feat(doctor, sync-project): mxcli fix property-sets in the upgrade path, report first; model-stamp.sh known-fix note

CHANGELOG.md

@@ -17,6 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- feat(doctor, sync-project): **`mxcli fix property-sets` is wired into the upgrade path, report first: the Studio Pro merge break no gate could see.** mxcli up to v0.25 wrote units without Studio Pro's full property set. `mx check`, the build and the runtime stay green, and Studio Pro's merge/diff throws ("Objects with ID … do not have the same properties") once it has saved such a document. New `bin/doctor.sh --property-sets <project>` runs the read-only `--dry-run` and records the result with the mxcli version in `.claude/.property-sets-receipt` (machine-local, gitignored). It exits 0 clean, 1 needs repair, 2 not run, 3 for an mxcli before v0.26.0, and 4 when the check itself failed or its output could not be classified (never green by absence; a repair would not help). `sync-project.sh` runs it with `--if-stale`, which skips only a recorded clean or unsupported result for the installed mxcli (errors and timeouts are never recorded; the dry-run is bounded by `MXTK_PROPSETS_TIMEOUT`, default 300 s, 120 s under sync, which announces the bound first), and `doctor --quick` (which exec.sh runs when the mxcli version changes) warns while it is owed. The repair is `bin/doctor.sh --fix-property-sets <project>`, which runs `mxcli fix property-sets` only through `exec.sh --patch` (snapshot, mxbuild gate, restore). It refuses on an exec.sh without `--patch`. Support is probed from `mxcli fix --help`, because `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too, printing the parent's help. New row in `learned-detection-gaps.md`; `platform-link.md` gains "Before a Team Server merge", covering `fix property-sets`, `fix hashes` and `git note`. Golden input is captured from the v0.24.0/v0.25.0/v0.26.0 release binaries. The clean/NEEDS/FAILED reports follow mxcli's source format strings, because no model was run. `tests/wave2/test-property-sets.sh` (61 cases). Field run still owed. `fix hashes` as an `exec.sh --patch` post-step is pending (Refs #295) — jopterhorst
+- fix(sync-project): **sync names a `bin/model-stamp.sh` that predates the worktree hook blind-spot fix.** `known_fix_note` gains the `model-stamp.sh` arm from the #236 patch, keyed on `GIT_WORK_TREE`, which the fixed script pins. The arm says to upgrade `model-stamp.sh` and `_common.sh` together. `tests/wave2/test-model-stamp.sh` T9 adds the unstaged worktree `commit -a` and `commit -- app` cases. The silent rc 1 half of #236 landed earlier. The new note is asserted by `test-property-sets.sh` P10, which fails on master. — MendixMau (card-disbursement requirements-driven build, field task 21)
+- chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo