diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..20342404 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,11 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
+- learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
+- fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
+- learn(record-demo-video): **four defects from a three-film demo set, ported as rules** ([#237](https://github.com/MendixMau/mxcli-project-toolkit/issues/237)). (1) From Node, read ffmpeg's freezedetect report with `spawnSync(...).stderr`: `execFileSync` returns stdout only, and one script threw on `null` after a six-minute take. Keep the raw `.webm` so post can be re-run on its own. (2) The step counter shows the step number only: a guessed total read "25/34" at the end of a complete 25-step film. (3) Find a grid row by the key the grid displays, not by the key the script created. (4) Skipped beats set a non-zero exit code: a fault film skipped its retry beats and still exited 0. Also: take the config module's named export and check the base URL before the browser opens (`goto("undefined/")`). Four new failure-mode rows; patch 0005 rebased over #303's rule 13 and rows. — MendixMau (requirements-driven back-office build, FINDINGS T-227)
+- fix(project-bin): **`build-plan-status.sh` takes flags and the path in any order, and `restore-mpr.sh` takes the bare timestamp its usage line promised.** `build-plan-status.sh --json <root>` dropped `--json` and refused the path as "unknown arg" (exit 2); `--json` alone inside a project wrote no JSON and said nothing. `restore-mpr.sh 20261013-120000` resolved the name after its own `cd` into the model dir and failed with "snapshot ... is missing App.mpr"; a caller-relative path failed the same way on a two-tree checkout. Now one argument loop, a timestamp resolves under `.mpr-snapshots/`, and an unknown name exits 1 listing the newest snapshots. Fixtures `test-build-plan-status-args.sh` (4 of 6 fail on the old code) and `test-restore-mpr-arg.sh` (5 of 10 fail, both layouts) ([#309](https://github.com/MendixMau/mxcli-project-toolkit/pull/309)) — AlvinnYeo
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/contrib/inbox/2026-09-29-acceptance-test-strength.md b/contrib/inbox/2026-09-29-acceptance-test-strength.md
index 43d6b5ed..25b20925 100644
--- a/contrib/inbox/2026-09-29-acceptance-test-strength.md
+++ b/contrib/inbox/2026-09-29-acceptance-test-strength.md
@@ -1,4 +1,4 @@
-# Acceptance testing: what made the toolkit build's tests stronger, and its three gaps
+# Acceptance testing: what made the toolkit build's tests stronger
 
 **From:** a field comparison (mxcli + toolkit build vs a Studio Pro MCP build, same frozen spec)
 **Date:** 2026-09-29
@@ -14,9 +14,6 @@ Keep (measured to matter):
   escalation bug (uncommitted change) the other build never exercised.
 - Fresh data per variant, not reuse of rehearsal data.
 
-Gaps found (the other build did these better):
-- Menu/permission refusal checked client-side only — add a server-side probe (expect HTTP 560
-  / access denied), not "the menu item is hidden".
-- Unexpected 400/422 API responses treated as informational — make them failures.
-- 20/20 was stitched from three runs — require one clean-database final run that includes the
-  timer scenarios.
+The three gaps this comparison found (server-side permission probe, unexpected 4xx as a failure,
+one clean-database final run) were promoted on 2026-10-13 into `skills/testing-shape.md` §4/§7 and
+`skills/test-result-audit.md` 2e (#172). The "Keep" items above are not yet promoted.
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index 9b54f068..b18ffe19 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -7,7 +7,9 @@
 #   ./bin/app-restart.sh --timeout <s>    readiness bound (default 240, MXTK_RESTART_TIMEOUT)
 #
 # Exit: 0 up and serving · 1 restarted but not proven up (timeout, no bundle) · 2 usage ·
-#       3 refused — nothing was stopped (no record, record belongs elsewhere, start command unknown)
+#       3 refused — nothing was stopped (no record, record belongs elsewhere, start command unknown) ·
+#       4 instrument blocked — the app or admin port is held by a process this script did not record
+#         (named, with its pid; never stopped). A run summary records it as blocked, not as FAIL.
 #
 # WHY (#289 item 1, field run 2026-10-12). A 20-task UX-fix run over three apps, one lane per app:
 # implementers were told never to start or stop apps, because a broad kill in one lane had once
@@ -42,6 +44,14 @@
 # JS bundle that index.html references (dist/index.js or mxui.js) answering 2xx — an app serving
 # a blank page because the bundle is missing is not up (contrib note 5e, 2026-08-29).
 #
+# PORTS HELD BY SOMEONE ELSE (#262, field run 2026-10-10): Studio Pro had started its own runtime on
+# the same app/admin ports seconds before a restart. `mxcli run --local` then failed with
+# "Authentication failed" — the admin API answering was the other runtime's — which reads as a
+# credential problem, and the next journey ran against Studio Pro's runtime: no OQL, run INVALID,
+# four more runs NOT RUN. So before stopping anything, and again before starting, the app port and
+# the admin port (record's adminPort, else app port + 10) must be free or held by the recorded
+# process tree; otherwise it exits 4 naming the holder (lsof / ss / netstat) and kills nothing.
+#
 # Never touches Studio Pro, the model, Docker, or another port. Docker stack: bin/test-stack-up.sh
 # --restart (scoped to this project's container). Bash 3.2 / Git Bash / macOS / Linux.
 set -uo pipefail
@@ -119,6 +129,66 @@ mask() {  # print argv joined, with the value after any password/secret/token/ke
     "s/(-[-A-Za-z_]*([Pp][Aa][Ss][Ss]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Tt][Oo][Kk][Ee][Nn]|[Kk][Ee][Yy])[-A-Za-z_]*)(=| +)[^ ']+/\1\3****/g"
 }
 
+# port_holder <port> — who LISTENs on it: prints "<pid>|<process name>" and returns 0, or returns 1
+# when the port is free. "?|an unidentified process" when something accepts connections but no
+# tool here can name it (lsof without root cannot see another user's sockets). Never kills anything.
+# Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
+port_holder() {
+  local p="$1" out pid="" name=""
+  case "$(mxtk_platform)" in
+    windows)
+      pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
+      [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
+    *)
+      if command -v lsof >/dev/null 2>&1; then
+        out="$(lsof -nP -iTCP:"$p" -sTCP:LISTEN -Fpc 2>/dev/null)"
+        pid="$(printf '%s\n' "$out" | sed -n 's/^p//p' | head -1)"
+        name="$(printf '%s\n' "$out" | sed -n 's/^c//p' | head -1)"
+      fi
+      if [ -z "$pid" ] && command -v ss >/dev/null 2>&1; then
+        out="$(ss -ltnpH "sport = :$p" 2>/dev/null | head -1)"
+        pid="$(printf '%s' "$out" | sed -n 's/.*pid=\([0-9][0-9]*\).*/\1/p')"
+        name="$(printf '%s' "$out" | sed -n 's/.*users:(("\([^"]*\)".*/\1/p')"
+      fi ;;
+  esac
+  if [ -n "$pid" ]; then printf '%s|%s\n' "$pid" "${name:-unknown}"; return 0; fi
+  if (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then printf '?|an unidentified process\n'; return 0; fi
+  return 1
+}
+# holder_text "<pid>|<name>" — "studiopro pid 4711" plus its parent where ps can show one, because a
+# runtime Studio Pro started shows up as plain "java"; the parent is what names the owner.
+holder_text() {
+  local pid="${1%%|*}" name="${1#*|}" pp pn
+  [ "$pid" = "?" ] && { printf '%s (pid unknown — no lsof/ss/netstat could name it)\n' "$name"; return; }
+  printf '%s pid %s' "$name" "$pid"
+  if [ "$(mxtk_platform)" != windows ]; then
+    pp="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"
+    pn="$(ps -o comm= -p "${pp:-0}" 2>/dev/null | sed 's#.*/##')"
+    [ -n "$pp" ] && [ "$pp" != 1 ] && [ -n "$pn" ] && printf ' (parent: %s pid %s)' "$pn" "$pp"
+  fi
+  printf '\n'
+}
+# blocked <port> "<pid>|<name>" <when> — exit 4, the holder named, nothing of it touched.
+blocked() {
+  echo "✗ app-restart: instrument blocked — port :$1 is held by $(holder_text "$2"), not this project's run --local." >&2
+  echo "  $3. This script never stops a process it did not record, so it is not touching that one." >&2
+  echo "  Starting now would collide: mxcli reports 'Authentication failed' against the other runtime's admin API." >&2
+  echo "  → Stop that process yourself (Studio Pro: stop its run), or start on free ports:" >&2
+  echo "    ./bin/app-restart.sh --cmd './mxcli run --local --watch -p $(basename "$MPR") --app-port <free> --admin-port <free>'" >&2
+  echo "  Record this run as INSTRUMENT BLOCKED, not as a test failure." >&2
+  exit 4
+}
+# in_our_tree <pid> — the recorded pid itself, or a descendant of it (the runtime mxcli started).
+in_our_tree() {
+  local p="$1" i=0
+  [ "$ALIVE" = 1 ] || return 1
+  while [ -n "$p" ] && [ "$p" != 0 ] && [ "$p" != 1 ] && [ "$i" -lt 10 ]; do
+    [ "$p" = "$PID" ] && return 0
+    p="$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')"; i=$((i + 1))
+  done
+  return 1
+}
+
 # ── 1. The record ───────────────────────────────────────────────────────────
 [ -n "$HS" ] || refuse "no run --local record for this project (.mxcli/run-local.json beside $(basename "$MPR"))." \
   "This app was not started with \`mxcli run --local\` (v0.24+), or it is not running. This script never" \
@@ -138,6 +208,7 @@ if [ "$HS_REAL" != "$MPR_REAL" ] && [ "$HS_REAL" != "$MPR_TARGET" ] \
     "A copied project carries the original's record; stopping its pid would stop someone else's app."
 fi
 ALIVE=0; pid_alive "$PID" && ALIVE=1
+ADMIN_PORT="$(hs_num adminPort "$HS")"; [ -n "$ADMIN_PORT" ] || ADMIN_PORT=$((PORT + 10))
 
 # ── 2. How it was started ───────────────────────────────────────────────────
 REC_DIR="$PROJECT_ROOT/.claude/loop/app-restart"; REC="$REC_DIR/start.cmd"
@@ -175,6 +246,22 @@ if [ "$ALIVE" = 1 ]; then echo "  stop:  pid $PID (from $HS) and its own child p
 else echo "  stop:  nothing — recorded pid $PID is not running"; fi
 echo "  start: $(mask "${ARGV[@]}")"
 echo "         in $START_CWD   [$HOW]"
+echo "  ports: app :$PORT, admin :$ADMIN_PORT"
+
+# ── 2b. Ports: free, or held by the recorded tree — never by someone else ───
+# Checked before anything is stopped, so a collision costs nothing. When the recorded app is alive
+# and the holder cannot be placed in its tree (no name, or Windows where Git Bash shows no parent
+# pids), it is left to the post-stop check below, which is exact: after our tree is gone, whatever
+# still holds the port is not ours.
+for _p in "$PORT" "$ADMIN_PORT"; do
+  _h="$(port_holder "$_p")" || continue
+  if [ "$ALIVE" = 1 ]; then
+    case "${_h%%|*}" in '?') continue ;; esac
+    [ "$(mxtk_platform)" = windows ] && continue
+    in_our_tree "${_h%%|*}" && continue
+  fi
+  blocked "$_p" "$_h" "Nothing was stopped"
+done
 [ "$DRY" = 1 ] && { echo "  (dry run — nothing stopped or started)"; exit 0; }
 
 # ── 3. Stop exactly that process tree ───────────────────────────────────────
@@ -192,11 +279,17 @@ if [ "$ALIVE" = 1 ]; then
   fi
   echo "  ✓ stopped pid $PID"
 fi
-for _i in $(seq 1 30); do port_answers "$PORT" || break; sleep 1; done
-if port_answers "$PORT"; then
-  echo "✗ app-restart: :$PORT still answers after the recorded process stopped — something else holds it." >&2
-  echo "  Not touching it, and not starting a second app. Find the owner of :$PORT by hand." >&2
-  exit 1
+_busy=""
+for _i in $(seq 1 30); do
+  _busy=""
+  for _p in "$PORT" "$ADMIN_PORT"; do port_holder "$_p" >/dev/null && { _busy="$_p"; break; }; done
+  [ -z "$_busy" ] && ! port_answers "$PORT" && break
+  sleep 1
+done
+if [ -n "$_busy" ]; then
+  blocked "$_busy" "$(port_holder "$_busy" || echo '?|an unidentified process')" "The recorded app was stopped; nothing was started"
+elif port_answers "$PORT"; then
+  blocked "$PORT" "?|an unidentified process" "The recorded app was stopped; nothing was started"
 fi
 
 # ── 4. Start it the same way, detached, and remember how ────────────────────
diff --git a/project-bin/build-plan-status.sh b/project-bin/build-plan-status.sh
index a5cfc2a8..779ae491 100755
--- a/project-bin/build-plan-status.sh
+++ b/project-bin/build-plan-status.sh
@@ -28,7 +28,7 @@
 # --html and --json outputs and never touches the .mpr.
 #
 # Usage:
-#   build-plan-status.sh [project-dir] [--html] [--json] [--quiet] [--refresh]
+#   build-plan-status.sh [project-dir] [--html] [--json] [--quiet] [--refresh]   (flags and path in any order)
 #     --html    also write architecture/build-plan.html (self-contained, no external deps): the
 #               plan itself (phases, rows, claims from build-plan.md, see "P." below) followed
 #               by views A and B
@@ -44,10 +44,11 @@
 
 set -uo pipefail
 
-ROOT="${1:-}"
-[ -n "$ROOT" ] && [ "${ROOT#--}" = "$ROOT" ] || ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-shift 2>/dev/null || true
-
+# One loop for flags AND the path, in any order (2026-10-13, field report via PR #309): the old
+# form read $1 as the path, fell back to pwd when $1 was a flag, then `shift`ed unconditionally.
+# `--json <root>` therefore dropped --json and refused the real path as "unknown arg" (exit 2), and
+# a bare `--json` from inside a project silently ran without it: no build-plan.json, no error.
+ROOT=""
 WRITE_HTML=0
 WRITE_JSON=0
 QUIET=0
@@ -58,9 +59,11 @@ for a in "$@"; do
     --refresh) WRITE_HTML=1; REFRESH=1; QUIET=1 ;;
     --json)  WRITE_JSON=1 ;;
     --quiet) QUIET=1 ;;
-    *) echo "unknown arg: $a" >&2; exit 2 ;;
+    --*) echo "unknown arg: $a" >&2; exit 2 ;;
+    *) if [ -z "$ROOT" ]; then ROOT="$a"; else echo "unexpected second path: $a (first was $ROOT)" >&2; exit 2; fi ;;
   esac
 done
+[ -n "$ROOT" ] || ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 
 cd "$ROOT" || exit 0
 
diff --git a/project-bin/restore-mpr.sh b/project-bin/restore-mpr.sh
index c7ae37b9..fd8ba9ca 100755
--- a/project-bin/restore-mpr.sh
+++ b/project-bin/restore-mpr.sh
@@ -1,20 +1,45 @@
 #!/usr/bin/env bash
 # restore-mpr.sh — restore the .mpr + mprcontents/ from a snapshot-mpr.sh snapshot.
 #
-# Usage: ./bin/restore-mpr.sh [timestamp]    (defaults to the newest snapshot)
+# Usage: ./bin/restore-mpr.sh [timestamp | snapshot path]    (defaults to the newest snapshot)
+#   timestamp      a folder name under .mpr-snapshots/, e.g. 20261013-120000
+#   snapshot path  absolute, or relative to the directory you call from
 set -euo pipefail
 . "$(dirname "$0")/_common.sh"
 
 # Snapshots live under $PROJECT_ROOT; the model tree they restore INTO may not
 # (two-tree checkout: app/ holds the .mpr and mprcontents/). Resolve both.
 SNAP_DIR="$PROJECT_ROOT/.mpr-snapshots"
+
+# Resolve the argument BEFORE the cd below (2026-10-13, field report via PR #309): the usage line
+# promised [timestamp], but the argument was used as given after `cd "$MODEL_DIR"`, so a bare
+# `20261013-120000` was looked up in the model directory and failed with "snapshot ... is missing
+# App.mpr" — sending a recovering user to inspect a healthy snapshot. Order: a directory as given
+# (absolute or caller-relative), else a folder of that name under $SNAP_DIR, else refuse by name.
+SNAP=""
+if [ -n "${1:-}" ]; then
+  if [ -d "$1" ]; then
+    SNAP="$(cd "$1" && pwd)"
+  elif [ -d "$SNAP_DIR/$1" ]; then
+    SNAP="$SNAP_DIR/$1"
+  else
+    echo "ERROR: no snapshot named '$1' in $SNAP_DIR (and no such directory from $(pwd))."
+    NEWEST=$(ls -dt "$SNAP_DIR"/*/ 2>/dev/null | head -3) || true
+    if [ -n "$NEWEST" ]; then
+      echo "  Newest snapshots:"
+      printf '%s\n' "$NEWEST" | while IFS= read -r d; do echo "    $(basename "$d")"; done
+    fi
+    exit 1
+  fi
+fi
+
 MODEL_DIR="$(find_model_dir)" || exit 1
 cd "$MODEL_DIR"
 
 MPR_PATH="$(find_mpr)"
 MPR="$(basename "$MPR_PATH")"
 
-SNAP="${1:-$(ls -dt "$SNAP_DIR"/*/ 2>/dev/null | head -1)}"
+[ -n "$SNAP" ] || SNAP="$(ls -dt "$SNAP_DIR"/*/ 2>/dev/null | head -1)" || true
 [ -z "$SNAP" ] && { echo "ERROR: no timestamped snapshots in $SNAP_DIR (a flat .mpr-only copy is not a snapshot — it has no mprcontents/ and restores to garbage)"; exit 1; }
 [ ! -f "$SNAP/$MPR" ] && { echo "ERROR: snapshot $SNAP is missing $MPR"; exit 1; }
 
diff --git a/project-bin/test-stack-up.sh b/project-bin/test-stack-up.sh
index 01f467ac..17af56ad 100755
--- a/project-bin/test-stack-up.sh
+++ b/project-bin/test-stack-up.sh
@@ -58,7 +58,17 @@
 # without --watch a model newer than the handshake is reported stale with the restart to run. Only
 # pid and appPort are read; the file also holds the admin password and boot config, never copied.
 #
-# Exit codes: 0 = required stack is up · 1 = not up and could not fix · 2 = usage/env error
+# Exit codes: 0 = required stack is up · 1 = not up and could not fix · 2 = usage/env error ·
+#             4 = instrument blocked: the port `mxcli run --local` needs is held by another process
+#                 (named with its pid, never stopped) — record it as blocked, not as a test failure
+#
+# PORT HELD BEFORE RUN --LOCAL (#262, field run 2026-10-10). Studio Pro had started its own runtime on
+# the app/admin ports a run --local restart needed. mxcli failed with "Authentication failed" (the
+# admin API answering was Studio Pro's), and the journeys then ran against Studio Pro's runtime: run
+# INVALID. Wherever this script would tell you to start `mxcli run --local`, it first checks that
+# loop's app and admin port — from a leftover run-local.json, else RUN_LOCAL_APP_PORT /
+# RUN_LOCAL_ADMIN_PORT (stack.conf), else mxcli's defaults 8080 / app port + 10 — and exits 4
+# naming the holder (lsof / ss; netstat on Windows) instead of advising a start that cannot work.
 #
 # PROJECT CONFIGURATION — no project name, port or service path is hardcoded here. Put anything
 # project-specific in <project>/.claude/loop/stack.conf, which this script sources if present:
@@ -250,6 +260,69 @@ pid_alive() {
     *)       kill -0 "$1" 2>/dev/null ;;
   esac
 }
+# port_holder <port> — who LISTENs on it: prints "<pid>|<process name>" and returns 0, or returns 1
+# when the port is free. "?|an unidentified process" when something accepts connections but no
+# tool here can name it (lsof without root cannot see another user's sockets). Never kills anything.
+# Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
+port_holder() {
+  local p="$1" out pid="" name=""
+  case "$(mxtk_platform)" in
+    windows)
+      pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
+      [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
+    *)
+      if command -v lsof >/dev/null 2>&1; then
+        out="$(lsof -nP -iTCP:"$p" -sTCP:LISTEN -Fpc 2>/dev/null)"
+        pid="$(printf '%s\n' "$out" | sed -n 's/^p//p' | head -1)"
+        name="$(printf '%s\n' "$out" | sed -n 's/^c//p' | head -1)"
+      fi
+      if [ -z "$pid" ] && command -v ss >/dev/null 2>&1; then
+        out="$(ss -ltnpH "sport = :$p" 2>/dev/null | head -1)"
+        pid="$(printf '%s' "$out" | sed -n 's/.*pid=\([0-9][0-9]*\).*/\1/p')"
+        name="$(printf '%s' "$out" | sed -n 's/.*users:(("\([^"]*\)".*/\1/p')"
+      fi ;;
+  esac
+  if [ -n "$pid" ]; then printf '%s|%s\n' "$pid" "${name:-unknown}"; return 0; fi
+  if (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then printf '?|an unidentified process\n'; return 0; fi
+  return 1
+}
+# holder_text "<pid>|<name>" — "studiopro pid 4711" plus its parent where ps can show one, because a
+# runtime Studio Pro started shows up as plain "java"; the parent is what names the owner.
+holder_text() {
+  local pid="${1%%|*}" name="${1#*|}" pp pn
+  [ "$pid" = "?" ] && { printf '%s (pid unknown — no lsof/ss/netstat could name it)\n' "$name"; return; }
+  printf '%s pid %s' "$name" "$pid"
+  if [ "$(mxtk_platform)" != windows ]; then
+    pp="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"
+    pn="$(ps -o comm= -p "${pp:-0}" 2>/dev/null | sed 's#.*/##')"
+    [ -n "$pp" ] && [ "$pp" != 1 ] && [ -n "$pn" ] && printf ' (parent: %s pid %s)' "$pn" "$pp"
+  fi
+  printf '\n'
+}
+# The ports a `mxcli run --local` of this project will want: "<app> <admin>".
+run_local_ports() {
+  local a="" m=""
+  if pick_local_hs; then a="$(hs_field appPort)"; m="$(sed -n 's/^  "adminPort": *\([0-9][0-9]*\).*/\1/p' "$LOCAL_HS" 2>/dev/null | head -1)"; fi
+  a="${RUN_LOCAL_APP_PORT:-${a:-8080}}"
+  m="${RUN_LOCAL_ADMIN_PORT:-${m:-$((a + 10))}}"
+  echo "$a $m"
+}
+# Exit 4 if a run --local of this project could not bind its ports. Never stops the holder.
+check_run_local_ports() {
+  local p h kind=app
+  for p in $(run_local_ports); do
+    if h="$(port_holder "$p")"; then
+      bad "INSTRUMENT BLOCKED — :$p (the run --local $kind port) is held by $(holder_text "$h")"
+      echo "  Not touching it. \`mxcli run --local\` here would collide: it reports 'Authentication failed'"
+      echo "  against the other runtime's admin API, and a journey would test that runtime instead."
+      echo "  → Stop that process yourself (Studio Pro: stop its run), or start on free ports:"
+      echo "    ./mxcli run --local --watch -p $(basename "$MPR") --app-port <free> --admin-port <free>"
+      echo "  Record the run as INSTRUMENT BLOCKED, not as a failure. Then re-run with --check."
+      exit 4
+    fi
+    kind=admin
+  done
+}
 local_loop_port() {
   local pid port
   pick_local_hs || return 1
@@ -455,6 +528,8 @@ if [ "$MODE" = "check" ]; then
     echo "READY (app :$APP_PORT · jaeger $([ $JAEGER_OK -eq 0 ] && echo up || echo DOWN))"
     exit 0
   fi
+  # A leftover run-local record means this project runs as run --local: name a port thief now.
+  [ $APP_FOUND -ne 0 ] && pick_local_hs && check_run_local_ports
   echo "NOT READY — re-run without --check to bring it up"
   exit 1
 fi
@@ -531,6 +606,7 @@ fi
 # --- Bring up the app -------------------------------------------------------
 if [ $APP_FOUND -ne 0 ]; then
   if [ "$MODE" = "nodocker" ]; then
+    check_run_local_ports
     bad "App down and --no-docker given. Click Run Locally in Studio Pro (or, with no Studio Pro, ./mxcli run --local --watch), then re-run --check."
     exit 1
   fi
@@ -548,6 +624,7 @@ if [ $APP_FOUND -ne 0 ]; then
     [ -n "$_DK" ] || { wait "$_dk_pid"; _DK=$?; }
   fi
   if [ "$_DK" != 0 ]; then
+    check_run_local_ports
     bad "App down and no Docker/Podman reachable, so this script cannot build the app container."
     echo "  Normal in a cloud container, and fine on a desktop without one. Run the app without it:"
     echo "    Studio Pro: Run Locally.  No Studio Pro:"
diff --git a/skills/learned-detection-gaps.md b/skills/learned-detection-gaps.md
index 109ee26d..b65f55b2 100644
--- a/skills/learned-detection-gaps.md
+++ b/skills/learned-detection-gaps.md
@@ -54,6 +54,8 @@ verification rungs form a ladder, and a green result only certifies what that ru
 | A `commit` (or `create … commit`) **inside a loop** — and every other shape defect `mxcli lint` has a rule for (CONV011, empty container MPR006, empty nanoflow MPR002) | rungs 1–4 **including exec.sh's mxbuild gate**, and `mxcli check` (whose MDL001/MDL067 hints are not lint, however the script header labels them) | `mxcli lint` — but only if something *runs* it | On a 2026-09-24 field project the gate-agent, where lint was an optional step, had been spawned 0 times against 21 `exec.sh` runs and 234 raw `mxcli exec` runs; `lint-gate.sh` had run twice, by hand, to seed a baseline. A migration flow shipped three commits-in-a-loop under "✅ applied · mxbuild clean". Fix: `exec.sh` runs `lint-gate.sh` after every clean mxbuild and writes the lint verdict into the BUILD-LOG row (`LINT ROSE` exits 1, write kept, `SKIP_LINT=<reason>` recorded). **An instrument that lives only in an agent definition is a suggestion; count its BUILD-LOG rows before claiming coverage** | a marketplace guest-group migration, 2026-09-24 |
 | `Title = null` (or any `= null`) as an **XPath retrieve constraint** | rungs 1–3 — `check --references` clean, exec succeeds, and mxcli's **own OQL engine evaluates the query** and returns rows, so even a read-back looks right | native `mx check` / mxbuild: CE0161 | XPath has no `= null`; write `not(Title)` / `Title != ''` for the empty test. Note what makes this one expensive: mxcli's query engine is more permissive than the model loader, so "I ran the query and it worked" is **not** evidence the constraint is legal | field build (Maurits Visser), 2026-09 |
 | A page layout migrated with `ALTER PAGES … WHERE LAYOUT = X`, in a project whose page scripts **hardcode** `Layout:` inside `create or replace page` | rungs 1–6 — every rung, including live runtime: the app loads, every page renders, every journey passes. There is no error anywhere | a screenshot **of the nav shell** on every page, or `grep -l 'Layout: <old>' mdlsource/` after the migration | `create or replace page` rewrites the page **wholesale**, layout included — so re-running any older page script silently reverts that page to the old shell, and the app ships **two navigation shells at once**. Found when 4 of 7 screens had no navigation at all, just a bare hamburger, after a UI fix loop re-ran five page scripts. A layout migration is not done until the `Layout:` literal is fixed **in the source scripts**; the `ALTER` is a one-shot, the scripts are the repeat offender | field build (Maurits Visser), 2026-09 |
+| A pluggable **combo box filter with `lazyLoading: true`** whose options data source also sets the **preset value** | rungs 1–4, lint, and every scripted check — the model is valid and the list *is* filtered | rung 6, by eye, **before touching the filter**: the list is already narrowed by the preset while the filter looks empty (no value, no clear button) until its menu is first opened | Lazy loading defers the options source, so the preset it sets is not rendered until first open. Turn lazy loading off for short lists (≤10 options). Before the build, check every pluggable property that changes *when* data loads (lazy loading, load-on-open), on any widget that should show a value on page load | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
+| A widget **inserted into an existing container** whose theme pins `height` on **positional row classes** (`widget-row-N` and kin) | rungs 1–4, lint, and every scripted check — the MDL insert is correct and the widget renders | rung 6, by eye: the next row overlaps the inserted widget and covers part of it (here the filter's clear button) | The theme sized rows by position, not content, so a taller row 1 runs under row 2. Before an insert into an existing container, grep the theme SCSS for fixed `height` on that container's row/position classes; if found, add a `:has(<new widget>)` rule adjusting both rows | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
 
 ## Operating rules that fall out of this table
 
diff --git a/skills/module-review.md b/skills/module-review.md
index c562d68b..d1a45f18 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -133,6 +133,9 @@ For each page, ask and answer in writing:
 - **Does every displayed field actually show its value?** Especially DateTime, enum, and
   calculated fields. A blank where data must exist (a system `createdDate` can never be null) is
   a render bug, not missing data. Confirm the binding in MDL, then treat a persistent blank as P1.
+- **`N of N` filters show their preset on first load** — lazy loading hides it.
+- **`N of N` widgets inserted into an existing container fully visible** — theme-pinned row
+  heights cover them (`learned-detection-gaps.md`).
 - **Submit every New/Edit form with required fields empty.** A visible validation message must
   appear. A 4xx/5xx with no user-facing feedback is high-severity silent failure, not a pass.
 - **Does every View/Edit/action button point at the *current* page?** Confirm with
diff --git a/skills/record-demo-video.md b/skills/record-demo-video.md
index 67fe251b..0d97f174 100644
--- a/skills/record-demo-video.md
+++ b/skills/record-demo-video.md
@@ -6,7 +6,9 @@ narrated product demo, not a test artifact — with a repeatable technique for
 opening on the app instead of a blank frame, and for keeping narration synced
 to what's on screen.
 **Source:** field-tested on a live mxcli project's Playwright demo-recording
-script (mobile tour, two roles), 2026-09.
+script (mobile tour, two roles), 2026-09; the Node, counter, row-lookup and
+skip notes come from a requirements-driven back-office build's three-film set,
+2026-09.
 
 ## When to use this skill
 
@@ -114,6 +116,10 @@ there either. Find it with `freezedetect`, which reports `freeze_start` /
 ffmpeg -i trimmed.webm -vf "freezedetect=n=-55dB:d=5" -f null - 2>&1 | grep freeze
 ```
 
+From Node, read that report with `spawnSync(ffmpeg, args, { encoding: 'utf8',
+maxBuffer: 1 << 26 }).stderr`. `execFileSync(...)` returns **stdout only**: one
+script got `null` back and threw in post after a full six-minute take.
+
 Keep ~1.5s of each freeze and drop the rest with a `select`/`setpts` pair. On
 the source project that squeezed 6–20s out of a 100–150s tour without cutting
 a single caption short.
@@ -193,8 +199,10 @@ labels.
 Text swapped in place looks like one long static banner. Three cheap signals
 turn a strip into narration:
 
-- a **step counter** (`07/34`) so the viewer knows where they are and that
-  something advanced;
+- a **step counter** (`07`) so the viewer knows where they are and that
+  something advanced. Show the step number only. The total has to be guessed
+  before the film is final, and the guess ends up in every frame: one film
+  ended on "25/34" after 25 complete steps;
 - a **short entry animation** on text change (~0.34s fade + 7px rise) —
   restart it by removing the class, forcing a reflow, re-adding it;
 - a **dwell timer bar** across the top of the strip, animated to the exact
@@ -466,7 +474,25 @@ be sorted.
   }
   ```
 
-  A skipped step is a hole in the demo; it must be loud, not silent.
+  A skipped step is a hole in the demo. Logging it is not enough: count the
+  skips, print the count in the last line, and end the take with a non-zero
+  exit code (still writing the raw video). That does not make the demo a test,
+  because it never runs in a build. It stops a take with holes from being
+  delivered as finished. One fault film logged four skips, never showed its
+  retry beats and still exited 0.
+- **Find a row by the value the grid displays.** A script knows the key it
+  created, such as a client id, but a list page may show a different one, such
+  as the case id. When the script searched the Technical errors grid by client
+  id, "Open task" was never found. Once the record reaches the state the screen
+  lists, read the displayed key with one query and locate the row by it.
+- **Fail before the browser opens, not at the first `goto`.** Take what the
+  harness config module exports (`const { cfg } = require('./config')`, not the
+  whole module) and check the base URL up front. One first take died on
+  `goto("undefined/")`.
+- **Record and post-process as separate steps.** Write the raw `.webm` before
+  post-processing starts, and make post able to run on its own against a saved
+  raw file. Then a crash in post costs one re-run instead of the whole take. On
+  the source project, a re-run of post alone produced the 3:24 MP4.
 - **Always sign out at the end.** An unlicensed Mendix runtime caps
   concurrent sessions and a killed browser does **not** release one — leak a
   few and the next recording cannot log in at all.
@@ -508,4 +534,8 @@ be sorted.
 | Captions unreadable / cursor teleports after a speed-up | Re-timed past the 1.6× readability ceiling to hit a length target | Rule 12 — cap the factor, cut an act instead |
 | The film says "three apps" and shows two; a seeded answer is gone | A reset-bearing journey suite ran between rehearsal and recording | Rule 9 — film first, snapshot the rehearsed state, run suites after the cut |
 | A viewer points out the narration contradicts the screen | Captions synced in time (rule 2) but never read against the frame | Rule 13 — claims table, one row per line, fail on any mismatch |
+| First navigation goes to `undefined/` | The config module was required whole instead of destructuring its export | Instrumentation: destructure the export and check the base URL before launching |
+| Post-processing throws on `null` after a complete take | `execFileSync` returns stdout, and ffmpeg's freezedetect report is on stderr | Rule 1: `spawnSync(...).stderr`. Keep the raw `.webm` and re-run post alone |
+| The last caption reads "25/34" in a complete film | A guessed total is burned into the counter | Rule 4: show the step number only |
+| A block of beats never happens and the take still exits 0 | The row was looked up by a key the grid does not display, and skips were logged but not counted | Instrumentation: locate rows by the displayed key, and make skips set the exit code |
 | An embedded YouTube video's frame is black | Sandbox egress opened only the page-shell domain, not the CDN host that serves media (`*.googlevideo.com`), and/or the headless browser has no H.264 decoder | Not an app defect — caption it (Rule 8); confirm which domains are actually open before assuming egress alone will fix it |
diff --git a/skills/test-result-audit.md b/skills/test-result-audit.md
index c69a6127..710bf568 100644
--- a/skills/test-result-audit.md
+++ b/skills/test-result-audit.md
@@ -95,7 +95,7 @@ artifact" as "nothing to check against." A project that *does* have BRDs/module-
 coverage against those directly: does the report's page/action list actually match what the BRD's
 acceptance criteria describe, not just what the harness happened to walk.
 
-### 2. Four checks against the report's own numbers — this is the judgement, not a script
+### 2. Five checks against the report's own numbers — this is the judgement, not a script
 
 None of these are mechanically checkable the way `report-disposition-check.sh`'s grep is — that is
 exactly why this is a skill and not a new script, per `skills-over-scripts.md`. A script can compute
@@ -144,11 +144,31 @@ journeys run, N of M personas exercised," per `module-review.md`'s own denominat
 report that never states its denominator is itself a finding under this check, independent of what
 it did or didn't find.
 
+**e. Was the run itself strong enough?** Three questions, each answered with its own count from
+the report (`testing-shape.md` §7 has the report lines). Source: a field comparison of two builds
+against one frozen spec (2026-09-29, #172) — the toolkit build had more tests and still lost on
+exactly these three:
+- **Refusals proven on the server?** `N of N restricted (role, page/microflow) pairs probed
+  server-side`, each as that role, expecting the refusal (the field run saw HTTP 560 / access
+  denied). A hidden menu item or missing button proves the UI hides the action, not that the
+  server refuses it: a role that opens the page by URL or calls the microflow over `/xas/` is not
+  stopped. The toolkit build checked every refusal client-side only.
+- **Every unexpected 4xx a failure?** `undeclared 4xx/5xx: 0 of M requests`. A 400 or 422 means
+  the request was wrong or refused, so a step that carries on past it measures a page that never
+  saved. A step that expects a refusal (the probe above) declares it; any other 4xx/5xx the report
+  lists as "info" next to a passing step is a finding against that step.
+- **One clean-database final run?** `final run <id>: N of N scenarios, timers included`. "20/20"
+  stitched from three runs never showed the scenarios together on one database: a later scenario
+  may lean on data an earlier run left, and a timer scenario may have passed only where its data
+  happened to exist. A stitched total is reported as stitched, with the run ids, never as the
+  verdict.
+A report that does not give one of these numbers fails that question; say which.
+
 ### 3. Produce a written critique — not a rubber stamp
 
 The deliverable is prose, not a checklist of ✅s. State plainly:
 - What was actually covered, with the denominator from 2d.
-- Every gap found under 2a–2c, each with what page/persona/module it names and why it counts as a
+- Every gap found under 2a–2c and 2e, each with what page/persona/module it names and why it counts as a
   gap (missing journey file vs. role-gated-and-undocumented vs. genuinely out of scope).
 - Every suspicious-but-passing result found under 2b, with the evidence line from the report that
   triggered the suspicion and what would need to be checked live to confirm or dismiss it (do not
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index fd9c04b3..d1c77406 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -241,13 +241,10 @@ is measured and wrong (the feature is broken), `INVALID` means **the instrument
 absent, not green. "The test could not run" and "the feature is broken" send you to different
 people; blending them is how a week gets spent debugging a page that was never reached. In the
 report/exit-code dialect these become `pass` / `fail` / `fault`, and **`fault` is never amber** —
-amber means "ran, degraded". Corollary, applied everywhere in this toolkit: an empty result set is
-never a pass — guard non-emptiness first, then assert (`[].every()` is `true`).
+amber means "ran, degraded".
 
-**Two verdicts, never collapsed.** When a §4 shape is present the correct report is ***the test is
-invalid***, not *the feature failed*. Collapsing them is what sends people diagnosing the wrong
-subsystem. Refuse to report green on a zero-span trace assertion, an unguarded navigation, or a
-bare-existence DB assertion — regardless of what the runner printed.
+**A §4 shape means the test is *invalid*, not that the feature *failed*** — never report green on
+a zero-span trace assertion, an unguarded navigation or a bare-existence DB assertion.
 
 **An assertion is also too weak if it lacks a fixture, an observable, and an exact expected value.**
 Not "correct", not "as specified". The register says how a part lies; this says when the assertion
@@ -506,6 +503,9 @@ Data:   <ran | n/a>  — delta-not-existence: <y/n>
 Unit:   <ran | n/a>  — --list count matches file: <y/n>    every @expect visible: <y/n>
 Trace:  <ran | n/a>  — non-empty span check: <y/n>         activity granularity: <y/n>
 Stack:  docker | sp-local, APP_URL=<url>, docker status verified: <y/n>
+Refusals: <N of N> restricted pairs probed server-side (not a hidden menu item)
+HTTP:   undeclared 4xx/5xx: <0 of M> requests — each fails its step
+Final:  one clean-DB run <id>: <N of N> scenarios incl. timers, not stitched
 Invalid tests: <any §4 shape found — reported separately from feature failures, or "none">
 ```
 
diff --git a/tests/wave2/test-app-restart.sh b/tests/wave2/test-app-restart.sh
index 31966e4a..75920d7c 100755
--- a/tests/wave2/test-app-restart.sh
+++ b/tests/wave2/test-app-restart.sh
@@ -19,6 +19,9 @@
 # live, port + bundle proven, command remembered, self-gitignored); bundle missing → exit 1 with
 # the blank-page message; dead pid + remembered command → start only; dead pid, nothing
 # remembered → refuse naming --cmd; secrets masked; no pattern-kill anywhere in the source.
+# #262: a stranger on the admin port while our app runs → exit 4 before anything is stopped, the
+# stranger named by pid and alive; our app dead and a stranger on the app port → exit 4, nothing
+# started. (The stranger is a bare TCP listener, as a runtime's admin port is to curl.)
 # Needs node and curl; skips (exit 0, says so) without them.
 set -uo pipefail
 
@@ -76,6 +79,7 @@ http.createServer((req, res) => {
     .replace(/^  "project": "[^"]*"/m, '  "project": ' + JSON.stringify(path.join(dir, 'Fixture.mpr')))
     .replace(/^  "pid": \d+/m, '  "pid": ' + process.pid)
     .replace(/^  "appPort": \d+/m, '  "appPort": ' + port)
+    .replace(/^  "adminPort": \d+/m, '  "adminPort": ' + (port + 10))
     .replace(/^  "adminPass": "[^"]*"/m, '  "adminPass": "x"');
   fs.mkdirSync(path.dirname(hs), { recursive: true });
   setTimeout(() => fs.writeFileSync(hs, g), 300);   // written when "ready", as mxcli does
@@ -153,6 +157,42 @@ has "says there was nothing to stop" "$OUT" "nothing — recorded pid $D is not
 has "uses the remembered command" "$OUT" "remembered from the last restart"
 KILL_LIST="$KILL_LIST $(hs_pid "$P") $(cat "$P/.fakechild" 2>/dev/null)"
 
+# A process this script did not start, listening on $1 — the Studio Pro runtime of #262.
+stranger() {
+  node -e "require('net').createServer(()=>{}).listen($1,'127.0.0.1')" & STR=$!; KILL_LIST="$KILL_LIST $STR"
+  local i; for i in $(seq 1 50); do alive "$STR" && (exec 3<>"/dev/tcp/127.0.0.1/$1") 2>/dev/null && return 0; sleep 0.1; done; return 1
+}
+CAN_NAME=0; { command -v lsof >/dev/null 2>&1 || command -v ss >/dev/null 2>&1; } && CAN_NAME=1
+
+echo "-- #262: a stranger holds the admin port while our app runs → exit 4, nothing stopped"
+CUR="$(hs_pid "$P")"; CURKID="$(cat "$P/.fakechild" 2>/dev/null)"
+if [ "$CAN_NAME" = 1 ]; then
+  stranger $((PORT + 10)) && ok "[setup] stranger listening on :$((PORT + 10))" || bad "[setup] stranger never listened"
+  OUT="$(restart "$P" --timeout 10)"; RC=$?
+  [ "$RC" -eq 4 ] && ok "exit 4" || bad "exit $RC: $(printf '%s' "$OUT" | tail -4)"
+  has "says instrument blocked" "$OUT" "instrument blocked"
+  has "names the holder's pid" "$OUT" "pid $STR"
+  has "says nothing was stopped" "$OUT" "Nothing was stopped"
+  alive "$CUR" && ok "our app still running" || bad "our app was stopped although the start could never succeed"
+  alive "$STR" && ok "stranger untouched" || bad "stranger killed"
+  kill -KILL "$STR" 2>/dev/null; wait "$STR" 2>/dev/null
+else
+  echo "  [skip] neither lsof nor ss — a holder beside a live app cannot be told from the app's own runtime"
+fi
+
+echo "-- #262: our app died and a stranger took the app port → exit 4, nothing started"
+CUR="$(hs_pid "$P")"; CURKID="$(cat "$P/.fakechild" 2>/dev/null)"
+kill -KILL "$CUR" "$CURKID" 2>/dev/null; sleep 0.5
+stranger "$PORT" && ok "[setup] stranger listening on :$PORT" || bad "[setup] stranger never listened"
+OUT="$(restart "$P" --timeout 10)"; RC=$?
+[ "$RC" -eq 4 ] && ok "exit 4" || bad "exit $RC: $(printf '%s' "$OUT" | tail -4)"
+has "says instrument blocked" "$OUT" "instrument blocked — port :$PORT"
+[ "$CAN_NAME" = 1 ] && has "names the holder's pid" "$OUT" "pid $STR"
+hasnt "starts nothing" "$OUT" "started (log:"
+alive "$STR" && ok "stranger untouched" || bad "stranger killed"
+NEWP="$(hs_pid "$P")"; [ "$NEWP" = "$CUR" ] && ok "no new record written" || { bad "the record changed: an app was started or the record removed (pid '$NEWP')"; KILL_LIST="$KILL_LIST $NEWP"; }
+kill -KILL "$STR" 2>/dev/null; wait "$STR" 2>/dev/null
+
 echo "-- dead pid, nothing remembered, no --cmd → refuse naming --cmd"
 D="$(hs_pid "$P")"; kill -KILL "$D" "$(cat "$P/.fakechild" 2>/dev/null)" 2>/dev/null; sleep 0.5
 rm -rf "$P/.claude/loop/app-restart"
diff --git a/tests/wave2/test-build-plan-status-args.sh b/tests/wave2/test-build-plan-status-args.sh
new file mode 100644
index 00000000..7b2d5ed3
--- /dev/null
+++ b/tests/wave2/test-build-plan-status-args.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# test-build-plan-status-args.sh — project-bin/build-plan-status.sh takes flags and the path in any order.
+#
+# Usage: bash tests/wave2/test-build-plan-status-args.sh /path/to/build-plan-status.sh
+#
+# WHY (field report via PR #309, 2026-10-13): `$1` was read as the path, fell back to the git top
+# level when it was a flag, then `shift` ran unconditionally. So `--json <root>` threw --json away
+# and refused the real path ("unknown arg: <root>", exit 2), and the quiet variant — `--json` alone
+# from inside a project — printed the table and silently wrote no build-plan.json.
+#
+# Covers: --json before the path writes the JSON (exit 0); --quiet before the path is quiet (exit
+# 0); --json alone from inside the project writes the JSON; the documented path-first form still
+# works; an unknown --flag still exits 2 naming it; a second path exits 2 instead of being ignored.
+set -uo pipefail
+
+SCRIPT="${1:?usage: bash tests/wave2/test-build-plan-status-args.sh /path/to/build-plan-status.sh}"
+case "$SCRIPT" in /*) ;; *) SCRIPT="$PWD/$SCRIPT" ;; esac
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/bps-args.XXXXXX")"
+WORK="$(cd "$WORK" && pwd -P)"
+trap 'rm -rf "$WORK"' EXIT
+
+# shellcheck disable=SC1091
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/bin/lib/portable.sh"
+PY="$(resolve_py 2>/dev/null || true)"
+[ -n "$PY" ] || { echo "SKIP: no Python 3 found; --json needs one."; echo "PASS=0 FAIL=0"; exit 0; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/  FAIL-detail: /'; }
+
+new_project() {
+  local p="$WORK/$1"
+  mkdir -p "$p/architecture"
+  ( cd "$p" && git init -q . )
+  cat > "$p/architecture/build-plan.md" <<'MD'
+# Build Plan
+
+### Phase 1 — Home
+
+| # | Kind | Step | Produces/Proves | Depends on | Skills | State |
+|---|---|---|---|---|---|---|
+| 1.1 | BUILD | `mdlsource/01-home.mdl` | home page | — | create-page | not built |
+MD
+  echo "$p"
+}
+JSON=architecture/build-plan.json
+
+P="$(new_project flag-first)"
+OUT="$(cd "$WORK" && bash "$SCRIPT" --json "$P" 2>&1)"; RC=$?
+if [ "$RC" -eq 0 ] && [ -s "$P/$JSON" ]; then ok "--json <path>: exit 0, build-plan.json written"
+else bad "--json <path> (rc=$RC, json=$([ -s "$P/$JSON" ] && echo yes || echo no))" "$OUT"; fi
+
+P="$(new_project quiet-first)"
+OUT="$(cd "$WORK" && bash "$SCRIPT" --quiet "$P" 2>&1)"; RC=$?
+if [ "$RC" -eq 0 ] && [ -z "$OUT" ]; then ok "--quiet <path>: exit 0, nothing on stdout"
+else bad "--quiet <path> (rc=$RC)" "$OUT"; fi
+
+P="$(new_project flag-only)"
+OUT="$(cd "$P" && bash "$SCRIPT" --json 2>&1)"; RC=$?
+if [ "$RC" -eq 0 ] && [ -s "$P/$JSON" ]; then ok "--json alone inside the project: build-plan.json written"
+else bad "--json alone (rc=$RC, json=$([ -s "$P/$JSON" ] && echo yes || echo no)) — the silent variant" "$OUT"; fi
+
+P="$(new_project path-first)"
+OUT="$(cd "$WORK" && bash "$SCRIPT" "$P" --json --quiet 2>&1)"; RC=$?
+if [ "$RC" -eq 0 ] && [ -s "$P/$JSON" ]; then ok "<path> --json --quiet (documented order) still works"
+else bad "<path> --json --quiet (rc=$RC)" "$OUT"; fi
+
+P="$(new_project unknown)"
+OUT="$(cd "$WORK" && bash "$SCRIPT" "$P" --bogus 2>&1)"; RC=$?
+if [ "$RC" -eq 2 ] && printf '%s' "$OUT" | grep -q 'unknown arg: --bogus'; then ok "unknown --flag: exit 2, named"
+else bad "unknown --flag (rc=$RC)" "$OUT"; fi
+
+P="$(new_project twopaths)"
+OUT="$(cd "$WORK" && bash "$SCRIPT" "$P" "$WORK/elsewhere" 2>&1)"; RC=$?
+if [ "$RC" -eq 2 ] && printf '%s' "$OUT" | grep -q 'unexpected second path'; then ok "second path: exit 2, not silently ignored"
+else bad "second path (rc=$RC)" "$OUT"; fi
+
+printf '\n%s: %d passed, %d failed\n' "$(basename "$0")" "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-restore-mpr-arg.sh b/tests/wave2/test-restore-mpr-arg.sh
new file mode 100644
index 00000000..f1c56dd8
--- /dev/null
+++ b/tests/wave2/test-restore-mpr-arg.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# test-restore-mpr-arg.sh — project-bin/restore-mpr.sh accepts what its usage line promises.
+#
+# Usage: bash tests/wave2/test-restore-mpr-arg.sh [path-to-restore-mpr.sh]
+#
+# WHY (field report via PR #309, 2026-10-13): the usage line said `[timestamp]`, and snapshot-mpr.sh
+# names snapshots by timestamp, but the argument was used as given AFTER `cd "$MODEL_DIR"` — so
+# `restore-mpr.sh 20261013-120000` failed with "snapshot ... is missing App.mpr" during a crash
+# recovery, pointing the user at a healthy snapshot. Only the full path worked.
+#
+# Snapshots are made by the real producer (project-bin/snapshot-mpr.sh), never hand-built, on both
+# layouts (model at the root; model under app/ — CLAUDE.md "Both layouts").
+# Covers, per layout: bare timestamp restores; absolute path restores; no argument restores the
+# newest; an unknown name exits 1 naming .mpr-snapshots and listing what exists — never "missing
+# <mpr>". Plus: a path relative to the CALLER's directory resolves before the script's own cd.
+set -uo pipefail
+
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SUBJECT="${1:-$TOOLKIT/project-bin/restore-mpr.sh}"
+case "$SUBJECT" in /*) ;; *) SUBJECT="$PWD/$SUBJECT" ;; esac
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+echo "== subject: $SUBJECT"
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/restorearg.XXXXXX")" || exit 2
+WORK="$(cd "$WORK" && pwd -P)"
+trap 'rm -rf "$WORK"' EXIT
+
+# $1 = project dir, $2 = model subdir ("" or "app")
+mkproj() {
+  local P="$1" M="$1${2:+/$2}"
+  mkdir -p "$P/bin" "$M/mprcontents/aa"
+  cp "$TOOLKIT/project-bin/_common.sh" "$TOOLKIT/project-bin/snapshot-mpr.sh" "$P/bin/"
+  cp "$SUBJECT" "$P/bin/restore-mpr.sh"
+  chmod +x "$P/bin/"*.sh
+  printf 'index v2\n' > "$M/App.mpr"
+  printf 'unit\n' > "$M/mprcontents/aa/one.mxunit"
+  ( cd "$P" && git init -q . 2>/dev/null; PROJECT_ROOT="$P" ./bin/snapshot-mpr.sh >/dev/null 2>&1 )
+  ls -d "$P/.mpr-snapshots"/*/ 2>/dev/null | head -1
+}
+dirty() { printf 'CHANGED\n' >> "$1/App.mpr"; }
+clean() { [ "$(cat "$1/App.mpr")" = "index v2" ]; }
+
+for layout in single two-tree; do
+  echo "-- layout: $layout"
+  P="$WORK/$layout"; sub=""; [ "$layout" = two-tree ] && sub="app"
+  M="$P${sub:+/$sub}"
+  SNAP="$(mkproj "$P" "$sub")"
+  [ -n "$SNAP" ] || { bad "$layout: snapshot-mpr.sh produced no snapshot"; continue; }
+  TS="$(basename "$SNAP")"
+
+  dirty "$M"
+  OUT="$(cd "$P" && PROJECT_ROOT="$P" ./bin/restore-mpr.sh "$TS" 2>&1)"; RC=$?
+  if [ "$RC" -eq 0 ] && clean "$M"; then ok "$layout: bare timestamp '$TS' restores"
+  else bad "$layout: bare timestamp failed (rc=$RC): $(printf '%s' "$OUT" | head -3)"; fi
+
+  dirty "$M"
+  OUT="$(cd "$P" && PROJECT_ROOT="$P" ./bin/restore-mpr.sh "$SNAP" 2>&1)"; RC=$?
+  if [ "$RC" -eq 0 ] && clean "$M"; then ok "$layout: absolute snapshot path restores"
+  else bad "$layout: absolute path failed (rc=$RC): $(printf '%s' "$OUT" | head -3)"; fi
+
+  dirty "$M"
+  OUT="$(cd "$P" && PROJECT_ROOT="$P" ./bin/restore-mpr.sh ".mpr-snapshots/$TS" 2>&1)"; RC=$?
+  if [ "$RC" -eq 0 ] && clean "$M"; then ok "$layout: caller-relative '.mpr-snapshots/$TS' restores"
+  else bad "$layout: caller-relative path failed (rc=$RC): $(printf '%s' "$OUT" | head -3)"; fi
+
+  dirty "$M"
+  OUT="$(cd "$P" && PROJECT_ROOT="$P" ./bin/restore-mpr.sh 2>&1)"; RC=$?
+  if [ "$RC" -eq 0 ] && clean "$M"; then ok "$layout: no argument restores the newest"
+  else bad "$layout: no-argument restore failed (rc=$RC): $(printf '%s' "$OUT" | head -3)"; fi
+
+  dirty "$M"
+  OUT="$(cd "$P" && PROJECT_ROOT="$P" ./bin/restore-mpr.sh 19990101-000000 2>&1)"; RC=$?
+  if [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "no snapshot named '19990101-000000'" \
+     && printf '%s' "$OUT" | grep -q "$TS" && ! printf '%s' "$OUT" | grep -q 'is missing' && ! clean "$M"; then
+    ok "$layout: unknown name exits 1, names it, lists '$TS', model untouched"
+  else bad "$layout: unknown name (rc=$RC): $(printf '%s' "$OUT" | head -4)"; fi
+done
+
+printf '\n%s: %d passed, %d failed\n' "$(basename "$0")" "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-stack-up-local.sh b/tests/wave2/test-stack-up-local.sh
index 369bbd72..cd7521a7 100755
--- a/tests/wave2/test-stack-up-local.sh
+++ b/tests/wave2/test-stack-up-local.sh
@@ -11,7 +11,11 @@
 # rewrites only pid/appPort/adminPass. The "app" is a python http.server serving a login page with
 # a Mendix marker; the "mxcli" is `sleep` with its argv[0] set, so `ps` shows the command line the
 # script reads --watch from. docker/podman are stubbed out so no real container can answer.
-# Not fixtured: the Windows tasklist branch of pid_alive (CI is Linux).
+# Not fixtured: the Windows tasklist branch of pid_alive and the netstat branch of port_holder (CI
+# is Linux).
+# T7 (#262): a port the run --local loop needs is held by a process that is not this project's
+# loop (here the fake app itself, behind a dead handshake — Studio Pro's runtime in the field) →
+# exit 4, "INSTRUMENT BLOCKED", the holder named with its pid, and it is still alive afterwards.
 #
 # usage: test-stack-up-local.sh /path/to/test-stack-up.sh
 set -uo pipefail
@@ -49,7 +53,7 @@ s = http.server.ThreadingHTTPServer(("127.0.0.1", 0), H)
 open(sys.argv[2], "w").write(str(s.server_address[1]))
 s.serve_forever()
 EOF
-PIDS="$PIDS $!"
+PIDS="$PIDS $!"; APP_PID=$!
 for _ in $(seq 1 50); do [ -s "$WORK/port" ] && break; sleep 0.1; done
 APP="$(cat "$WORK/port" 2>/dev/null)"
 [ -n "$APP" ] && curl -s --max-time 4 "http://localhost:$APP/login.html" | grep -q mxui \
@@ -147,6 +151,23 @@ touch "$P/app/mprcontents/a.mxunit"
 OUT="$(run "$P")"; RC=$?
 [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "APP UP BUT STALE" && ok "edit behind the symlink reads stale" || bad "edit behind symlink not seen (rc=$RC)" "$OUT"
 
+echo "== T7 (#262): the run --local port is held by someone else -> instrument blocked, exit 4 =="
+CAN_NAME=0; { command -v lsof >/dev/null 2>&1 || command -v ss >/dev/null 2>&1; } && CAN_NAME=1
+P="$(mkproj t7 root)"; handshake "$P" "$DEAD_PID"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 4 ] && ok "--check exits 4 (dead loop, its app port taken)" || bad "--check rc=$RC, want 4" "$OUT"
+printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED — :$APP (the run --local app port)" && ok "says instrument blocked, names :$APP" || bad "no blocked verdict" "$OUT"
+if [ "$CAN_NAME" = 1 ]; then
+  printf '%s' "$OUT" | grep -q "pid $APP_PID" && ok "names the holder's pid $APP_PID" || bad "holder pid not named" "$OUT"
+else echo "  [skip] neither lsof nor ss: the holder is reported unnamed"; fi
+kill -0 "$APP_PID" 2>/dev/null && ok "holder untouched" || bad "holder was killed"
+P="$(mkproj t7b root)"; printf 'RUN_LOCAL_APP_PORT=%s\n' "$APP" >> "$P/.claude/loop/stack.conf"
+OUT="$(cd "$P" && bash bin/test-stack-up.sh --no-docker 2>&1)"; RC=$?
+[ "$RC" -eq 4 ] && printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && ok "--no-docker, no record, RUN_LOCAL_APP_PORT taken: exit 4" || bad "--no-docker rc=$RC, want 4" "$OUT"
+P="$(mkproj t7c root)"; handshake "$P" "$DEAD_PID"; sed -i.bak "s/^  \"appPort\": [0-9]*/  \"appPort\": 1/; s/^  \"adminPort\": [0-9]*/  \"adminPort\": 1/" "$P/.mxcli/run-local.json"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 1 ] && ! printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && ok "free run --local ports: plain NOT READY, exit 1" || bad "free ports rc=$RC, want 1" "$OUT"
+
 echo
 echo "stack-up-local: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]