Small fixes: arg parsing (#309), demo-video rules (#237), port holder before run --local (#262), detection gaps (#299), test strength (#172)

[MendixMau]

Five independent fixes, one commit each, plus one commit that keeps the baseline skills inside their word budget. Each commit carries its own CHANGELOG line.

Direct lane

1. build-plan-status.sh flag order and restore-mpr.sh bare timestamp (AlvinnYeo's inbox PR #309): Refs #309

Two bugs from #309. #309 itself is not merged or modified here.

• Problem (a): the script read $1 as the path. When $1 was a flag it fell back to the git top level and then ran shift anyway. So build-plan-status.sh --json <root> dropped --json and rejected the real path with "unknown arg" (exit 2). The quiet variant: --json on its own, run inside a project, wrote no JSON and printed no error.
• Fix (a): one loop now parses the flags and the path in any order. An unknown --flag still exits 2, and so does a second path.
• Problem (b): the usage line says [timestamp], but the script used the argument as given after cd "$MODEL_DIR". A bare timestamp therefore failed with "snapshot … is missing App.mpr". On a two-tree checkout a caller-relative path failed the same way. This confirms the hypothesis in inbox: eight field notes from an existing-app legacy-widget rebuild (exec.sh crash gap, restore-mpr usage, #228/#244 confirmations, durable-rebuild kit, learned widget entries) #309.
• Fix (b): the argument is resolved before the cd. It is tried first as a directory as given, then as a folder name under .mpr-snapshots/. If neither matches, the script exits 1, names the argument and lists the three newest snapshots. The usage line now reads [timestamp | snapshot path]. Two ls | head substitutions also got || true, because under set -e + pipefail they could exit silently when no snapshot existed.
• Fixtures:
  • tests/wave2/test-build-plan-status-args.sh: 6 cases, 4 fail on master.
  • tests/wave2/test-restore-mpr-arg.sh: 10 cases across both layouts, with snapshots made by the real snapshot-mpr.sh. 5 fail on master.

2. record-demo-video.md rules from patch 0005: Closes #237

• What changed: patch 0005 applied. Hunks 1–4 applied cleanly. Hunk 5 (four failure-mode rows) was re-placed by hand, because learn: four retro findings from a 2026-10-12 UX-fix run (#277 #279 #281 #283) #303 added two rows to the same table; the new rows go before the egress row.
• The rules: spawnSync(...).stderr for ffmpeg's freezedetect report; the step counter shows the step number with no guessed total; skipped beats are counted and give a non-zero exit; grid rows are found by the key the grid displays; the base URL is checked before launch; recording and post-processing are separate steps.

3. Name the process holding the port before run --local: Closes #262

• Problem: Studio Pro's runtime held the app and admin ports. mxcli run --local then reported "Authentication failed", and the next journey ran against Studio Pro's runtime.
• project-bin/app-restart.sh, before stopping anything:
  • It checks the app port and the admin port (the record's adminPort, else app port + 10).
  • If the holder is outside the recorded process tree (found by walking parent pids), the script exits 4: "instrument blocked — port :N is held by pid N (parent: …)". It touches nothing.
  • It skips this pre-check when the holder can't be named, or on Windows (Git Bash shows no parent pids).
• project-bin/app-restart.sh, after the stop: the same check runs again. This one is exact, since whatever still holds a port at that point is not ours. The old "still answers → exit 1" path is replaced by this check (exit 4).
• project-bin/test-stack-up.sh: the same check runs wherever the script would tell you to start run --local: --no-docker, no reachable Docker daemon, and --check when a leftover run-local record exists.
  • Ports checked, in order of preference: the record's ports, then RUN_LOCAL_APP_PORT/RUN_LOCAL_ADMIN_PORT from stack.conf, then mxcli's defaults 8080/8090. The defaults come from upstream cmd_run.go flag help.
  • Exit 4 is new for this script and documented in its header.
• Holder lookup: lsof, then ss, then netstat -ano + tasklist on Windows. Last resort is a /dev/tcp connect, which gives "an unidentified process".
• Fixtures:
  • test-app-restart.sh: 2 new cases (14 assertions). The stand-in record's adminPort is now port + 10. 11 assertions fail on master.
  • test-stack-up-local.sh: new T7. 4 of 6 fail on master.
• Duplicated helper: port_holder/holder_text are copied into both scripts, because _common.sh was outside this PR's file scope. Moving them there is a follow-up.

4. Two UI detection gaps: Closes #299

• learned-detection-gaps.md: two rows appended at the end of the table:
  • a lazy-loaded combo box filter hides its preset;
  • a theme that pins height on positional row classes lets the next row cover an inserted widget.
• module-review.md §4c: two LOOK lines with denominators.

5. Three testing rules with denominators: Closes #172

• testing-shape.md §7: three report lines:
  • N of N restricted pairs probed server-side
  • undeclared 4xx/5xx: 0 of M requests — each fails its step
  • one clean-DB run <id>: N of N scenarios incl. timers, not stitched
• test-result-audit.md: new check 2e, with the reasons and the field evidence.
• Inbox: contrib/inbox/2026-09-29-acceptance-test-strength.md is trimmed, not deleted. Its "Keep" items (timer compression, committed results trend, fresh data per variant) are not promoted anywhere yet.

Baseline budget (commit 6)

• Problem: the first cut of [idea] Acceptance testing: server-side permission probes, 4xx as failures, one clean-DB final run incl. timers #172/[field 2026-10-13] Detection gaps: lazy-loaded combo box hides its preset; theme-fixed row heights cover an inserted widget #299 took the baseline tier to 80,466 words against the 80,000 ratchet (master: 79,975).
• Fix:
  • The testing rules' reasoning moved into on-demand test-result-audit.md.
  • The LOOK lines were shortened.
  • Two redundant sentences in testing-shape.md §4's verdict paragraphs were folded together. The empty-set corollary still appears in the Trace row, harness-architecture.md and report-schema.md.
• Result: baseline is now 79,997 / 80,000. Any further baseline growth will need the ratchet raised on purpose.

Field evidence

• inbox: eight field notes from an existing-app legacy-widget rebuild (exec.sh crash gap, restore-mpr usage, #228/#244 confirmations, durable-rebuild kit, learned widget entries) #309 (a) and (b): reported from a field project. Reproduced here on scratch projects by the new fixtures. (b) is now also shown on the two-tree layout.
• [bug] A foreign runtime on the app's port makes the journey harness fail with "Authentication failed" #262: field run 2026-10-10 on a consuming project (Mendix 11.14, macOS). A T2 field run of the new check is still owed: it was exercised only against stand-ins on Linux (node/python listeners named via lsof). It has not been run against a real Studio Pro runtime, and not on macOS or Windows. The ss and netstat branches are untested.
• [learning] record-demo-video: four demo-film defects from the first real takes (T-227) #237, [field 2026-10-13] Detection gaps: lazy-loaded combo box hides its preset; theme-fixed row heights cover an inserted widget #299, [idea] Acceptance testing: server-side permission probes, 4xx as failures, one clean-DB final run incl. timers #172: skill text. The evidence is in each issue.

Checks run

• Scoped fixtures (each new fixture was also run against master's script to confirm it fails there):
  • test-build-plan-status-args.sh 6/6
  • test-build-plan-json.sh 66/66
  • test-restore-mpr-arg.sh 10/10
  • test-wrong-verdicts.sh bin/gate-check.sh 20/20
  • test-bug07-08.sh project-bin/exec.sh 43/43
  • test-exec-lock-watch.sh 45/45
  • test-app-restart.sh 44/44
  • test-stack-up-local.sh 23/23
• Repo checks:
  • bin/check-scripts.sh: clean
  • bin/check-portability.sh: clean
  • bin/check-no-private-citations.sh: clean
  • bin/check-pr-discipline.sh origin/master: clean
  • Leak guard (LEAKGUARD_ALLOW_NO_DENYLIST=1): clean
  • bin/render-routing.sh --check: rc 0
• Full suites: not run locally (T3 is CI's).

Template checklist

• No client data anywhere in the diff
• Size cap: 10 non-fixture files, ~318 lines changed excluding fixtures and CHANGELOG
• Test tier: T0 + T1 for every change. T2 is owed for [bug] A foreign runtime on the app's port makes the journey harness fail with "Authentication failed" #262 (see above).
• Golden input: the existing captured run-local handshake is reused. Both layouts are covered for restore-mpr. Windows is handled in code (netstat/tasklist) but not executed.
• CHANGELOG.md lines appended with credit (AlvinnYeo, MendixMau, jopterhorst)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code