fix(exec): follow-ups from independent review of #304/#306/#290

CHANGELOG.md

@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. A review of this PR found that an empty takeover file was judged stale by `find -mmin +0` within a second of its creation, so a live contender's fresh file could be moved aside and a third contender could get in. The threshold is now `-mmin +1`, the holder removes the takeover file only while it still holds its own line, and a fixture case checks that a fresh empty takeover file is respected. Microflow-body verbs, `CREATE FOLDER` and moves into a folder are neutral for the watch verdict. agent-roles.md names the `unknown` verdict. A clean exec now also shows lint-gate's non-blocking `note: SEC014 not configured` line (#312), which was only visible on a failing lint run; the exit code is unchanged. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo