stage <N>    # → docs/open-questions.
 
 `gate-check.sh` writes it for you whenever the open-questions row blocks a gate. Give the user the path — it is openable, sortable and forwardable to a customer SME in a way a terminal dump is not, and it flags every question that arrived without a proposed answer.
 
-The vocabulary is controlled, and only these six values are legal in a `status`:
-
-| State | Meaning | Blocks a gate? |
-|---|---|---|
-| `UNRAISED` | never put in front of the user — the default for anything not positively past it | **yes** |
-| `RAISED` | put to the user at a named gate, awaiting their reply | no |
-| `ANSWERED` | the user decided; requires a non-empty `answer` | no |
-| `ASSUMED` | agent took a position **and** the user consented after seeing it; requires `consentBy` + `consentAt` | no |
-| `MOOT` | descoped by another decision; the reason is in the text | no |
-| `UNRECOGNISED` | the normaliser could not place it — counts as **not done** | **yes** |
+The `status` vocabulary is controlled: six legal values — `UNRAISED` and `UNRECOGNISED` block a
+gate; `RAISED`, `ANSWERED`, `ASSUMED`, `MOOT` do not. Their meanings are the table in
+`interview-protocol.md` §4, the single source.
 
 An `ASSUMED` with no `consentBy`/`consentAt` is not an assumption, it is the defect: it normalises to `UNRAISED` and blocks. `bin/gate-check.sh <project-root> <N>` enforces this and will not pass a stage carrying unraised questions. Unlike protocol staleness (which notifies), this one blocks — it is the project's own state, and an architecture built on decisions the customer never saw is exactly what §1 exists to prevent.
 
@@ -251,7 +237,7 @@ Note the ruling this encodes, from the user, 2026-08-12: *"At each gate, also gi
 
 A proposal beats a questionnaire because it asks the user to **correct** something rather than supply it cold — and by the time each gate arrives, the agent has read the source and has evidence to put behind its recommendation.
 
-**Unattended mode is opt-in, never inferred.** The "default + record + proceed" behavior (skipping the wait, not the question — questions still get logged in `PROJECT.md` open-questions) is only legal when the user explicitly said to run unattended, recorded at Stage P in `PROJECT.md` (`Interview mode: unattended`). Default is **attended**: every gate question is asked in chat and the turn ends there. (Real incident, 2026-07-14: an attended run produced architecture diagrams and a design system through Stage 3 without a single question reaching the user — "a solo run never stalls" was read as "never ask." It means "an *authorized* solo run doesn't deadlock," nothing more.)
+**Unattended mode is opt-in, never inferred.** The "default + record + proceed" behavior (skipping the wait, not the question — questions still get logged in `PROJECT.md` open-questions) is only legal when the user explicitly said to run unattended, recorded at Stage P in `PROJECT.md` (`Interview mode: unattended`). Default is **attended**: every gate question is asked in chat and the turn ends there. (Failure: an attended run reached Stage 3 with zero questions asked, reading "a solo run never stalls" as "never ask" — `process/baseline-incident-history.md` §R5.)
 
 **Unattended runs keep a Ruling ledger.** Nobody can be asked, so the register alone is not
 enough: an `ASSUMED` line records the decision and sometimes the reason, never the blast
@@ -281,7 +267,7 @@ obra/superpowers, adapted; the ledger is the compensating control for the fact t
 
 And at **every** checkpoint, after the 2+1 questions: one standing open-floor question — "anything else you want changed, added, or worried about — scope, priorities, anything?" — before the gate closes.
 
-**Lightweight-change carve-out — small, unambiguous, already-decided changes skip dispatch, never skip the record.** Not every BRD/architecture edit needs the six-step protocol or a `ba-agent`/`architect-agent` round-trip. If the change is small in scope (renaming a field, adding one or two entities/attributes whose shape was already settled in the current conversation, fixing a stale line that contradicts an already-CONFIRMED decision) *and* unambiguous (no real alternatives to weigh, nothing left for the user to correct), the acting agent may edit the BRD/architecture doc directly instead of dispatching a subagent. It still MUST: (a) log the change in `PROJECT.md` — a `## Change log` row when the user asked for it (`change-intake.md`: an S change the user typed needs no question, only that row), a decision row when it settles a choice — (b) set or flip the drift-sync marker on any BRD/wireframe it touched and did not flush in the same session, per §3b. What this carve-out buys back is the interview/dispatch overhead, not the paper trail — a change made without a recorded decision or marker is exactly the drift this runbook exists to catch, however small the diff. Anything touching module boundaries, the security model, a new integration, or requiring a judgment call between real alternatives still runs the full protocol. (Real incident, 2026-07-23: a "flip 2 entities to persistent + add 2 new entities" change — already fully settled in conversation — was routed through ba-agent twice and architect-agent once, ~270k combined tokens, for what was fundamentally a handful of document edits. The user called it out directly. The fix isn't skipping the record, it's skipping the dispatch when there's nothing left to decide.)
+**Lightweight-change carve-out — small, unambiguous, already-decided changes skip dispatch, never skip the record.** Not every BRD/architecture edit needs the six-step protocol or a `ba-agent`/`architect-agent` round-trip. If the change is small in scope (renaming a field, adding one or two entities/attributes whose shape was already settled in the current conversation, fixing a stale line that contradicts an already-CONFIRMED decision) *and* unambiguous (no real alternatives to weigh, nothing left for the user to correct), the acting agent may edit the BRD/architecture doc directly instead of dispatching a subagent. It still MUST: (a) log the change in `PROJECT.md` — a `## Change log` row when the user asked for it (`change-intake.md`: an S change the user typed needs no question, only that row), a decision row when it settles a choice — (b) set or flip the drift-sync marker on any BRD/wireframe it touched and did not flush in the same session, per §3b. What this carve-out buys back is the interview/dispatch overhead, not the paper trail — a change made without a recorded decision or marker is exactly the drift this runbook exists to catch, however small the diff. Anything touching module boundaries, the security model, a new integration, or requiring a judgment call between real alternatives still runs the full protocol. (Failure: a settled 4-entity edit took three subagent round-trips, ~270k tokens — `process/baseline-incident-history.md` §R8.)
 
 **The packaged form of this protocol is a checkpoint — and checkpoints are mandatory where they exist.** `skills/checkpoints/` ships ready-made Context-Aware Checkpoints (CAC) for the six busiest transitions (scope, BRD, architecture, design, build, cutover) — each runs the protocol above as a "2 predefined questions + 1 open question" script, derived from what the pipeline actually found. Run the raw six steps only where no checkpoint exists. **A checkpoint fires *before* the next stage's artifacts are produced** — creating architecture diagrams or a design system before their checkpoint ran is a protocol violation: stop, run the checkpoint, and be prepared to throw the premature artifact away. Either way the decisions land in `PROJECT.md` — checkpoints keep no state file of their own.
 
@@ -352,13 +338,9 @@ Rules — these apply to every stage and every per-module build loop:
    item that makes the obligation check bite: it reports a pass nobody performed, but only on
    a run, and nothing before this rule required one.
 
-   **Why (measured, 2026-09-19, two field builds of the same app).** A full Stage-5 build closed with all seven screens built, a green mxbuild
-   gate, and 11 of 37 acceptance rows confirmed. `gate-check.sh` had run exactly once, at
-   scaffold time. The `look` obligation, the wiring sweep, journeys and coherence were all
-   `PENDING` and nobody saw it, because nothing asked. When the gate was finally run as a
-   deliberate second pass, the seven screens scored 0, 18, 40, 40, 58, 58 and 69 percent against
-   their own wireframes on an element checklist — one screen matched none of its wireframe's
-   elements at all. Every one of those defects was visible to a gate that never ran.
+   **Why:** a full Stage-5 build closed green with `gate-check.sh` run once, at scaffold; run
+   late, it showed LOOK, wiring, journeys and coherence all `PENDING` and the seven screens at
+   0–69% of their wireframes (2026-09-19, `process/baseline-incident-history.md` §R9).
 
 The final full-checklist repost before a gate doubles as the gate's evidence: the user should
 be able to approve the gate by reading that one message. The close-out block is what the
@@ -368,13 +350,9 @@ reader approves the *transition* on — checklist for the work, block for the ha
 
 ## 1c. Dispatch — what leaves the main session, in what batch, on which model
 
-**Why this is written down (2026-09-14).** The six agent stubs have carried model tiers since
-they were generated (`architect-agent` on the strong tier, the other five on the mid tier), and
-§2's Owner rows name who is accountable for each stage. Nothing said *when* the main session
-hands work over — so in the token-path A/B (nine runs, Stages P–4) the main session did nearly
-everything itself, at its own model's price, and only two skills (`brd-generation.md`,
-`image-transcription.md`) ever asked for a fan-out. Owner is accountability; this table is the
-runtime rule. It is the single source; `agent-roles.md` (setup) defers here. *How* to dispatch —
+**Why (2026-09-14):** with no rule for *when* to hand work over, the main session did nearly all
+of Stages P–4 itself at its own model's price (`process/baseline-incident-history.md` §R10). Owner is accountability; this table is
+the runtime rule. It is the single source; `agent-roles.md` (setup) defers here. *How* to dispatch —
 model named on every call, fresh agent not fork, fix rounds, notices — is `agent-roles.md` →
 "Dispatching".
 
@@ -444,12 +422,9 @@ Eight stages (plus Stage P kickoff). For each: what the user co-defines, what th
 
 **Every stage transition has a packaged checkpoint. Here is where they attach.** The `skills/checkpoints/`
 CAC files run the §1 interview protocol at the busiest transitions; they write to `PROJECT.md`,
-never to a separate state file. Until 2026-08-20 this runbook — the file every session is required
-to read — **named none of them**, and they were reachable only from `skills/migration-pipeline.md`.
-A requirements-driven session never loads that skill, so it never fired a single checkpoint, and
-CAC-1's scope brainstorm silently did not exist outside migration mode. Checkpoints are wired to
-*stages* here, not to pipeline phases, precisely so that a project running no pipeline still gets
-them.
+never to a separate state file. They are wired to *stages*, not pipeline phases, so a project
+running no pipeline still gets them (failure: reachable only from `migration-pipeline.md`, they
+never fired in requirements-driven mode — `process/baseline-incident-history.md` §R12).
 
 | Fires at the close of | Checkpoint | The question it exists to force |
 |---|---|---|
@@ -565,11 +540,9 @@ Then, and only then, **the open scope question** ("Scope brainstorm", further do
 present the overview, say what the corpus appears to cover versus what the user described at Stage
 P, and discuss it openly. No option lists.
 
-Doing this out of order is a real, reported failure (2026-08-19): a Stage 0 run on a four-file
-documents-only corpus produced a correct ten-dimension grade and then asked the user a closed,
-rubric-shaped gate question — because the grade was the only artifact in front of it. The
-instruction to present a source map already existed here; nothing produced the map, so the agent
-asked what the tooling gave it something to ask about. **An uncovered dimension is an open question
+Failure out of order: a four-file corpus got a correct ten-dimension grade, then a closed,
+rubric-shaped gate question — the grade was the only artifact in front of the agent (2026-08-19,
+`process/baseline-incident-history.md` §R16). **An uncovered dimension is an open question
 for a human. A low rating is a closed one. Reach the first list before the second.**
 
 Three things come out of pass 2, and each changes what you do next:
@@ -596,20 +569,15 @@ shape-changing gaps to the gate, and mark the extraction rows N/A rather than un
 **Decide that on evidence, and decide it per artifact — not off the entry-mode label.** Open the
 folder first. A schema, a table dump, an ORM model, an OpenAPI contract or entity/field tables
 inside a spec are extractable structure, and each earns a Coverage Matrix row and the two-way
-reuse-or-build call exactly as a codebase would. A mode-shaped `N/A` is precisely how the misroute
-in the next paragraph happens: the corpus reads like requirements, the whole of it goes down Path
-B, and the entities that were sitting in the schema are re-typed out of prose three stages later.
+reuse-or-build call exactly as a codebase would. A mode-shaped `N/A` is precisely how the most
+common presales misroute happens: the corpus reads like requirements, the whole of it goes down
+Path B, and the entities that were sitting in the schema are re-typed out of prose three stages
+later (`process/baseline-incident-history.md` §R17). Markdown alongside a schema does not downgrade the schema.
 
 **"Does not apply" stops at the extraction rows. It never reaches the scope brainstorm.** Read
 that sentence as licence to move on to Stage 1 and you have skipped the one thing Stage 0 exists
 for. Finish the stage: run CAC-1, get the slice ordering, sign `triage.md` off.
 
-**A source that is documents plus a database is not a documents-only source.** A schema, a table
-dump, or an ORM model file is extractable structure and grades as such — the presence of markdown
-alongside it does not downgrade it. This is the shape that misroutes most often in presales
-(2026-08-20): the corpus *reads* like requirements, so it gets treated as prose, and the entities
-that were sitting right there in the schema get re-derived by hand later.
-
 | | |
 |---|---|
 | **User defines** | Reuse-vs-build-new extraction pipeline (agent proposes with a coverage matrix — two-way call, not three-way, made per extractable structure found in the source and never off the entry-mode label; see `source-triage.md`). Policy per missing dependency: acquire / stub / declare-not-implemented. Slice ordering if the source is too big for one pass — **a slice is an ordering, not an exclusion**. |
@@ -623,34 +591,24 @@ that were sitting right there in the schema get re-derived by hand later.
 Three extraction methods, not two. Each is either **done** or **explicitly declared unavailable by a named person** — never silently skipped.
 
 **Closes with CAC-1b** (`skills/checkpoints/checkpoint-extraction.md`) — the scope-out
-confirmation. It is a checkpoint you run, not a gate that stops you, and the reason is worth
-keeping in front of you.
-
-Stage 0 confirms scope *in*: what we intend to cover. It cannot confirm scope *out*, because
-nobody knows what extraction will actually produce until it has produced it. On the customer round
-that prompted this, extraction ran across the whole corpus rather than the subsystems under
-discussion, and the over-reach was invisible until modules were being built — every downstream
-gate measured *quality*, and the output was perfectly good BRDs about the wrong things. A
-validation-clean BRD for a subsystem nobody asked for is a clean pass at every remaining gate in
-this runbook.
+confirmation; a checkpoint you run, not a gate that stops you. Stage 0 confirms scope *in*; it
+cannot confirm scope *out*, because nobody knows what extraction produces until it has. Failure:
+extraction ran across the whole corpus, and validation-clean BRDs about unrequested subsystems
+passed every remaining gate until modules were being built (`process/baseline-incident-history.md` §R18).
 
 So before any BRD is written: put the extraction result next to the Stage 0 scope decision, name
-the delta, and get a decision on it. Do it before the BRDs rather than after — writing them first
-makes narrowing feel expensive, which is exactly when people stop narrowing.
+the delta, and get a decision on it — writing BRDs first makes narrowing feel expensive, which is
+exactly when people stop narrowing.
 
-**Nothing enforces this and nothing should.** A script can only check that a `CONFIRMED` row
-exists in `PROJECT.md`, and an agent can type that row without asking anyone — so the check
-cannot tell the conversation from the string, which is the only thing worth telling apart. (A
-blocking version of this gate existed for part of 2026-08-20 and was removed the same day; see
-`skills/skills-over-scripts.md`.) If the checkpoint gets skipped, run it late against the BRD set
-you already have — with the extraction report in hand you can see what actually came out, which
-is better input than the triage map ever was.
+**Nothing enforces this and nothing should** — a script can see a `CONFIRMED` row, never the
+conversation behind it (`skills/skills-over-scripts.md`). If the checkpoint gets skipped, run it
+late against the BRD set you already have.
 
 | | |
 |---|---|
 | **User defines** | Do documents exist that aren't in the folder (specs, manuals, field-label sheets, screenshots)? DB schema? Sample data? Who has them? SME access for what neither code nor docs answer. **Then, at CAC-1b: does the extraction output match the intended scope — accept, narrow, or re-extract.** |
 | **Agent produces** | **Path A — code → AST extractors** (always runs *in migration mode*; N/A with attribution otherwise). **Path B — documents → LLM extraction** (`kb-generation.md`). **Path C — SME interview** (closes `openQuestions` that neither code nor docs answer). Plus CAC-1b's scope-out surface — the delta table when CAC-1 recorded a slice to diff against, otherwise the one-line statement of what extraction covers (a single app dropped in a folder needs stating, not interrogating). |
-| **Surface** | `analysis/source-ledger.html` — `bin/source-ledger.sh report <project-root>`: every inventoried file, its verdict, and what consumed it. `<kb>/extraction-report.html` — `bin/extraction-report.sh <project-root>`. One renderer for every entry mode: it reads the knowledge base, not the source, so a Path B document corpus gets the same surface as a Path A extraction, one page per knowledge base at the path the gate looks for. Each section carries a `report-schema.md` verdict, and no zero is printed unless a second record (the pre-merge `extracted/*.json`, or `reports/summary.md`) agrees with it — one method returning zero renders `manual`, not a green. Until 2026-08-20 this was `node generate-report.js` inside each pipeline, so requirements-driven and greenfield projects could not produce the file their own Stage 1 gate requires, despite this row promising it. |
+| **Surface** | `analysis/source-ledger.html` — `bin/source-ledger.sh report <project-root>`: every inventoried file, its verdict, and what consumed it. `<kb>/extraction-report.html` — `bin/extraction-report.sh <project-root>`. One renderer for every entry mode: it reads the knowledge base, not the source, so a Path B document corpus gets the same surface as a Path A extraction, one page per knowledge base at the path the gate looks for. Each section carries a `report-schema.md` verdict, and no zero is printed unless a second record (the pre-merge `extracted/*.json`, or `reports/summary.md`) agrees with it — one method returning zero renders `manual`, not a green. History: `process/baseline-incident-history.md` §R19. |
 | **Gate** | 4 extraction quality checks pass with evidence. Paths B and C are done or declared-unavailable, with attribution (who declared it, when). **Every row of the Stage 0 inventory has a disposition that holds up** — `bin/source-ledger.sh check <project>`: an artifact that exists, is non-empty and *names* the file (with one specific finding as evidence, and for a container its images and pages accounted for: `mark <rel> --artifact <path> --evidence "<finding → where>" --pages N --media N --by <who>`; a mention is not a reading, post-mortem 2026-09-02 F3), or a person's waiver (`bin/gate-check.sh <project> --waive source/<rel> --reason "..."`), and no file on disk without an inventory row. This part **blocks** — `bin/gate-check.sh <project> 1` exits 1 on it, and so does Stage 2 — because it is a file test, not a conversation test: "the triage already used the deck" is grepped, not believed (the 2026-09-02 miss). The rest stays advisory. Record CAC-1b's outcome as a Stage-1 `Extraction scope:` decision naming what is in and what is out, so the next session isn't guessing. |
 | **Owner** | `ba-agent` |
 
@@ -660,7 +618,7 @@ is better input than the triage map ever was.
 |---|---|
 | **User defines** | Confirms business rules the code implies. Answers `openQuestions` (via SME). Narrative is never invented. |
 | **Agent produces** | BRD scaffolds → enrichment from `KB.md` → validation to clean. `F{NNN}.brd.json`. |
-| **Surface** | `analysis/brd-report.html` — `bin/brd-report.sh <project-root>`. One renderer for every entry mode: it reads BRDs, not source, so a requirements-driven or greenfield project gets the same surface as a migration, and so does a BRD no extractor produced. Each section carries a `report-schema.md` verdict, so a section that is empty because this kind of BRD has nothing to put there reads differently from one that is empty because something broke. Until 2026-08-19 this was `enrichment-summary.html`, built three times inside three pipelines against three different BRD key shapes — each copy rendered blanks for the other two’s output, and non-migration projects got no surface at all despite this row promising one. |
+| **Surface** | `analysis/brd-report.html` — `bin/brd-report.sh <project-root>`. One renderer for every entry mode: it reads BRDs, not source, so a requirements-driven or greenfield project gets the same surface as a migration, and so does a BRD no extractor produced. Each section carries a `report-schema.md` verdict, so a section that is empty because this kind of BRD has nothing to put there reads differently from one that is empty because something broke. History: `process/baseline-incident-history.md` §R20. |
 | **Gate** | Every BRD validation-clean; `validation-report.md` has 0 issues; **every `openQuestions` entry raised in chat** — `bin/open-questions.sh <root> --stage 2` reports 0 blocking, which `gate-check.sh` enforces. Close-out block pasted (§1b rule 7) — CAC-3 opens with it. "Chased to closure" was the old wording and it was unenforceable: a question logged with a self-answer read as closed. |
 | **Owner** | `ba-agent` |
 
diff --git a/skills/interview-protocol.md b/skills/interview-protocol.md
index 19302a9a..93394e80 100644
--- a/skills/interview-protocol.md
+++ b/skills/interview-protocol.md
@@ -113,14 +113,10 @@ Typical `user-only` questions, none of which a source can answer:
 2. **Never batch-approvable.** It cannot be one line of a batch that can be cleared with "approve
    all as recommended", because there is no recommendation to approve. Ask it on its own.
 
-*Real incident, 2026-08-19 (PROJECT-B).* "Are there branding inputs?" went in as line 7
-of a seven-item Stage 3 gate batch, carrying the recommended default *"no branding assets
-provided — use Atlas defaults."* The user approved the batch. There was in fact a real art
-direction — top-bar layout, industrial look, grey background, cool colours, the client wordmark in
-the shell — and a WCAG 2.1 AA target, and neither had ever been asked for. Both surfaced only
-when the user challenged the finished design system and asked why nobody had checked. The
-question had been treated as a `gap`. The recommendation was the entire defect: it converted
-"I don't know" into "I've decided", and a batch approval swallowed it.
+*Failure:* "Are there branding inputs?" rode in a seven-item batch with the default *"use Atlas
+defaults"*; the batch was approved, and a real art direction plus a WCAG AA target surfaced only
+after the design system was built. The recommendation converted "I don't know" into "I've
+decided" (2026-08-19, `process/baseline-incident-history.md` §IP1).
 
 **Design-system questions specifically.** Branding and accessibility are `user-only` on every
 project and are asked plainly and separately at the design step — not folded into a batched
@@ -248,12 +244,9 @@ tool-specific at all — it is the half that actually enforces the gate, and the
 without `AskUserQuestion` will drop first, because "I can't call that tool" reads as "skip this
 step" rather than "render it differently".
 
-*Why this is spelled out (real incident, 2026-08-19).* A dry run of this toolkit on GitHub
-Copilot on Windows produced the question *"AskUserQuestion doesn't seem installed, is that
-something we can include in the setup?"* It cannot be. Until then every call site here named
-the tool as **the** mechanism, so on a non-Claude agent the instruction was simply
-unfollowable — and an unfollowable gate is not a loud failure, it is a silent skip. Same shape
-as the Stage P false-green: the enforcement quietly evaporates and nothing says so.
+*Failure:* a Copilot dry run asked *"AskUserQuestion doesn't seem installed, is that something
+we can include in the setup?"* — while the tool was named as **the** mechanism, the gate was
+unfollowable off Claude Code, which is a silent skip, not a loud failure (2026-08-19, `process/baseline-incident-history.md` §IP2).
 
 ### 4. Record the answer where the collector can see it.
 
@@ -272,7 +265,7 @@ States the collector recognises — anything else normalises to `UNRECOGNISED` a
 |---|---|
 | `UNRAISED` | never put to the user. **Blocks.** |
 | `RAISED` | asked, awaiting the answer. Does not block. |
-| `ANSWERED` | settled, answer recorded. |
+| `ANSWERED` | settled; requires a non-empty `answer`. |
 | `ASSUMED` | you took a position **and the user consented** to you taking it. Requires `consentBy` and `consentAt`. Without both it normalises to `UNRAISED` and blocks — a position the user never saw is not an assumption they made. |
 | `MOOT` | descoped. Genuinely dead, not quietly dropped. |
 | `UNRECOGNISED` | an unparseable status. **Blocks**, on purpose. |
@@ -285,14 +278,9 @@ from `raisedAt` and the collector reads both.
 ## An answer that points at another document is a claim, not an answer
 
 The one form of answer that reads as settled and cannot be trusted: *"X already covers this."*
-Verbatim, from a real intake (2026-09-02, Q4 "documents not yet accounted for?"):
-
-> the `.pptx` is already inside `source/<track>/` and was already used as triage input by the
-> Group A–D triage pass (see `<track>-triage.md`) — nothing additional exists outside the folder.
-
-The triage never named the deck. Two months of downstream artifacts inherited the gap, because
-once Q4 read "answered" nothing had a reason to look again. The answer *cited a document*, which
-is exactly why it was believed.
+Failure: *"the `.pptx` … was already used as triage input by the Group A–D triage pass"* — the
+triage never named the deck, and two months of artifacts inherited the gap; the answer *cited a
+document*, which is exactly why it was believed (2026-09-02, `process/baseline-incident-history.md` §IP3; also `source-triage.md`).
 
 **Rule.** Before recording an answer of the form "X already handled Y": open X and find Y in it —
 `grep -il "<Y's name>" X`. Zero hits means the answer is "not yet accounted for", whatever the
diff --git a/skills/source-triage.md b/skills/source-triage.md
index 0fab3763..42555a37 100644
--- a/skills/source-triage.md
+++ b/skills/source-triage.md
@@ -31,15 +31,11 @@ the file), or a person's waiver (`bin/gate-check.sh <project> --waive source/<re
 un-inventoried. Added files re-enter through `init --refresh` — never through memory.
 
 > **A claim that another document already handled a file is a claim to verify, not an
-> answer.** Real incident, 2026-09-02, a VBA migration: intake Q4 ("documents not yet accounted
-> for?") was closed with *"the .pptx is already inside `source/` and was already used as triage
-> input by the Group A–D triage pass"*. The triage was derived from the `.cls` exports and never
-> named the deck; its 22 diagrams — the only place the workflow engine's X/M/E semantics were
-> written down — went unread for two months of BRDs, blueprint and build plan, and a `CONFIRMED`
-> architecture decision had to be reversed. The wrong answer *reads* right because it cites a
-> document. The right form is the ledger's: **name the artifact, and let the gate grep it.** A
-> text read of a deck is not the deck either — a 25-slide, 22-image container is consumed when
-> the disposition says `--pages 25 --media 22`, not when its title appears in a summary.
+> answer.** Failure: *"the .pptx … was already used as triage input"* closed an intake question;
+> the triage never named the deck, its 22 diagrams went unread for two months, and a `CONFIRMED`
+> architecture decision was reversed (2026-09-02, `process/baseline-incident-history.md` §ST1). The right form is the ledger's:
+> **name the artifact, and let the gate grep it.** A text read of a deck is not the deck — a
+> 25-slide, 22-image container is consumed when the disposition says `--pages 25 --media 22`.
 
 **Always stand up an extractor — reuse where one already covers this stack, build new otherwise.** Field finding: reading source without an extractor missed information even on small, cleanly structured apps — manual reading is not a substitute for the coverage an extractor gives you, it's a different (weaker) tool. The extractor *is* the coverage gate: it's what lets Step 3 below actually answer "is this reliable enough to trust," instead of relying on how thorough a manual read happened to be. There is no manual-only path anymore.
 
@@ -56,12 +52,10 @@ OpenAPI/GraphQL contract, or entity/field table definitions inside a spec docume
 extractable structure, each gets its own Coverage Matrix row in Step 3, and each gets its own
 verdict.
 
-Mixed corpora are where this goes wrong, and they are the normal case in presales. The folder
-*reads* like requirements, so the whole thing is sent down the document path (`kb-generation.md`,
-Path B) and comes back as prose — including the entities that were sitting in the schema, which
-then get re-derived by hand three stages later. Prose is the right reading method for prose and
-the wrong one for structure. Choosing per artifact is this step's job; routing a whole corpus by
-how it looks at a glance is the failure it exists to prevent.
+Mixed corpora — the normal case in presales — are where this goes wrong: the folder *reads*
+like requirements, all of it goes down Path B, and the schema's entities are re-derived by hand
+three stages later (anti-patterns below). Prose is the right reading method for prose and the
+wrong one for structure.
 
 **This does not reopen the two-way call.** Path B is not "read the code by hand" — it is the
 correct method for genuine prose. For every *extractable structure* the answer is still
@@ -83,21 +77,9 @@ file" was never the manual-only path it forbids — that rule is about *structur
 exports), where a human skim demonstrably drops the tail. Nothing here lets a codebase, a schema
 or a data export past without an extractor.
 
-**Field evidence, 2026-09-07** — a no-code app replacement whose corpus was one data export
-(`.ods`), one 3.5 MB reverse-engineering spec (`.html`) and one workflow inventory (`.md`):
-
-- The **export parser corrected the documents written about it**: 53 stored columns against
-  128–175 documented (~120 are computed in the platform — neither attributes to model nor data to
-  migrate), four different spellings of one foreign key across four sheets, 15 sheets where the
-  spec documented 17, plus per-sheet volumes. No reading of any document produces one of those.
-- A **regex classifier over the spec's prose scored ~50% precision and ~50% recall** against a
-  user-confirmed sample, and was deleted the same day. It read the spec's "what the recording
-  covered" bullets as requirements, truncated sentences at inline HTML tags, and matched none of
-  the negative-form statements ("there is no role model", "no reminders, no escalation") that
-  carried some of the sharpest requirements in the document. The same agent's plain read of the
-  same file, at intake, was better in one pass.
-- The user's question is the rule in one line: *"do we need an extractor for html & md files?
-  Can't we just analyse and conclude what it should be? But when it's ppt and images better yes?"*
+**Field evidence (2026-09-07, `process/baseline-incident-history.md` §ST3):** the export parser corrected the spec written about
+it (53 stored columns against 128–175 documented); a regex classifier over the spec's prose scored
+~50% precision and recall and was deleted the same day — the agent's plain read was better.
 
 **Large text-native files still need a denominator.** A 3.5 MB HTML spec is legible but not
 readable in one pass, so the parser that takes its tables should also emit its **section list**.
@@ -123,18 +105,9 @@ For a **requirements-driven** project the two are not alternatives and the seque
 So: **document discovery is unconditional; extractors are conditional on there being structure;
 `N/A` is a finding about the folder, never a property of the entry mode.**
 
-**Why this is spelled out (2026-09-07).** `conversion-runbook.md`'s Stage-0 applicability table
-said the extraction call was **`N/A` for requirements-driven**, flatly — while this skill and the
-shipped `triage.md` header said `N/A` only where the corpus holds no extractable structure, "on
-evidence, never on the entry-mode label". The runbook is the file every session is required to
-read first, so the unconditional version was the one that got followed. On the project that
-surfaced it — requirements-driven, corpus of one spec, one workflow inventory and **one platform
-data export** — following the runbook literally would have marked extraction `N/A` and left the
-export unparsed. That parser went on to correct the very documents written about the app: 53
-stored columns against 128–175 documented, four spellings of one foreign key across four sheets,
-15 sheets where the spec said 17. Same shape as the `toolkit-guide.html` first-touch incident in
-`CLAUDE.md`: a rule stated conditionally in its owning file and unconditionally in the front
-door, where the front door wins. The runbook now defers here.
+**This skill owns the rule; the runbook defers here.** Failure: the runbook once said `N/A` for
+requirements-driven flatly, and following it would have left a data export unparsed — the parser
+that later corrected the spec (`process/baseline-incident-history.md` §ST4).
 
 | Signal | Lean toward |
 |---|---|

From 76075d8a08d9daf243a7ec03aca5e39373a44de1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:44:55 +0000
Subject: [PATCH 3/7] =?UTF-8?q?fix(trim):=20review=20follow-ups=20?=
 =?UTF-8?q?=E2=80=94=20dispatch=20obligation=20pointer,=20stale=20"below",?=
 =?UTF-8?q?=20ST1=20id?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent review of #315: obligations.tsv still pointed at agent-roles.md for
step 8a, which moved to agents/README.md; agent-roles.md said the example bodies
are "below"; the history header cited a non-existent section id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 bin/lib/obligations.tsv              | 5 +++--
 process/baseline-incident-history.md | 2 +-
 skills/agent-roles.md                | 4 +++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bin/lib/obligations.tsv b/bin/lib/obligations.tsv
index 3bbb40c8..3c912083 100644
--- a/bin/lib/obligations.tsv
+++ b/bin/lib/obligations.tsv
@@ -137,8 +137,9 @@ fidelity	mdl	module	names	docs/PAGE-FIDELITY.tsv	no	yes	5	skills/ui-loop.md
 # module's own dispatch history. It is owed by mdl because mdl-agent is the one that knows, at
 # the moment of writing, whether it is the one writing.
 #
-# Column 9 names skills/agent-roles.md, not agents/mdl-agent.md: agent-roles.md's "Workflow"
-# step 8a is what actually specifies the log line, its path and format, and the discharge rule
+# Column 9 names skills/agent-roles.md, not agents/mdl-agent.md: the mdl-agent "Workflow" step 8a
+# (its full text now lives in agents/README.md, pointed to from agent-roles.md) specifies the log
+# line, its path and format, and the discharge rule
 # ("owes no denominator, just the line") — that is the governing text this column exists to
 # point at. The agent stub is the performer named in column 2 (mdl); it is not itself a skill
 # and holds no verdict of its own to point to (review of PR #99, 2026-09).
diff --git a/process/baseline-incident-history.md b/process/baseline-incident-history.md
index 9a3fe133..c863ea2d 100644
--- a/process/baseline-incident-history.md
+++ b/process/baseline-incident-history.md
@@ -7,7 +7,7 @@ moved verbatim so the evidence survives while the baseline stays inside the
 `bin/render-routing.sh --check` word budget (CLAUDE.md skill-authoring rule 6, "write for the
 trigger, then stop").
 
-Each section id (`R1`, `AR2`, …) is what the pointer in the skill cites. The section text is
+Each section id (`R1`, `ST1`, …) is what the pointer in the skill cites. The section text is
 the original wording, unedited — when a rule's justification is challenged, cite from here.
 Nothing in this file is a rule on its own; the rule lives in the skill that points here.
 
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index d9aca394..ba9c2e2a 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -14,7 +14,9 @@
 - You're asked to "set up agents for this project" or "create dev-process agents" on a fresh repo.
 - An existing project's agents feel ad hoc or over-permissioned (e.g. one agent can both write MDL and run `mxcli exec`).
 
-**This is a generation guide, not a copy-paste template.** The example bodies below are illustrative shapes — read the target project's own CLAUDE.md and skills first, then write agent files that match *that* project's actual commands, paths, and tooling. A gate-agent pointed at the wrong `.mpr` filename or a stale compile-gate command silently verifies nothing.
+**This is a generation guide, not a copy-paste template.** The example bodies (in `agents/README.md`) are illustrative shapes — read the target project's own CLAUDE.md and skills first, then write agent files that match *that* project's actual commands, paths, and tooling. A gate-agent pointed at the wrong `.mpr` filename or a stale compile-gate command silently verifies nothing.
+
+**Discharging the `dispatch` obligation:** the mdl-agent logs every dispatch per Workflow step 8a — the log line, path (`.claude/loop/dispatch/<Module>/scripts.tsv`) and format are in `agents/README.md` step 8a; one line per dispatch, no denominator owed.
 
 **Mechanical scaffolding exists:** `bin/init-agents.sh <session-root> [p|build|all]` copies stub versions of all **six** agents (from the toolkit's `agents/` folder) into the project's `.claude/agents/` — `p` for the Stage-P pair (ba/architect), `build` for the Stage-5 quartet (mdl/gate/test/**review**). The stubs are safe by construction: each refuses to run while `{{PLACEHOLDER}}`s remain, so "downloaded but never configured" fails loudly instead of verifying nothing. Your job after scaffolding is Steps 1–4 below: fill every placeholder from the *actual* project, including the **Domain context** block.
 

From cd67a7c33c391cb69e1c8bed24305e2641adcf6f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:59:35 +0000
Subject: [PATCH 4/7] chore(trim): correct the measured word counts in the
 CHANGELOG line

Measured with LC_ALL=C on the branch after master (#313) was merged in:
79,997 -> 76,259 (-3,738); the old line used pre-#313 figures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bad77127..507ad9ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
+- chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo

From 4b2afa6811676e5f605fe96a2d0cf8b4b5e7bec8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:04:30 +0000
Subject: [PATCH 5/7] Restatement guards: review fixes (done- order, applied
 record, in-order replay, STOP 29 command)

Review of #311 (held):
1. script-owners.sh orders and matches scripts with a leading done- removed: a raw sort put an
   executed done-05-x.mdl after 09-y.mdl and called the NEW 09 a replay; `-- supersedes: 05-x.mdl`
   stopped matching after the rename.
2. describe-baseline.sh record-applied <script> records each document's live hash after a write;
   verify reads SAME when the live body is the script's own recorded write (a re-run) or when a
   baselined document is absent (a rebuild onto a fresh model). exec.sh is not changed here: the
   one call it needs after a gate pass is proposed in the PR; the fixture runs that case only
   when exec.sh carries it (NOT RUN otherwise) and passes 67/67 with the patch applied.
3. Replaying older co-owned scripts in run order is quiet: the "replaying reverts O" verdicts
   ask the model first (document absent, or live body applied by this script or an older one).
   No ./mxcli to ask stays a conflict.
4. "Not found" matching follows recorded mxcli output (entity/constant not-found, rc 1) by shape:
   non-zero exit, no body, "not found: <Doc>"; "no describable document" and parse errors fail
   the call instead. No capture of a missing MICROFLOW/PAGE exists in the repo.
5. STOP 29 gives a pipe-free grep over mprcontents/ instead of the codec library.
6. Cut the Step 0 line that repeated STOP 22.

Fixture tests/wave2/test-restatement-guard.sh: 65 ok + 1 NOT RUN on this branch.

Refs #261
Refs #269
Refs #309

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |   2 +-
 project-bin/describe-baseline.sh      | 108 ++++++++++++++++++++++----
 project-bin/script-owners.sh          |  69 ++++++++++++----
 skills/learned-mdl-preflight.md       |   4 +-
 tests/wave2/test-restatement-guard.sh |  98 ++++++++++++++++++++++-
 5 files changed, 243 insertions(+), 38 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18854c22..94d3cfb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
+- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). Executed scripts renamed `done-` keep their run order and header names; a re-run after a clean exec (`describe-baseline.sh record-applied`), a rebuild onto a fresh model, and an in-order replay with `-- supersedes:` headers stay quiet. The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
 - fix(exec): **when mxbuild ran on the baseline and then crashes on the written model (no errors file, non-zero exit), the write is rolled back like a failed gate; the kept-write message now says STOP and names `restore-mpr.sh`; preflight STOP 29: DESCRIBE omits module-role and layout-row visibility, so a page restated from it silently loses them.** Field: a two-hop data source passed check, mxbuild's loader crashed, the write was kept and the next script ran on a model nothing could load; one page had 19 role-locked widgets DESCRIBE did not print, a snippet 56 row-visibility rules (refs [#309](https://github.com/MendixMau/mxcli-project-toolkit/pull/309)). — AlvinnYeo
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
diff --git a/project-bin/describe-baseline.sh b/project-bin/describe-baseline.sh
index fea7c056..2ade0cef 100755
--- a/project-bin/describe-baseline.sh
+++ b/project-bin/describe-baseline.sh
@@ -11,6 +11,18 @@
 #   bin/describe-baseline.sh verify <script.mdl>   re-DESCRIBE each baselined document and compare.
 #                                                 exit 0 all match · 1 drift (one DRIFT row each)
 #                                                 · 2 no baseline header · 3 could not DESCRIBE
+#   bin/describe-baseline.sh record-applied <script.mdl>
+#                                                 after a gate pass: record each document's live
+#                                                 hash as written BY this script (applied.tsv)
+#   bin/describe-baseline.sh live <KIND> <Doc>     prints sha256=<hex> or absent
+#   bin/describe-baseline.sh applied-by <Doc> <sha256=hex>
+#                                                 the scripts whose recorded write left that hash
+#
+# verify reads SAME — not DRIFT — in the two cases that are not a stale draft:
+#   the live body is this script's own recorded write (a re-run after a clean exec), and
+#   a baselined document is absent (a rebuild onto a fresh model: the script creates it).
+# Without the applied record a re-run of a stamped script read DRIFT, and under exec approval
+# `ask` that refused every re-run and every from-empty rebuild.
 #
 # "Restates" = `create or modify|create or replace microflow|nanoflow|page|snippet` — the
 # statements whose body replaces whatever is live (script-owners.sh docs, one parser). A plain
@@ -33,7 +45,14 @@
 # them with the hash unchanged — learned-mdl-preflight.md has the STOP row for that.
 #
 # DESCRIBE runs through the project's own ./mxcli: `mxcli -p <app>.mpr -c "DESCRIBE <KIND> <Doc>"`.
-# A document that does not exist exits non-zero ("... not found"), recorded as `absent`.
+# A missing document: exit non-zero and "<kind> not found: <Doc>", recorded as `absent`. That
+# text is real mxcli output recorded in this repo, never imagined: `Error: entity not found:
+# ZKT35.Widget (duration: 1.022958ms)`, EXIT 1 (a 2026-08-07 retest log under bug-logs/)
+# and `Error: constant not found: Nope.X`, rc 1 (v0.24.0, project-bin/conformance-check.sh). No
+# capture for a missing MICROFLOW/PAGE exists here, so the match is on the shape — non-zero exit,
+# no DESCRIBE body, "not found:" followed by this document's name — and never on a parse error
+# or "no describable document named" (both verbatim v0.24.0, conformance-check.sh), which say
+# nothing about the model and fail the call (exit 3).
 # Golden DESCRIBE output: mxcli v0.23.0 captures in tests/wave2/fixtures/context-pack/capture/.
 # Consumer: exec.sh runs `verify` before every MDL write that carries a baseline header
 # (warn-first; MXTK_RESTATE_GUARD=refuse or exec approval `ask` makes drift a refusal).
@@ -42,7 +61,7 @@
 set -u
 
 usage() {
-  sed -n '3,14p' "$0" | sed 's/^# \{0,1\}//' >&2
+  sed -n '3,20p' "$0" | sed 's/^# \{0,1\}//' >&2
   exit 2
 }
 
@@ -50,12 +69,33 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 . "$HERE/_common.sh"
 
 CMD="${1:-}"; SCRIPT="${2:-}"
-case "$CMD" in stamp|verify) ;; *) usage ;; esac
-[ -f "$SCRIPT" ] || usage
+case "$CMD" in
+  stamp|verify|record-applied) [ -f "$SCRIPT" ] || usage ;;
+  live) [ $# -eq 3 ] || usage ;;
+  applied-by) [ $# -eq 3 ] || usage ;;
+  *) usage ;;
+esac
 OWNERS="$HERE/script-owners.sh"
 [ -f "$OWNERS" ] || { echo "describe-baseline: $OWNERS is not installed (run sync-project.sh)" >&2; exit 3; }
 
 CACHE="$PROJECT_ROOT/.claude/loop/describe-baseline"
+APPLIED="$CACHE/applied.tsv"   # epoch <tab> script key <tab> Doc <tab> sha256=<hex>
+
+# A script's key: its path relative to the project root with a leading done- taken off the file
+# name (iterative-build-loop.md renames an executed script done-<name>); script-owners.sh sorts
+# and matches on the same key.
+script_key() {  # $1 = script path
+  local abs rel b
+  abs="$(cd "$(dirname "$1")" 2>/dev/null && pwd)/$(basename "$1")"
+  rel="${abs#"$PROJECT_ROOT"/}"
+  b="$(basename "$rel" | sed 's/^done-//')"
+  printf '%s/%s\n' "$(dirname "$rel")" "$b"
+}
+# applied_keys <Doc> <sha256=hex> → every script key whose recorded write left that hash.
+applied_keys() {
+  [ -f "$APPLIED" ] || return 0
+  awk -F'\t' -v d="$1" -v h="$2" '$3 == d && $4 == h && !seen[$2]++ { print $2 }' "$APPLIED"
+}
 
 # KIND <tab> Doc for every restated document, first occurrence order, unique.
 restated() {
@@ -73,19 +113,57 @@ need_mxcli() {
 # Prints the hash (or "absent") of DESCRIBE <kind> <doc>; keeps the text in the cache.
 # Returns 1 when DESCRIBE failed for a reason other than "not found".
 describe_hash() {  # $1 = KIND, $2 = Doc
-  local out err rc h
+  local out err rc h all body
   err="$(mktemp "${TMPDIR:-/tmp}/dbl-err.XXXXXX")"
-  out="$("$MXCLI" -p "$MPR" -c "DESCRIBE $1 $2" 2>"$err")"; rc=$?
+  rc=0
+  out="$("$MXCLI" -p "$MPR" -c "DESCRIBE $1 $2" 2>"$err")" || rc=$?
+  # Which stream carries "Error: ..." is not recorded in the captures, so read both. The
+  # "Connected to: <path>" line seen in the recorded REPL-style output is not part of the body.
+  body="$(printf '%s\n' "$out" | tr -d '\r' | grep -v '^Connected to:' || true)"
   if [ "$rc" -ne 0 ]; then
-    if grep -qi 'not found' "$err"; then rm -f "$err"; echo absent; return 0; fi
-    sed 's/^/    mxcli: /' "$err" >&2; rm -f "$err"; return 1
+    all="$(printf '%s\n' "$out"; cat "$err")"
+    if [ -z "$(printf '%s' "$body" | grep -v '^Error:' | tr -d '[:space:]')" ] \
+       && ! printf '%s\n' "$all" | grep -qE 'Parse error|no describable document' \
+       && printf '%s\n' "$all" | grep -qiF "not found: $2"; then
+      rm -f "$err"; echo absent; return 0
+    fi
+    printf '%s\n' "$all" | sed 's/^/    mxcli: /' >&2; rm -f "$err"; return 1
   fi
   rm -f "$err"
-  h="$(printf '%s\n' "$out" | tr -d '\r' | mxtk_sha256)"
-  mkdir -p "$CACHE" 2>/dev/null && printf '%s\n' "$out" | tr -d '\r' > "$CACHE/$h.mdl" 2>/dev/null
+  h="$(printf '%s\n' "$body" | mxtk_sha256)"
+  mkdir -p "$CACHE" 2>/dev/null && printf '%s\n' "$body" > "$CACHE/$h.mdl" 2>/dev/null
   echo "sha256=$h"
 }
 
+if [ "$CMD" = live ]; then
+  need_mxcli || exit 3
+  describe_hash "$2" "$3" || exit 3
+  exit 0
+fi
+if [ "$CMD" = applied-by ]; then
+  applied_keys "$2" "$3"
+  exit 0
+fi
+if [ "$CMD" = record-applied ]; then
+  # Every document the script names (create too: a re-run of a plain create is refused by
+  # mxcli anyway, but its body is still the script's own write for a later co-owner).
+  need_mxcli || exit 3
+  KEY="$(script_key "$SCRIPT")"
+  mkdir -p "$CACHE" 2>/dev/null || exit 3
+  n=0
+  while IFS='	' read -r kind doc; do
+    [ -n "$doc" ] || continue
+    v="$(describe_hash "$kind" "$doc")" || continue
+    [ "$v" = absent ] && continue
+    printf '%s\t%s\t%s\t%s\n' "$(date +%s)" "$KEY" "$doc" "$v" >> "$APPLIED"
+    n=$((n + 1))
+  done <<EOF
+$(bash "$OWNERS" docs "$SCRIPT" | awk -F'\t' '{ k = $1 "\t" $2; if (!(k in s)) { s[k] = 1; print k } }')
+EOF
+  echo "describe-baseline: recorded $n applied document(s) for $KEY"
+  exit 0
+fi
+
 if [ "$CMD" = stamp ]; then
   need_mxcli || exit 3
   DOCS="$(restated)"
@@ -115,6 +193,7 @@ if [ -z "$LINES" ]; then
 fi
 need_mxcli || exit 3
 KINDS="$(restated)"
+KEY="$(script_key "$SCRIPT")"
 RC=0
 while read -r doc want; do
   [ -n "$doc" ] || continue
@@ -122,10 +201,11 @@ while read -r doc want; do
   if [ -z "$kind" ]; then echo "STALEHEADER	$doc	the script no longer restates it — re-stamp"; continue; fi
   have="$(describe_hash "$kind" "$doc")" || { echo "UNKNOWN	$doc	DESCRIBE failed"; [ "$RC" -eq 0 ] && RC=3; continue; }
   if [ "$have" = "$want" ]; then echo "SAME	$doc"; continue; fi
-  case "$want/$have" in
-    absent/*) why="created since the script was drafted" ;;
-    */absent) why="deleted since the script was drafted" ;;
-    *)        why="changed since the script was drafted" ;;
+  if [ "$have" = absent ]; then echo "SAME	$doc	absent: this script creates it (a rebuild)"; continue; fi
+  if applied_keys "$doc" "$have" | grep -qxF "$KEY"; then echo "SAME	$doc	live body is this script's own recorded write"; continue; fi
+  case "$want" in
+    absent) why="created since the script was drafted" ;;
+    *)      why="changed since the script was drafted" ;;
   esac
   echo "DRIFT	$doc	$why"
   old="$CACHE/${want#sha256=}.mdl"; new="$CACHE/${have#sha256=}.mdl"
diff --git a/project-bin/script-owners.sh b/project-bin/script-owners.sh
index c9cc162d..4aba5d7b 100755
--- a/project-bin/script-owners.sh
+++ b/project-bin/script-owners.sh
@@ -33,17 +33,27 @@
 #                                             whether O sorts before S (S is a new restatement
 #                                             that needs a supersedes header) or after it
 #                                             (S is an older script being replayed)
-# Run order is the path order under mdlsource/ (LC_ALL=C sort), which is how numbered scripts
-# are run. A script outside mdlsource/ (a scratch file) owns nothing; every owner is "other".
+# Run order is the path order under mdlsource/ (LC_ALL=C sort) with a leading `done-` taken off
+# the file name: iterative-build-loop.md renames an executed script `done-<name>`, and a raw sort
+# put done-05-x.mdl after 09-y.mdl, so a NEW 09 was reported as "replaying reverts done-05" —
+# backwards. Header names match the same way: `-- supersedes: 05-x.mdl` still names
+# done-05-x.mdl after the rename. A script outside mdlsource/ (a scratch file) owns nothing.
+#
+# REPLAY IN RUN ORDER IS NOT A CONFLICT. On a rebuild every older script runs before the script
+# that supersedes it; warning there trains people to ignore the warning. So the two "replaying
+# reverts O" verdicts ask the model first (describe-baseline.sh live / applied-by, siblings):
+# the document absent → nothing to revert; its live body recorded as applied by this script or
+# an older one → O's work is not live yet. Anything else, or no ./mxcli to ask, stays a CONFLICT.
 #
 # Not a parser: the same comment/string/$$-body blanking and bracket depth as exec.sh's change
 # class lexer, then only statement heads at depth 0 are read, so a caption saying "create page"
 # or a widget line never counts. Unlike that lexer, a string literal may span lines (a real
 # `find($Clean, '<newline>')` in skills/agents-examples/single-call.example.mdl hid the next
-# microflow from a per-line lexer: the open quote left the bracket depth at 1). Golden input is real MDL: mxcli v0.23.0 DESCRIBE captures
-# (tests/wave2/fixtures/context-pack/capture/describe/), the shipped StyleGallery mdlsource tree
-# and skills/agents-examples/*.mdl (tests/wave2/test-script-owners.sh). `*.test.mdl` files are
-# skipped: they are microflow tests, not build steps.
+# microflow from a per-line lexer: the open quote left the bracket depth at 1). Golden input is
+# real MDL: mxcli v0.23.0 DESCRIBE captures (tests/wave2/fixtures/context-pack/capture/describe/),
+# the shipped StyleGallery mdlsource tree and skills/agents-examples/*.mdl
+# (tests/wave2/test-restatement-guard.sh). `*.test.mdl` files are skipped: they are microflow
+# tests, not build steps.
 #
 # Producer for every consumer (CLAUDE.md "Shipping an instrument" rule 5): the input is the
 # project's own mdlsource/, written by every build step; the consumers are exec.sh (check, every
@@ -105,11 +115,18 @@ so_docs() {  # $1 = script
   awk "$_SO_AWK" "$1"
 }
 
-# Header values: `-- supersedes: a.mdl, b.mdl` → one basename per line.
+# A script's identity: its file name without a leading done- (the executed-script rename).
+so_key() { basename "$1" | sed 's/^done-//'; }
+# Sort key: the path with that prefix removed from the file name.
+so_sortkey() { printf '%s/%s\n' "$(dirname "$1")" "$(so_key "$1")"; }
+# True when path $1 runs before path $2.
+so_before() { [ "$(printf '%s\n%s\n' "$(so_sortkey "$1")" "$(so_sortkey "$2")" | LC_ALL=C sort | head -1)" = "$(so_sortkey "$1")" ]; }
+
+# Header values: `-- supersedes: a.mdl, b.mdl` → one name per line, done- taken off.
 so_header() {  # $1 = script, $2 = supersedes|superseded-by
   sed -nE "s/^[[:space:]]*--[[:space:]]*$2:[[:space:]]*(.*)$/\1/p" "$1" 2>/dev/null \
     | tr ',' '\n' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//; s/[[:space:]].*$//' \
-    | sed -E 's#.*/##' | grep -v '^$' || true
+    | sed -E 's#.*/##; s/^done-//' | grep -v '^$' || true
 }
 
 so_root() {  # $1 = optional project root
@@ -121,7 +138,9 @@ so_root() {  # $1 = optional project root
 
 so_scripts() {  # $1 = root → every build script under mdlsource/, run order, root-relative
   [ -d "$1/mdlsource" ] || return 0
-  ( cd "$1" && find mdlsource -type f -name '*.mdl' ! -name '*.test.mdl' 2>/dev/null | LC_ALL=C sort )
+  ( cd "$1" && find mdlsource -type f -name '*.mdl' ! -name '*.test.mdl' 2>/dev/null ) \
+    | awk '{ k = $0; n = split(k, a, "/"); sub(/^done-/, "", a[n]); k = a[1]; for (i = 2; i <= n; i++) k = k "/" a[i]; print k "\t" $0 }' \
+    | LC_ALL=C sort | cut -f2
 }
 
 so_index() {  # $1 = root → "doc <tab> script" for every owner, run order
@@ -166,7 +185,25 @@ case "$cmd" in
     S_ABS="$(cd "$(dirname "$S")" && pwd)/$(basename "$S")"
     S_REL="${S_ABS#"$ROOT"/}"
     [ "$S_REL" = "$S_ABS" ] && S_REL=""
-    S_BASE="$(basename "$S")"
+    S_KEY="$(so_key "$S")"
+    DBL="$(dirname "$0")/describe-baseline.sh"
+    # 0 when O's work on doc $1 ("KIND Module.Name") is not live, so replaying S reverts nothing.
+    not_live() {
+      local kind="${1%% *}" doc="${1#* }" live keys k
+      [ -f "$DBL" ] || return 1
+      live="$(PROJECT_ROOT="$ROOT" bash "$DBL" live "$kind" "$doc" 2>/dev/null)" || return 1
+      [ "$live" = absent ] && return 0
+      keys="$(PROJECT_ROOT="$ROOT" bash "$DBL" applied-by "$doc" "$live" 2>/dev/null)"
+      [ -n "$keys" ] || return 1
+      while IFS= read -r k; do   # applied-by prints root-relative paths, done- already removed
+        [ -n "$k" ] || continue
+        [ "$k" = "$(so_sortkey "${S_REL:-$S}")" ] && continue
+        so_before "$k" "${S_REL:-$S}" || return 1
+      done <<KEYS
+$keys
+KEYS
+      return 0
+    }
     MY_SUP="$(so_header "$S" supersedes)"
     MY_SUPBY="$(so_header "$S" superseded-by)"
     DOCS="$(so_docs "$S" | awk -F'\t' '{ print $1 " " $2 }' | LC_ALL=C sort -u)"
@@ -176,18 +213,18 @@ case "$cmd" in
       [ -n "$d" ] || continue
       printf '%s\n' "$IDX" | awk -F'\t' -v d="$d" '$1 == d { print $2 }' | while IFS= read -r o; do
         [ "$o" = "$S_REL" ] && continue
-        ob="$(basename "$o")"
-        if printf '%s\n' "$MY_SUP" | grep -qxF "$ob" || so_header "$ROOT/$o" superseded-by | grep -qxF "$S_BASE"; then
+        ob="$(so_key "$o")"
+        if printf '%s\n' "$MY_SUP" | grep -qxF "$ob" || so_header "$ROOT/$o" superseded-by | grep -qxF "$S_KEY"; then
           continue
         fi
-        if printf '%s\n' "$MY_SUPBY" | grep -qxF "$ob" || so_header "$ROOT/$o" supersedes | grep -qxF "$S_BASE"; then
-          echo "CONFLICT	$d	$o	superseded: $o supersedes this script — replaying it reverts $o"
+        if printf '%s\n' "$MY_SUPBY" | grep -qxF "$ob" || so_header "$ROOT/$o" supersedes | grep -qxF "$S_KEY"; then
+          not_live "$d" || echo "CONFLICT	$d	$o	superseded: $o supersedes this script — replaying it reverts $o"
         elif [ -z "$S_REL" ]; then
           echo "CONFLICT	$d	$o	owned by $o; this script is outside mdlsource/"
-        elif [ "$(printf '%s\n%s\n' "$o" "$S_REL" | LC_ALL=C sort | head -1)" = "$o" ]; then
+        elif so_before "$o" "$S_REL"; then
           echo "CONFLICT	$d	$o	older owner $o — a new restatement needs '-- supersedes: $ob'"
         else
-          echo "CONFLICT	$d	$o	newer owner $o — replaying this script reverts it"
+          not_live "$d" || echo "CONFLICT	$d	$o	newer owner $o — replaying this script reverts it"
         fi
       done
     done <<EOF
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index 92975d19..b97bdd15 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -24,8 +24,6 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 
 **Also decide, per document, where it lands.** Any operation that *creates* a document — page, snippet, microflow, nanoflow — needs its folder chosen now and written into the `folder` property of the same statement, not fixed afterwards. Read the path off the brief's `### Document folder plan`; when there is no row for it, derive it per `module-folder-convention.md` ("Deciding the path"), and escalate rather than guess when the feature group is unclear. Omitting `folder` is legal MDL that silently drops the document at module root — no error, no gate, and a cleanup job later that nobody schedules.
 
-**And decide which script owns each document.** Change a document in the script that created it, or with `alter` — a second full restatement makes every replay of the older script a silent revert (STOP 21).
-
 **Companion skills:** `bug-logs/mxcli-bugs.md` (bug detail), `iterative-build-loop.md` (exec discipline), `learned-microflow-patterns.md` (annotation and association rules)
 
 ---
@@ -62,7 +60,7 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
-| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → scan the unit first** (`project-bin/mxunit_bson.py`) for `ConditionalVisibilitySettings` with `ModuleRoles`, or on a `LayoutGridRow`/`Column`. None: restate. Otherwise rewrite each rule as container `Visible:` or flow access, or use `alter page` / Studio Pro. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): a page with 19 role-locked widgets, a snippet with 56 row rules — none printed; restated, all gates pass and the rules vanish. The STOP 21 baseline hashes DESCRIBE, so it cannot see this. |
+| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → grep its unit first:** `grep -la -e ModuleRoles -e ConditionalVisibilitySettings /dev/null $(grep -rlF '<Doc name>' mprcontents/)` (in the `.mpr` folder; it also lists units that merely name the document). None listed: restate. Otherwise check the hits in Studio Pro (a setting can be empty); rewrite each real rule as container `Visible:` or flow access, or use `alter page` / Studio Pro. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): a page with 19 role-locked widgets, a snippet with 56 row rules — none printed; restated, all gates pass and the rules vanish. The STOP 21 baseline hashes DESCRIBE, so it cannot see this. |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).
 
diff --git a/tests/wave2/test-restatement-guard.sh b/tests/wave2/test-restatement-guard.sh
index 638a3d45..bb31924c 100644
--- a/tests/wave2/test-restatement-guard.sh
+++ b/tests/wave2/test-restatement-guard.sh
@@ -83,6 +83,18 @@ cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/09-reject-f
 { echo "-- superseded-by: 09-reject-fix.mdl"; cat "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; } > "$O/mdlsource/05-reject.mdl"
 OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
 [ "$RC" -eq 0 ] && ok "-- superseded-by: in the old script settles it too" || bad "superseded-by ignored (rc $RC): $OUT"
+# iterative-build-loop.md renames an executed script done-<name>; run order and header names
+# must survive that (a raw sort put done-05 after 09 and called the NEW script a replay).
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/done-05-reject.mdl"; rm -f "$O/mdlsource/05-reject.mdl"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$O/mdlsource/09-reject-fix.mdl"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && has "done-05 still runs before 09: older owner, not 'newer'" "$OUT" "older owner mdlsource/done-05-reject.mdl" || bad "done- ordering rc $RC: $OUT"
+hasnt "  and the new script is not called a replay" "$OUT" "newer owner"
+OUT="$(bash "$OWNERS" report "$O" 2>&1)"
+has "report keeps run order across the rename" "$OUT" "2 scripts: mdlsource/done-05-reject.mdl, mdlsource/09-reject-fix.mdl"
+{ echo "-- supersedes: 05-reject.mdl"; cat "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; } > "$O/mdlsource/09-reject-fix.mdl"
+OUT="$(bash "$OWNERS" check "$O/mdlsource/09-reject-fix.mdl" "$O" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "'-- supersedes: 05-reject.mdl' still names done-05-reject.mdl" || bad "supersedes lost after rename (rc $RC): $OUT"
 
 # ── fixture project for baseline + exec.sh ───────────────────────────────────
 P="$WORK/proj"
@@ -100,19 +112,27 @@ D=".mpr-snapshots/$(date +%Y%m%d-%H%M%S)-$$"
 mkdir -p "$D"; cp Fixture.mpr "$D/"; cp -r mprcontents "$D/"
 echo "Snapshot saved: $D"
 SNAP
-# Fake mxcli: check passes, exec appends to the model, DESCRIBE replays live/<KIND>__<Name>.out
-# (copies of the v0.23.0 captures) and answers "not found" for anything else, as the real one did.
+# Fake mxcli: check passes, exec appends to the model (and, with FAKE_APPLY="<src>=<dst>", puts
+# the script's body into live/ the way a real exec changes what DESCRIBE prints). DESCRIBE replays
+# live/<KIND>__<Name>.out (copies of the v0.23.0 captures). A missing document answers in the
+# recorded shape "Error: entity not found: ZKT35.Widget (duration: 1.022958ms)", exit 1
+# (a 2026-08-07 retest log under bug-logs/), with this kind and name; Bad.Parse answers
+# the verbatim v0.24.0 "no describable document named" refusal (conformance-check.sh).
 cat > "$P/mxcli" <<'MXCLI'
 #!/usr/bin/env bash
 D="$(cd "$(dirname "$0")" && pwd)"
 case "${1:-}" in
   check) exit 0 ;;
-  exec)  echo "fake mxcli exec"; echo "written by the script" >> "$D/Fixture.mpr"; exit 0 ;;
+  exec)  echo "fake mxcli exec"; echo "written by the script" >> "$D/Fixture.mpr"
+         [ -n "${FAKE_APPLY:-}" ] && cp "${FAKE_APPLY%%=*}" "$D/live/${FAKE_APPLY#*=}"; exit 0 ;;
 esac
 q="${4:-}"; q="${q#DESCRIBE }"; name="${q##* }"; kind="${q% *}"
 f="$D/live/${kind}__${name}.out"
 [ -f "$f" ] && { cat "$f"; exit 0; }
-echo "Error: $(printf '%s' "$kind" | tr 'A-Z' 'a-z') not found: $name" >&2; exit 1
+if [ "$name" = Bad.Parse ]; then
+  echo "Error: no describable document named \"Bad.Parse\" found in the project; specify the type explicitly" >&2; exit 1
+fi
+echo "Error: $(printf '%s' "$kind" | tr 'A-Z' 'a-z') not found: $name (duration: 1.022958ms)" >&2; exit 1
 MXCLI
 cat > "$WORK/mxbuild" <<'MXB'
 #!/usr/bin/env bash
@@ -159,6 +179,34 @@ has "absent at draft, present now" "$OUT" "DRIFT	Sales.ACT_ApprovalStep_Hold	cre
 hasnt "the unchanged microflow is not reported" "$OUT" "DRIFT	Sales.ACT_ApprovalStep_Approve"
 rm -f "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Hold.out"
 
+echo "-- baseline: re-run after a clean exec, and a rebuild onto a fresh model, are not drift"
+B="$P/mdlsource/11-reject-own.mdl"
+sed "s/A comment is required to reject./A reason is required./" "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" > "$B"
+( cd "$P" && bash bin/describe-baseline.sh stamp "$B" ) >/dev/null 2>&1
+LIVE_BEFORE="$(cat "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out")"
+grep -v '^-- baseline:' "$B" > "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"   # the exec wrote B's body
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$B" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && ok "[control] without an applied record the script's own write reads as drift" || bad "[control] rc $RC — the applied cases below prove nothing"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh record-applied "$B" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && has "record-applied records the written document" "$OUT" "recorded 1 applied" || bad "record-applied rc $RC: $OUT"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$B" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && has "re-run: live body is the script's own write → SAME" "$OUT" "own recorded write" || bad "re-run after exec rc $RC: $OUT"
+mv "$B" "$P/mdlsource/done-11-reject-own.mdl"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$P/mdlsource/done-11-reject-own.mdl" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "  still SAME after the done- rename" || bad "done- rename broke the applied match (rc $RC): $OUT"
+rm -f "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$P/mdlsource/done-11-reject-own.mdl" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && has "fresh model: absent → SAME (the script creates it)" "$OUT" "absent: this script creates it" || bad "rebuild rc $RC: $OUT"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$P/live/"   # neither the draft-time body nor B's
+OUT="$(cd "$P" && bash bin/describe-baseline.sh verify "$P/mdlsource/done-11-reject-own.mdl" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && ok "someone else's body is still drift" || bad "foreign body rc $RC: $OUT"
+rm -f "$P/mdlsource/done-11-reject-own.mdl"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh live MICROFLOW Bad.Parse 2>&1)"; RC=$?
+[ "$RC" -eq 3 ] && ok "'no describable document' is a failed call, never 'absent'" || bad "refusal read as rc $RC: $OUT"
+OUT="$(cd "$P" && bash bin/describe-baseline.sh live MICROFLOW Sales.Nope 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && [ "$OUT" = absent ] && ok "the recorded not-found shape reads absent" || bad "not-found rc $RC: $OUT"
+printf '%s\n' "$LIVE_BEFORE" > "$P/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"   # the drifted body again
+
 # ── exec.sh: warn / refuse / ask / off ───────────────────────────────────────
 run() {  # env... ; runs exec.sh on $S; prints output; rc in $WORK/rc
   ( cd "$P" && SKIP_BASELINE=1 SKIP_DOCTOR=1 SP_RESTART=0 MXTK_NO_INSTALL=1 MXTK_NO_SCORE=1 \
@@ -210,6 +258,48 @@ OUT="$(run)"; RC=$(cat "$WORK/rc")
 hasnt "  and no stale-draft warning" "$OUT" "Stale draft"
 reset_model
 
+# ── replay in run order (a rebuild) is quiet; replaying after the newer owner landed is not ──
+echo "-- owners: replay in run order with supersedes headers"
+R="$WORK/rebuild"; mkdir -p "$R/bin" "$R/live" "$R/mdlsource"
+cp "$P/bin/"*.sh "$R/bin/"; cp "$P/mxcli" "$R/"; printf 'not a real model\n' > "$R/Fixture.mpr"
+cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$R/mdlsource/05-reject.mdl"
+{ echo "-- supersedes: 05-reject.mdl"; sed "s/A comment is required to reject./A reason is required./" "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; } > "$R/mdlsource/09-reject-fix.mdl"
+own() { ( cd "$R" && PROJECT_ROOT="$R" bash bin/script-owners.sh check "$1" "$R" ) 2>&1; }
+applied() { cp "$1" "$R/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"; ( cd "$R" && PROJECT_ROOT="$R" bash bin/describe-baseline.sh record-applied "$1" ) >/dev/null 2>&1; }
+OUT="$(own mdlsource/05-reject.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "fresh model: replaying 05 before 09 is quiet" || bad "rebuild step 05 warned (rc $RC): $OUT"
+applied "$R/mdlsource/05-reject.mdl"
+OUT="$(own mdlsource/05-reject.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "05's own write is live: re-running 05 is quiet" || bad "re-run of 05 warned (rc $RC): $OUT"
+OUT="$(own mdlsource/09-reject-fix.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "then 09 (supersedes 05) is quiet" || bad "rebuild step 09 warned (rc $RC): $OUT"
+grep -v '^-- supersedes' "$R/mdlsource/09-reject-fix.mdl" > "$WORK/09.body"; applied "$R/mdlsource/09-reject-fix.mdl"
+cp "$WORK/09.body" "$R/live/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out"
+( cd "$R" && PROJECT_ROOT="$R" bash bin/describe-baseline.sh record-applied mdlsource/09-reject-fix.mdl ) >/dev/null 2>&1
+OUT="$(own mdlsource/05-reject.mdl)"; RC=$?
+[ "$RC" -eq 1 ] && has "09's write is live: replaying 05 now is the conflict" "$OUT" "superseded: mdlsource/09-reject-fix.mdl" || bad "replay over 09 rc $RC: $OUT"
+rm -rf "$R/live"/*; rm -f "$R/mxcli"
+OUT="$(own mdlsource/05-reject.mdl)"; RC=$?
+[ "$RC" -eq 1 ] && ok "no ./mxcli to ask: stays a conflict (never quiet by default)" || bad "no-mxcli rc $RC: $OUT"
+
+# ── exec.sh records what it wrote (proposed exec.sh line, see the PR) ────────
+echo "-- exec.sh: a clean exec records its write, so the re-run is not stale"
+if grep -q 'describe-baseline.sh" record-applied' "$SUBJECT"; then
+  E="$P/mdlsource/12-reject-again.mdl"
+  sed "s/A comment is required to reject./Say why./" "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" > "$E"
+  ( cd "$P" && bash bin/describe-baseline.sh stamp "$E" ) >/dev/null 2>&1
+  { echo "-- supersedes: 05-reject.mdl, 10-reject-msg.mdl"; cat "$E"; } > "$E.t" && mv "$E.t" "$E"
+  grep -v '^--' "$E" > "$WORK/12.body"; commit_model
+  OUT="$(FAKE_APPLY="$WORK/12.body=MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" RUN_SCRIPT=mdlsource/12-reject-again.mdl run)"; RC=$(cat "$WORK/rc")
+  [ "$RC" -eq 0 ] && hasnt "first exec: no stale-draft warning" "$OUT" "Stale draft" || bad "first exec rc $RC"
+  commit_model
+  OUT="$(RUN_SCRIPT=mdlsource/12-reject-again.mdl MXTK_ROOT="$TOOLKIT" CLAUDE_EXEC_APPROVAL=ask run)"; RC=$(cat "$WORK/rc")
+  [ "$RC" -eq 0 ] && hasnt "re-run under ask: no stale-draft refusal" "$OUT" "Stale draft" || bad "re-run under ask rc $RC: $(tail -4 "$WORK/out")"
+  printf 'not a real model\n' > "$P/Fixture.mpr"; cp "$CAP/MICROFLOW__Sales.ACT_ApprovalStep_Reject.out" "$P/live/"; rm -f "$E"; commit_model
+else
+  echo "  NOT RUN — this exec.sh does not call 'describe-baseline.sh record-applied' after a gate pass yet"
+fi
+
 # ── crash: mxbuild ran on the baseline, crashed after the write ──────────────
 echo "-- crash: mxbuild crashes on the written model"
 printf 'CREATE MODULE "Nope";\n' > "$P/mdlsource/20-crash.mdl"; commit_model

From 3d3e7894ed53d4eedd8f3464609393a9755bfc44 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:09:04 +0000
Subject: [PATCH 6/7] learned-mdl-preflight: shorten STOP 16/22/23 evidence
 cells to fit the baseline budget after merging master

Master sits at 79997 of 80000 baseline words; this branch's STOP 21/29 text needs room.
Instruction cells are unchanged; only incident history is compressed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                    |  2 +-
 skills/learned-mdl-preflight.md | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cde21353..2aacbace 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). Executed scripts renamed `done-` keep their run order and header names; a re-run after a clean exec (`describe-baseline.sh record-applied`), a rebuild onto a fresh model, and an in-order replay with `-- supersedes:` headers stay quiet. The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
+- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership; the evidence cells of STOP 16, 22 and 23 are shortened to pay for it in the baseline word budget.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). Executed scripts renamed `done-` keep their run order and header names; a re-run after a clean exec (`describe-baseline.sh record-applied`), a rebuild onto a fresh model, and an in-order replay with `-- supersedes:` headers stay quiet. The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
 - fix(exec): **when mxbuild ran on the baseline and then crashes on the written model (no errors file, non-zero exit), the write is rolled back like a failed gate; the kept-write message now says STOP and names `restore-mpr.sh`; preflight STOP 29: DESCRIBE omits module-role and layout-row visibility, so a page restated from it silently loses them.** Field: a two-hop data source passed check, mxbuild's loader crashed, the write was kept and the next script ran on a model nothing could load; one page had 19 role-locked widgets DESCRIBE did not print, a snippet 56 row-visibility rules (refs [#309](https://github.com/MendixMau/mxcli-project-toolkit/pull/309)). — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index b97bdd15..b28834c1 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -52,15 +52,15 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | v0.24.0: revoke + re-grant no longer drops another role's grant (`mx check` 0 errors); the merge on a lone `grant` remains. |
 | 17 | *(retired 2026-09-30 — uppercase `AND`/`OR` with `!=` builds at 0 errors)* | | |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | v0.24.0: with the callee already in the model, `check` and `exec` refuse a call-microflow with an unmapped parameter, a missing callee, and a `JUMP TO` that is not a real activity name (MDL-WF05). With the callee created **in the same script**, `check --references` skips the call and `exec` auto-fills the `WITH` mapping — a non-context parameter gets `(Name = '$WorkflowContext')` — and `mx check` fails with CE0117 at the call. A context-typed parameter auto-maps fine. `mxcli lint` does not flag it. Earlier incidents: 2026-07-24 ×2, 2026-08-21, 2026-08-31 (`learned-workflow-patterns.md` §7, §13, §14, §21). |
-| 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | This is genuinely invalid Mendix XPath, not an mxcli-specific bug — `CE0161` "Error(s) in XPath constraint" is Mendix correctly rejecting it every time it's checked, which is why it kept resurfacing across three separate incidents on a PLM parts-flow project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) that were originally misdiagnosed as mxcli corrupting the domain model on unrelated grant rewrites. In fact the "unrelated entity broke too" symptom was just two independently-broken rules (both using the same invalid CurrentUser-path form) surfacing together once a full `mx check` ran — not one rule corrupting the other. Once rewritten to the correct bare-CurrentUser/full-LHS-chain form, the earlier "Studio Pro GUI only, module-wide" restriction no longer applies — **confirmed mxcli-safe 2026-07-23** via `test-05-currentuser-xpath-chain.mdl` (rebuilt all 4 role grants on the affected entity through mxcli exec, reproducing the corrected XPath verbatim, `mx check: 0 errors`). Use mxcli directly for this pattern; no GUI fallback needed. |
-| 21 | `DROP` + `CREATE` (or `create or modify` / `create or replace`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile — **or any restatement drafted while earlier scripts of the same batch have not run yet** | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** Drafting ahead of earlier scripts in a batch: DESCRIBE after they ran, or `alter`. Stamp what you drafted from (`bin/describe-baseline.sh stamp <script>`); `exec.sh` warns when it moved. A new owner of a document says `-- supersedes: <older script>`, else `exec.sh` warns (`bin/script-owners.sh report`). mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". #261 (2026-10-10): a script drafted before an earlier one ran put four old messages back, all gates green. #269: 99/579, 130/357, 38/159 documents had several owning scripts. |
-| 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is not run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.24.0: `check` passes; `exec` now fails loudly (`Error: attribute 'Note' already exists on entity Mod.Order`, exit 1) and a later `CREATE MICROFLOW` in the script is **not created** — the earlier statements stay written. `mx check` reports 0 errors on the partial model, so the only signal is the exit code: never ignore it. Field case (2026-08-31, mxcli v0.20.0): script `09b` re-ran after its attributes existed, died on statement 1, and two microflows at the end were never applied; `ACT_Version_Delete` quietly lost a call, found by `DESCRIBE MICROFLOW` on a hunch. Compounded by rule 21 one level up: six scripts held a grant on the same three entities, so whichever ran last decided their security. The fix for both is the same: one owner per document, `create or modify` throughout, and a from-empty replay in CI or at wrap-up. |
-| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (a dashboard-publishing migration, mxcli v0.20.0). A new script declared `create or modify non-persistent entity DashboardPublishing."ViewerContext"` with one attribute, believing the name unused. The entity already existed, owned by an earlier page script, carrying four attributes — `VersionLabel`, `HasContent`, `Html`, `DashboardTitle` — which are the entire datasource of the app's viewing page. `diff --format struct` reported `+ Attribute SharedCount` and **four `- Attribute` lines**, i.e. `create or modify` on an entity does not merge into the attribute set, it **replaces** it. Renaming the new entity took ten seconds; the alternative was a page that renders nothing, on a model that would have passed `mx check` and mxbuild clean, since an entity losing four attributes is a perfectly valid model. **This is the cheapest guard in the file — the whole rule is `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` and `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY` before trusting or dismissing it. |
+| 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Genuinely invalid Mendix XPath, not an mxcli bug: `CE0161` every time it is checked. Three incidents on one project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) were first misdiagnosed as mxcli corrupting the domain model; two independently broken rules had surfaced together. The corrected form was rebuilt through mxcli exec for all 4 role grants, `mx check` 0 errors (2026-07-23): no Studio Pro fallback needed. |
+| 21 | `DROP` + `CREATE` (or `create or modify` / `create or replace`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile — **or any restatement drafted while earlier scripts of the same batch have not run yet** | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** Drafting ahead of a batch: DESCRIBE after the earlier scripts ran, or `alter`; stamp it (`bin/describe-baseline.sh stamp <script>`). A new owner says `-- supersedes: <older script>` (`bin/script-owners.sh report`). mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". #261: a script drafted before an earlier one ran put four old messages back, all gates green. |
+| 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is not run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.24.0: `check` passes; `exec` fails loudly (`Error: attribute 'Note' already exists on entity Mod.Order`, exit 1) and every later statement is **not run** while the earlier ones stay written. `mx check` reports 0 errors on the partial model, so the exit code is the only signal. Field case (2026-08-31, v0.20.0): script `09b` re-ran, died on statement 1, and two microflows at its end were never applied — one quietly lost a call. Six scripts also held a grant on the same three entities, so the last to run decided their security (rule 21). Fix for both: one owner per document, `create or modify` throughout, a from-empty replay at wrap-up. |
+| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (mxcli v0.20.0): a new script declared `create or modify non-persistent entity` with one attribute on a name it believed unused. The entity existed, owned by an earlier page script, with the four attributes behind the app's viewing page. `diff --format struct` printed `+ Attribute SharedCount` and **four `- Attribute` lines**: `create or modify` on an entity **replaces** the attribute set. `mx check` and mxbuild would have passed. **The cheapest guard in the file: `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` / `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY`. |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | Greenfield pilot 2026-09-04, mxcli v0.20.0, Mendix 11.13.0, signal theme: `DesignProperties: ['Form orientation': 'Vertical']` on a DataView → exec ok, CE6083 at the gate, auto-restored. `Class: 'form-vertical'` built clean — and then changed nothing on screen, because in that theme the form layout is decided by the theme's own dataview rules, not the class (ui-loop.md "which side is wrong", row 1). The look caught it; no gate could. |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
-| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → grep its unit first:** `grep -la -e ModuleRoles -e ConditionalVisibilitySettings /dev/null $(grep -rlF '<Doc name>' mprcontents/)` (in the `.mpr` folder; it also lists units that merely name the document). None listed: restate. Otherwise check the hits in Studio Pro (a setting can be empty); rewrite each real rule as container `Visible:` or flow access, or use `alter page` / Studio Pro. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): a page with 19 role-locked widgets, a snippet with 56 row rules — none printed; restated, all gates pass and the rules vanish. The STOP 21 baseline hashes DESCRIBE, so it cannot see this. |
+| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → grep its unit first:** `grep -la -e ModuleRoles -e ConditionalVisibilitySettings /dev/null $(grep -rlF '<Doc name>' mprcontents/)` in the `.mpr` folder. None listed: restate. Hits (some are empty settings, or units that only name it): check in Studio Pro; rewrite real rules as container `Visible:` or flow access, or use `alter page`. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): 19 role-locked widgets on one page, 56 row rules on a snippet, none printed; restated, every gate passes and the rules vanish. The STOP 21 baseline cannot see it. |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).
 

From 67024f533bbef1cf320888dd8833b814dd7f611d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:10:14 +0000
Subject: [PATCH 7/7] Revert "learned-mdl-preflight: shorten STOP 16/22/23
 evidence cells to fit the baseline budget after merging master"

This reverts commit 3d3e7894ed53d4eedd8f3464609393a9755bfc44.
---
 CHANGELOG.md                    |  2 +-
 skills/learned-mdl-preflight.md | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2aacbace..cde21353 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership; the evidence cells of STOP 16, 22 and 23 are shortened to pay for it in the baseline word budget.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). Executed scripts renamed `done-` keep their run order and header names; a re-run after a clean exec (`describe-baseline.sh record-applied`), a rebuild onto a fresh model, and an in-order replay with `-- supersedes:` headers stay quiet. The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
+- feat(exec): **restatement guards before every MDL write — a stale `-- baseline:` DESCRIBE (`bin/describe-baseline.sh`) and a document another `mdlsource/` script also owns (`bin/script-owners.sh`) — warn by default, refuse under `MXTK_RESTATE_GUARD=refuse` or exec approval `ask`; `gate-check.sh` prints the co-owned count; preflight STOP 21 covers draft-ahead batches and script ownership.** A script drafted from a DESCRIBE taken before an earlier script ran put four old messages back with check, mxbuild and lint green ([#261](https://github.com/MendixMau/mxcli-project-toolkit/issues/261)); three apps had 99/579, 130/357 and 38/159 documents created by more than one script, so every replay of an older one reverts the newer ([#269](https://github.com/MendixMau/mxcli-project-toolkit/issues/269)). Executed scripts renamed `done-` keep their run order and header names; a re-run after a clean exec (`describe-baseline.sh record-applied`), a rebuild onto a fresh model, and an in-order replay with `-- supersedes:` headers stay quiet. The owner parser was run over real MDL (mxcli v0.23.0 DESCRIBE captures, the StyleGallery tree: 0 of 20 co-owned, the agent examples), where a string literal spanning lines hid a microflow from a per-line lexer; field run on a project still owed. — AlvinnYeo, MendixMau
 - fix(exec): **when mxbuild ran on the baseline and then crashes on the written model (no errors file, non-zero exit), the write is rolled back like a failed gate; the kept-write message now says STOP and names `restore-mpr.sh`; preflight STOP 29: DESCRIBE omits module-role and layout-row visibility, so a page restated from it silently loses them.** Field: a two-hop data source passed check, mxbuild's loader crashed, the write was kept and the next script ran on a model nothing could load; one page had 19 role-locked widgets DESCRIBE did not print, a snippet 56 row-visibility rules (refs [#309](https://github.com/MendixMau/mxcli-project-toolkit/pull/309)). — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index b28834c1..b97bdd15 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -52,15 +52,15 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | v0.24.0: revoke + re-grant no longer drops another role's grant (`mx check` 0 errors); the merge on a lone `grant` remains. |
 | 17 | *(retired 2026-09-30 — uppercase `AND`/`OR` with `!=` builds at 0 errors)* | | |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | v0.24.0: with the callee already in the model, `check` and `exec` refuse a call-microflow with an unmapped parameter, a missing callee, and a `JUMP TO` that is not a real activity name (MDL-WF05). With the callee created **in the same script**, `check --references` skips the call and `exec` auto-fills the `WITH` mapping — a non-context parameter gets `(Name = '$WorkflowContext')` — and `mx check` fails with CE0117 at the call. A context-typed parameter auto-maps fine. `mxcli lint` does not flag it. Earlier incidents: 2026-07-24 ×2, 2026-08-21, 2026-08-31 (`learned-workflow-patterns.md` §7, §13, §14, §21). |
-| 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Genuinely invalid Mendix XPath, not an mxcli bug: `CE0161` every time it is checked. Three incidents on one project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) were first misdiagnosed as mxcli corrupting the domain model; two independently broken rules had surfaced together. The corrected form was rebuilt through mxcli exec for all 4 role grants, `mx check` 0 errors (2026-07-23): no Studio Pro fallback needed. |
-| 21 | `DROP` + `CREATE` (or `create or modify` / `create or replace`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile — **or any restatement drafted while earlier scripts of the same batch have not run yet** | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** Drafting ahead of a batch: DESCRIBE after the earlier scripts ran, or `alter`; stamp it (`bin/describe-baseline.sh stamp <script>`). A new owner says `-- supersedes: <older script>` (`bin/script-owners.sh report`). mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". #261: a script drafted before an earlier one ran put four old messages back, all gates green. |
-| 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is not run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.24.0: `check` passes; `exec` fails loudly (`Error: attribute 'Note' already exists on entity Mod.Order`, exit 1) and every later statement is **not run** while the earlier ones stay written. `mx check` reports 0 errors on the partial model, so the exit code is the only signal. Field case (2026-08-31, v0.20.0): script `09b` re-ran, died on statement 1, and two microflows at its end were never applied — one quietly lost a call. Six scripts also held a grant on the same three entities, so the last to run decided their security (rule 21). Fix for both: one owner per document, `create or modify` throughout, a from-empty replay at wrap-up. |
-| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (mxcli v0.20.0): a new script declared `create or modify non-persistent entity` with one attribute on a name it believed unused. The entity existed, owned by an earlier page script, with the four attributes behind the app's viewing page. `diff --format struct` printed `+ Attribute SharedCount` and **four `- Attribute` lines**: `create or modify` on an entity **replaces** the attribute set. `mx check` and mxbuild would have passed. **The cheapest guard in the file: `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` / `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY`. |
+| 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | This is genuinely invalid Mendix XPath, not an mxcli-specific bug — `CE0161` "Error(s) in XPath constraint" is Mendix correctly rejecting it every time it's checked, which is why it kept resurfacing across three separate incidents on a PLM parts-flow project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) that were originally misdiagnosed as mxcli corrupting the domain model on unrelated grant rewrites. In fact the "unrelated entity broke too" symptom was just two independently-broken rules (both using the same invalid CurrentUser-path form) surfacing together once a full `mx check` ran — not one rule corrupting the other. Once rewritten to the correct bare-CurrentUser/full-LHS-chain form, the earlier "Studio Pro GUI only, module-wide" restriction no longer applies — **confirmed mxcli-safe 2026-07-23** via `test-05-currentuser-xpath-chain.mdl` (rebuilt all 4 role grants on the affected entity through mxcli exec, reproducing the corrected XPath verbatim, `mx check: 0 errors`). Use mxcli directly for this pattern; no GUI fallback needed. |
+| 21 | `DROP` + `CREATE` (or `create or modify` / `create or replace`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile — **or any restatement drafted while earlier scripts of the same batch have not run yet** | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** Drafting ahead of earlier scripts in a batch: DESCRIBE after they ran, or `alter`. Stamp what you drafted from (`bin/describe-baseline.sh stamp <script>`); `exec.sh` warns when it moved. A new owner of a document says `-- supersedes: <older script>`, else `exec.sh` warns (`bin/script-owners.sh report`). mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". #261 (2026-10-10): a script drafted before an earlier one ran put four old messages back, all gates green. #269: 99/579, 130/357, 38/159 documents had several owning scripts. |
+| 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is not run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.24.0: `check` passes; `exec` now fails loudly (`Error: attribute 'Note' already exists on entity Mod.Order`, exit 1) and a later `CREATE MICROFLOW` in the script is **not created** — the earlier statements stay written. `mx check` reports 0 errors on the partial model, so the only signal is the exit code: never ignore it. Field case (2026-08-31, mxcli v0.20.0): script `09b` re-ran after its attributes existed, died on statement 1, and two microflows at the end were never applied; `ACT_Version_Delete` quietly lost a call, found by `DESCRIBE MICROFLOW` on a hunch. Compounded by rule 21 one level up: six scripts held a grant on the same three entities, so whichever ran last decided their security. The fix for both is the same: one owner per document, `create or modify` throughout, and a from-empty replay in CI or at wrap-up. |
+| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (a dashboard-publishing migration, mxcli v0.20.0). A new script declared `create or modify non-persistent entity DashboardPublishing."ViewerContext"` with one attribute, believing the name unused. The entity already existed, owned by an earlier page script, carrying four attributes — `VersionLabel`, `HasContent`, `Html`, `DashboardTitle` — which are the entire datasource of the app's viewing page. `diff --format struct` reported `+ Attribute SharedCount` and **four `- Attribute` lines**, i.e. `create or modify` on an entity does not merge into the attribute set, it **replaces** it. Renaming the new entity took ten seconds; the alternative was a page that renders nothing, on a model that would have passed `mx check` and mxbuild clean, since an entity losing four attributes is a perfectly valid model. **This is the cheapest guard in the file — the whole rule is `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` and `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY` before trusting or dismissing it. |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | Greenfield pilot 2026-09-04, mxcli v0.20.0, Mendix 11.13.0, signal theme: `DesignProperties: ['Form orientation': 'Vertical']` on a DataView → exec ok, CE6083 at the gate, auto-restored. `Class: 'form-vertical'` built clean — and then changed nothing on screen, because in that theme the form layout is decided by the theme's own dataview rules, not the class (ui-loop.md "which side is wrong", row 1). The look caught it; no gate could. |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
-| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → grep its unit first:** `grep -la -e ModuleRoles -e ConditionalVisibilitySettings /dev/null $(grep -rlF '<Doc name>' mprcontents/)` in the `.mpr` folder. None listed: restate. Hits (some are empty settings, or units that only name it): check in Studio Pro; rewrite real rules as container `Visible:` or flow access, or use `alter page`. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): 19 role-locked widgets on one page, 56 row rules on a snippet, none printed; restated, every gate passes and the rules vanish. The STOP 21 baseline cannot see it. |
+| 29 | Restate an existing page, snippet or layout from `describe` output | **STOP → grep its unit first:** `grep -la -e ModuleRoles -e ConditionalVisibilitySettings /dev/null $(grep -rlF '<Doc name>' mprcontents/)` (in the `.mpr` folder; it also lists units that merely name the document). None listed: restate. Otherwise check the hits in Studio Pro (a setting can be empty); rewrite each real rule as container `Visible:` or flow access, or use `alter page` / Studio Pro. | DESCRIBE omits role and layout-row visibility (v0.25.0, #309): a page with 19 role-locked widgets, a snippet with 56 row rules — none printed; restated, all gates pass and the rules vanish. The STOP 21 baseline hashes DESCRIBE, so it cannot see this. |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).