From 5412e82e4fc44eaaf54c0c8069ddd5c63855285e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 10:06:46 +0000
Subject: [PATCH 01/68] Fix graph-sweep/app-facts catalog guard and per-BRD
 conformance ledgers (#259, #260)

graph-sweep.sh and app-facts.sh refused any catalog whose build_mode label
was not 'full'; mxcli v0.24+ writes 'source' for a complete catalog. Both now
check what they read: a non-empty refs table with at least one RefKind='call'
edge, and FAULT naming the mode and per-kind edge counts otherwise.

conformance-check.sh read only <Module>/coverage-ledger.md, which is an index
in the per-BRD layout. It now measures every <Module>/coverage-ledger/*.md,
writes one report per BRD, keys baseline pointers by BRD, documents
LEDGER_FILE (file or directory), FAULTs on a missing LEDGER_FILE, and names
an index as an index with the files its rows are in.

Fixtures (both layouts, fail on master's scripts):
tests/wave2/test-catalog-call-edges.sh (12 checks, 10 fail on master),
tests/wave2/test-conformance-per-brd-ledger.sh (17 checks, 17 fail on master).
Synthetic catalogs/ledgers; field runs on a v0.24 / per-BRD project are owed.

Reported by AlvinnYeo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   2 +
 agents/review-agent.md                        |   7 +-
 project-bin/app-facts.sh                      |  24 ++-
 project-bin/conformance-check.sh              | 140 ++++++++++++---
 project-bin/graph-sweep.sh                    |  35 ++--
 skills/coverage-ledger.md                     |  18 +-
 tests/wave2/test-catalog-call-edges.sh        | 170 ++++++++++++++++++
 .../wave2/test-conformance-per-brd-ledger.sh  | 163 +++++++++++++++++
 8 files changed, 510 insertions(+), 49 deletions(-)
 create mode 100755 tests/wave2/test-catalog-call-edges.sh
 create mode 100755 tests/wave2/test-conformance-per-brd-ledger.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a28740e2..9af52a63 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(graph-sweep, app-facts): **the catalog guard checks for `call` edges, not the `build_mode` label; mxcli v0.24+ labels a complete catalog `source` and both scripts refused every one** ([#259](https://github.com/MendixMau/mxcli-project-toolkit/issues/259)). Field report: four module reviews recorded the sweep as "Instrument FAULT" on a fresh catalog with 5,368 refs rows. Now an empty refs table or zero `RefKind='call'` edges FAULTs, naming the mode and per-kind edge counts; `manifest.json` records the real mode. `tests/wave2/test-catalog-call-edges.sh` (12 checks, both layouts) fails 10 of 12 on master's scripts, including the verbatim FAULT line. Synthetic catalogs; a field run on a v0.24 project is still owed. — AlvinnYeo
+- fix(conformance-check, coverage-ledger): **per-BRD ledgers (`<Module>/coverage-ledger/<BRD>.md`) are all measured, one report per BRD, and an index file is named as one instead of "0 measurable rows"** ([#260](https://github.com/MendixMau/mxcli-project-toolkit/issues/260)). Field report: every module with an index ended in `FAULT: 0 measurable rows extracted from 1 ledger(s).`, while `LEDGER_FILE` on one per-BRD file measured 128 rows. Baseline pointers carry the BRD id, `LEDGER_FILE` (file or directory) is in the usage text, and a missing one FAULTs instead of falling back. `tests/wave2/test-conformance-per-brd-ledger.sh` (17 checks, both layouts) fails all 17 on master's script. A field run on a per-BRD project is still owed. — AlvinnYeo
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
 - fix(journeys): **the journey runner preflights the suite: a refused admin credential aborts it before the first journey, missing mock env vars are one SETUP line, and journeys can declare `requires` / `leaves` / `consumes` so order is computed and an unmet precondition is named** ([#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286), #287 item 1, [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) first half). Field run 2026-10-12, 14 journeys: the runner's literal admin default (`M2EE_ADMIN_PASS || '1'`) was not the app's, every data rung got HTTP 403 and read INVALID, and the suite walked all 14 anyway (first pass 305/339, 2 of 14 green, discarded). Two unset mock vars made 3 journeys INVALID one at a time, and an undeclared order dependency made 6 of 14 INVALID. `tests/e2e/config.js` now resolves the token from `M2EE_ADMIN_PASS` → this app's `.mxcli/run-local.json` (matched on appPort) → `.docker/.env` → a labelled guess, and records the source, never the value. `journey-runner.js` refuses to start with `TEST_PASS` unset, before any login (#278: a run without the env step submitted the config default, then the admin fallback, and locked two demo accounts for ~5 min each; `ALLOW_CONFIG_CREDENTIALS=1` when the default is real). It then probes once through the same `mxcli oql --direct` before opening the browser: 401/403 or unreachable → exit 2 with the source and the remedy (`ALLOW_NO_DATA_RUNG=1` overrides), the live `System.Session` count is reported, and `JOURNEY_SESSION_CAP` refuses a run at the cap. Logout now runs on crash and SIGINT/SIGTERM too, and the findings slot is overwritten on an abort. Journeys without the new fields run in file order exactly as before. `journey-proof.md` / `journey-examples.md` / `learned-db-assertions.md` updated. Fixture `tests/wave2/test-journey-preflight.sh` (54 cases at first commit, including three end-to-end runs of the real runner on a stub mxcli; golden = mxcli v0.26.0's own message and `.docker/.env` template strings read from the binary, plus the captured run-local handshake; 1/2 against master's runner). Second commit, from the skills review: `"resetsData": true` tags a journey that resets or reloads demo data, printed at start and refused under `--protect-state` (#279: one suite run between rehearsal and recording wiped an app's seeded state, and that app never appeared in the film). `"assertLanding": true` / `--assert-landing` records, right after login and before any click, whether any element draws an outline or a focused element draws a box-shadow (#281: ring on landing for 3 of 3 roles while 3 UX asserts stayed green). `journey-proof.md` adds a third rule as text only: a fix to a displayed fact asserts the old text is absent on every page in its `Displayed fact:` row (#283). Fixture now 65 cases; the in-page landing collector needs a browser and is not fixtured. Not yet run against a live app — MendixMau
 - learn(learned-mdl-cannot-express): **a widget for one role only is not writable in MDL; the action-button workaround and its three traps are now written down** ([#277](https://github.com/MendixMau/mxcli-project-toolkit/issues/277)). Grant `execute` on the button's microflow only to the roles that should see it, and Mendix will not render the button for the rest. Three traps from a 2026-10-12 20-task UX-fix run over three apps: a helper sentence naming the button cannot be gated the same way, an admin (or admin-fallback) session proves nothing, and terminal-state demo data hides the button for the wrong reason. The skill gives a per-role absence check with a denominator and a before/after journey step. Its routing row now triggers on "a widget for one role and not another". — MendixMau
diff --git a/agents/review-agent.md b/agents/review-agent.md
index b925be50..22d69171 100644
--- a/agents/review-agent.md
+++ b/agents/review-agent.md
@@ -141,9 +141,10 @@ current — that block is the single source of truth and gets corrected independ
 Both are read-only. Neither touches the `.mpr`. Both refuse to report a clean sweep from a stale
 or empty catalog rather than silently passing.
 
-**Stale-catalog self-heal:** if `graph-sweep.sh` faults because `catalog_meta.build_mode` is not
-`full`, you may run `./mxcli -p <mpr> -c 'REFRESH CATALOG FULL'` yourself and retry once — this
-rebuilds the catalog database, it does not write to `.mpr` content, so it's outside what the
+**Stale-catalog self-heal:** if `graph-sweep.sh` faults because the catalog is stale, empty, or
+has no `call` edges (its `build_mode` label is reported, not judged — mxcli v0.24+ writes
+`source` for a complete catalog), you may run `./mxcli -p <mpr> -c 'REFRESH CATALOG FULL'`
+yourself and retry once — this rebuilds the catalog database, it does not write to `.mpr` content, so it's outside what the
 project's write-approval rule protects. If the retry still faults, report it; don't loop.
 
 ## Four hard rules — STOP, not suggestions
diff --git a/project-bin/app-facts.sh b/project-bin/app-facts.sh
index ac8b7eb1..96a2c2cf 100755
--- a/project-bin/app-facts.sh
+++ b/project-bin/app-facts.sh
@@ -246,10 +246,11 @@ fi
 
 q() { sqlite3 -noheader "$DB" "$1"; }
 BUILD_MODE="$(q "SELECT Value FROM catalog_meta WHERE Key='build_mode';")"
-if [ "$BUILD_MODE" != "full" ]; then
-  echo "FAULT: catalog build_mode is '$BUILD_MODE' after graph-report; refs/activities are not trustworthy." >&2
-  exit 2
-fi
+# The build_mode LABEL is not checked (fixed 2026-10-13, field report 2026-10-11): mxcli v0.24.0
+# labels a complete catalog 'source', and the old `!= full` test refused it on every run. What
+# this script needs is checked instead, below: the tables by name, non-empty refs/activities,
+# and at least one 'call' edge (the call graph in step 2 reads RefKind='call'). The label is
+# recorded in manifest.json as found, so a reader can still see it.
 MISSING=""
 for t in modules_data entities_data microflows_data activities_data pages_data scheduled_events_data refs catalog_meta projects; do
   [ "$(q "SELECT count(*) FROM sqlite_master WHERE name='$t';")" = "1" ] || MISSING="$MISSING $t"
@@ -264,10 +265,17 @@ N_MODULES=$(q "SELECT count(*) FROM modules_data;")
 N_REFS=$(q "SELECT count(*) FROM refs;")
 N_ACTS=$(q "SELECT count(*) FROM activities_data;")
 if [ "${N_MODULES:-0}" -eq 0 ] || [ "${N_REFS:-0}" -eq 0 ] || [ "${N_ACTS:-0}" -eq 0 ]; then
-  echo "FAULT: catalog is vacuous (modules=$N_MODULES refs=$N_REFS activities=$N_ACTS). An empty graph is not a clean app." >&2
+  echo "FAULT: catalog is vacuous (modules=$N_MODULES refs=$N_REFS activities=$N_ACTS, build_mode '${BUILD_MODE:-unset}'). An empty graph is not a clean app." >&2
+  exit 2
+fi
+N_CALLS=$(q "SELECT count(*) FROM refs WHERE RefKind='call';")
+if [ "${N_CALLS:-0}" -eq 0 ]; then
+  KINDS="$(q "SELECT RefKind || '=' || count(*) FROM refs GROUP BY RefKind ORDER BY count(*) DESC LIMIT 8;" | paste -sd' ' -)"
+  echo "FAULT: catalog has 0 'call' edges (build_mode '${BUILD_MODE:-unset}', $N_REFS refs: ${KINDS:-none})." >&2
+  echo "       The call graph and dead-asset facts read 'call' edges. Refusing to write facts without them." >&2
   exit 2
 fi
-log "catalog ok: modules=$N_MODULES refs=$N_REFS activities=$N_ACTS (${T1}s)"
+log "catalog ok: build_mode=${BUILD_MODE:-unset} modules=$N_MODULES refs=$N_REFS (call=$N_CALLS) activities=$N_ACTS (${T1}s)"
 
 # ---------------------------------------------------------------------------------------------
 # Step 2 — inventory + dependencies, straight from the catalog through the REAL module column.
@@ -546,7 +554,7 @@ fi
 FACTS_DIR="$FACTS_DIR" MX_VERSION="$MX_VERSION" MPR_BASE="$MPR_BASE" DB="$DB" \
 T1="$T1" T2="$T2" T3="$T3" TALL="$(( $(date +%s) - START_ALL ))" \
 LOOP_STATUS="$LOOP_STATUS" LOOP_REASON="$LOOP_REASON" N_CAND="$N_CAND" N_DESC="$N_DESC" N_FAILED="$N_FAILED" N_RULES="$N_RULES" \
-N_MODULES="$N_MODULES" N_REFS="$N_REFS" N_ACTS="$N_ACTS" WORKERS="$WORKERS" MAX_LOOPS="$MAX_LOOPS" "$PY" - <<'PY'
+BUILD_MODE="$BUILD_MODE" N_MODULES="$N_MODULES" N_REFS="$N_REFS" N_ACTS="$N_ACTS" WORKERS="$WORKERS" MAX_LOOPS="$MAX_LOOPS" "$PY" - <<'PY'
 import json, os, datetime, hashlib
 F = os.environ["FACTS_DIR"]
 def sha(p):
@@ -563,7 +571,7 @@ man = {
   "generated": datetime.datetime.now().astimezone().isoformat(timespec="seconds"),
   "mpr": os.environ["MPR_BASE"], "mpr_sha256_16": sha(mp) if os.path.exists(mp) else "",
   "mxcli": os.environ["MX_VERSION"],
-  "catalog": {"modules": int(os.environ["N_MODULES"]), "refs": int(os.environ["N_REFS"]), "activities": int(os.environ["N_ACTS"]), "build_mode": "full"},
+  "catalog": {"modules": int(os.environ["N_MODULES"]), "refs": int(os.environ["N_REFS"]), "activities": int(os.environ["N_ACTS"]), "build_mode": os.environ.get("BUILD_MODE", "")},
   "timings_s": {"catalog_and_graph_report": int(os.environ["T1"]), "inventory_and_dependencies": int(os.environ["T2"]), "loops": int(os.environ["T3"]), "total": int(os.environ["TALL"])},
   "options": {"workers": int(os.environ["WORKERS"]), "max_loops": int(os.environ["MAX_LOOPS"])},
   "sections": {
diff --git a/project-bin/conformance-check.sh b/project-bin/conformance-check.sh
index ebbb94a8..57b88a56 100755
--- a/project-bin/conformance-check.sh
+++ b/project-bin/conformance-check.sh
@@ -31,13 +31,22 @@
 # Nothing here blocks that did not block before, and no exit code got more severe: a missing
 # ledger now exits 3 (NOT MEASURED) or 4 (NOT APPLICABLE) instead of 2 (FAULT).
 #
-# Ledger path shapes, all read, first is canonical:
-#   architecture/modules/<Module>/coverage-ledger.md   canonical (per-module)
-#   architecture/modules/<Module>-coverage-ledger.md   flat module layout
-#   architecture/coverage-ledger.md                    single-BRD project
+# Ledger path shapes, all read:
+#   architecture/modules/<Module>/coverage-ledger/*.md  one ledger per BRD (coverage-check-all.sh's
+#                                                       form); EVERY file is measured, one report
+#                                                       per BRD, and the coverage-ledger.md beside
+#                                                       the directory is treated as its index
+#   architecture/modules/<Module>/coverage-ledger.md    canonical (per-module)
+#   architecture/modules/<Module>-coverage-ledger.md    flat module layout
+#   architecture/coverage-ledger.md                     single-BRD project
 #
 # Usage:
 #   bin/conformance-check.sh [--module <Name>] [--update-baseline] [--quiet]
+#   LEDGER_FILE=<file-or-dir> bin/conformance-check.sh [--module <Name>] ...
+#
+#   LEDGER_FILE   overrides discovery: one ledger file, or a directory whose *.md files are all
+#                 measured (one per BRD). Relative to the project root. A path that is neither is
+#                 a FAULT, never a silent fall-back to another ledger.
 #
 # Exit: 0 clean or baseline written · 1 regression · 2 instrument fault (refuses to guess)
 #       3 NOT MEASURED (no ledger, but a spec exists) · 4 NOT APPLICABLE (no spec at all)
@@ -60,7 +69,7 @@ while [ $# -gt 0 ]; do
     --module)          MODULE="${2:-}"; shift 2 ;;
     --update-baseline) UPDATE_BASELINE=1; shift ;;
     --quiet)           QUIET=1; shift ;;
-    -h|--help)         sed -n '2,45p' "$0"; exit 0 ;;
+    -h|--help)         sed -n '2,52p' "$0"; exit 0 ;;
     *) echo "unknown argument: $1" >&2; exit 2 ;;
   esac
 done
@@ -80,20 +89,47 @@ mkdir -p "$OUTDIR"
 # LEDGER_COUNT is tracked separately rather than read back as ${#LEDGERS[@]}: under `set -u`,
 # bash 3.2 (stock macOS) treats an EMPTY array as unset and aborts on that expansion — which is
 # precisely the case this block exists to handle gracefully.
+#
+# PER-BRD DIRECTORIES (fixed 2026-10-13, field report 2026-10-11): a
+# module that splits its ledger one-per-BRD keeps the rows in <Module>/coverage-ledger/<BRD>.md
+# and turns <Module>/coverage-ledger.md into an index. This script only ever read the index, so
+# every such module ended in "FAULT: 0 measurable rows extracted from 1 ledger(s)." — while the
+# operator's LEDGER_FILE workaround on ONE per-BRD file measured 128 rows (66 measured, 66 OK).
+# coverage-preflight.sh already read the directory first (2026-09-26); this is the same rule:
+# the directory wins over the index beside it, and every file in it is measured.
 LEDGERS=()
 LEDGER_COUNT=0
-if [ -n "$MODULE" ]; then
-  for c in "${LEDGER_FILE:-}" \
-           "architecture/modules/$MODULE/coverage-ledger.md" \
-           "architecture/modules/$MODULE-coverage-ledger.md" \
-           "architecture/coverage-ledger.md"; do
-    [ -n "$c" ] && [ -f "$c" ] && { LEDGERS=("$c"); LEDGER_COUNT=1; break; }
-  done
+add_ledger() { LEDGERS[$LEDGER_COUNT]="$1"; LEDGER_COUNT=$((LEDGER_COUNT+1)); }
+has_md()     { [ -d "$1" ] && ls "$1"/*.md >/dev/null 2>&1; }
+add_dir()    { local f; for f in "$1"/*.md; do [ -f "$f" ] && add_ledger "$f"; done; }
+if [ -n "${LEDGER_FILE:-}" ]; then
+  if has_md "$LEDGER_FILE"; then add_dir "$LEDGER_FILE"
+  elif [ -f "$LEDGER_FILE" ]; then add_ledger "$LEDGER_FILE"
+  else
+    echo "FAULT: LEDGER_FILE=$LEDGER_FILE is neither a ledger file nor a directory of *.md ledgers" >&2
+    echo "       (resolved against $PROJECT_ROOT). Refusing to fall back to another ledger." >&2
+    exit 2
+  fi
+elif [ -n "$MODULE" ]; then
+  if has_md "architecture/modules/$MODULE/coverage-ledger"; then
+    add_dir "architecture/modules/$MODULE/coverage-ledger"
+  else
+    for c in "architecture/modules/$MODULE/coverage-ledger.md" \
+             "architecture/modules/$MODULE-coverage-ledger.md" \
+             "architecture/coverage-ledger.md"; do
+      [ -f "$c" ] && { add_ledger "$c"; break; }
+    done
+  fi
 else
+  for d in architecture/modules/*/coverage-ledger; do
+    has_md "$d" && add_dir "$d"
+  done
   for c in architecture/modules/*/coverage-ledger.md \
            architecture/modules/*-coverage-ledger.md \
            architecture/coverage-ledger.md; do
-    if [ -f "$c" ]; then LEDGERS[$LEDGER_COUNT]="$c"; LEDGER_COUNT=$((LEDGER_COUNT+1)); fi
+    [ -f "$c" ] || continue
+    has_md "${c%.md}" && continue          # the index of a per-BRD directory measured above
+    add_ledger "$c"
   done
 fi
 
@@ -149,6 +185,8 @@ fi
 # SHOW/DESCRIBE in the acceptance cell are measurable; the rest are counted, not run.
 # The module label comes from the path, and the path has three shapes (above), so read it per
 # shape instead of assuming the parent directory is always the module.
+# A per-BRD file <Module>/coverage-ledger/<BRD>.md belongs to <Module> and carries a BRD label;
+# every other shape has no BRD label ("-": read splits on tabs, so an empty field would shift).
 ledger_module() {
   local ledger="$1" base parent
   base="$(basename "$ledger")"
@@ -157,26 +195,38 @@ ledger_module() {
     *-coverage-ledger.md) printf '%s\n' "${base%-coverage-ledger.md}"; return ;;
   esac
   case "$parent" in
-    architecture) printf '%s\n' "${MODULE:-project}"; return ;;
-    *)            printf '%s\n' "$parent"; return ;;
+    architecture)    printf '%s\n' "${MODULE:-project}"; return ;;
+    coverage-ledger) printf '%s\n' "$(basename "$(dirname "$(dirname "$ledger")")")"; return ;;
+    *)               printf '%s\n' "$parent"; return ;;
+  esac
+}
+ledger_brd() {
+  case "$(basename "$(dirname "$1")")" in
+    coverage-ledger) printf '%s\n' "$(basename "$1" .md)" ;;
+    *)               printf '%s\n' "-" ;;
   esac
 }
 
+# Rows are keyed (module, pointer) in the baseline. A JSON pointer is relative to ITS BRD, so two
+# per-BRD ledgers of one module both have `/microflows/0`; their pointer key carries the BRD id.
 extract() {
-  local ledger="$1" mod
+  local ledger="$1" mod brd
   mod="$(ledger_module "$ledger")"
-  awk -F'|' -v mod="$mod" '
+  brd="$(ledger_brd "$ledger")"
+  awk -F'|' -v mod="$mod" -v brd="$brd" -v file="$ledger" '
     NF==9 && $2 ~ /^ *`\// {
       total++
       ptr=$2; acc=$7; st=$8
       gsub(/^ +| +$/, "", ptr); gsub(/^ +| +$/, "", st)
+      if (brd != "-") ptr = brd ":" ptr
       if (match(acc, /`(SHOW|DESCRIBE)[^`]*`/)) {
         cmd = substr(acc, RSTART+1, RLENGTH-2)
-        print "ROW\t" mod "\t" ptr "\t" st "\t" cmd
+        print "ROW\t" mod "\t" brd "\t" ptr "\t" st "\t" cmd
       } else {
-        print "PROSE\t" mod "\t" ptr "\t" st "\t"
+        print "PROSE\t" mod "\t" brd "\t" ptr "\t" st "\t"
       }
     }
+    END { if (!total) print "NOTABLE\t" file }
   ' "$ledger"
 }
 
@@ -184,10 +234,39 @@ ROWS="$(for l in "${LEDGERS[@]}"; do [ -f "$l" ] && extract "$l"; done)"
 
 MEASURABLE=$(printf '%s\n' "$ROWS" | grep -c '^ROW' || true)
 PROSE=$(printf '%s\n' "$ROWS" | grep -c '^PROSE' || true)
+NOTABLE="$(printf '%s\n' "$ROWS" | awk -F'\t' '$1=="NOTABLE"{print $2}')"
+
+# A ledger file with no ledger table is, in practice, an index: the coverage-ledger.md a module
+# keeps beside its per-BRD directory, or one that points at another module's per-BRD file.
+# Say where its rows are rather than "0 measurable rows", which reads as a broken instrument.
+explain_index() {
+  local f="$1" dir links
+  dir="${f%.md}"
+  echo "       $f has no ledger table rows — it is an index, not a ledger." >&2
+  if has_md "$dir"; then
+    echo "       Its rows are in $dir/:" >&2
+    for l in "$dir"/*.md; do echo "         $l" >&2; done
+    echo "       Unset LEDGER_FILE (the directory is found by itself) or set LEDGER_FILE=$dir" >&2
+    return
+  fi
+  links="$(grep -oE '\]\([^)#]+\.md\)' "$f" 2>/dev/null | sed -E 's/^\]\(//; s/\)$//' | sort -u)"
+  if [ -n "$links" ]; then
+    echo "       It links to these ledgers (relative to $(dirname "$f")/) — rows are in them:" >&2
+    printf '%s\n' "$links" | sed 's/^/         /' >&2
+    echo "       Measure them with LEDGER_FILE=<that file or its directory>." >&2
+  fi
+}
 
 # Non-vacuous guard: an instrument that measured nothing must not report "all clean".
 if [ "$MEASURABLE" -eq 0 ]; then
-  echo "FAULT: 0 measurable rows extracted from ${#LEDGERS[@]} ledger(s)." >&2
+  NNOTABLE=$(printf '%s' "$NOTABLE" | grep -c . || true)
+  if [ "$NNOTABLE" -gt 0 ] && [ "$NNOTABLE" -eq "$LEDGER_COUNT" ]; then
+    echo "FAULT: nothing to measure — the ledger read is an index, not a ledger table." >&2
+    while IFS= read -r f; do [ -n "$f" ] && explain_index "$f"; done <<< "$NOTABLE"
+    echo "       Refusing to report a clean run over zero measurements." >&2
+    exit 2
+  fi
+  echo "FAULT: 0 measurable rows extracted from $LEDGER_COUNT ledger(s)." >&2
   echo "       Either the ledger table shape changed or the glob matched nothing." >&2
   echo "       Refusing to report a clean run over zero measurements." >&2
   exit 2
@@ -281,7 +360,7 @@ probe() {
 
 RESULTS=""
 n=0
-while IFS=$'\t' read -r kind mod ptr status cmd; do
+while IFS=$'\t' read -r kind mod brd ptr status cmd; do
   [ "$kind" = "ROW" ] || continue
   n=$((n+1))
   [ "$QUIET" -eq 1 ] || printf '\r  measuring %d/%d ' "$n" "$MEASURABLE" >&2
@@ -297,7 +376,7 @@ while IFS=$'\t' read -r kind mod ptr status cmd; do
         *)                                                               verdict="UNKNOWN-STATUS" ;;
       esac ;;
   esac
-  RESULTS+="$mod	$ptr	$status	$observed	$verdict	$cmd"$'\n'
+  RESULTS+="$mod	$ptr	$status	$observed	$verdict	$cmd	$brd"$'\n'
 done 3<<< "$ROWS" <&3
 [ "$QUIET" -eq 1 ] || printf '\r%*s\r' 30 '' >&2
 
@@ -346,8 +425,16 @@ NSEED=$(printf '%s' "$SEEDED" | grep -c . || true)
 
 # --- report ------------------------------------------------------------------------------
 STAMP="$(date +%Y-%m-%d)"
-REPORT="$OUTDIR/report-$STAMP.tsv"
-{ printf 'module\tpointer\tstored\tobserved\tverdict\tcommand\n'; printf '%s\n' "$RESULTS"; } > "$REPORT"
+# One report per BRD for per-BRD ledgers (report-<date>-<BRD>.tsv), so measuring several BRDs
+# does not leave only the last one on disk; rows from every other shape keep report-<date>.tsv.
+REPORTS=""
+for b in $(printf '%s\n' "$RESULTS" | awk -F'\t' 'NF{print $7}' | sort -u); do
+  if [ "$b" = "-" ]; then REPORT="$OUTDIR/report-$STAMP.tsv"; else REPORT="$OUTDIR/report-$STAMP-$b.tsv"; fi
+  { printf 'module\tpointer\tstored\tobserved\tverdict\tcommand\n'
+    printf '%s\n' "$RESULTS" | awk -F'\t' -v b="$b" 'BEGIN{OFS="\t"} $7==b {print $1,$2,$3,$4,$5,$6}'
+  } > "$REPORT"
+  REPORTS+="$REPORT"$'\n'
+done
 
 count() { printf '%s\n' "$RESULTS" | awk -F'\t' -v v="$1" '$5==v' | grep -c . || true; }
 OK=$(count OK); STALE=$(count STALE); UNDER=$(count UNDERSTATED); UNK=$(count UNKNOWN-STATUS)
@@ -363,7 +450,10 @@ echo "  UNDERSTATED            $UNDER"
 [ "$UNRUN" -gt 0 ] && echo "  UNRUNNABLE             $UNRUN   (backticked prose, or a probe mxcli rejects — fix the probe; see the report)"
 [ "$TMO" -gt 0 ]   && echo "  TIMEOUT                $TMO   (>${TIMEOUT_S}s — never counted as a pass)"
 [ "$UNK" -gt 0 ]   && echo "  UNKNOWN-STATUS         $UNK"
-echo "  report                 $REPORT"
+while IFS= read -r r; do [ -n "$r" ] && echo "  report                 $r"; done <<< "$REPORTS"
+if [ -n "$NOTABLE" ]; then
+  while IFS= read -r f; do [ -n "$f" ] && echo "  no table (index?)      $f"; done <<< "$NOTABLE"
+fi
 [ "$NSEED" -gt 0 ] && echo "  newly baselined        $NSEED   (no baseline row yet — regressions measured from the next run)"
 
 if [ "$STALE" -gt 0 ] || [ "$UNDER" -gt 0 ]; then
diff --git a/project-bin/graph-sweep.sh b/project-bin/graph-sweep.sh
index 41f1b65c..313df442 100755
--- a/project-bin/graph-sweep.sh
+++ b/project-bin/graph-sweep.sh
@@ -26,7 +26,7 @@
 # is an intent question, answered against the module brief, not here.
 #
 # Usage: bin/graph-sweep.sh [--module <Name>] [--min-elements N] [--tsv]
-# Exit:  0 swept · 2 instrument fault (stale catalog, empty graph, missing db)
+# Exit:  0 swept · 2 instrument fault (stale catalog, empty graph, no 'call' edges, missing db)
 
 set -uo pipefail
 
@@ -110,18 +110,33 @@ if [ "$CAT_MTIME" != "$MPR_MTIME" ]; then
   exit 2
 fi
 
-if [ "$BUILD_MODE" != "full" ]; then
-  echo "FAULT: catalog build_mode is '$BUILD_MODE'; reference edges require 'full'." >&2
-  echo "       Rebuild: ./mxcli -p $MPR -c 'REFRESH CATALOG FULL'" >&2
-  exit 2
-fi
-
-# --- guard 2: non-vacuous ------------------------------------------------------------------
+# --- guard 2: non-vacuous, measured on the edges this sweep reads -------------------------
 # An empty graph produces zero findings, which is indistinguishable from a clean model.
+#
+# WHY NOT `build_mode` (fixed 2026-10-13, reported from the field 2026-10-11): this guard used
+# to refuse any catalog whose catalog_meta.build_mode was not the literal 'full'. mxcli v0.24.0
+# writes 'source' even after `REFRESH CATALOG FULL`, and that catalog held 5,368 typed refs
+# rows. So the sweep FAULTed on every run on that mxcli, on a fresh, complete catalog:
+#   FAULT: catalog build_mode is 'source'; reference edges require 'full'.
+# The label was a proxy for "the reference edges are there". Test that directly instead: the
+# orphan finding reads RefKind 'call' (with action/menu_item/show_page/datasource), and a
+# catalog built without edges (the old 'fast' mode) has none. Zero 'call' edges is the
+# signature of a catalog that cannot answer the question, whatever its label says.
+# Assumption, stated: a real model with microflows has at least one microflow-to-microflow
+# call. A model with literally none would FAULT here; the message says what was counted.
 REFS=$(q "SELECT COUNT(*) FROM refs;")
 OBJS=$(q "SELECT COUNT(*) FROM objects;")
 if [ "${REFS:-0}" -eq 0 ] || [ "${OBJS:-0}" -eq 0 ]; then
-  echo "FAULT: graph is empty (refs=$REFS objects=$OBJS). Refusing to report a clean sweep." >&2
+  echo "FAULT: graph is empty (refs=$REFS objects=$OBJS, build_mode '${BUILD_MODE:-unset}'). Refusing to report a clean sweep." >&2
+  echo "       Rebuild: ./mxcli -p $MPR -c 'REFRESH CATALOG FULL'" >&2
+  exit 2
+fi
+CALLS=$(q "SELECT COUNT(*) FROM refs WHERE RefKind='call';")
+if [ "${CALLS:-0}" -eq 0 ]; then
+  KINDS="$(q "SELECT RefKind || '=' || COUNT(*) FROM refs GROUP BY RefKind ORDER BY COUNT(*) DESC LIMIT 8;" | paste -sd' ' -)"
+  echo "FAULT: catalog has 0 'call' edges (build_mode '${BUILD_MODE:-unset}', $REFS refs: ${KINDS:-none})." >&2
+  echo "       The orphan finding reads 'call' edges; without them every microflow looks orphaned." >&2
+  echo "       Rebuild: ./mxcli -p $MPR -c 'REFRESH CATALOG FULL'" >&2
   exit 2
 fi
 
@@ -195,7 +210,7 @@ fi
 N_UNWIRED=$(printf '%s\n' "$WIRING" | awk -F'|' 'NF && $3==0' | grep -c . || true)
 N_ORPH=$(printf '%s\n' "$ORPHANS" | grep -c . || true)
 
-echo "graph-sweep · catalog $CAT_MTIME · $OBJS objects · $REFS typed edges"
+echo "graph-sweep · catalog $CAT_MTIME (build_mode ${BUILD_MODE:-unset}) · $OBJS objects · $REFS typed edges ($CALLS call)"
 echo
 echo "  module wiring (>= $MIN_ELEMENTS elements)"
 printf '    %-24s %8s %9s %10s\n' MODULE ELEMENTS INBOUND OUTBOUND
diff --git a/skills/coverage-ledger.md b/skills/coverage-ledger.md
index 431c68ea..88674a5a 100644
--- a/skills/coverage-ledger.md
+++ b/skills/coverage-ledger.md
@@ -14,11 +14,12 @@
 
 ## Where the ledger lives
 
-Three path shapes exist in real projects. All three are read by `project-bin/conformance-check.sh`
-and `project-bin/coverage-preflight.sh`; the first is canonical.
+Four path shapes exist in real projects. All four are read by `project-bin/conformance-check.sh`
+and `project-bin/coverage-preflight.sh`; the per-module file is canonical.
 
 | Path | When | Status |
 |---|---|---|
+| `architecture/modules/<Module>/coverage-ledger/<BRDID>.md` | module with several BRDs, split one ledger per BRD (`coverage-check-all.sh`'s form) | accepted — wins over the `coverage-ledger.md` beside it, which becomes the index |
 | `architecture/modules/<Module>/coverage-ledger.md` | multi-module project | **canonical** |
 | `architecture/modules/<Module>-coverage-ledger.md` | project whose `architecture/modules/` is flat | accepted |
 | `architecture/coverage-ledger.md` | single-BRD project | accepted |
@@ -30,9 +31,20 @@ together), and changing canon would invalidate every ledger already written to i
 The flat shape is read because it is what projects actually have: PROJECT-A's `architecture/modules/`
 contains `Approval-brief.md`, `ProductNumbers.md`, `Common-brief.md` and no subdirectories at all.
 An instrument that globs only the canonical shape tells such a project it has no ledger even when
-it has one. **When no ledger is found, the instruments print all three paths they tried** — a
+it has one. **When no ledger is found, the instruments print all the paths they tried** — a
 "not found" that does not name what it looked for is not actionable.
 
+The per-BRD directory is read because a module with several BRDs splits its ledger that way and
+keeps `coverage-ledger.md` as an index. Conformance measures every `<BRDID>.md` in it and writes
+one `docs/conformance/report-<date>-<BRDID>.tsv` per BRD; baseline pointers carry the BRD
+(`<BRDID>:<pointer>`), because the same JSON pointer recurs across BRDs. An index read on its own
+(`LEDGER_FILE=…/coverage-ledger.md`, or a module whose index links to another module's per-BRD
+file) is reported as an index, naming the files its rows are in.
+
+Bad, before the per-BRD read (field report, 2026-10-11) — every module with an index printed
+`FAULT: 0 measurable rows extracted from 1 ledger(s).` while its rows sat one directory down.
+`LEDGER_FILE=<file or directory>` overrides discovery in both instruments.
+
 ---
 
 ## The four fallback levels — what an instrument does when there is no ledger
diff --git a/tests/wave2/test-catalog-call-edges.sh b/tests/wave2/test-catalog-call-edges.sh
new file mode 100755
index 00000000..b6a11835
--- /dev/null
+++ b/tests/wave2/test-catalog-call-edges.sh
@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# Usage: bash test-catalog-call-edges.sh [path-to-graph-sweep.sh]
+#
+# Fixture for the catalog guard in project-bin/graph-sweep.sh and project-bin/app-facts.sh
+# (app-facts.sh is taken from beside the subject).
+#
+# The defect (issue #259, field report 2026-10-11, mxcli v0.24.0, Mendix 11.14.0): both scripts
+# refused any catalog whose catalog_meta.build_mode was not the literal 'full'. mxcli v0.24.0
+# writes 'source' even after `REFRESH CATALOG FULL`, on a catalog holding 5,368 typed refs rows,
+# so every sweep on that mxcli ended in (verbatim from the report — the golden input):
+#   FAULT: catalog build_mode is 'source'; reference edges require 'full'.
+# The fix tests what the scripts read instead of the label: a non-empty refs table with at
+# least one RefKind='call' edge.
+#
+# Cases, each on BOTH layouts (single-tree, and two-tree with the .mpr and catalog under app/):
+#   1. build_mode 'source' + call edges  -> sweep runs, orphan finding still correct
+#   2. build_mode 'full'   + zero call edges -> FAULT naming the mode and the per-kind counts
+#   3. build_mode 'fast'   + empty refs  -> FAULT (graph is empty), as before
+#   4. app-facts: 'source' + calls passes the guard; zero calls FAULTs naming mode and counts
+#
+# The catalog databases are SYNTHETIC: no real catalog.db is captured in this repo, and the
+# report quotes only the FAULT line and the counts. Tables and columns are exactly the ones the
+# two scripts query (catalog_meta key/value, refs SourceName/TargetName/RefKind, objects,
+# microflows_data, and app-facts' nine required tables); RefKind values 'call' and 'action' are
+# the ones the scripts' own queries name. The mxcli used by app-facts is a stub that copies a
+# prepared catalog into place — no real mxcli runs.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/graph-sweep.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+SUT="$(cd "$(dirname "$SUT")" && pwd)/$(basename "$SUT")"
+AF="$(dirname "$SUT")/app-facts.sh"
+command -v sqlite3 >/dev/null || { echo "SKIP: sqlite3 not on PATH"; echo "SCORE: 0/0"; exit 0; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/catalog-calls.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+# mkdb <db> <build_mode> <with-calls:1|0> <with-refs:1|0>
+mkdb() {
+  local db="$1" mode="$2" calls="$3" refs="$4"
+  mkdir -p "$(dirname "$db")"; rm -f "$db"
+  {
+    echo "CREATE TABLE catalog_meta (key TEXT, value TEXT);"
+    echo "INSERT INTO catalog_meta VALUES ('mpr_mod_time','2026-10-10T12:00:00.000');"
+    echo "INSERT INTO catalog_meta VALUES ('build_mode','$mode');"
+    echo "CREATE TABLE refs (SourceType TEXT, SourceName TEXT, TargetName TEXT, RefKind TEXT, ModuleName TEXT);"
+    echo "CREATE TABLE objects (QualifiedName TEXT, ModuleName TEXT, ObjectType TEXT);"
+    echo "CREATE TABLE microflows_data (QualifiedName TEXT, ModuleName TEXT, Name TEXT, ActivityCount INTEGER, MicroflowType TEXT);"
+    echo "CREATE TABLE modules_data (Name TEXT, Source TEXT, AppStoreVersion TEXT, AppStoreGuid TEXT);"
+    echo "CREATE TABLE entities_data (QualifiedName TEXT, ModuleName TEXT, EntityType TEXT);"
+    echo "CREATE TABLE activities_data (MicroflowQualifiedName TEXT, ModuleName TEXT, ActivityType TEXT);"
+    echo "CREATE TABLE pages_data (QualifiedName TEXT, ModuleName TEXT);"
+    echo "CREATE TABLE scheduled_events_data (QualifiedName TEXT, ModuleName TEXT);"
+    echo "CREATE TABLE projects (Name TEXT);"
+    echo "INSERT INTO modules_data VALUES ('Orders','', '', ''),('Billing','', '', '');"
+    echo "INSERT INTO activities_data VALUES ('Orders.SUB_Total','Orders','ActionActivity');"
+    for m in Orders.ACT_Save Orders.SUB_Total Orders.SUB_Unused Billing.ACT_Send; do
+      echo "INSERT INTO objects VALUES ('$m','${m%%.*}','MICROFLOW');"
+      echo "INSERT INTO microflows_data VALUES ('$m','${m%%.*}','${m#*.}',3,'MICROFLOW');"
+    done
+    if [ "$refs" = 1 ]; then
+      echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','action','Orders');"
+      echo "INSERT INTO refs VALUES ('MICROFLOW','Billing.ACT_Send','Orders.ACT_Save','action','Billing');"
+      [ "$calls" = 1 ] && echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total','call','Orders');"
+    fi
+  } | sqlite3 "$db"
+}
+
+# proj <layout:single|two> -> prints project dir; .mpr mtime pinned to match catalog_meta
+proj() {
+  local p="$WORK/$1-$RANDOM" mdir
+  mkdir -p "$p"
+  if [ "$1" = two ]; then mdir="$p/app"; else mdir="$p"; fi
+  mkdir -p "$mdir"
+  : > "$mdir/Shop.mpr"
+  touch -t 202610101200.00 "$mdir/Shop.mpr"
+  printf '%s\n' "$p"
+}
+mdir() { if [ -d "$1/app" ]; then printf '%s/app\n' "$1"; else printf '%s\n' "$1"; fi; }
+sweep() { ( cd "$1" && PROJECT_ROOT="$1" bash "$SUT" --min-elements 1 ) > "$WORK/out" 2>&1; echo $?; }
+out() { tr '\n' ' ' < "$WORK/out" | cut -c1-400; }
+
+for layout in single two; do
+  echo "== graph-sweep · $layout-tree layout"
+
+  # --- 1. 'source' with call edges: the field case --------------------------------------------
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" source 1 1
+  rc="$(sweep "$P")"
+  if grep -q "FAULT: catalog build_mode is 'source'; reference edges require 'full'." "$WORK/out"; then
+    bad "[$layout] build_mode 'source' refused by label (issue #259 golden FAULT line)" "rc=$rc $(out)"
+  elif [ "$rc" = 0 ] && grep -q "graph-sweep ·" "$WORK/out"; then
+    ok "[$layout] build_mode 'source' with call edges is swept (rc 0)"
+  else
+    bad "[$layout] 'source' catalog with call edges did not sweep" "rc=$rc $(out)"
+  fi
+  if grep -q "Orders.SUB_Unused" "$WORK/out" && ! grep -q "Orders.SUB_Total " "$WORK/out"; then
+    ok "[$layout] orphan finding still reads call edges (SUB_Unused listed, called SUB_Total not)"
+  else
+    bad "[$layout] orphan finding wrong on a 'source' catalog" "$(out)"
+  fi
+
+  # --- 2. 'full' label but zero call edges: the label is not evidence --------------------------
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full 0 1
+  rc="$(sweep "$P")"
+  if [ "$rc" = 2 ] && grep -q "0 'call' edges" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out" \
+     && grep -q "action=2" "$WORK/out"; then
+    ok "[$layout] zero call edges FAULTs, naming the mode and per-kind counts (action=2)"
+  else
+    bad "[$layout] a catalog with no call edges was not refused by what it holds" "rc=$rc $(out)"
+  fi
+
+  # --- 3. empty refs still FAULTs ---------------------------------------------------------------
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" fast 0 0
+  rc="$(sweep "$P")"
+  if [ "$rc" = 2 ] && grep -q "^FAULT:" "$WORK/out"; then
+    ok "[$layout] empty refs still FAULTs (never a clean sweep)"
+  else
+    bad "[$layout] empty refs not refused" "rc=$rc $(out)"
+  fi
+
+  # --- 4. app-facts: same guard, through a stub mxcli that drops a prepared catalog -------------
+  if [ -f "$AF" ]; then
+    for variant in source-calls full-nocalls; do
+      P="$(proj $layout)"; M="$(mdir "$P")"
+      case "$variant" in
+        source-calls) mkdb "$WORK/prep.db" source 1 1 ;;
+        full-nocalls) mkdb "$WORK/prep.db" full 0 1 ;;
+      esac
+      cat > "$WORK/mxcli-stub" <<EOF
+#!/usr/bin/env bash
+[ "\${1:-}" = --version ] && { echo "mxcli stub"; exit 0; }
+o=""; while [ \$# -gt 0 ]; do [ "\$1" = -o ] && o="\$2"; shift; done
+mkdir -p .mxcli && cp "$WORK/prep.db" .mxcli/catalog.db && echo '{}' > "\$o"
+EOF
+      chmod +x "$WORK/mxcli-stub"
+      ( cd "$P" && PROJECT_ROOT="$P" MXCLI="$WORK/mxcli-stub" bash "$AF" --skip-loops --facts-dir "$P/facts" ) > "$WORK/out" 2>&1
+      rc=$?
+      case "$variant" in
+        source-calls)
+          if grep -q "catalog ok: build_mode=source" "$WORK/out" && ! grep -q "build_mode is 'source'" "$WORK/out"; then
+            ok "[$layout] app-facts accepts a 'source' catalog with call edges"
+          else
+            bad "[$layout] app-facts refused a 'source' catalog with call edges" "rc=$rc $(out)"
+          fi ;;
+        full-nocalls)
+          if [ "$rc" = 2 ] && grep -q "0 'call' edges" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out"; then
+            ok "[$layout] app-facts FAULTs on zero call edges, naming the mode"
+          else
+            bad "[$layout] app-facts wrote facts from a catalog with no call edges" "rc=$rc $(out)"
+          fi ;;
+      esac
+    done
+  else
+    bad "app-facts.sh not beside $SUT"
+  fi
+done
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-conformance-per-brd-ledger.sh b/tests/wave2/test-conformance-per-brd-ledger.sh
new file mode 100755
index 00000000..766577cb
--- /dev/null
+++ b/tests/wave2/test-conformance-per-brd-ledger.sh
@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+# Usage: bash test-conformance-per-brd-ledger.sh [path-to-conformance-check.sh]
+#
+# Fixture for project-bin/conformance-check.sh on a per-BRD coverage-ledger layout:
+#   architecture/modules/<Module>/coverage-ledger.md        an INDEX (no ledger table)
+#   architecture/modules/<Module>/coverage-ledger/<BRD>.md  the rows, one file per BRD
+#
+# The defect (issue #260, field report 2026-10-11, mxcli v0.24.0, four modules): the script read
+# only the index and ended every such run in (verbatim from the report — the golden input):
+#   FAULT: 0 measurable rows extracted from 1 ledger(s).
+# while LEDGER_FILE=<one per-BRD file> measured 128 rows. The fix measures every per-BRD file,
+# writes one report per BRD, documents LEDGER_FILE, and names an index as an index.
+#
+# Cases, each on BOTH layouts (single-tree, and two-tree with the .mpr under app/):
+#   1. --module Orders: both per-BRD files measured, one report each, the index not read
+#   2. two BRDs reuse the same JSON pointer; the baseline keeps both rows (BRD-keyed)
+#   3. a per-BRD row going absent is a regression naming its BRD
+#   4. no --module: same rows, the index is not measured as a third ledger
+#   5. LEDGER_FILE=<the index> says "index" and names the directory, not "0 measurable rows"
+#   6. a module whose index links to another module's per-BRD file: the link is named
+#   7. LEDGER_FILE that does not exist FAULTs instead of falling back
+#   8. --help documents LEDGER_FILE
+#
+# The ledgers and the mxcli stub are SYNTHETIC, as in test-conformance-baseline-scope.sh: the
+# field-proof rule's captured-golden-input clause governs parsers of tool output, and nothing
+# here exercises the DESCRIBE-output parser — the stub answers the two shapes the script already
+# classifies (text + rc 0 = PRESENT, "Error: … not found" + rc 1 = ABSENT). The ledger table
+# shape is the 7-column one coverage-ledger.md specifies and the existing fixture uses.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/conformance-check.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+SUT="$(cd "$(dirname "$SUT")" && pwd)/$(basename "$SUT")"
+[ -f "$(dirname "$SUT")/_common.sh" ] || { echo "FAIL — _common.sh not beside $SUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/conf-perbrd.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+GOLDEN='FAULT: 0 measurable rows extracted from 1 ledger(s).'
+
+ledger_rows() {  # ledger_rows <file> <Module> <entity> <microflow>
+  cat > "$1" <<EOF
+# Coverage ledger — $(basename "$1" .md)
+
+| Pointer | Kind | Name | Row | Proof | Acceptance | Status |
+|---|---|---|---|---|---|---|
+| \`/domainEntities/0\` | entity | $3 | 1.1 | exec.sh | \`DESCRIBE ENTITY $2.$3\` | built |
+| \`/microflows/0\` | microflow | $4 | 1.2 | exec.sh | \`DESCRIBE MICROFLOW $2.$4\` | built |
+EOF
+}
+
+setup() {  # setup <single|two> -> sets P
+  P="$WORK/$1"
+  rm -rf "$P"
+  local O="$P/architecture/modules/Orders" B="$P/architecture/modules/Billing"
+  mkdir -p "$O/coverage-ledger" "$B"
+  if [ "$1" = two ]; then mkdir -p "$P/app"; : > "$P/app/Shop.mpr"; else : > "$P/Shop.mpr"; fi
+  printf 'Orders.Order\nOrders.ACT_Order_Save\nOrders.Invoice\nOrders.ACT_Invoice_Send\n' > "$P/PRESENT"
+  cat > "$P/mxcli" <<'EOF'
+#!/usr/bin/env bash
+cmd=""; while [ $# -gt 0 ]; do [ "$1" = -c ] && cmd="$2"; shift; done
+name="${cmd##* }"
+d="$(dirname "$0")"
+if grep -qx "$name" "$d/PRESENT"; then echo "-- $name"; echo "create $name;"; exit 0; fi
+echo "Error: $name not found"; exit 1
+EOF
+  chmod +x "$P/mxcli"
+  ledger_rows "$O/coverage-ledger/F001-orders.md" Orders Order ACT_Order_Save
+  ledger_rows "$O/coverage-ledger/F002-invoicing.md" Orders Invoice ACT_Invoice_Send
+  cat > "$O/coverage-ledger.md" <<'EOF'
+# Orders — coverage ledger index
+
+Rows live one file per BRD:
+- [F001](coverage-ledger/F001-orders.md)
+- [F002](coverage-ledger/F002-invoicing.md)
+EOF
+  cat > "$B/coverage-ledger.md" <<'EOF'
+# Billing — coverage ledger index
+
+Billing has no ledger of its own; its rows are in [F002](../Orders/coverage-ledger/F002-invoicing.md).
+EOF
+}
+run() { ( cd "$P" && PROJECT_ROOT="$P" bash "$SUT" --quiet "$@" ) > "$WORK/out" 2>&1; echo $?; }
+out() { tr '\n' ' ' < "$WORK/out" | cut -c1-400; }
+base_rows() { grep -c . "$P/docs/conformance/baseline.tsv" 2>/dev/null || echo 0; }
+
+for layout in single two; do
+  echo "== $layout-tree layout"
+  setup "$layout"
+
+  # --- 1. --module measures every per-BRD file ------------------------------------------------
+  rc="$(run --module Orders)"
+  if grep -qF "$GOLDEN" "$WORK/out"; then
+    bad "[$layout] per-BRD layout read as the index (issue #260 golden FAULT line)" "rc=$rc $(out)"
+  elif [ "$rc" = 0 ] && grep -q "measured 4 " "$WORK/out"; then
+    ok "[$layout] --module Orders measures both per-BRD ledgers (4 rows)"
+  else
+    bad "[$layout] per-BRD rows not measured" "rc=$rc $(out)"
+  fi
+  n=$(ls "$P"/docs/conformance/report-*-F001-orders.tsv "$P"/docs/conformance/report-*-F002-invoicing.tsv 2>/dev/null | grep -c .)
+  [ "$n" = 2 ] && ok "[$layout] one report per BRD (report-<date>-F001-orders.tsv, -F002-invoicing.tsv)" \
+    || bad "[$layout] expected 2 per-BRD reports" "$(ls "$P/docs/conformance" 2>/dev/null | tr '\n' ' ')"
+
+  # --- 2. same pointer in two BRDs: two baseline rows, not one ----------------------------------
+  [ "$(base_rows)" = 4 ] && grep -q 'F001-orders:`/microflows/0`' "$P/docs/conformance/baseline.tsv" \
+    && grep -q 'F002-invoicing:`/microflows/0`' "$P/docs/conformance/baseline.tsv" \
+    && ok "[$layout] baseline keys rows by BRD (4 rows, /microflows/0 twice)" \
+    || bad "[$layout] baseline collapsed per-BRD rows" "$(cat "$P/docs/conformance/baseline.tsv" 2>/dev/null | tr '\n' ' ')"
+
+  # --- 3. a per-BRD row going absent is a regression --------------------------------------------
+  sed -i.bak '/^Orders.ACT_Invoice_Send$/d' "$P/PRESENT"
+  rc="$(run --module Orders)"
+  [ "$rc" = 1 ] && grep -q 'F002-invoicing:`/microflows/0`.*was OK, now STALE' "$WORK/out" \
+    && ok "[$layout] F002's microflow going absent fails the run, naming the BRD" \
+    || bad "[$layout] per-BRD regression not reported" "rc=$rc $(out)"
+  mv "$P/PRESENT.bak" "$P/PRESENT"
+
+  # --- 4. unscoped run: the index is not a third ledger -----------------------------------------
+  rc="$(run)"
+  if [ "$rc" = 0 ] && grep -q "measured 4 " "$WORK/out" && ! grep -q "Orders/coverage-ledger.md" "$WORK/out"; then
+    ok "[$layout] unscoped run measures the 4 per-BRD rows; Orders' index is not read"
+  else
+    bad "[$layout] unscoped run wrong on per-BRD layout" "rc=$rc $(out)"
+  fi
+
+  # --- 5. LEDGER_FILE pointed at the index says so ---------------------------------------------
+  rc="$( ( cd "$P" && PROJECT_ROOT="$P" LEDGER_FILE=architecture/modules/Orders/coverage-ledger.md \
+           bash "$SUT" --quiet --module Orders ) > "$WORK/out" 2>&1; echo $? )"
+  [ "$rc" = 2 ] && grep -q "is an index" "$WORK/out" && grep -q "architecture/modules/Orders/coverage-ledger/" "$WORK/out" \
+    && ! grep -qF "$GOLDEN" "$WORK/out" \
+    && ok "[$layout] LEDGER_FILE=<index> is named an index and points at its directory" \
+    || bad "[$layout] index reported as '0 measurable rows'" "rc=$rc $(out)"
+
+  # --- 6. an index that links to another module's per-BRD file names the link ------------------
+  rc="$(run --module Billing)"
+  [ "$rc" = 2 ] && grep -q "is an index" "$WORK/out" && grep -q "Orders/coverage-ledger/F002-invoicing.md" "$WORK/out" \
+    && ok "[$layout] Billing's index names the ledger its rows are in" \
+    || bad "[$layout] cross-module index not explained" "rc=$rc $(out)"
+
+  # --- 7. a LEDGER_FILE that does not exist FAULTs ----------------------------------------------
+  rc="$( ( cd "$P" && PROJECT_ROOT="$P" LEDGER_FILE=architecture/nope.md bash "$SUT" --quiet --module Orders ) \
+           > "$WORK/out" 2>&1; echo $? )"
+  [ "$rc" = 2 ] && grep -q "LEDGER_FILE=architecture/nope.md" "$WORK/out" \
+    && ok "[$layout] missing LEDGER_FILE FAULTs instead of falling back" \
+    || bad "[$layout] missing LEDGER_FILE silently fell back" "rc=$rc $(out)"
+done
+
+# --- 8. LEDGER_FILE is in the usage text --------------------------------------------------------
+( cd "$P" && PROJECT_ROOT="$P" bash "$SUT" --help ) 2>/dev/null | grep -q "LEDGER_FILE" && ok "--help documents LEDGER_FILE" \
+  || bad "--help does not mention LEDGER_FILE"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From 4a60e144451e20ea4f1eb55020135d59f254e89d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 10:08:05 +0000
Subject: [PATCH 02/68] fix(lint-gate): reverted-to-stock rules stop the run as
 BLIND, not a rise (#264); BUG-156 + preflight row 28 (#263)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#264: `mxcli init` re-seeds .claude/lint-rules/ and the toolkit rules lose their header.
lint-gate.sh never read .claude/.mxtk-lint-receipt, so the re-seed showed up as a rise on the
next exec (CONV010 26 -> 169 on a pages-only script), or sat for days while the baseline
absorbed stock counts.

- project-bin/lint-gate.sh: before linting, each rule in the receipt is md5'd; a mismatch with
  the header gone (or a missing file) is named, the remedy `<toolkit>/bin/sync-project.sh
  <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock`.
  lint-last.json gets verdict BLIND-RULES-REVERTED and no total (no stale total for
  metrics-ledger). --update-baseline is refused over reverted rules. A headered edit is left to
  the installer's LOCALLY MODIFIED report; no receipt means no check;
  LINT_RULES_REVERTED_OK=1 lints anyway, with the warning.
- project-bin/exec.sh: run_lint_gate maps that output to LINT_RC 3 / "LINT BLIND: rules
  reverted to stock (<files>) — run sync-project.sh; delta not attributable".
- Guard rules: the receipt is the installer's evidence, not lint-gate's own stamp (rule 6);
  the remedy (sync-project.sh / the installer) is never blocked and clears it — fixture T6
  (rule 7).
- tests/wave2/test-lint-receipt-revert.sh: golden receipt from the real installer run into a
  scratch project; 23/23 here, 11 fail with master's lint-gate.sh.

#263 (learned-rule half): BUG-156 in bug-logs/mxcli-bugs.md (bin/bug-lookup.sh BUG-156 and
"free room" find it) and STOP row 28 in skills/learned-mdl-preflight.md, quoting the issue's
exec error verbatim. Upstream draft prepared, not filed.

Field run: the receipt/installer half was field-checked by the maintainer on a copy of a
v0.25.0 project (#264 comment: installer restores conv010/data_change, md5s then match the
toolkit). lint-gate's new check has not yet run on a live project — fixture only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |   2 +
 agents/gate-agent.md                    |   4 +-
 bug-logs/mxcli-bugs.md                  |  27 ++++++
 project-bin/exec.sh                     |  11 ++-
 project-bin/lint-gate.sh                |  76 +++++++++++++++-
 skills/learned-mdl-preflight.md         |   1 +
 skills/lint-that-actually-runs.md       |   3 +
 tests/wave2/test-lint-receipt-revert.sh | 114 ++++++++++++++++++++++++
 8 files changed, 234 insertions(+), 4 deletions(-)
 create mode 100755 tests/wave2/test-lint-receipt-revert.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a28740e2..d5262529 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer: 23/23 here, 11 fail on master's lint-gate. — AlvinnYeo
+- learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
 - fix(journeys): **the journey runner preflights the suite: a refused admin credential aborts it before the first journey, missing mock env vars are one SETUP line, and journeys can declare `requires` / `leaves` / `consumes` so order is computed and an unmet precondition is named** ([#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286), #287 item 1, [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) first half). Field run 2026-10-12, 14 journeys: the runner's literal admin default (`M2EE_ADMIN_PASS || '1'`) was not the app's, every data rung got HTTP 403 and read INVALID, and the suite walked all 14 anyway (first pass 305/339, 2 of 14 green, discarded). Two unset mock vars made 3 journeys INVALID one at a time, and an undeclared order dependency made 6 of 14 INVALID. `tests/e2e/config.js` now resolves the token from `M2EE_ADMIN_PASS` → this app's `.mxcli/run-local.json` (matched on appPort) → `.docker/.env` → a labelled guess, and records the source, never the value. `journey-runner.js` refuses to start with `TEST_PASS` unset, before any login (#278: a run without the env step submitted the config default, then the admin fallback, and locked two demo accounts for ~5 min each; `ALLOW_CONFIG_CREDENTIALS=1` when the default is real). It then probes once through the same `mxcli oql --direct` before opening the browser: 401/403 or unreachable → exit 2 with the source and the remedy (`ALLOW_NO_DATA_RUNG=1` overrides), the live `System.Session` count is reported, and `JOURNEY_SESSION_CAP` refuses a run at the cap. Logout now runs on crash and SIGINT/SIGTERM too, and the findings slot is overwritten on an abort. Journeys without the new fields run in file order exactly as before. `journey-proof.md` / `journey-examples.md` / `learned-db-assertions.md` updated. Fixture `tests/wave2/test-journey-preflight.sh` (54 cases at first commit, including three end-to-end runs of the real runner on a stub mxcli; golden = mxcli v0.26.0's own message and `.docker/.env` template strings read from the binary, plus the captured run-local handshake; 1/2 against master's runner). Second commit, from the skills review: `"resetsData": true` tags a journey that resets or reloads demo data, printed at start and refused under `--protect-state` (#279: one suite run between rehearsal and recording wiped an app's seeded state, and that app never appeared in the film). `"assertLanding": true` / `--assert-landing` records, right after login and before any click, whether any element draws an outline or a focused element draws a box-shadow (#281: ring on landing for 3 of 3 roles while 3 UX asserts stayed green). `journey-proof.md` adds a third rule as text only: a fix to a displayed fact asserts the old text is absent on every page in its `Displayed fact:` row (#283). Fixture now 65 cases; the in-page landing collector needs a browser and is not fixtured. Not yet run against a live app — MendixMau
 - learn(learned-mdl-cannot-express): **a widget for one role only is not writable in MDL; the action-button workaround and its three traps are now written down** ([#277](https://github.com/MendixMau/mxcli-project-toolkit/issues/277)). Grant `execute` on the button's microflow only to the roles that should see it, and Mendix will not render the button for the rest. Three traps from a 2026-10-12 20-task UX-fix run over three apps: a helper sentence naming the button cannot be gated the same way, an admin (or admin-fallback) session proves nothing, and terminal-state demo data hides the button for the wrong reason. The skill gives a per-role absence check with a denominator and a before/after journey step. Its routing row now triggers on "a widget for one role and not another". — MendixMau
diff --git a/agents/gate-agent.md b/agents/gate-agent.md
index 32fa7df8..cbdea4ff 100644
--- a/agents/gate-agent.md
+++ b/agents/gate-agent.md
@@ -104,7 +104,9 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
    the user's decision, made in chat; `--update-baseline` refuses a rise without `--reason`, a
    security-tier rise (SEC*, CONV006) also without `--approved-in-chat`, and logs each one to
    `.claude/lint-acceptances.tsv`. A row reading `LINT BLIND` is an instrument fault (a rule
-   inspected nothing), not a rise: name the rule and its configuration fix. If the row says
+   inspected nothing), not a rise: name the rule and its configuration fix. `LINT BLIND: rules
+   reverted to stock (…)` means `mxcli init` re-seeded the toolkit rules and lint did not run:
+   the fix is the toolkit's `bin/sync-project.sh`, never a re-baseline. If the row says
    `lint not installed`, say so as a finding: nothing has checked shape in this project.
 
 ## A clean result is not automatically a pass
diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md
index 5bdcbc70..b81fe9fd 100644
--- a/bug-logs/mxcli-bugs.md
+++ b/bug-logs/mxcli-bugs.md
@@ -6029,6 +6029,33 @@ backend's mutator already handles it (the two lists drifted).
 **Not covered by the fix:** `set Content`/`ContentParams` on a dynamic text (parser-level),
 container `RenderMode`, button `RenderType` — all still need `replace`.
 
+## BUG-156: `check -p --references` passes a microflow change that exec then refuses for lack of free room — and says it checked
+
+**Severity:** Medium — loud refusal, nothing written (exec.sh restores the snapshot), but the pre-flight that should have caught it says the opposite, so the failure costs a full exec cycle
+**mxcli version:** v0.25.0 · **Mendix version:** 11.14.0 · **Not filed upstream** (draft prepared, issue #263)
+**Discovered:** 2026-10-11, a consuming project (macOS, toolkit `9dd9be4`), reported by an outside contributor
+**Reproducible:** seen once in the field; no minimal repro yet
+
+`./mxcli check script.mdl -p App.mpr --references` passed the script and printed "no flow change
+exec would refuse". `bin/exec.sh --patch` then refused it:
+
+```
+create or modify microflow Common.IVK_X: this change cannot be spliced into the stored flow ... insert before return $LiveResult: there is no free room for the fragment ... drawn over the ActionActivity at (2025, 200)
+```
+
+`check` does not run the splice / free-room test that exec runs, yet its message reads as if it had.
+Nothing inside ALTER gets round it: `check --help` has no layout or free-room option, `alter microflow`
+insert takes no `@position`, cannot move existing objects, and cannot replace a fragment that returns.
+
+**Workaround (field-used):** `drop microflow` + `create microflow` in the same script, so the flow is
+laid out fresh. Before dropping, `show access on microflow Mod.Name` — the field case had no grants;
+re-granting after a drop + create was not exercised. A dropped-and-restated microflow is also a
+whole-document restatement: `learned-mdl-preflight.md` row 21 (describe first, keep sibling edits)
+applies. The planning rule is row 28 there.
+
+**Upstream ask:** have `check -p` run the same splice/free-room test exec runs, or stop printing
+"no flow change exec would refuse" when it has not.
+
 ## BUG-DRAFT-loop-var-expression-typecheck: the expression type checker is skipped inside a `LOOP` body — the identical expression is caught on a parameter and missed on a loop variable (2026-09-15)
 
 > **FILED UPSTREAM 2026-09-15 — https://github.com/mendixlabs/mxcli/issues/1100**
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index b57430d9..37c9e812 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -738,7 +738,16 @@ run_lint_gate() {
                  | awk '{printf "%s %s ", $1, $6}')
        _blind=$(sed -n '/^!! A RULE COULD NOT READ/,/^$/p' "$_lo" \
                  | grep -oE '^ +[A-Z][A-Z0-9-]*[0-9]+:' | tr -d ' :' | sort -u | paste -sd, -)
-       if [ -z "$_rules" ] && grep -q '^PASS' "$_lo"; then
+       _reverted=$(sed -n '/^!! LINT RULES REVERTED TO STOCK/,/^$/p' "$_lo" \
+                    | grep -oE '^ +[A-Za-z0-9_.-]+\.star:' | tr -d ' :' | paste -sd, -)
+       if grep -q '^BLIND — lint rules reverted to stock' "$_lo"; then
+         # `mxcli init` re-seeded the toolkit rules (#264): lint-gate did not lint. Logging this
+         # as a rise blamed the next script for CONV010 26 -> 169 on flows it never touched.
+         LINT_RC=3
+         LINT_DETAIL="lint BLIND: rules reverted to stock (${_reverted:-see output}) — run sync-project.sh; delta not attributable"
+         echo "  ✗ lint: toolkit rules reverted to stock (${_reverted:-see output}) — not linted, not a rise"
+         sed -n '/^!! LINT RULES REVERTED TO STOCK/,/^BLIND/p' "$_lo" | head -16 | sed 's/^/    /'
+       elif [ -z "$_rules" ] && grep -q '^PASS' "$_lo"; then
          # lint-gate exits 1 for PASS-BLIND too. Logging that as "ROSE: see output" made a rule
          # that inspected nothing look like a rise with no rule named — 20 such rows in two
          # field apps whose CONV020 shipped unconfigured (#229). It is an instrument fault.
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index bac65a4c..ac88c496 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -18,7 +18,24 @@
 #       --approved-in-chat              # ALSO required when a security-tier rule rises
 #   bin/lint-gate.sh --full             # ignore the vendor exclusion (rarely useful)
 #
-# Exit codes: 0 clean or unchanged · 1 a rule increased · 2 could not run (or a refused update)
+# Exit codes: 0 clean or unchanged · 1 a rule increased, or BLIND (a rule inspected nothing,
+#             or the toolkit rules reverted to stock — see below) · 2 could not run (or a
+#             refused update)
+#
+# RULES REVERTED TO STOCK ARE BLIND, NOT A RISE (#264, 2026-10-13). `mxcli init` re-seeds
+# .claude/lint-rules/ and silently overwrites the toolkit's rules with stock ones. Two apps hit
+# it: CONV010 went 26 -> 169 and the next exec — a pages-only script — was logged as the rise;
+# in the other the re-seed sat uncommitted for five days and the baseline absorbed the noisier
+# counts. bin/lib/install-lint-rules.sh already writes .claude/.mxtk-lint-receipt (md5 of each
+# rule AS INSTALLED; it survives `mxcli init`), so before linting this script reads it: a rule
+# whose md5 no longer matches its receipt line AND whose `# mxtk-lint-rule:` header is gone (or
+# whose file is gone) was re-seeded, not edited by a person. The run then prints "BLIND — lint
+# rules reverted to stock", names the files, points at sync-project.sh (which restores them and
+# rewrites the receipt, so the next run is clean) and exits 1 without linting; --update-baseline
+# is refused, since baselining stock counts is how the five-day case went in. A rule that still
+# carries the header but differs is a hand edit — install-lint-rules.sh reports those, this does
+# not. No receipt = nothing to compare (pre-receipt installs) = no check. A deliberate headerless
+# local rule: LINT_RULES_REVERTED_OK=1 runs anyway, with the warning.
 #
 # ACCEPTING DEBT IS RECORDED, NOT SILENT (2026-10-12). Three toolkit-built apps re-baselined
 # 61 times in four days — every acceptance made by the agent whose script caused the rise,
@@ -111,7 +128,7 @@ while [ $# -gt 0 ]; do
               REASON="$2"; shift ;;
     --reason=*) REASON="${1#--reason=}" ;;
     --approved-in-chat) APPROVED=1 ;;
-    -h|--help) sed -n '2,35p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,60p' "$0"; exit 0 ;;
     *) echo "lint-gate: unknown argument '$1'" >&2; exit 2 ;;
   esac
   shift
@@ -133,6 +150,61 @@ if [ "$FULL" -eq 0 ] && [ -f "$VENDOR_FILE" ]; then
   EXCLUDE="$(grep -v '^[[:space:]]*#' "$VENDOR_FILE" | grep -v '^[[:space:]]*$' | paste -sd, -)"
 fi
 
+# Receipt check (#264, see header). Runs before lint, on check AND update runs, and also under
+# LINT_JSON so fixtures exercise it. Reads the receipt bin/lib/install-lint-rules.sh writes;
+# never writes it — only the installer does, and that is the remedy named below.
+RECEIPT="$ROOT/.claude/.mxtk-lint-receipt"
+if [ -f "$RECEIPT" ]; then
+  # Read into a variable first: a heredoc inside $(...) does not parse on bash 3.2.
+  IFS= read -r -d '' _RCHK <<'PY' || true
+import hashlib, os
+rec, d = os.environ["RECEIPT"], os.environ["RULES_DIR"]
+for line in open(rec, encoding="utf-8", errors="replace"):
+    parts = line.split()
+    if len(parts) < 2 or parts[0].startswith("#"):
+        continue
+    name, want = parts[0], parts[1]
+    path = os.path.join(d, name)
+    if not os.path.isfile(path):
+        print("%s\tgone (installed per the receipt, missing now)" % name)
+        continue
+    data = open(path, "rb").read()
+    got = hashlib.md5(data).hexdigest()
+    if got == want:
+        continue
+    if b"# mxtk-lint-rule:" in data:
+        continue  # header kept: a hand edit, which install-lint-rules.sh reports
+    print("%s\theader gone, md5 %s != receipt %s" % (name, got[:8], want[:8]))
+PY
+  REVERTED="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" "$PY" -c "$_RCHK")"
+  if [ -n "$REVERTED" ]; then
+    TKR=""
+    type find_toolkit_root >/dev/null 2>&1 && TKR="$(PROJECT_ROOT="$ROOT" find_toolkit_root 2>/dev/null || true)"
+    echo "!! LINT RULES REVERTED TO STOCK (mxcli init?) — this run's delta is not attributable:"
+    printf '%s\n' "$REVERTED" | while IFS="$(printf '\t')" read -r _f _why; do
+      printf '   %s: %s\n' "$_f" "$_why"; done
+    echo ""
+    echo "   Restore the toolkit rules (rewrites .claude/.mxtk-lint-receipt), then re-run:"
+    echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT"
+    if [ "${LINT_RULES_REVERTED_OK:-}" = "1" ]; then
+      echo "   LINT_RULES_REVERTED_OK=1 — linting anyway; counts below are from the files on disk."
+      echo ""
+    elif [ "$UPDATE" -eq 1 ]; then
+      echo "lint-gate: REFUSED — --update-baseline over reverted rules would baseline stock counts." >&2
+      exit 2
+    else
+      echo "BLIND — lint rules reverted to stock; lint not run, nothing compared against the baseline."
+      # lint-last.json gets the verdict but no total: lint did not run, and a stale total from
+      # the previous run would be read as this run's by metrics-ledger.sh. No ledger row either.
+      mkdir -p "$ROOT/.claude/loop" 2>/dev/null &&
+        printf '{\n  "timestamp": "%s",\n  "verdict": "BLIND-RULES-REVERTED",\n  "reverted": "%s"\n}\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$(printf '%s\n' "$REVERTED" | cut -f1 | paste -sd, -)" \
+          > "$ROOT/.claude/loop/lint-last.json" 2>/dev/null || true
+      exit 1
+    fi
+  fi
+fi
+
 # LINT_JSON=<file> skips mxcli entirely and reads pre-captured lint output. This makes
 # the comparison logic testable against fixtures with no .mpr, no mxcli and no catalog
 # (a full cold run costs ~12 min on a project whose catalog needs rebuilding).
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index 69993014..2c72f814 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -60,6 +60,7 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
+| 28 | Change an existing microflow **near a `return` in a dense flow** (`create or modify microflow`, or an `alter microflow` insert before the return) | **Plan drop + create in the same script, not a splice — and run `show access on microflow Mod.Name` first.** A passing `check -p --references` is not evidence here: it does not run exec's free-room test, though it prints "no flow change exec would refuse". If `show access` lists grants, restate them after the create (not field-proven: the field case had none). Row 21 applies to the restatement. | v0.25.0, Mendix 11.14.0, 2026-10-11: `check` passed; exec refused with `create or modify microflow Common.IVK_X: this change cannot be spliced into the stored flow ... insert before return $LiveResult: there is no free room for the fragment ... drawn over the ActionActivity at (2025, 200)` and exec.sh restored the snapshot. `alter microflow` insert takes no `@position`, cannot move objects, and cannot replace a fragment that returns, so drop + create was the only write. BUG-156. |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).
 
diff --git a/skills/lint-that-actually-runs.md b/skills/lint-that-actually-runs.md
index 64b1b179..beb2a0d3 100644
--- a/skills/lint-that-actually-runs.md
+++ b/skills/lint-that-actually-runs.md
@@ -191,6 +191,9 @@ telling a human to do it.
   reverted ARCH002/ARCH003 reports a clean pass while inspecting nothing. This is why the install
   receipt lives outside `lint-rules/` and why installing rules **after** `mxcli init` is not a
   style preference.
+  Between syncs, `bin/lint-gate.sh` reads the same receipt before every lint: a rule whose md5
+  no longer matches and whose header is gone stops the run as `BLIND — lint rules reverted to
+  stock` (exit 1, exec.sh logs `LINT BLIND`), not as a rise on the next script (#264).
 - **Registering a file is not enough — register the pointer.** An earlier workstream's scripts sat
   in the toolkit unused for weeks because the routing row naming them existed in 2 of 6 projects.
   Nothing told any agent they existed. A skill without a `bin/lib/skill-routing.tsv` row is
diff --git a/tests/wave2/test-lint-receipt-revert.sh b/tests/wave2/test-lint-receipt-revert.sh
new file mode 100755
index 00000000..85057c28
--- /dev/null
+++ b/tests/wave2/test-lint-receipt-revert.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/lint-gate.sh's receipt check (#264) and exec.sh's reading of it.
+#
+# Usage: bash test-lint-receipt-revert.sh [path-to-lint-gate.sh]
+#
+# Field case (two toolkit-built apps, mxcli v0.25.0, 2026-10-07 and 2026-10-11): `mxcli init`
+# re-seeded .claude/lint-rules/ and the toolkit rules lost their `# mxtk-lint-rule:` header.
+# CONV010 went 26 -> 169 and the next exec (a pages-only script) was logged as the rise; in the
+# other app the stock rules sat for five days and the baseline absorbed their counts. The
+# installer's receipt (.claude/.mxtk-lint-receipt) already records each rule's md5 as installed;
+# lint-gate never read it.
+#
+# Golden input: the receipt and rules are produced by running the REAL installer
+# (bin/lib/install-lint-rules.sh, the function init-project.sh and sync-project.sh call) into a
+# scratch project — never a hand-written receipt. The re-seed is simulated the way the field
+# showed it: header block gone (entity_business_key's stock body IS the toolkit body minus the
+# header — the installer's "headered" branch), and a rule file removed (init drops rules it does
+# not know). Lint output is read through LINT_JSON; no mxcli or .mpr is needed. exec.sh's
+# run_lint_gate() is extracted from the real file and executed.
+set -uo pipefail
+TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GATE="${1:-$TK/project-bin/lint-gate.sh}"
+EXEC="$TK/project-bin/exec.sh"
+. "$TK/bin/lib/portable.sh"
+require_py
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lint-receipt.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
+
+P="$WORK/proj"; mkdir -p "$P/bin" "$P/.claude"
+cp "$GATE" "$P/bin/lint-gate.sh"; [ -f "$TK/project-bin/_common.sh" ] && cp "$TK/project-bin/_common.sh" "$P/bin/"
+printf 'mpr' > "$P/App.mpr"; printf '#!/bin/sh\nexit 0\n' > "$P/mxcli"; chmod +x "$P/mxcli" "$P/bin/lint-gate.sh"
+install_rules() { ( . "$TK/bin/lib/install-lint-rules.sh"; mxtk_install_lint_rules "$TK" "$P" 0 "" ) 2>&1; }
+
+v() { i=0; while [ "$i" -lt "$3" ]; do
+  printf '{"ruleId":"%s","severity":"%s","message":"finding %s","module":"Orders","document":"Doc%s","documentType":"microflow","documentId":"id-%s-%s","suggestion":"s"},' \
+    "$1" "$2" "$i" "$i" "$1" "$i"; i=$((i+1)); done; }
+mk() { printf '{"violations":[%s{"ruleId":"MPR001","severity":"warning","message":"m","module":"Orders","document":"E","documentType":"entity","documentId":"x","suggestion":"s"}],"summary":{}}' "$1" > "$WORK/lint.json"; }
+gate() { (cd "$P" && LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh "$@"); }
+fn="$WORK/run_lint_gate.sh"; sed -n '/^run_lint_gate() {/,/^}/p' "$EXEC" > "$fn"
+exec_detail() { (cd "$P" && PROJECT_ROOT="$P" LINT_JSON="$WORK/lint.json" bash -c ". '$fn'; LINT_RC=0; run_lint_gate >/dev/null; echo \"\$LINT_RC|\$LINT_DETAIL\""); }
+strip_header() { sed '1,/^# --- end mxtk-lint-rule header ---$/d' "$1" > "$1.tmp" && mv "$1.tmp" "$1"; }
+
+echo "T0 golden input: the real installer writes the rules and the receipt"
+out=$(install_rules)
+R="$P/.claude/.mxtk-lint-receipt"
+[ -f "$R" ] && ok "receipt written by install-lint-rules.sh" || bad "installer wrote no receipt" "$out"
+n=$(grep -cv '^#' "$R" 2>/dev/null || echo 0)
+[ "$n" -ge 3 ] && ok "receipt lists $n rules" || bad "receipt lists $n rules"
+grep -q '^conv010_act_microflow_content.star  [0-9a-f]\{32\}$' "$R" && ok "conv010 row: name + md5" || bad "conv010 row missing" "$(cat "$R")"
+
+echo "T1 rules as installed: no receipt complaint, normal ratchet"
+mk "$(v CONV010 warning 26)"
+out=$(gate --update-baseline 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "baseline written over installed rules" || bad "rc=$rc" "$out"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "unchanged run passes (rc 0)" || bad "rc=$rc" "$out"
+case "$out" in *REVERTED*) bad "false receipt alarm on untouched rules" "$out" ;; *) ok "no receipt alarm" ;; esac
+
+echo "T2 re-seed: header gone on two rules, one rule removed -> BLIND, not a rise"
+strip_header "$P/.claude/lint-rules/conv010_act_microflow_content.star"
+strip_header "$P/.claude/lint-rules/data_change_microflows.star"
+rm -f "$P/.claude/lint-rules/entity_business_key.star"
+mk "$(v CONV010 warning 169)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && ok "exit 1 (the blind code)" || bad "rc=$rc" "$out"
+case "$out" in *"BLIND — lint rules reverted to stock"*) ok "says BLIND, reverted to stock" ;; *) bad "no BLIND verdict" "$out" ;; esac
+case "$out" in *"FAIL —"*|*"got worse"*) bad "reported as a rise" "$out" ;; *) ok "CONV010 26 -> 169 not reported as a rise" ;; esac
+for f in conv010_act_microflow_content.star data_change_microflows.star entity_business_key.star; do
+  case "$out" in *"$f"*) ok "names $f" ;; *) bad "does not name $f" "$out" ;; esac
+done
+case "$out" in *ux001_confirm_before_destructive.star*) bad "names an untouched rule" "$out" ;; *) ok "untouched rules not named" ;; esac
+case "$out" in *"bin/sync-project.sh $P"*) ok "points at the remedy (sync-project.sh <root>)" ;; *) bad "no remedy command" "$out" ;; esac
+"$PY" -c 'import json,sys;d=json.load(open(sys.argv[1]));sys.exit(0 if d["verdict"]=="BLIND-RULES-REVERTED" and "total" not in d else 1)' \
+  "$P/.claude/loop/lint-last.json" 2>/dev/null && ok "lint-last.json: BLIND-RULES-REVERTED, no stale total" \
+  || bad "lint-last.json wrong" "$(cat "$P/.claude/loop/lint-last.json" 2>/dev/null)"
+
+echo "T3 exec.sh logs it as LINT BLIND (rc 3), naming the files"
+d=$(exec_detail)
+case "$d" in "3|lint BLIND: rules reverted to stock (conv010_act_microflow_content.star,data_change_microflows.star,entity_business_key.star)"*) ok "exec detail: ${d#*|}" ;;
+  *) bad "exec did not log a reverted-rules BLIND" "$d" ;; esac
+
+echo "T4 --update-baseline over reverted rules is refused, baseline untouched"
+before=$(cat "$P/.claude/lint-baseline.json")
+out=$(gate --update-baseline --reason "x" 2>&1); rc=$?
+[ "$rc" -eq 2 ] && ok "refused (rc 2)" || bad "stock counts baselined (rc $rc)" "$out"
+[ "$(cat "$P/.claude/lint-baseline.json")" = "$before" ] && ok "baseline unchanged" || bad "baseline rewritten"
+
+echo "T5 LINT_RULES_REVERTED_OK=1 lints anyway, with the warning"
+out=$(cd "$P" && LINT_RULES_REVERTED_OK=1 LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh 2>&1); rc=$?
+case "$out" in *"REVERTED TO STOCK"*"FAIL —"*) ok "warned, then compared (rise visible)" ;; *) bad "override did not lint" "$out" ;; esac
+
+echo "T6 the remedy is not blocked and clears it (the installer sync-project.sh runs)"
+out=$(install_rules)
+case "$out" in *conv010_act_microflow_content.star*) ok "installer restored conv010" ;; *) bad "installer did not touch conv010" "$out" ;; esac
+mk "$(v CONV010 warning 26)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "after the remedy: rc 0, no alarm" || bad "still blocked after the remedy (rc $rc)" "$out"
+
+echo "T7 a hand edit that keeps the header is not called a revert"
+printf '\n# local tweak\n' >> "$P/.claude/lint-rules/data_change_microflows.star"
+out=$(gate 2>&1); rc=$?
+case "$out" in *REVERTED*) bad "hand edit flagged as a revert" "$out" ;; *) ok "headered edit left to the installer's report" ;; esac
+
+echo "T8 no receipt (pre-receipt install): no check"
+rm -f "$R"; strip_header "$P/.claude/lint-rules/conv010_act_microflow_content.star"
+out=$(gate 2>&1); rc=$?
+case "$out" in *REVERTED*) bad "alarm with no receipt to compare" "$out" ;; *) ok "no receipt -> no alarm (rc $rc)" ;; esac
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From faf196eee8fc5132dcc05567bf88318a5366038c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:06:37 +0000
Subject: [PATCH 03/68] e2e: read OQL rows by alias; liveness for negative-only
 span claims; APP-DOWN between journeys

#154: helpers.js built OQL rows with Object.values(r) and oqlScalar read
rows[0][0]. mxcli v0.26.0 prints keys alphabetically, omits an all-null
column and, over a view entity, adds ID beside the alias, so columns
shifted and a view's count read as its ID. The brace counter ignored
strings, so a value holding ] or } returned null. Rows are now keyed by
the parsed SELECT aliases (SELECT order, explicit nulls), oqlScalar reads
the first alias, new oqlRows, string-aware slicing. Golden: the released
v0.26.0 binary's verbatim output against a stub admin API
(tests/wave2/fixtures/oql-json/); test-oql-rows.sh 15/15, 0/15 on master.

#150 remainder: a mustNotFire-only step with zero spans was INVALID on
every run. Rung 2 (now traceRung) waits the full window and requires a
declared spans.liveness span or any service span since the journey began
(otel.js liveness) before judging; the trace-negative mutant injects the
forbidden name after that check.

#285 harness half: probe baseUrl before each journey (APP-DOWN, not
walked) and after each (flag its FAIL rows). APP_PROBE=0 disables.
test-journey-liveness.sh 27/27 over the captured Jaeger trace.

No live-app field run yet.

Closes #154
Refs #150 #285

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   2 +
 project-tests/e2e/helpers.js                  | 151 ++++++++++---
 project-tests/e2e/journey-runner.js           | 181 +++++++++++++---
 project-tests/e2e/otel.js                     |  32 ++-
 skills/journey-proof.md                       |  36 +++-
 skills/learned-db-assertions.md               |  23 ++
 .../wave2/fixtures/oql-json/admin-api-stub.js |  27 +++
 tests/wave2/fixtures/oql-json/allnull.stderr  |   2 +
 tests/wave2/fixtures/oql-json/allnull.stdout  |   6 +
 tests/wave2/fixtures/oql-json/bracket.stderr  |   2 +
 tests/wave2/fixtures/oql-json/bracket.stdout  |   6 +
 tests/wave2/fixtures/oql-json/cases.txt       |   7 +
 tests/wave2/fixtures/oql-json/nullcol.stderr  |   2 +
 tests/wave2/fixtures/oql-json/nullcol.stdout  |  12 ++
 tests/wave2/fixtures/oql-json/view.stderr     |   2 +
 tests/wave2/fixtures/oql-json/view.stdout     |   6 +
 tests/wave2/test-journey-liveness.sh          | 198 ++++++++++++++++++
 tests/wave2/test-oql-rows.sh                  | 131 ++++++++++++
 18 files changed, 770 insertions(+), 56 deletions(-)
 create mode 100644 tests/wave2/fixtures/oql-json/admin-api-stub.js
 create mode 100644 tests/wave2/fixtures/oql-json/allnull.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/allnull.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/bracket.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/bracket.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/cases.txt
 create mode 100644 tests/wave2/fixtures/oql-json/nullcol.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/nullcol.stdout
 create mode 100644 tests/wave2/fixtures/oql-json/view.stderr
 create mode 100644 tests/wave2/fixtures/oql-json/view.stdout
 create mode 100644 tests/wave2/test-journey-liveness.sh
 create mode 100644 tests/wave2/test-oql-rows.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..9e69376c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (27 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/project-tests/e2e/helpers.js b/project-tests/e2e/helpers.js
index f0e0c53c..a4c9cb6e 100644
--- a/project-tests/e2e/helpers.js
+++ b/project-tests/e2e/helpers.js
@@ -631,10 +631,14 @@ async function computedStyles(page, checks) {
 // This project runs natively under Studio Pro, so `mxcli oql -p` would route
 // through `docker compose exec` and fail. --direct talks HTTP to the admin API.
 //
-// Two shapes come back depending on mxcli version: {rows:[[v]]} (positional) or
-// a bare array of column-keyed objects [{n: "30"}]. Normalise both to
-// {rows:[[v]]} so callers only deal with one shape. Note OQL requires every
-// select column to be aliased — `SELECT COUNT(*) AS n`, never `SELECT COUNT(*)`.
+// What `mxcli oql --direct --json` prints (captured from the released v0.26.0 binary, see
+// tests/wave2/fixtures/oql-json/): a bare array of objects keyed by column alias, keys in
+// ALPHABETICAL order (Go map encoding), a column that is null in every row LEFT OUT, a view
+// entity's `ID` key added beside the aliases, and "(n rows)" on stderr. So a row is never
+// read by position: oql() keys every row by the SELECT list's aliases, in SELECT order,
+// with an explicit null for an absent key (#154 — `Object.values(r)` read `ID` for a view's
+// count and shifted every column after a null one place left). OQL requires every select
+// column to be named — `SELECT COUNT(*) AS n`, never `SELECT COUNT(*)`.
 // The mxcli binary to spawn. Git Bash maps `mxcli` -> `mxcli.exe` transparently; Node does
 // not, so on Windows a configured './mxcli' that only exists as './mxcli.exe' is probed here
 // (CLAUDE.md "Shipping an instrument" rule 3). Shared by oql() and journey-runner's preflight
@@ -646,6 +650,7 @@ function mxcliBin() {
   return cfg.mxcli;
 }
 
+// Returns { columns, rows, objects } (see parseOqlOutput) or null when the query did not run.
 function oql(sql) {
   try {
     const out = execFileSync(mxcliBin(), [
@@ -653,43 +658,133 @@ function oql(sql) {
       '--host', cfg.adminHost, '--port', String(cfg.adminPort), '--token', cfg.adminToken,
       '--json', sql,
     ], { cwd: cfg.root, encoding: 'utf8', timeout: 20000 });
-    return parseOqlOutput(out);
+    return parseOqlOutput(out, sql);
   } catch (_) {}
   return null;
 }
 
+// The SELECT list's column names, in SELECT order: `AS <alias>` where given, else the last
+// segment of a bare attribute path (`c.Name` → Name). null for an item that has neither
+// (an expression the runtime would refuse as unnamed); null for the whole list when it
+// cannot be read (no SELECT, `*`). Commas inside parentheses and quoted strings are not
+// separators, so `COALESCE(a, b) AS x` and `'a, b' AS y` are one item each.
+function oqlAliases(sql) {
+  const s = String(sql || '');
+  const head = s.match(/^\s*SELECT\s+(?:DISTINCT\s+)?/i);
+  if (!head) return null;
+  const items = [];
+  let depth = 0, quote = null, cur = '';
+  for (let i = head[0].length; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      cur += c;
+      if (c === quote) { if (s[i + 1] === quote) { cur += s[++i]; } else quote = null; }
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; cur += c; continue; }
+    if (c === '(') depth++;
+    else if (c === ')') depth--;
+    if (depth === 0) {
+      if (c === ',') { items.push(cur); cur = ''; continue; }
+      if (/\s/.test(c) && /^FROM\b/i.test(s.slice(i + 1))) { items.push(cur); cur = null; break; }
+    }
+    cur += c;
+  }
+  if (cur !== null && cur.trim()) items.push(cur);   // no FROM: SELECT 1 AS n
+  if (!items.length) return null;
+  const names = items.map((raw) => {
+    const it = raw.trim();
+    const as = it.match(/\bAS\s+(?:"([^"]+)"|([A-Za-z_]\w*))\s*$/i);
+    if (as) return as[1] || as[2];
+    const bare = it.match(/^(?:[A-Za-z_][\w]*[./])*([A-Za-z_]\w*)$/);
+    return bare ? bare[1] : null;
+  });
+  return names.some((n) => n === '*') ? null : names;
+}
+
+// The first JSON value in mxcli's stdout, sliced string-aware: a `]` or `}` inside a string
+// value (a label such as "a]b}c") is not a bracket. The old depth counter ended the slice
+// there and JSON.parse failed, so the helper returned null — "no measurement" — on a real
+// answer (#154).
+function sliceJson(out) {
+  const start = out.search(/[[{]/);
+  if (start < 0) return null;
+  let depth = 0, inStr = false;
+  for (let i = start; i < out.length; i++) {
+    const c = out[i];
+    if (inStr) {
+      if (c === '\\') i++;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') inStr = true;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') { depth--; if (depth === 0) return out.slice(start, i + 1); }
+  }
+  return null;
+}
+
+// Look a column up in one row object: exact key first, then case-insensitively. An absent
+// key is null — the runtime leaves null columns out, it does not mean "no such column".
+function pick(obj, name) {
+  if (!obj || typeof obj !== 'object') return null;
+  if (Object.prototype.hasOwnProperty.call(obj, name)) return obj[name] ?? null;
+  const k = Object.keys(obj).find((x) => x.toLowerCase() === String(name).toLowerCase());
+  return k === undefined ? null : (obj[k] ?? null);
+}
+
 // The parsing half of oql(), split out so journey-runner's admin preflight reads a probe's
 // stdout with the same code the data rungs use (one parser, so the probe cannot pass on a
-// shape the rungs then reject).
-// mxcli prints a "Using project:" banner and a trailing "(n rows)" line
-// around the JSON — slice out the JSON body before parsing.
-function parseOqlOutput(out) {
+// shape the rungs then reject). mxcli prints a banner and "(n rows)" around the JSON —
+// slice out the JSON body before parsing.
+//
+// Returns { columns, rows, objects, keyed }:
+//   columns — the SELECT aliases (keyed: true), or, when `sql` is absent or unreadable, the
+//             union of the answer's keys (keyed: false — positions then mean nothing)
+//   rows    — [[v…]] in `columns` order, explicit null where a key was absent
+//   objects — one { alias: value } per row, every alias present
+// A legacy {rows:[[…]]} body passes through unchanged (keyed: false).
+function parseOqlOutput(out, sql) {
   try {
-    out = String(out || '');
-    const start = out.search(/[[{]/);
-    if (start < 0) return null;
-    let depth = 0, end = -1;
-    for (let i = start; i < out.length; i++) {
-      const c = out[i];
-      if (c === '[' || c === '{') depth++;
-      else if (c === ']' || c === '}') { depth--; if (depth === 0) { end = i + 1; break; } }
-    }
-    if (end < 0) return null;
-    const parsed = JSON.parse(out.slice(start, end));
-
+    const body = sliceJson(String(out || ''));
+    if (body === null) return null;
+    const parsed = JSON.parse(body);
     if (Array.isArray(parsed)) {
-      return { rows: parsed.map((r) => (r && typeof r === 'object' ? Object.values(r) : [r])) };
+      const aliases = oqlAliases(sql);
+      const keyed = !!(aliases && aliases.every((a) => a));
+      let columns = keyed ? aliases : [];
+      if (!keyed) for (const r of parsed) {
+        if (r && typeof r === 'object') for (const k of Object.keys(r)) if (!columns.includes(k)) columns.push(k);
+      }
+      if (!keyed && !columns.length) columns = ['value'];
+      const objects = parsed.map((r) => Object.fromEntries(columns.map((c) =>
+        [c, r && typeof r === 'object' ? pick(r, c) : (columns.length === 1 ? r : null)])));
+      return { columns, rows: objects.map((o) => columns.map((c) => o[c])), objects, keyed };
     }
-    if (parsed && parsed.rows !== undefined) return parsed;
+    if (parsed && parsed.rows !== undefined) return { keyed: false, ...parsed };
   } catch (_) {}
   return null;
 }
 
-// Convenience: first cell of the first row, or null.
-function oqlScalar(sql) {
+// Rows as alias-keyed objects ([{ n: "3", label: null }]), or null when the query did not run.
+function oqlRows(sql) {
   const r = oql(sql);
-  return r && r.rows && r.rows[0] !== undefined && r.rows[0][0] !== undefined
-    ? String(r.rows[0][0]) : null;
+  return r && r.objects ? r.objects : null;
+}
+
+// The FIRST SELECT alias of the first row, or null (no row, a null value, or no measurement).
+// Never `rows[0][0]` of whatever order the keys came back in: over a view entity the answer
+// carries `ID` too, and that sorts before a lower-case alias. When the SELECT list cannot be
+// read, a single-key answer is still unambiguous; anything wider is null — a guess between
+// columns is exactly the defect this replaces.
+function oqlScalar(sql) {
+  return scalarOf(oql(sql));
+}
+function scalarOf(r) {
+  if (!r || !r.rows || r.rows[0] === undefined) return null;
+  if (r.keyed === false && r.columns && r.columns.length !== 1) return null;
+  const v = r.rows[0][0];
+  return v === undefined || v === null ? null : String(v);
 }
 
 // ── Reporter ────────────────────────────────────────────────────────────────
@@ -733,6 +828,6 @@ module.exports = {
   humanMove, humanClick, humanType, humanTypeKeys, humanScroll,
   navTo, ensureSidebar, copilotText, askCopilot, approveConfirmCard,
   login, logout, assertIdentity, dismissModal, gotoTarget,
-  screenshotEl, fullPageShot, computedStyles, oql, oqlScalar, parseOqlOutput, mxcliBin, makeReporter,
+  screenshotEl, fullPageShot, computedStyles, oql, oqlRows, oqlScalar, oqlAliases, parseOqlOutput, scalarOf, mxcliBin, makeReporter,
   ensureDirs, parseTokens, path, fs,
 };
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index 1c954cab..b4ce1fd0 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -9,7 +9,8 @@
 // credential + reachability, required env vars, live sessions. Exit 2 = aborted there.
 // Env: TEST_USER / TEST_PASS (required; ALLOW_CONFIG_CREDENTIALS=1 to use the config
 // default), M2EE_ADMIN_PASS / M2EE_ADMIN_PORT, ALLOW_NO_DATA_RUNG=1, JOURNEY_SESSION_CAP=<n>,
-// ALLOW_SESSION_CAP=1. Journeys may declare requiresEnv / requires / leaves / consumes,
+// ALLOW_SESSION_CAP=1, APP_PROBE=0 (no app probe between journeys). Journeys may declare
+// requiresEnv / requires / leaves / consumes,
 // resetsData (refused under --protect-state) and assertLanding (or --assert-landing).
 //
 // WHY THIS EXISTS
@@ -319,6 +320,61 @@ async function act(page, a, vars, note) {
   else await settle(page, { timeout: 10000, stableMs: 300, networkIdleMs: 0, fallbackMs: 1200 });
 }
 
+// ── RUNG 2: ordered spans, as a function (called from runJourney) ───────────
+// Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with ordered
+// empty/absent) — a step whose whole proof is "this did NOT run" (#150). `capture` and
+// `live` are injected so tests/wave2/test-journey-negative-trace.sh drives it with a
+// captured Jaeger trace and no browser. `rec(name, verdict, detail)` records one row.
+//
+// NEGATIVE-ONLY NEEDS A LIVENESS REFERENCE. Zero spans in the step window is what a correct
+// Cancel looks like AND what Jaeger down / OTel off looks like. Before 2026-10-13 that was
+// INVALID "Jaeger down or OTel off" for both, so the claim could never pass; the opposite
+// fix (zero spans → PASS) would pass with tracing dead. So: wait the full capture window
+// (there is nothing to `until` on), then require evidence the pipeline was delivering —
+// the step's declared `spans.liveness` span, or any span from the service since the
+// journey began (otel.js liveness). No evidence → INVALID, naming which.
+async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
+  const claimed = (step.spans && step.spans.ordered) || [];
+  const mustNot = (step.spans && step.spans.mustNotFire) || [];
+  if (!claimed.length && !mustNot.length) return;
+  const negOnly = !claimed.length;
+  const probe = (step.spans && step.spans.liveness) || null;
+  const has = (sp, n) => O.microflowNames(sp).includes(n) || sp.some(x => x.op === n);
+  // Wait for the claimed microflows, not just any span — see otel.js capture() `until`.
+  const until = !negOnly ? sp => claimed.every(n => O.microflowNames(sp).includes(n))
+    : probe ? sp => has(sp, probe) : () => false;
+  let spans = capture ? await capture(t0, { min: 1, until })
+                      : await O.capture(t0, { min: 1, until: until });
+  const real = spans.length;
+  if (negOnly && (!real || probe)) {
+    const lv = await live(since, { name: probe, spans });
+    if (!lv.ok) {
+      rec(`${step.name}: spans`, 'INVALID',
+          `negative-only claim (${mustNot.join(', ')} must not run) with no liveness evidence: ${lv.detail}. ` +
+          '"Nothing ran" and "tracing is off" look the same here — trace rung did NOT run.');
+      return;
+    }
+    rec(`${step.name}: tracing live`, 'PASS', lv.detail);
+  } else if (!real) {
+    rec(`${step.name}: spans`, 'INVALID',
+        'zero spans captured — Jaeger down or OTel off. Trace rung did NOT run.');
+    return;
+  }
+  // Positive control only (controlMutants' trace-negative branch for a negative-only claim):
+  // the forbidden microflow is injected into the capture AFTER the liveness verdict, so the
+  // mutant proves assertNotFired can go red without being able to vouch for a dead pipeline.
+  const inject = (step.spans && step.spans._controlInjectFired) || [];
+  if (inject.length) spans = spans.concat(inject.map(n => ({ op: n, start: Date.now() * 1000, dur: 0,
+    traceID: 'positive-control', tags: { 'mx.microflow.name': n }, logs: [] })));
+  const rep = (name, ok, detail) => rec(name, ok ? 'PASS' : 'FAIL', detail);
+  if (real) {
+    O.guard(spans, rep, `${step.name}: capture non-empty`);
+    if (claimed.length) O.assertSequence(spans, claimed, rep, `${step.name}: ordered`);
+    O.assertNoErrors(spans, rep, `${step.name}: no ERROR at any level`);
+  }
+  for (const n of mustNot) O.assertNotFired(spans, new RegExp(n), rep, `${step.name}: ${n} did not run`);
+}
+
 // ── Rung 3 helpers ──────────────────────────────────────────────────────────
 // oql() swallows every error and returns null, so null must mean "no measurement",
 // never "zero". A count assertion that treats null as 0 passes when the instrument
@@ -491,6 +547,17 @@ const CONTROL_RUNGS = [
   'data-delta', 'data-target', 'outcome',
 ];
 
+// A microflow name the mustNotFire pattern matches: the pattern itself when it matches its
+// own text (the usual bare name, `Mod.ACT_X`), else the pattern with anchors and escapes
+// stripped; null when neither matches (the mutant is then reported unsupported, not faked).
+function forbiddenSample(pattern) {
+  let re;
+  try { re = new RegExp(pattern); } catch (_) { return null; }
+  if (re.test(pattern)) return pattern;
+  const plain = String(pattern).replace(/^\^|\$$/g, '').replace(/\\(.)/g, '$1');
+  return re.test(plain) ? plain : null;
+}
+
 function controlMutants(j) {
   const clone = () => JSON.parse(JSON.stringify(j));
   const out = [];
@@ -535,8 +602,16 @@ function controlMutants(j) {
   // any out-of-sequence microflow through unnoticed.
   add('trace-negative', 'assert a microflow that DID run must not have run', (c) => {
     const s = c.steps.find(x => x.spans && x.spans.ordered && x.spans.ordered.length);
-    if (!s) return false;
-    s.spans.mustNotFire = [s.spans.ordered[0].split('.').pop()];
+    if (s) { s.spans.mustNotFire = [s.spans.ordered[0].split('.').pop()]; return; }
+    // A negative-only claim has no microflow that is known to run, so the mutant makes one:
+    // the forbidden name is injected into the step's capture (after its liveness check) and
+    // assertNotFired must go red on it (#150).
+    const neg = c.steps.find(x => x.spans && (x.spans.mustNotFire || []).length);
+    if (!neg) return false;
+    const name = forbiddenSample(neg.spans.mustNotFire[0]);
+    if (name === null) return false;
+    neg.spans.mustNotFire = [neg.spans.mustNotFire[0]];
+    neg.spans._controlInjectFired = [name];
   }, named('did not run'));
 
   // Rung 4a — the row-count delta.
@@ -607,6 +682,9 @@ async function resetToStart(page) {
 }
 
 async function runJourney(page, j) {
+  // Journey start, a little before: the window a negative-only span claim's liveness check
+  // reads (the navigation that resetToStart just made counts as evidence tracing is live).
+  const jt0 = Date.now() - 30000;
   console.log(`\n=== JOURNEY ${j.id} — ${j.title || ''}`);
   console.log(`    persona: ${j.persona || cfg.user}   requirements: ${(j.requirement || []).join(', ') || '(none declared)'}`);
 
@@ -751,27 +829,8 @@ async function runJourney(page, j) {
     }
 
     // ── RUNG 2: ordered spans ────────────────────────────────────────────────
-    // Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with
-    // ordered empty/absent) — a step whose whole proof is "this did NOT run" (#150).
-    const claimed = (step.spans && step.spans.ordered) || [];
-    const mustNot = (step.spans && step.spans.mustNotFire) || [];
-    if (claimed.length || mustNot.length) {
-      // Wait for the claimed microflows, not just any span — see otel.js capture() `until`.
-      const spans = await O.capture(t0, { min: 1,
-        until: sp => { const got = O.microflowNames(sp); return claimed.every(n => got.includes(n)); } });
-      if (!spans.length) {
-        record('trace', `${step.name}: spans`, 'INVALID',
-               'zero spans captured — Jaeger down or OTel off. Trace rung did NOT run.', req);
-      } else {
-        O.guard(spans, otelReporter(req), `${step.name}: capture non-empty`);
-        if (claimed.length)
-          O.assertSequence(spans, claimed, otelReporter(req), `${step.name}: ordered`);
-        O.assertNoErrors(spans, otelReporter(req), `${step.name}: no ERROR at any level`);
-        for (const n of mustNot) {
-          O.assertNotFired(spans, new RegExp(n), otelReporter(req), `${step.name}: ${n} did not run`);
-        }
-      }
-    }
+    await traceRung(step, { t0, since: jt0,
+      rec: (name, verdict, detail) => record('trace', name, verdict, detail, req) });
 
     // ── RUNG 3: data effects ─────────────────────────────────────────────────
     const d = step.data;
@@ -931,9 +990,9 @@ function classifyAdminProbe(text, status) {
   if (auth) return { state: 'auth', http: Number(auth[1] || auth[2]) };
   if (/cannot connect to Mendix admin API|ECONNREFUSED|connection refused/i.test(t))
     return { state: 'unreachable' };
-  const parsed = H.parseOqlOutput(t);
+  const parsed = H.parseOqlOutput(t, ADMIN_PROBE_SQL);
   if (status === 0 && parsed && parsed.rows && parsed.rows[0] !== undefined) {
-    const n = Number(parsed.rows[0][0]);
+    const v = H.scalarOf(parsed), n = v === null ? NaN : Number(v);
     return { state: 'ok', sessions: Number.isFinite(n) ? n : null };
   }
   return { state: 'unknown', detail: t.trim().split('\n').filter(Boolean).slice(-1)[0] || `exit ${status}` };
@@ -1188,6 +1247,50 @@ function stateTracker(journeys) {
   };
 }
 
+// ── App liveness between journeys (#285) ────────────────────────────────────
+// The preflight probes the app once, before the first journey. Field run 2026-10-12: a watch
+// rebuild failed mid-suite (IO_PathNotFound on deployment/web/pages), the runtime went down,
+// and every remaining journey failed as if the features were broken — the suite owner had to
+// be told to rerun only the infrastructure failures. So the runner asks before each journey
+// whether the app still answers, and after each one whether it outlived it:
+//   down before a journey → that journey is APP-DOWN (INVALID, `appDown: true`), not walked;
+//   down after a journey  → its FAIL rows are flagged `appDown: true` and named in the summary
+//                            as "rerun before reading as findings" — the verdict stays FAIL,
+//                            because the app may have died of what the journey found.
+// "Up" is any HTTP answer below 500; a refused connection, a timeout or a 5xx is down. A few
+// short retries absorb a restart already in progress. APP_PROBE=0 turns it off.
+async function probeApp(url, { timeoutMs = 5000, fetchFn = globalThis.fetch } = {}) {
+  try {
+    const r = await fetchFn(url, { redirect: 'manual', signal: AbortSignal.timeout(timeoutMs) });
+    return r.status >= 500 ? { up: false, detail: `HTTP ${r.status}` } : { up: true, detail: `HTTP ${r.status}` };
+  } catch (e) {
+    return { up: false, detail: (e && e.cause && e.cause.code) || (e && e.name) || String(e) };
+  }
+}
+
+async function appGate(url, { probe = probeApp, tries = 3, waitMs = 5000, sleep = PAUSE } = {}) {
+  let last = null;
+  for (let i = 0; i < tries; i++) {
+    last = await probe(url);
+    if (last.up) return { up: true, detail: last.detail, tries: i + 1 };
+    if (i + 1 < tries) await sleep(waitMs);
+  }
+  return { up: false, detail: last.detail, tries };
+}
+
+// The rows a journey just produced, after the app was found down: flag every FAIL. Returns
+// how many were flagged.
+function flagAppDown(rows, detail) {
+  let n = 0;
+  for (const r of rows) {
+    if (r.verdict !== 'FAIL') continue;
+    r.appDown = true;
+    r.detail = `${r.detail ? r.detail + '  ' : ''}[APP-DOWN after this journey: ${detail} — rerun before reading as a finding]`;
+    n++;
+  }
+  return n;
+}
+
 // ── Exports for the rung-4 scope unit test ──────────────────────────────────
 // The SQL builders are pure and exported so their behaviour can be proven against
 // fixture rows without a running app. See tests/e2e/journey-rung4-scope.test.js.
@@ -1200,6 +1303,7 @@ module.exports = {
   runExitCode, personaMismatch,
   classifyAdminProbe, journeyNeedsAdmin, missingEnv, preflight, orderJourneys, stateTracker,
   judgeLanding,
+  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown,
 };
 
 // ── Main ────────────────────────────────────────────────────────────────────
@@ -1297,10 +1401,25 @@ const findingsFile = () => path.join(cfg.artifactsDir,
   if (assumed.length)
     console.log(`  requires that no journey in this run leaves (trusted to the fixture): ${assumed.join(', ')}`);
 
+  const appDown = [], appDiedIn = [];
+  const APP_PROBE = process.env.APP_PROBE !== '0';
   if (li.ok && !li.usedFallback) {
     for (const j of journeys) {
       // Already named once on the preflight SETUP line; no per-journey INVALID on top.
       if (pf.skip.has(j.id)) { state.settle(j, [], false); continue; }
+      if (APP_PROBE) {
+        const app = await appGate(cfg.baseUrl);
+        if (!app.up) {
+          console.log(`  APP-DOWN  ${j.id} — ${cfg.baseUrl} not answering (${app.detail}, ${app.tries} tries)`);
+          record('setup', `${j.id}: app up`, 'INVALID',
+            `APP-DOWN — ${cfg.baseUrl} did not answer before this journey (${app.detail}). Not walked; ` +
+            'not a feature failure. Restart the app and rerun the APP-DOWN journeys.', (j.requirement || []).join(', '));
+          results[results.length - 1].appDown = true;
+          appDown.push(j.id);
+          state.settle(j, [], false);
+          continue;
+        }
+      }
       const wrongPersona = personaMismatch(j, li.user);
       if (wrongPersona) {
         record('ui', `${j.id}: persona`, 'INVALID', wrongPersona, (j.requirement || []).join(', '));
@@ -1362,6 +1481,10 @@ const findingsFile = () => path.join(cfg.artifactsDir,
         const before = results.length;
         await resetToStart(page);
         await runJourney(page, j);
+        if (APP_PROBE) {
+          const after = await probeApp(cfg.baseUrl);
+          if (!after.up && flagAppDown(results.slice(before), after.detail)) appDiedIn.push(j.id);
+        }
         state.settle(j, results.slice(before), true);
       }
     }
@@ -1381,6 +1504,11 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     console.log('  ⚠ INVALID means an instrument did not run. Those checks are NOT green —');
     console.log('    they are absent. Fix the instrument before reading this report as coverage.');
   }
+  if (appDown.length)
+    console.log(`  APP-DOWN ${appDown.length} journey(s) not walked — the app stopped answering: ${appDown.join(', ')}. ` +
+                'Restart it and rerun only these.');
+  if (appDiedIn.length)
+    console.log(`  ⚠ the app was down when ${appDiedIn.join(', ')} ended — their FAIL rows are flagged APP-DOWN; rerun before reading them as findings.`);
 
   // The control run's own denominator. Without it, 4 of 7 rungs proven and 7 of 7
   // print the same, and the second claim is the one everyone reads.
@@ -1422,6 +1550,7 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     capturedAt: new Date().toISOString(),
     configuredUser: cfg.user, actualUser: li.user, usedFallback: !!li.usedFallback,
     baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, mutants, results, walks,
+    appDown, appDiedIn,
   }, null, 2));
   console.log(`  findings → ${path.relative(cfg.root, out)}`);
 
diff --git a/project-tests/e2e/otel.js b/project-tests/e2e/otel.js
index 1fc35c16..e86a6e96 100644
--- a/project-tests/e2e/otel.js
+++ b/project-tests/e2e/otel.js
@@ -113,6 +113,36 @@ async function capture(t0, { min = 1, retries = 8, waitMs = 1500, until = null }
   return out;
 }
 
+/**
+ * Is tracing alive right now? The reference a NEGATIVE-ONLY span claim needs (#150).
+ *
+ * A step whose whole proof is "X did not run" (Cancel on a reset confirmation) can rightly
+ * capture zero spans — and zero spans is also what Jaeger down or OTel off looks like. So
+ * an empty step capture proves nothing until something shows the pipeline was delivering:
+ *   - `name` given (the step's `spans.liveness`): that microflow or operation is in `spans`
+ *     — a span the step is known to produce, e.g. the page's data-source retrieve;
+ *   - otherwise: Jaeger answers, and the service emitted at least one span since `since`
+ *     (the journey's start, so the navigation into the step counts).
+ * Returns { ok, detail }. Never throws: an unreachable Jaeger is `ok: false`.
+ */
+async function liveness(since, { name = null, spans = [] } = {}) {
+  if (name) {
+    const hit = spans.some(s => s.tags['mx.microflow.name'] === name || s.op === name);
+    return { ok: hit, detail: hit
+      ? `liveness span ${name} captured in the step window`
+      : `declared liveness span ${name} not captured in the step window (${spans.length} spans)` };
+  }
+  let data;
+  try { ({ data } = await fetchSince(since)); }
+  catch (e) { return { ok: false, detail: `Jaeger unreachable at ${JAEGER} (${e.code || e.message})` }; }
+  let n = 0;
+  const sinceUs = since * 1000;
+  for (const t of data) for (const s of t.spans) if (s.startTime >= sinceUs) n++;
+  return { ok: n > 0, detail: n > 0
+    ? `tracing live: ${n} span(s) from ${SVC} since the journey started`
+    : `Jaeger answered, but ${SVC} emitted no span since the journey started — OTel off or exporter down` };
+}
+
 // --- shape helpers ---------------------------------------------------------
 
 const microflowSpans = spans => spans.filter(s => s.tags['mx.microflow.name']);
@@ -235,7 +265,7 @@ function assertSequence(spans, names, reporter, label = null) {
 }
 
 module.exports = {
-  capture, guard,
+  capture, guard, liveness,
   microflowSpans, activitySpans, microflowNames, errorSpans, describeError,
   assertFired, assertNoErrors, assertNotFired, assertLoopCount, assertSequence,
   JAEGER, SVC,
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index 09c908d3..d637880d 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -100,6 +100,19 @@ before every journey that consumes X. A journey whose precondition did not hold
 and is not walked. Without the headers it would show up as a seed INVALID. Journeys without
 headers run in file order, as before.
 
+**APP-DOWN is not FAIL (#285).** The preflight probes the app only once. In one field run a
+watch rebuild took the runtime down mid-suite, and every later journey FAILed as if its feature
+were broken. The runner now probes `baseUrl` before each journey: 3 tries, 5 s apart. Any HTTP
+answer below 500 counts as up.
+
+- **Down before a journey:** an `APP-DOWN` line. The journey is recorded `INVALID` with
+  `appDown: true` and is not walked.
+- **Down after a journey:** that journey's FAIL rows are flagged `[APP-DOWN after this journey …]`
+  and keep FAIL, because the app may have died of what the journey found.
+
+The summary names both lists. Restart the app and rerun only those journeys. `APP_PROBE=0` turns
+the probe off.
+
 Logout runs on every exit path: normal end, a crash, and SIGINT/SIGTERM. A run whose logout is
 not confirmed says so. Declared state does not make a rerun idempotent. A journey that consumes
 its own fixture still needs a reset/seed journey that `leaves` that state again.
@@ -148,7 +161,7 @@ prove. (#149: a journey declaring a non-admin persona walked green under the adm
 |---|---|---|---|
 | 1 | **Landing guard** | the step's `ready` widget is visible | Without it, every later assertion runs against the *previous* page and screenshots it under the new page's title |
 | 2 | **What the screen says** | `textPresent` / `textAbsent` | The machine can do the work correctly and the screen still lie about it. This is the rung that found the one real product defect in the pilot |
-| 3 | **Ordered spans** | microflows fired, **in order**, plus `mustNotFire` | `assertFired` is existence-only: it cannot tell a skipped step from a reordered one |
+| 3 | **Ordered spans** | microflows fired, **in order**, plus `mustNotFire` | `assertFired` is existence-only: it cannot tell a skipped step from a reordered one. A `mustNotFire`-only claim needs a liveness reference — see below |
 | 4 | **Data effects** | row-count delta, `assocMustBeSet`, `mustPointAt` | See below — three distinct claims that look like one |
 | 5 | **Outcome** | one OQL query over the end state | Per-step deltas can each be right while the journey's net result is wrong |
 
@@ -166,6 +179,27 @@ with no link to the unit it is for is a broken golden path even though it saved.
 
 `mustPointAt` is the third claim and the expensive one to skip. **Set-ness is not correctness.**
 
+### A negative-only span claim needs a liveness reference
+
+A step whose whole proof is "X did not run" declares `spans: { "mustNotFire": ["ACT_X_Reset"] }`
+with no `ordered`. Cancel on a "Reset all state?" confirmation is an example. Such a step can
+correctly capture **zero spans**. Jaeger down or OTel off also gives zero spans.
+
+- **Before #150:** both cases read `INVALID — zero spans captured`, so the claim could never pass.
+- **Wrong fix:** reading zero spans as PASS passes the claim with tracing dead.
+
+The runner waits the full capture window, then asks for evidence that tracing was live:
+
+| Evidence | Verdict |
+|---|---|
+| the step declares `"liveness": "<span>"` (a span the step is known to produce, such as the page's data-source retrieve) and it was captured | judged: `tracing live` PASS, then each `did not run` |
+| no declared span; the service emitted ≥1 span since the journey started (`otel.liveness`) | judged, same rows |
+| declared span missing, service silent, or Jaeger unreachable | `INVALID`: the claim is not judged |
+
+The `trace-negative` control mutant covers this shape too. It injects the forbidden name into the
+step's capture **after** the liveness check, so `did not run` must go red. With tracing dead the
+mutant reads INVALID and the rung stays unproven.
+
 ---
 
 ## Non-vacuity: one control per rung, never a boolean
diff --git a/skills/learned-db-assertions.md b/skills/learned-db-assertions.md
index 895cb625..1cf340e7 100644
--- a/skills/learned-db-assertions.md
+++ b/skills/learned-db-assertions.md
@@ -54,6 +54,29 @@ on every data rung (#286). The shipped `tests/e2e/config.js` now resolves the to
 as a guess. `journey-runner.js` probes the admin API once before the suite and aborts on 401/403,
 naming where the token came from.
 
+### Read the answer by alias, never by position
+
+`mxcli oql --direct --json` prints an array of objects. Captured from the v0.26.0 binary
+(`tests/wave2/fixtures/oql-json/`):
+
+```
+SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid …   →   [{"mid":"m1","zeta":"z1"}]
+SELECT b.AttentionCount AS n FROM <Module>.<ViewEntity> …    →   [{"ID":"2814…","n":"7"}]
+```
+
+The keys come back alphabetically. A column that is null in every row is left out. A view entity
+adds `ID` beside your alias. So a row read by position is wrong: `Object.values(row)[0]` is
+`"m1"` in the first query (not `zeta`) and the view's ID in the second (not the count). That is
+what `helpers.js` did until #154.
+
+- `H.oqlScalar(sql)` returns the **first alias in the SELECT list**, or null when there is no row
+  or the value is null. Null always means "no measurement", never 0.
+- `H.oqlRows(sql)` returns alias-keyed objects with **every alias present** (explicit `null`).
+- `H.oql(sql).rows` is in SELECT order with explicit nulls.
+- Name every column (`COUNT(*) AS n`). An unaliased bare path (`c.Name`) is read as `Name`. A
+  `SELECT *` or an unnamed expression has no alias, so `oqlScalar` returns null rather than
+  guess a column.
+
 ### Correction to the previous version of this skill
 
 This skill used to open with: *"`mxcli oql --direct` requires the M2EE admin token. In Mendix
diff --git a/tests/wave2/fixtures/oql-json/admin-api-stub.js b/tests/wave2/fixtures/oql-json/admin-api-stub.js
new file mode 100644
index 00000000..13bf4b41
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/admin-api-stub.js
@@ -0,0 +1,27 @@
+// Stub of the Mendix admin API's OQL preview endpoint (POST /dev/preview_execute_oql), used to
+// capture what the REAL mxcli binary prints for `oql --direct --json`. The runtime half (the
+// bodies below) is synthetic and follows mxcli's own tests (cmd/mxcli/docker/oql_test.go:
+// "the runtime omits a column from a row's JSON object when its value is null"); the
+// *.stdout / *.stderr files beside this are mxcli v0.26.0's verbatim output for them.
+// Re-capture on an mxcli upgrade:
+//   node admin-api-stub.js 18991 &
+//   mxcli oql --direct --host 127.0.0.1 --port 18991 --token stub --json "<sql from cases.txt>" \
+//     > <case>.stdout 2> <case>.stderr
+// The case is chosen by its marker string inside the query.
+const http = require('http');
+const bodies = {
+  NULLCOL: { data: [{ zeta: 'z1', mid: 'm1' }, { zeta: 'z2', alpha: 'a2', mid: 'm2' }] },
+  ALLNULL: { data: [{ zeta: 'z1', mid: 'm1' }] },
+  VIEW:    { data: [{ ID: '281474976710657', n: '7' }] },
+  BRACKET: { data: [{ label: 'a]b}c"d', n: '2' }] },
+};
+http.createServer((req, res) => {
+  let b = '';
+  req.on('data', (c) => { b += c; });
+  req.on('end', () => {
+    const q = JSON.parse(b).oql;
+    const k = Object.keys(bodies).find((x) => q.includes(x));
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(bodies[k] || { data: [] }));
+  });
+}).listen(Number(process.argv[2]), '127.0.0.1');
diff --git a/tests/wave2/fixtures/oql-json/allnull.stderr b/tests/wave2/fixtures/oql-json/allnull.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/allnull.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/allnull.stdout b/tests/wave2/fixtures/oql-json/allnull.stdout
new file mode 100644
index 00000000..ce5a8876
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/allnull.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "mid": "m1",
+    "zeta": "z1"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/bracket.stderr b/tests/wave2/fixtures/oql-json/bracket.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/bracket.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/bracket.stdout b/tests/wave2/fixtures/oql-json/bracket.stdout
new file mode 100644
index 00000000..30467459
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/bracket.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "label": "a]b}c\"d",
+    "n": "2"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/cases.txt b/tests/wave2/fixtures/oql-json/cases.txt
new file mode 100644
index 00000000..327bd03e
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/cases.txt
@@ -0,0 +1,7 @@
+# case<TAB>query — run through the released mxcli v0.26.0 binary (`mxcli version v0.26.0
+# (2026-10-11T18:37:07Z)`) against admin-api-stub.js; <case>.stdout / <case>.stderr are its
+# verbatim output (exit 0 for all four). Captured 2026-10-13.
+nullcol	SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c WHERE 'NULLCOL' = 'NULLCOL'
+allnull	SELECT c.Zeta AS zeta, c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c WHERE 'ALLNULL' = 'ALLNULL'
+view	SELECT b.AttentionCount AS n FROM M.V AS b WHERE 'VIEW' = 'VIEW'
+bracket	SELECT c.Label AS label, COUNT(c.ID) AS n FROM M.E AS c WHERE 'BRACKET' = 'BRACKET' GROUP BY c.Label
diff --git a/tests/wave2/fixtures/oql-json/nullcol.stderr b/tests/wave2/fixtures/oql-json/nullcol.stderr
new file mode 100644
index 00000000..0b241b13
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/nullcol.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(2 rows)
diff --git a/tests/wave2/fixtures/oql-json/nullcol.stdout b/tests/wave2/fixtures/oql-json/nullcol.stdout
new file mode 100644
index 00000000..01807192
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/nullcol.stdout
@@ -0,0 +1,12 @@
+[
+  {
+    "alpha": null,
+    "mid": "m1",
+    "zeta": "z1"
+  },
+  {
+    "alpha": "a2",
+    "mid": "m2",
+    "zeta": "z2"
+  }
+]
diff --git a/tests/wave2/fixtures/oql-json/view.stderr b/tests/wave2/fixtures/oql-json/view.stderr
new file mode 100644
index 00000000..3c003d3d
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/view.stderr
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+(1 rows)
diff --git a/tests/wave2/fixtures/oql-json/view.stdout b/tests/wave2/fixtures/oql-json/view.stdout
new file mode 100644
index 00000000..2fad5197
--- /dev/null
+++ b/tests/wave2/fixtures/oql-json/view.stdout
@@ -0,0 +1,6 @@
+[
+  {
+    "ID": "281474976710657",
+    "n": "7"
+  }
+]
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
new file mode 100644
index 00000000..50b5aaa2
--- /dev/null
+++ b/tests/wave2/test-journey-liveness.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# Usage: bash test-journey-liveness.sh [path-to-journey-runner.js]
+#
+# Fixture for the journey runner's liveness checks: rung 2's negative-only span claim
+# (traceRung + otel.js liveness, the trace-negative positive-control mutant — #150) and the
+# app probe between journeys (probeApp / appGate / flagAppDown — #285).
+#
+# #150 (card-disbursement requirements-driven build, 2026-09-26): a step whose whole proof is
+# "the reset microflow did NOT run" (Cancel on a confirmation) captures zero spans. The runner
+# read every empty capture as INVALID "Jaeger down or OTel off", so the claim could never pass,
+# and the control run's trace-negative mutant needed an `ordered` list, so the claim could
+# never be shown able to fail either. Now: zero spans + evidence tracing is live → the claim is
+# judged; no evidence → INVALID; the mutant injects the forbidden name after the liveness check.
+# #285 (field run 2026-10-12): a watch rebuild took the runtime down mid-suite and every later
+# journey FAILed as if the features were broken.
+#
+# Golden input: fixtures/otel-capture/jaeger-trace-refused-arm.json — a real Jaeger
+# /api/traces response (Mendix 11.13.0 → Jaeger v1.76, see test-otel-capture-until.sh), fed
+# through the real otel.js capture()/liveness() with fetch stubbed. The app probe runs against
+# a real local HTTP server and a closed port; a Mendix runtime that is down refuses the
+# connection, which is the closed-port case. Not fixtured: the main loop's wiring (needs a
+# browser and a live app).
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/journey-runner.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GOLDEN="$HERE/fixtures/otel-capture/jaeger-trace-refused-arm.json"
+[ -f "$GOLDEN" ] || { echo "FAIL — golden capture missing: $GOLDEN"; exit 1; }
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+for f in helpers.js otel.js config.js settle.js; do
+  [ -f "$E2E/$f" ] || { echo "FAIL — $f not beside $SUT"; exit 1; }
+done
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/journey-liveness.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$E2E/helpers.js" "$E2E/settle.js" "$E2E/otel.js" "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+IFS= read -r -d '' JS <<'JSEOF' || true
+const fs = require('fs');
+const http = require('http');
+const E = process.env;
+const full = JSON.parse(fs.readFileSync(E.GOLDEN, 'utf8'));
+const empty = { data: [] };
+let body = full, fail = false;
+const realFetch = globalThis.fetch.bind(globalThis);
+global.fetch = async (url, opts) => {
+  if (String(url).includes('/api/traces')) {
+    if (fail) { const e = new Error('fetch failed'); e.code = 'ECONNREFUSED'; throw e; }
+    return { json: async () => body };
+  }
+  return realFetch(url, opts);
+};
+const R = require('./journey-runner.js');
+const O = require('./otel.js');
+const out = (k, v) => console.log(`${k} ${typeof v === 'string' ? v : JSON.stringify(v)}`);
+if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { console.log('NOFN'); process.exit(0); }
+
+(async () => {
+  // capture() over the golden, the way the runner calls it (fast retries)
+  const cap = async () => O.capture(0, { retries: 1, waitMs: 1 });
+  const isMf = s => s.tags.some(t => t.key === 'mx.microflow.name');
+  const goldSpans = await cap();
+  const noMf = goldSpans.filter(s => !s.tags['mx.microflow.name']);
+
+  // liveness() itself
+  body = full;  out('L_LIVE', await O.liveness(0));
+  body = empty; out('L_QUIET', (await O.liveness(0)).ok);
+  fail = true;  out('L_DOWN', await O.liveness(0)); fail = false;
+  body = full;  out('L_LATER', (await O.liveness(Date.now())).ok);   // spans older than `since`
+  out('L_NAMED', (await O.liveness(0, { name: 'POST /*', spans: noMf })).ok);
+  out('L_NAMEDMISS', (await O.liveness(0, { name: 'Microflow X.DS_Page', spans: noMf })).ok);
+
+  // traceRung, driven with the golden capture
+  const run = async (step, spans, liveOk) => {
+    const rows = [];
+    await R.traceRung(step, { t0: 0, since: 0, rec: (n, v, d) => rows.push(`${v} ${n}${d ? ' :: ' + d : ''}`),
+      capture: async () => spans,
+      live: liveOk === undefined ? O.liveness : async (s, o) => (liveOk ? { ok: true, detail: 'live (stub)' } : { ok: false, detail: 'dead (stub)' }) });
+    return rows;
+  };
+  const neg = { name: 'Cancel reset', spans: { ordered: [], mustNotFire: ['ACT_Settings_ResetAll'] } };
+  body = full;
+  out('T_NEG_EMPTY_LIVE', await run(neg, [], undefined));            // golden says tracing is live
+  body = empty;
+  out('T_NEG_EMPTY_DEAD', await run(neg, [], undefined));            // Jaeger answers, nothing since
+  fail = true; out('T_NEG_EMPTY_DOWN', await run(neg, [], undefined)); fail = false;
+  out('T_NEG_SPANS_CLEAN', await run(neg, noMf, false));             // spans present: they are the evidence
+  const negHit = { name: 'Cancel arm', spans: { mustNotFire: ['ACT_MockScenario_Arm'] } };
+  out('T_NEG_HIT', await run(negHit, goldSpans, false));
+  const negDecl = { name: 'Cancel', spans: { mustNotFire: ['ACT_Settings_ResetAll'], liveness: 'POST /*' } };
+  out('T_DECL_OK', await run(negDecl, noMf, undefined));
+  const negDeclMiss = { name: 'Cancel', spans: { mustNotFire: ['ACT_Settings_ResetAll'], liveness: 'Microflow X.DS_Page' } };
+  out('T_DECL_MISS', await run(negDeclMiss, noMf, undefined));
+  const pos = { name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } };
+  out('T_POS_EMPTY', await run(pos, [], true));                      // positive claim: empty is INVALID, liveness not consulted
+  out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
+
+  // the trace-negative mutant for a negative-only journey
+  const jNeg = { id: 'J-neg', steps: [{ name: 'Cancel reset', ui: { ready: '.x' }, spans: { mustNotFire: ['ACT_Settings_ResetAll'] } }] };
+  const mNeg = R.controlMutants(jNeg).find(m => m.rung === 'trace-negative');
+  out('M_SUPPORTED', { supported: mNeg.supported, inject: mNeg.supported && mNeg.journey.steps[0].spans._controlInjectFired });
+  const mRows = await run(mNeg.journey.steps[0], [], true);
+  out('M_LIVE', { rows: mRows, caught: mRows.some(r => r.startsWith('FAIL') && mNeg.expectFail({ name: r.split(' :: ')[0].slice(5) })) });
+  out('M_DEAD', await run(mNeg.journey.steps[0], [], false));
+  const jPos = { id: 'J-pos', steps: [{ name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } }] };
+  const mPos = R.controlMutants(jPos).find(m => m.rung === 'trace-negative');
+  out('M_POS', { supported: mPos.supported, mustNot: mPos.journey.steps[0].spans.mustNotFire, inject: mPos.journey.steps[0].spans._controlInjectFired || null });
+  out('M_NONE', R.controlMutants({ id: 'J', steps: [{ name: 's' }] }).find(m => m.rung === 'trace-negative').supported);
+  out('F_SAMPLE', [R.forbiddenSample('Mod.ACT_X'), R.forbiddenSample('^Mod\\.ACT_X$'), R.forbiddenSample('(')]);
+
+  // #285: app probe against a real server and a closed port
+  let status = 200;
+  const srv = http.createServer((q, s) => { s.statusCode = status; s.end('x'); });
+  await new Promise(r => srv.listen(0, '127.0.0.1', r));
+  const url = `http://127.0.0.1:${srv.address().port}/`;
+  out('A_UP', await R.probeApp(url));
+  status = 302; out('A_REDIRECT', (await R.probeApp(url)).up);
+  status = 503; out('A_503', await R.probeApp(url));
+  srv.closeAllConnections && srv.closeAllConnections();
+  await new Promise(r => srv.close(r));
+  // a port nothing listens on: bind one, release it, probe it (no pooled socket to reuse)
+  const gone = http.createServer();
+  await new Promise(r => gone.listen(0, '127.0.0.1', r));
+  const goneUrl = `http://127.0.0.1:${gone.address().port}/`;
+  await new Promise(r => gone.close(r));
+  out('A_REFUSED', await R.probeApp(goneUrl, { timeoutMs: 2000 }));
+  const seq = (...ups) => { let i = 0; return async () => ({ up: ups[i++], detail: 'stub' }); };
+  out('G_RECOVER', await R.appGate(url, { probe: seq(false, false, true), waitMs: 0 }));
+  out('G_DOWN', await R.appGate(url, { probe: seq(false, false, false), waitMs: 0 }));
+  const rows = [{ verdict: 'PASS', detail: '' }, { verdict: 'FAIL', detail: 'x' }, { verdict: 'INVALID', detail: '' }];
+  out('G_FLAG', { n: R.flagAppDown(rows, 'ECONNREFUSED'), rows });
+})().catch(e => { console.log(`ERR ${e.stack}`); process.exit(3); });
+JSEOF
+
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 GOLDEN="$GOLDEN" JAEGER_URL=http://jaeger.invalid node - 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+if printf '%s\n' "$OUT" | grep -qx NOFN; then
+  bad "journey-runner.js exports no traceRung / otel.js no liveness — #150 not addressed"
+  echo ""; echo "PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+[ -n "$(line G_FLAG)" ] || { echo "FAIL — harness did not finish"; echo "$OUT" | tail -12; exit 1; }
+
+echo "== T1: otel.js liveness() =="
+case "$(line L_LIVE)" in '{"ok":true,"detail":"tracing live: 8 span(s)'*) ok "golden trace since the journey start → live, 8 spans counted" ;; *) bad "golden not read as live" "$(line L_LIVE)" ;; esac
+[ "$(line L_QUIET)" = false ] && ok "Jaeger answers with nothing → not live" || bad "empty Jaeger read as live" "$(line L_QUIET)"
+case "$(line L_DOWN)" in '{"ok":false,"detail":"Jaeger unreachable'*ECONNREFUSED*) ok "Jaeger refusing → not live, says unreachable" ;; *) bad "unreachable Jaeger mishandled" "$(line L_DOWN)" ;; esac
+[ "$(line L_LATER)" = false ] && ok "spans older than the journey start do not count" || bad "stale spans counted" "$(line L_LATER)"
+[ "$(line L_NAMED)" = true ] && [ "$(line L_NAMEDMISS)" = false ] && ok "a declared liveness span is looked for in the step capture" || bad "declared liveness span" "$(line L_NAMED) / $(line L_NAMEDMISS)"
+
+echo "== T2: rung 2, negative-only claim (#150) =="
+case "$(line T_NEG_EMPTY_LIVE)" in '["PASS Cancel reset: tracing live :: tracing live: 8 span(s)'*'","PASS [MF] NEGATIVE: Cancel reset: ACT_Settings_ResetAll did not run :: none ran"]') ok "zero step spans + live tracing → the claim is judged: PASS, with the liveness row" ;; *) bad "correct Cancel still unjudgeable" "$(line T_NEG_EMPTY_LIVE)" ;; esac
+case "$(line T_NEG_EMPTY_DEAD)" in '["INVALID Cancel reset: spans :: negative-only claim (ACT_Settings_ResetAll must not run) with no liveness evidence: Jaeger answered, but '*'emitted no span'*) ok "zero spans, service silent → INVALID, never PASS" ;; *) bad "dead tracing passed a negative claim" "$(line T_NEG_EMPTY_DEAD)" ;; esac
+case "$(line T_NEG_EMPTY_DOWN)" in '["INVALID Cancel reset: spans :: '*'Jaeger unreachable'*) ok "zero spans, Jaeger down → INVALID naming Jaeger" ;; *) bad "Jaeger down not named" "$(line T_NEG_EMPTY_DOWN)" ;; esac
+case "$(line T_NEG_SPANS_CLEAN)" in *'PASS [GUARD] Cancel reset: capture non-empty'*'PASS [MF] NEGATIVE: Cancel reset: ACT_Settings_ResetAll did not run'*) ok "spans present without the forbidden one → PASS (the capture is its own evidence)" ;; *) bad "clean capture misjudged" "$(line T_NEG_SPANS_CLEAN)" ;; esac
+case "$(line T_NEG_HIT)" in *'FAIL [MF] NEGATIVE: Cancel arm: ACT_MockScenario_Arm did not run :: MockServices.ACT_MockScenario_Arm'*) ok "forbidden microflow in the golden capture → FAIL naming it" ;; *) bad "forbidden microflow not caught" "$(line T_NEG_HIT)" ;; esac
+case "$(line T_DECL_OK)" in *'PASS Cancel: tracing live :: liveness span POST /* captured'*'PASS [MF] NEGATIVE: Cancel: ACT_Settings_ResetAll did not run'*) ok "declared spans.liveness present → judged" ;; *) bad "declared liveness ignored" "$(line T_DECL_OK)" ;; esac
+case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness span Microflow X.DS_Page not captured'*) ok "declared spans.liveness absent → INVALID" ;; *) bad "missing declared liveness passed" "$(line T_DECL_MISS)" ;; esac
+[ "$(line T_POS_EMPTY)" = '["INVALID Arm: spans :: zero spans captured — Jaeger down or OTel off. Trace rung did NOT run."]' ] \
+  && ok "positive claim with zero spans → INVALID as before" || bad "positive-claim behaviour changed" "$(line T_POS_EMPTY)"
+[ "$(line T_POS_OK)" = '["PASS [GUARD] Arm: capture non-empty","PASS [MF] Arm: ordered","PASS [MF] Arm: no ERROR at any level"]' ] \
+  && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
+
+echo "== T3: trace-negative positive control for a negative-only claim =="
+[ "$(line M_SUPPORTED)" = '{"supported":true,"inject":["ACT_Settings_ResetAll"]}' ] && ok "mutant supported, injects the forbidden name" || bad "negative-only journey still has no trace-negative mutant" "$(line M_SUPPORTED)"
+case "$(line M_LIVE)" in *'"caught":true}') ok "with tracing live the injected name turns 'did not run' red — the targeted check" ;; *) bad "mutant not caught by its targeted check" "$(line M_LIVE)" ;; esac
+case "$(line M_DEAD)" in '["INVALID '*) ok "with tracing dead the mutant is INVALID — injection cannot vouch for a dead pipeline" ;; *) bad "mutant faked a proof over dead tracing" "$(line M_DEAD)" ;; esac
+[ "$(line M_POS)" = '{"supported":true,"mustNot":["ACT_MockScenario_Arm"],"inject":null}' ] && ok "positive-claim journey: mutant unchanged (first ordered name, no injection)" || bad "positive mutant changed" "$(line M_POS)"
+[ "$(line M_NONE)" = false ] && ok "no span claim at all → still unsupported" || bad "phantom mutant" "$(line M_NONE)"
+[ "$(line F_SAMPLE)" = '["Mod.ACT_X","Mod.ACT_X",null]' ] && ok "regex pattern → a name it matches; invalid regex → null" || bad "forbiddenSample" "$(line F_SAMPLE)"
+
+echo "== T4: app probe between journeys (#285) =="
+[ "$(line A_UP)" = '{"up":true,"detail":"HTTP 200"}' ] && ok "HTTP 200 → up" || bad "200 not up" "$(line A_UP)"
+[ "$(line A_REDIRECT)" = true ] && ok "a redirect (login page) is up" || bad "redirect read as down" "$(line A_REDIRECT)"
+[ "$(line A_503)" = '{"up":false,"detail":"HTTP 503"}' ] && ok "HTTP 503 → down" || bad "5xx read as up" "$(line A_503)"
+[ "$(line A_REFUSED)" = '{"up":false,"detail":"ECONNREFUSED"}' ] && ok "refused connection (runtime stopped) → down, ECONNREFUSED" || bad "refused not down" "$(line A_REFUSED)"
+[ "$(line G_RECOVER)" = '{"up":true,"detail":"stub","tries":3}' ] && ok "a restart in progress is waited out (3 tries)" || bad "gate gave up early" "$(line G_RECOVER)"
+[ "$(line G_DOWN)" = '{"up":false,"detail":"stub","tries":3}' ] && ok "down after every try → APP-DOWN" || bad "gate passed a dead app" "$(line G_DOWN)"
+case "$(line G_FLAG)" in '{"n":1,'*'"verdict":"FAIL","detail":"x  [APP-DOWN after this journey: ECONNREFUSED'*'"appDown":true}'*) ok "only FAIL rows are flagged APP-DOWN, verdict kept" ;; *) bad "flagging wrong" "$(line G_FLAG)" ;; esac
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-oql-rows.sh b/tests/wave2/test-oql-rows.sh
new file mode 100644
index 00000000..f9aff927
--- /dev/null
+++ b/tests/wave2/test-oql-rows.sh
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Usage: bash test-oql-rows.sh [path-to-helpers.js]
+#
+# Fixture for project-tests/e2e/helpers.js's OQL reader — parseOqlOutput(), oqlScalar(),
+# oqlRows(), oqlAliases() (#154).
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26/27): oql() turned each
+# row of `mxcli oql --direct --json` into `Object.values(r)` and oqlScalar read rows[0][0].
+# mxcli prints the keys ALPHABETICALLY and leaves out a column that is null in every row, so
+# positions were not SELECT positions; over a view entity the answer carries `ID` beside the
+# alias, and rows[0][0] was the ID, not the count. A string value holding `]` or `}` ended the
+# brace-counting slice early and the helper returned null on a real answer.
+#
+# Golden input is CAPTURED: fixtures/oql-json/<case>.stdout|.stderr are the released mxcli
+# v0.26.0 binary's verbatim output for the queries in fixtures/oql-json/cases.txt, run against
+# fixtures/oql-json/admin-api-stub.js (the runtime half is synthetic, shaped after mxcli's own
+# tests: null columns omitted from a row object). mxcli's own JSON formatting is the real part.
+# Not captured: a live runtime's answer over a real view entity (no app reachable from the
+# session that wrote this); the view case's `ID` key is the shape the field report describes.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/helpers.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FIX="$HERE/fixtures/oql-json"
+for c in nullcol allnull view bracket; do
+  for x in stdout stderr; do [ -f "$FIX/$c.$x" ] || { echo "FAIL — golden missing: $FIX/$c.$x"; exit 1; }; done
+done
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/oql-rows.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e" "$WORK/stub"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$WORK/tests/e2e/helpers.js"
+cp "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+# A stub mxcli that replays a captured case: stdout and stderr verbatim, exit 0.
+cat > "$WORK/stub/mxcli" <<'EOF'
+#!/usr/bin/env bash
+cat "$FIXDIR/$CASE.stdout"; cat "$FIXDIR/$CASE.stderr" >&2
+EOF
+chmod +x "$WORK/stub/mxcli"
+
+sqlof() { awk -F'\t' -v c="$1" '$1==c{print $2}' "$FIX/cases.txt"; }
+export Q_NULLCOL="$(sqlof nullcol)" Q_ALLNULL="$(sqlof allnull)" Q_VIEW="$(sqlof view)" Q_BRACKET="$(sqlof bracket)"
+[ -n "$Q_NULLCOL" ] && [ -n "$Q_VIEW" ] && [ -n "$Q_BRACKET" ] && [ -n "$Q_ALLNULL" ] \
+  || { echo "FAIL — cases.txt lost a query"; exit 1; }
+
+IFS= read -r -d '' JS <<'JSEOF' || true
+const fs = require('fs');
+const H = require('./helpers.js');
+const E = process.env;
+const out = (k, v) => console.log(`${k} ${typeof v === 'string' ? v : JSON.stringify(v)}`);
+const cap = c => fs.readFileSync(`${E.FIXDIR}/${c}.stdout`, 'utf8');
+const P = (c, q) => { const r = H.parseOqlOutput(cap(c), q); return r && { rows: r.rows, objects: r.objects }; };
+
+// one parser over the captured stdout
+out('P_NULLCOL', P('nullcol', E.Q_NULLCOL));
+out('P_ALLNULL', P('allnull', E.Q_ALLNULL));
+out('P_VIEW', P('view', E.Q_VIEW));
+out('P_BRACKET', P('bracket', E.Q_BRACKET));
+// stdout + stderr together, as the admin preflight reads it
+out('P_MIXED', P('view', E.Q_VIEW) && H.parseOqlOutput(cap('view') + fs.readFileSync(`${E.FIXDIR}/view.stderr`, 'utf8'), E.Q_VIEW).rows);
+
+// through the real oql() spawn, the stub replaying each case
+const scal = (c, q) => { process.env.CASE = c; return JSON.stringify(H.oqlScalar(q)); };  // JSON: the string "null" is not null
+const rowsOf = (c, q) => { process.env.CASE = c; return typeof H.oqlRows === 'function' ? H.oqlRows(q) : 'NOFN'; };
+out('S_VIEW', scal('view', E.Q_VIEW));
+out('S_BRACKET', scal('bracket', E.Q_BRACKET));
+out('S_NULLFIRST', scal('nullcol', 'SELECT c.Alpha AS alpha, c.Mid AS mid FROM M.E AS c'));
+out('S_NOSQLALIAS', scal('view', 'SELECT * FROM M.V'));
+out('R_NULLCOL', rowsOf('nullcol', E.Q_NULLCOL));
+
+// alias reading
+const A = q => (typeof H.oqlAliases === 'function' ? H.oqlAliases(q) : 'NOFN');
+out('A_PLAIN', A('SELECT COUNT(*) AS n FROM System.Session'));
+out('A_NESTED', A("SELECT COALESCE(c.A, 'x, y') AS a, (SELECT COUNT(o.ID) FROM M.O AS o WHERE o.X = c.ID) AS cnt, c/M.Assoc/M.T/Name FROM M.E AS c"));
+out('A_DISTINCT', A('select distinct c.Name as "Label" from M.E as c'));
+out('A_UNNAMED', A('SELECT COUNT(*) FROM M.E'));
+out('A_NOFROM', A('SELECT 1 AS n'));
+JSEOF
+
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 MXCLI="$WORK/stub/mxcli" FIXDIR="$FIX" node - 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+[ -n "$(line P_NULLCOL)" ] || { echo "FAIL — harness could not require $SUT"; echo "$OUT" | tail -8; exit 1; }
+
+echo "== T1: rows keyed by SELECT alias, in SELECT order, explicit nulls =="
+[ "$(line P_NULLCOL)" = '{"rows":[["z1",null,"m1"],["z2","a2","m2"]],"objects":[{"zeta":"z1","alpha":null,"mid":"m1"},{"zeta":"z2","alpha":"a2","mid":"m2"}]}' ] \
+  && ok "alphabetical keys back in SELECT order (zeta, alpha, mid); row 1's null alpha explicit" \
+  || bad "rows not in SELECT order" "$(line P_NULLCOL)"
+[ "$(line P_ALLNULL)" = '{"rows":[["z1",null,"m1"]],"objects":[{"zeta":"z1","alpha":null,"mid":"m1"}]}' ] \
+  && ok "a column mxcli left out entirely (null in every row) keeps its slot — mid is not shifted left" \
+  || bad "all-null column shifted the row (the #154 positional read)" "$(line P_ALLNULL)"
+[ "$(line P_VIEW)" = '{"rows":[["7"]],"objects":[{"n":"7"}]}' ] \
+  && ok "view answer: the ID key is not a column of SELECT … AS n" || bad "view's ID read as a column" "$(line P_VIEW)"
+[ "$(line P_BRACKET)" = '{"rows":[["a]b}c\"d","2"]],"objects":[{"label":"a]b}c\"d","n":"2"}]}' ] \
+  && ok "string value holding ] } and \" parses (string-aware slice)" || bad "bracket in a string broke the slice" "$(line P_BRACKET)"
+[ "$(line P_MIXED)" = '[["7"]]' ] && ok "stdout + stderr (warning, row count) still parses" || bad "mixed streams misread" "$(line P_MIXED)"
+
+echo "== T2: oqlScalar reads the FIRST alias, through the real spawn =="
+[ "$(line S_VIEW)" = '"7"' ] && ok "COUNT over a view entity → 7, not the view row's ID" || bad "oqlScalar over a view read the ID" "$(line S_VIEW)"
+[ "$(line S_BRACKET)" = '"a]b}c\"d"' ] && ok "first alias (label) of the bracket case, not null" || bad "bracket case lost" "$(line S_BRACKET)"
+[ "$(line S_NULLFIRST)" = null ] && ok "first alias null in row 1 → null (no measurement), not the next column" || bad "null first alias read a neighbour" "$(line S_NULLFIRST)"
+[ "$(line S_NOSQLALIAS)" = null ] && ok "SELECT * over a two-key answer → null, never a guessed column" || bad "guessed a column" "$(line S_NOSQLALIAS)"
+[ "$(line R_NULLCOL)" = '[{"zeta":"z1","alpha":null,"mid":"m1"},{"zeta":"z2","alpha":"a2","mid":"m2"}]' ] \
+  && ok "oqlRows → alias-keyed objects with every alias present" || bad "oqlRows wrong or missing" "$(line R_NULLCOL)"
+
+echo "== T3: the SELECT list is read, not split on every comma =="
+[ "$(line A_PLAIN)" = '["n"]' ] && ok "COUNT(*) AS n → n" || bad "plain alias" "$(line A_PLAIN)"
+[ "$(line A_NESTED)" = '["a","cnt","Name"]' ] && ok "commas in parens/strings and a subquery's FROM ignored; bare path → its last segment" || bad "nested list misread" "$(line A_NESTED)"
+[ "$(line A_DISTINCT)" = '["Label"]' ] && ok "lower-case keywords, DISTINCT, quoted alias" || bad "distinct/quoted alias" "$(line A_DISTINCT)"
+[ "$(line A_UNNAMED)" = '[null]' ] && ok "an unnamed expression is null, not invented" || bad "unnamed column named" "$(line A_UNNAMED)"
+[ "$(line A_NOFROM)" = '["n"]' ] && ok "SELECT without FROM" || bad "no-FROM select" "$(line A_NOFROM)"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From 8885d01b9ddb9619fd553ed8b0ea7760843f427c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:09:50 +0000
Subject: [PATCH 04/68] Lint Batch 4: SEC014 external-role writes, CONV009
 reads maxObjects (#268, #267)

SEC014 (warning, security tier): an external user role, named in
lint-config.yaml as `external_roles: "A, B"` (or "none"), that can write
all members, a state enumeration, an audit ...At/...By attribute, or the
association its own XPath scopes ownership on. A `_rule` finding when the
option is unset, given as a YAML list (mxcli passes it as None), names a
role that does not exist, or the catalog is not FULL.

CONV009: toolkit-owned copy of the stock rule, which hard-codes 15 and
ignores the maxObjects option its own generated config advertises. Reads
maxObjects (default kept at 15) and countLoopBodies; replaces the stock
file through STOCK-HASHES.txt (conv009 at v0.17.0/0.24.0/0.25.0 plus a
full v0.26.0 set, captured with `mxcli init` from the official release
assets; test-stock-hashes.sh T4 passes live on all four).

Harness: get_option, permissions_for, attributes_for, user_roles,
role_mappings mocks. 26 cases in tests/lint-rules/test-batch4-rules.sh.

Field run (official mxcli 0.26.0, scratch copies of two models): stock
CONV009 5 -> 5 with maxObjects: 20; toolkit CONV009 5 / 10 / 6 at
15 / 10 / 20+loops. SEC014 1 finding with the external role configured,
7 with every role configured, matched by a SQL replay of the catalog.
Both rules also load on mxcli 0.17.0 and 0.24.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 .github/workflows/checks.yml                  |   2 +
 CHANGELOG.md                                  |   1 +
 bin/lib/install-manifest.sh                   |  10 +-
 lint-rules/README.md                          |  28 ++
 lint-rules/STOCK-HASHES.txt                   |  11 +
 lint-rules/conv009_max_microflow_objects.star | 122 +++++
 lint-rules/sec014_external_role_write.star    | 233 +++++++++
 process/lint-backlog.md                       |  16 +
 skills/lint-that-actually-runs.md             |  20 +
 .../fixtures/conv009-a-default.json           |  44 ++
 .../lint-rules/fixtures/conv009-b-max20.json  |  47 ++
 .../fixtures/conv009-c-loop-bodies.json       |  48 ++
 .../fixtures/conv009-d-max-text.json          |  47 ++
 .../fixtures/conv009-e-max-list.json          |  49 ++
 .../fixtures/conv009-f-max-zero.json          |  47 ++
 .../fixtures/conv009-g-loop-text.json         |  47 ++
 .../fixtures/conv009-h-all-zero.json          |  44 ++
 .../lint-rules/fixtures/conv009-i-empty.json  |   3 +
 .../fixtures/conv009-j-nanoflow.json          |  24 +
 tests/lint-rules/fixtures/sec014-a-unset.json | 453 +++++++++++++++++
 tests/lint-rules/fixtures/sec014-b-none.json  | 456 +++++++++++++++++
 tests/lint-rules/fixtures/sec014-c-list.json  | 458 ++++++++++++++++++
 .../fixtures/sec014-d-write-all.json          | 456 +++++++++++++++++
 .../fixtures/sec014-e-input-only.json         | 240 +++++++++
 .../fixtures/sec014-f-state-only.json         | 246 ++++++++++
 .../fixtures/sec014-g-qualified-member.json   | 180 +++++++
 .../fixtures/sec014-h-unknown-role.json       | 456 +++++++++++++++++
 .../fixtures/sec014-i-not-full.json           | 127 +++++
 .../lint-rules/fixtures/sec014-j-skipped.json | 331 +++++++++++++
 .../fixtures/sec014-k-two-roles.json          | 214 ++++++++
 .../fixtures/sec014-l-mapping-only.json       | 143 ++++++
 tests/lint-rules/starrun/main.go              | 121 ++++-
 tests/lint-rules/test-batch4-rules.sh         | 130 +++++
 33 files changed, 4849 insertions(+), 5 deletions(-)
 create mode 100644 lint-rules/conv009_max_microflow_objects.star
 create mode 100644 lint-rules/sec014_external_role_write.star
 create mode 100644 tests/lint-rules/fixtures/conv009-a-default.json
 create mode 100644 tests/lint-rules/fixtures/conv009-b-max20.json
 create mode 100644 tests/lint-rules/fixtures/conv009-c-loop-bodies.json
 create mode 100644 tests/lint-rules/fixtures/conv009-d-max-text.json
 create mode 100644 tests/lint-rules/fixtures/conv009-e-max-list.json
 create mode 100644 tests/lint-rules/fixtures/conv009-f-max-zero.json
 create mode 100644 tests/lint-rules/fixtures/conv009-g-loop-text.json
 create mode 100644 tests/lint-rules/fixtures/conv009-h-all-zero.json
 create mode 100644 tests/lint-rules/fixtures/conv009-i-empty.json
 create mode 100644 tests/lint-rules/fixtures/conv009-j-nanoflow.json
 create mode 100644 tests/lint-rules/fixtures/sec014-a-unset.json
 create mode 100644 tests/lint-rules/fixtures/sec014-b-none.json
 create mode 100644 tests/lint-rules/fixtures/sec014-c-list.json
 create mode 100644 tests/lint-rules/fixtures/sec014-d-write-all.json
 create mode 100644 tests/lint-rules/fixtures/sec014-e-input-only.json
 create mode 100644 tests/lint-rules/fixtures/sec014-f-state-only.json
 create mode 100644 tests/lint-rules/fixtures/sec014-g-qualified-member.json
 create mode 100644 tests/lint-rules/fixtures/sec014-h-unknown-role.json
 create mode 100644 tests/lint-rules/fixtures/sec014-i-not-full.json
 create mode 100644 tests/lint-rules/fixtures/sec014-j-skipped.json
 create mode 100644 tests/lint-rules/fixtures/sec014-k-two-roles.json
 create mode 100644 tests/lint-rules/fixtures/sec014-l-mapping-only.json
 create mode 100755 tests/lint-rules/test-batch4-rules.sh

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index f59e0b63..4f9ccdd9 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -98,3 +98,5 @@ jobs:
         run: bash tests/lint-rules/test-batch2-rules.sh
       - name: Lint-rule unit suite, batch 3 (tests/lint-rules/test-batch3-rules.sh)
         run: bash tests/lint-rules/test-batch3-rules.sh
+      - name: Lint-rule unit suite, batch 4 (tests/lint-rules/test-batch4-rules.sh)
+        run: bash tests/lint-rules/test-batch4-rules.sh
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..2405b1eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is unset or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 26 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. A project that syncs gets SEC014 PASS-BLIND until it sets `external_roles` — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/bin/lib/install-manifest.sh b/bin/lib/install-manifest.sh
index b969693d..f3f56790 100644
--- a/bin/lib/install-manifest.sh
+++ b/bin/lib/install-manifest.sh
@@ -131,7 +131,7 @@ MXTK_PROJECT_BIN_NOINSTALL="report-disposition-check.sh"  # gate-check.sh runs i
 # Copied from toolkit lint-rules/ into <project>/.claude/lint-rules/. Two lists, because the
 # rules divide on one question: may a project edit this file?
 #
-# MXTK_LINT_RULES — toolkit-owned. Fixes to rules `mxcli init` seeds. Three of them, and two
+# MXTK_LINT_RULES — toolkit-owned. Fixes to rules `mxcli init` seeds. Four of them, and two
 # are dead on arrival as shipped: data_change_microflows (ARCH002) and entity_business_key
 # (ARCH003) compare entity_type to "PERSISTENT" when the model returns "Persistent", so they
 # skip every entity and report a clean pass forever. Measured on TestCLIApp 2026-08-18,
@@ -139,8 +139,10 @@ MXTK_PROJECT_BIN_NOINSTALL="report-disposition-check.sh"  # gate-check.sh runs i
 # nothing more: all 38 are `System` entities, because ARCH002 has no module skip. See
 # lint-rules/README.md. conv010 (CONV010) is the top rule by
 # volume everywhere it runs; the de-noised version here took PROJECT-C 399 -> 51.
+# conv009 (CONV009, issue #267) hard-codes 15 and never calls get_option(), so the
+# `maxObjects` example in the lint-config.yaml init writes does nothing; ours reads it.
 #
-# The toolkit repairs ONLY these three of mxcli's ~29 (MXTK_LINT_RULES_STOCK below); rules
+# The toolkit repairs ONLY these four of mxcli's ~29 (MXTK_LINT_RULES_STOCK below); rules
 # after them in the list are toolkit-authored, never seeded by init. Copying the rest would pin every project
 # to whatever mxcli shipped the day someone copied them.
 #
@@ -155,14 +157,14 @@ MXTK_PROJECT_BIN_NOINSTALL="report-disposition-check.sh"  # gate-check.sh runs i
 # project that re-runs init loses these fixes and its lint gate goes quietly blind. Re-running
 # sync-project.sh restores them; lint-rules/STOCK-HASHES.txt is what lets it tell a
 # reverted-to-stock file (safe to restore) from one a project deliberately tuned (hands off).
-MXTK_LINT_RULES="conv010_act_microflow_content.star data_change_microflows.star entity_business_key.star ux001_confirm_before_destructive.star ux002_decisions_captioned.star err001_error_swallowed.star loop001_expensive_action_in_loop.star perf001_generalization_depth.star perf002_nested_data_widgets.star perf004_npe_system_user_assoc.star txt001_build_words_in_user_text.star txt002_non_iso_date_in_user_text.star ui001_widget_layout_traps.star"
+MXTK_LINT_RULES="conv010_act_microflow_content.star data_change_microflows.star entity_business_key.star conv009_max_microflow_objects.star ux001_confirm_before_destructive.star ux002_decisions_captioned.star err001_error_swallowed.star loop001_expensive_action_in_loop.star perf001_generalization_depth.star perf002_nested_data_widgets.star perf004_npe_system_user_assoc.star txt001_build_words_in_user_text.star txt002_non_iso_date_in_user_text.star ui001_widget_layout_traps.star sec014_external_role_write.star"
 # MXTK_LINT_RULES_STOCK — the subset of MXTK_LINT_RULES that `mxcli init` ALSO seeds, i.e. the
 # only files lint-rules/STOCK-HASHES.txt can ever hold a hash for. The ux001/ux002 rules are
 # toolkit-authored: init never writes them, so no stock hash can exist and a coverage check
 # that demanded one (tests/wave2/test-stock-hashes.sh, until 2026-10-08) went red on every
 # version the day a non-stock rule joined MXTK_LINT_RULES. Every name here must also be in
 # MXTK_LINT_RULES; the fixture asserts it.
-MXTK_LINT_RULES_STOCK="conv010_act_microflow_content.star data_change_microflows.star entity_business_key.star"
+MXTK_LINT_RULES_STOCK="conv010_act_microflow_content.star data_change_microflows.star entity_business_key.star conv009_max_microflow_objects.star"
 MXTK_LINT_RULES_CONFIGURABLE="conv020_action_user_feedback.star"
 
 # Files in lint-rules/ deliberately NOT installed. Same contract as MXTK_PROJECT_BIN_NOINSTALL:
diff --git a/lint-rules/README.md b/lint-rules/README.md
index 81b2cfd4..3be6cb72 100644
--- a/lint-rules/README.md
+++ b/lint-rules/README.md
@@ -6,6 +6,7 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 
 | Rule | What it catches | Configure? |
 |---|---|---|
+| `conv009_max_microflow_objects.star` | CONV009 — a microflow over the object threshold. Replaces the stock rule, which hard-codes 15 and ignores the `maxObjects` option its own generated `lint-config.yaml` advertises | in `.claude/lint-config.yaml`, never in the file: `rules: CONV009: options: maxObjects: 20`, `countLoopBodies: true` (default 15 / false) |
 | `conv010_act_microflow_content.star` | `ACT_` page-action microflows holding business logic instead of delegating to `SUB_` | if your prefixes differ — `ACTION_PREFIX`, `DELEGATE_PREFIX` |
 | `conv020_action_user_feedback.star` | Page-triggered microflows that commit / import / delete but tell the user nothing | no — `PROJECT_MODULES` defaults to `"*"` (all modules the lint run includes, minus `.claude/lint-vendor-modules.txt`); `ACTION_PREFIX` if your prefixes differ |
 | `data_change_microflows.star` | ARCH002 — persistent entities written from pages instead of microflows | no |
@@ -20,6 +21,7 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 | `txt001_build_words_in_user_text.star` | TXT001 — user-visible text (titles, captions, templates, messages, menu items) holding build-process words: `Stage N`, `BR-10`, `F004`, TODO, a version tag, "(local, …)" | `PROJECT_WORDS` (sibling-app and project code names); `LEAK_PATTERNS` if "Stage N" is a real domain word |
 | `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — delete it deliberately if the project's display standard is not ISO |
 | `ui001_widget_layout_traps.star` | UI001 — a list view inside a Data grid 2 column (its own "Load more" / "No items found" in every cell); an inline `width` on an Atlas input without `flex` (ignored) | `DATAGRID_TYPES`, `LISTVIEW_TYPES`, `INPUT_TYPES` (widget_type vocabulary: probe first) |
+| `sec014_external_role_write.star` | SEC014 — an external user role (partner, customer, portal) that can write every member, a state enumeration (`Status`, `State`, …), an audit attribute (`…At` / `…By`) or the association its own XPath uses for ownership: the client API lets it skip the approval microflow | **yes, required**, in `.claude/lint-config.yaml`: `rules: SEC014: options: external_roles: "Partner, Customer"` (one text, not a YAML list), or `"none"`. Unset is a `_rule` finding, so the gate reports PASS-BLIND until it is set |
 
 `err001` and `loop001` first field count (2026-10-12, mxcli 0.26.0, 21-module Mendix 11.12 model,
 876 microflows): ERR001 8 (3 true, 5 debatable — flows that return an error payload instead of
@@ -53,6 +55,26 @@ Starlark compile error): mxcli prints "rule file skipped" on stderr and no `_rul
 emitted, so pin the binary rather than trusting the count (`tests/lint-rules/test-batch3-rules.sh`,
 23 cases; the harness gained a `strings()` mock).
 
+`conv009` and `sec014` (Lint Batch 4, issues #267 / #268) first field run (2026-10-13, official
+mxcli 0.26.0 release binary, two scratch model copies: the 21-module Mendix 11.12 model used for
+Batches 2 and 3, and a 9-module one; catalog FULL, 0.2 s each, no load errors).
+CONV009 on the first model's own modules: 5 findings with no option, **still 5 from the stock rule
+with `maxObjects: 20`** (the bug, reproduced), 10 with ours at `maxObjects: 10` (the option reaches
+the rule), 5 at 20 (every offender is above 25), 6 at 20 with `countLoopBodies`; a YAML list as
+the value gives one `_rule` finding. The second model: 0 at every setting (its app modules hold no
+flow over 10 objects). SEC014 with the model's one external-style role configured: **1 finding** —
+write on all 7 attributes of a decision entity, one of them an audit attribute, plus the ownership
+association its own XPath scopes on; a true positive by the rule's definition, the same shape as
+#268. Positive control with every user role configured: 7 findings across 6 entities, and a SQL
+replay of the same logic over `.mxcli/catalog.db` gives the same 7 (0 on the second model, which
+has no external role; `"none"` there gives 0 and no `_rule`). Unset, a list, or a misspelt role
+each give exactly one `_rule` finding. Both files also load and give the same counts on mxcli
+0.17.0 and 0.24.0 (SEC014 avoids `associations()`, which does not exist before 0.25.0 and would
+make the file fail to load). Vocabulary landed in SEC014's header: `MEMBER_WRITE` rows carry
+qualified member and module-role names, attribute `data_type` for an enum is `Enumeration`.
+Unit cases: `tests/lint-rules/test-batch4-rules.sh` (26; the harness gained `get_option`,
+`permissions_for`, `attributes_for`, `user_roles`, `role_mappings` mocks).
+
 `data_change_microflows` and `entity_business_key` are **repaired copies of rules `mxcli init`
 already seeds**, not new ones. Both shipped comparing `entity.entity_type` to `"PERSISTENT"`
 while the model returns `"Persistent"`, so both skipped every entity and reported a clean pass
@@ -123,6 +145,12 @@ the template has not moved. The receipt lives outside `lint-rules/`, which is wh
 survive `mxcli init` — and surviving matters, because init wipes every in-file marker at once,
 which would otherwise make a genuine revert indistinguishable from a first install.
 
+**Tuning a toolkit rule never means editing it.** `conv009` and `sec014` read their settings
+with `get_option()` from `.claude/lint-config.yaml` (`rules: <RULE_ID>: options:`), so the file
+stays byte-identical to the toolkit's and keeps refreshing. mxcli passes an option to Starlark
+only as a bool, a number or a text; a YAML list or map arrives as `None`. Both rules report that
+as a `_rule` finding instead of quietly using their default.
+
 ## `mxcli init` overwrites these without asking
 
 Verified 2026-08-18 on v0.17.0: a line appended to a seeded `.star` was gone after a second
diff --git a/lint-rules/STOCK-HASHES.txt b/lint-rules/STOCK-HASHES.txt
index 22b1fd74..4b11d776 100644
--- a/lint-rules/STOCK-HASHES.txt
+++ b/lint-rules/STOCK-HASHES.txt
@@ -16,13 +16,24 @@
 #
 # Adding a version: run `mxcli init` into an EMPTY directory and md5 the seeded files.
 # Never harvest a hash from a real project — you cannot tell there whether it was edited.
+#
+# conv009 lines and the v0.26.0 set: captured 2026-10-13 by exactly that procedure, from the
+# official mendixlabs/mxcli release assets (mxcli-linux-amd64) for v0.17.0, v0.24.0, v0.25.0
+# and v0.26.0; the same run reproduced every hash already listed here.
 
+conv009_max_microflow_objects.star  c1c398da8bf5033ab6884921232279c3  v0.17.0
 conv010_act_microflow_content.star  276df639edbd90d8010ee711a1e7c0fa  v0.17.0
 data_change_microflows.star         a47e068e01895ce2938d39846a8d907d  v0.17.0
 entity_business_key.star            956c7469e234033e22a9ac32844cb236  v0.17.0
+conv009_max_microflow_objects.star  c1c398da8bf5033ab6884921232279c3  v0.24.0
 conv010_act_microflow_content.star  24295842479e192c71c5176e91a24d39  v0.24.0
 data_change_microflows.star         4f8194a133da3f1961e87f5df684afed  v0.24.0
 entity_business_key.star            d66528c958ad2259462bdf0456c13286  v0.24.0
+conv009_max_microflow_objects.star  95f3d4fef197882e300fcfe4a7fae372  v0.25.0
 conv010_act_microflow_content.star  de7463c1eca28b9b3291adf2a03db2d7  v0.25.0
 data_change_microflows.star         4f8194a133da3f1961e87f5df684afed  v0.25.0
 entity_business_key.star            d66528c958ad2259462bdf0456c13286  v0.25.0
+conv009_max_microflow_objects.star  95f3d4fef197882e300fcfe4a7fae372  v0.26.0
+conv010_act_microflow_content.star  de7463c1eca28b9b3291adf2a03db2d7  v0.26.0
+data_change_microflows.star         4f8194a133da3f1961e87f5df684afed  v0.26.0
+entity_business_key.star            d66528c958ad2259462bdf0456c13286  v0.26.0
diff --git a/lint-rules/conv009_max_microflow_objects.star b/lint-rules/conv009_max_microflow_objects.star
new file mode 100644
index 00000000..099cf5b5
--- /dev/null
+++ b/lint-rules/conv009_max_microflow_objects.star
@@ -0,0 +1,122 @@
+# mxtk-lint-rule: conv009_max_microflow_objects
+# Shipped by mxcli-project-toolkit. This file REPLACES the same-named rule that
+# `mxcli init` seeds into .claude/lint-rules/. Do not hand-edit: tune it through
+# .claude/lint-config.yaml (below). `mxcli init` silently overwrites it, and
+# sync-project.sh restores it only while the marker line above is present and unmodified.
+# See skills/lint-that-actually-runs.md.
+# --- end mxtk-lint-rule header ---
+# CONV009: Maximum Microflow Objects
+#
+# A microflow with more objects than the threshold should be split into SUB_ flows.
+#
+# WHY THIS COPY EXISTS (issue #267). The stock rule (mxcli 0.17.0 to 0.26.0) hard-codes
+# `MAX_ACTIVITIES = 15` and never calls get_option(). The lint-config.yaml that `mxcli init`
+# writes names this very rule as its options example (`CONV009: options: maxObjects: 20`),
+# so a project that follows the example changes nothing: no error, no notice, findings stay
+# at 15. Field evidence: three toolkit-built apps had 36 / 30 / 5 findings at 15 and would
+# have had 16 / 11 / 2 at 20; one app ran a script whose only job was to split flows below
+# 15 to quiet the linter, and the rises were re-baselined in bulk.
+#
+# Configure in .claude/lint-config.yaml (this is the ONLY way; do not edit this file):
+#
+#   rules:
+#     CONV009:
+#       options:
+#         maxObjects: 20          # default 15, the stock value
+#         countLoopBodies: true   # default false: count objects inside loops too
+#
+# DEFAULT KEPT AT 15. skills/microflow-preflight.md splits at 20 counting loop bodies;
+# changing the default for every project is a maintainer call, so this copy changes only
+# that the option is read. `maxObjects: 20` + `countLoopBodies: true` is the preflight rule.
+#
+# What it counts: `activity_count` = top-level flow objects (actions, splits, loops,
+# annotations; not start, end, merge). With countLoopBodies, `total_activity_count`
+# (mxcli >= 0.25.0) adds every object inside a loop, at any depth.
+#
+# SELF-CHECKS (a rule that cannot see must say so, never report a clean pass):
+#   - maxObjects / countLoopBodies set to something unusable (a list, text, 0): `_rule`
+#     finding, and the rule does not silently fall back to 15.
+#   - countLoopBodies on an mxcli without total_activity_count: `_rule` finding.
+#   - flows exist and every one reports 0 objects: activity_count is not populated.
+
+RULE_ID = "CONV009"
+RULE_NAME = "MaxMicroflowObjects"
+DESCRIPTION = "Microflows should not exceed the configured number of objects (default 15; option maxObjects)"
+CATEGORY = "quality"
+SEVERITY = "info"
+
+DEFAULT_MAX_OBJECTS = 15
+# Below this many flows, "every flow has 0 objects" is a plausible empty model.
+MIN_FLOWS_FOR_BLINDNESS = 3
+
+
+def _blind(msg, suggestion):
+    return violation(
+        message=msg,
+        location=location(module="_rule", document_type="Microflow", document_name="CONV009"),
+        suggestion=suggestion,
+    )
+
+
+def _int_option(raw):
+    # YAML gives an int; a quoted "20" arrives as text. Anything else is unusable.
+    if type(raw) == "int":
+        return raw
+    if type(raw) == "float" and raw == int(raw):
+        return int(raw)
+    if type(raw) == "string" and raw.strip().isdigit():
+        return int(raw.strip())
+    return None
+
+
+def check():
+    violations = []
+
+    raw_max = get_option("maxObjects", DEFAULT_MAX_OBJECTS)
+    max_objects = _int_option(raw_max)
+    if max_objects == None or max_objects < 1:
+        return [_blind(
+            "CONV009 option maxObjects is {} ({}), not a positive whole number. This rule inspected NOTHING.".format(repr(raw_max), type(raw_max)),
+            "Set `rules: CONV009: options: maxObjects: 20` in .claude/lint-config.yaml (a plain number; a YAML list reaches the rule as None).",
+        )]
+
+    nested = get_option("countLoopBodies", False)
+    if type(nested) != "bool":
+        return [_blind(
+            "CONV009 option countLoopBodies is {} ({}), not true / false. This rule inspected NOTHING.".format(repr(nested), type(nested)),
+            "Set `countLoopBodies: true` or `false` under `rules: CONV009: options:` in .claude/lint-config.yaml.",
+        )]
+
+    flows = microflows()
+    if nested and len(flows) > 0 and getattr(flows[0], "total_activity_count", None) == None:
+        return [_blind(
+            "CONV009 countLoopBodies is on, but this mxcli has no total_activity_count (needs mxcli >= 0.25.0). This rule inspected NOTHING.",
+            "Upgrade mxcli, or drop countLoopBodies from .claude/lint-config.yaml.",
+        )]
+
+    counted = 0
+    nonzero = 0
+    for mf in flows:
+        n = mf.total_activity_count if nested else mf.activity_count
+        counted += 1
+        if n > 0:
+            nonzero += 1
+        if n <= max_objects:
+            continue
+        noun_title = getattr(mf, "document_noun_title", "") or "Microflow"
+        noun = getattr(mf, "document_noun", "") or "microflow"
+        scope = "objects, loop bodies included" if nested else "top-level objects"
+        violations.append(violation(
+            message="{} '{}' has {} {} (max: {}). Split into sub-{}s.".format(
+                noun_title, mf.name, n, scope, max_objects, noun),
+            location=location(module=mf.module_name, document_type=noun_title, document_name=mf.qualified_name),
+            suggestion="Extract logical sections into SUB_ {}s to keep each at or under {} objects".format(noun, max_objects),
+        ))
+
+    if counted >= MIN_FLOWS_FOR_BLINDNESS and nonzero == 0:
+        violations.append(_blind(
+            "CONV009 saw {} flows and every one reports 0 objects: activity_count is not populated on this mxcli. This rule inspected NOTHING.".format(counted),
+            "Probe: sqlite3 .mxcli/catalog.db \"SELECT ActivityCount, COUNT(*) FROM microflows GROUP BY 1;\" — then upgrade mxcli or report it upstream.",
+        ))
+
+    return violations
diff --git a/lint-rules/sec014_external_role_write.star b/lint-rules/sec014_external_role_write.star
new file mode 100644
index 00000000..180427d1
--- /dev/null
+++ b/lint-rules/sec014_external_role_write.star
@@ -0,0 +1,233 @@
+# mxtk-lint-rule: sec014_external_role_write
+# Shipped by mxcli-project-toolkit. Do not hand-edit: configure it through
+# .claude/lint-config.yaml (below). sync-project.sh refreshes it while it is unedited and
+# reports (never overwrites) a locally edited copy. See lint-rules/README.md.
+# --- end mxtk-lint-rule header ---
+# SEC014: External role can write state, audit or ownership members
+#
+# An external user role (a partner, customer or operator portal role, named per project)
+# holds entity WRITE on: every member (`write *`); a workflow-state enumeration (`Status`,
+# `State`, `Result`, `Stage`, `Phase`); an audit attribute (`...At` / `...By`); or an
+# association the access rule's own XPath uses for ownership.
+#
+# Why: `grant create, read *, write * on X to Partner where [owner = CurrentUser]` passes
+# every stock rule (CONV006 reports only create/delete, CONV007 only a missing XPath, the
+# SEC00x rules app settings and PII reads). Yet it lets that role set its own record's
+# Status through the client API, past the approval microflow that is supposed to be the
+# only way to change it, and re-point the owner association. Field evidence (issue #268,
+# mxcli 0.25.0): a partner role held `create, read *, write *` on two partner-owned
+# entities with a state attribute; lint showed only CONV006 +4, re-baselined as "by
+# design"; a manual security review found it five days later.
+#
+# Configure in .claude/lint-config.yaml (the ONLY way; do not edit this file):
+#
+#   rules:
+#     SEC014:
+#       options:
+#         external_roles: "Partner, Customer"   # user role or module role names, comma-separated
+#         # external_roles: "none"               # this app has no external role: rule is off, on the record
+#         # state_names: "Status, State, Result, Stage, Phase"   # the default list
+#
+# The value is ONE TEXT, not a YAML list: mxcli passes only bool / int / float / text
+# options to Starlark, and a list reaches the rule as None (mxcli 0.26.0,
+# goValueToStarlark). A list is reported, not ignored.
+#
+# A name matches a user role (all its module roles count) or a module role, qualified
+# (`Portal.Partner`) or bare (`Partner`). One finding per entity x configured role,
+# listing the members. Skipped: System / Administration, non-persistable and external
+# entities.
+#
+# SELF-CHECKS (a rule that cannot see must say so, never report a clean pass):
+#   - external_roles unset, empty or a list: `_rule` finding. Set it, or set "none".
+#   - a configured name matches no user role and no module role: `_rule` finding (typo, or
+#     user_roles() / role_mappings() return nothing on this mxcli).
+#   - persistable entities exist and permissions_for() returns no row for any of them: the
+#     catalog is not FULL (permissions are only indexed by `REFRESH CATALOG FULL`).
+#
+# Vocabulary (mxcli 0.26.0 source, mdl/catalog/builder_permissions.go; probe on your model):
+#   permissions_for(e).access_type: CREATE READ WRITE DELETE MEMBER_READ MEMBER_WRITE
+#   member_name: an attribute or association name, bare or qualified; compared on its last
+#   segment. entity_type: "Persistent" in Starlark (compared case-insensitively here).
+#   sqlite3 .mxcli/catalog.db "SELECT AccessType, COUNT(*) FROM permissions GROUP BY 1;"
+#   sqlite3 .mxcli/catalog.db "SELECT DISTINCT DataType FROM attributes;"
+
+RULE_ID = "SEC014"
+RULE_NAME = "ExternalRoleWritesControlledMembers"
+DESCRIPTION = "An external user role can write all members, a state enumeration, an audit attribute or an ownership association"
+CATEGORY = "security"
+SEVERITY = "warning"
+
+REQUIRES = ["full"]
+
+SKIP_MODULES = ("System", "Administration")
+DEFAULT_STATE_NAMES = "Status, State, Result, Stage, Phase"
+# Audit attributes: CreatedAt, ApprovedBy, Submitted_At. Case-sensitive on purpose: "Format",
+# "Nearby" and "Flat" do not match.
+AUDIT_PATTERN = "[a-z0-9_](At|By)$"
+OFF_VALUES = ("none", "-", "off")
+
+
+def _bare(name):
+    return name.split(".")[-1]
+
+
+def _split(text):
+    out = []
+    for part in text.replace(";", ",").split(","):
+        p = part.strip()
+        if p and p not in out:
+            out.append(p)
+    return out
+
+
+def _blind(msg, suggestion):
+    return violation(
+        message=msg,
+        location=location(module="_rule", document_type="Security", document_name="SEC014"),
+        suggestion=suggestion,
+    )
+
+
+def _resolve(names):
+    # configured name -> list of module role names (as the permission rows spell them, or bare)
+    urs = user_roles()
+    mapped = {}
+    for rm in role_mappings():
+        mapped.setdefault(rm.user_role_name, []).append(rm.module_role_name)
+    module_roles = {}
+    for ur in urs:
+        for mr in ur.module_roles:
+            module_roles[mr] = True
+    for rm in role_mappings():
+        module_roles[rm.module_role_name] = True
+
+    resolved = {}
+    unknown = []
+    for n in names:
+        roles = []
+        for ur in urs:
+            if ur.name == n:
+                roles = list(ur.module_roles) + mapped.get(n, [])
+        if not roles and n in mapped:
+            roles = mapped[n]
+        if not roles:
+            for mr in module_roles:
+                if mr == n or _bare(mr) == n:
+                    roles.append(mr)
+        if roles:
+            resolved[n] = roles
+        else:
+            unknown.append(n)
+    return resolved, unknown, len(urs) + len(module_roles)
+
+
+def _role_matches(perm_role, roles):
+    for r in roles:
+        if perm_role == r:
+            return True
+        # one side qualified, the other bare
+        if ("." in perm_role) != ("." in r) and _bare(perm_role) == _bare(r):
+            return True
+    return False
+
+
+def check():
+    raw = get_option("external_roles", "")
+    if raw == None or type(raw) != "string":
+        return [_blind(
+            "SEC014 option external_roles is {} ({}), not text. A YAML list reaches Starlark as None. This rule inspected NOTHING.".format(repr(raw), type(raw)),
+            "Write it as one text: `external_roles: \"Partner, Customer\"` under `rules: SEC014: options:` in .claude/lint-config.yaml.",
+        )]
+    if raw.strip().lower() in OFF_VALUES:
+        return []
+    names = _split(raw)
+    if not names:
+        return [_blind(
+            "SEC014 has no external roles configured, so it cannot tell a partner / customer / portal role from an internal one. This rule inspected NOTHING.",
+            "Name them in .claude/lint-config.yaml: `rules: SEC014: options: external_roles: \"Partner, Customer\"`, or `external_roles: \"none\"` if this app has no external users.",
+        )]
+
+    raw_states = get_option("state_names", DEFAULT_STATE_NAMES)
+    if type(raw_states) != "string":
+        raw_states = DEFAULT_STATE_NAMES
+    state_names = _split(raw_states)
+
+    resolved, unknown, role_count = _resolve(names)
+    violations = []
+    if unknown:
+        violations.append(_blind(
+            "SEC014 external role(s) {} match no user role and no module role ({} roles seen). Those roles were NOT inspected.".format(
+                ", ".join(["'" + u + "'" for u in unknown]), role_count),
+            "Check the spelling against `SHOW USER ROLES` / `SHOW MODULE ROLES`; if roles exist and none is seen, user_roles() / role_mappings() return nothing on this mxcli.",
+        ))
+    if not resolved:
+        return violations
+
+    persistable = 0
+    perm_rows = 0
+    for e in entities():
+        if e.module_name in SKIP_MODULES or e.is_external:
+            continue
+        if e.entity_type.lower() != "persistent":
+            continue
+        persistable += 1
+        perms = permissions_for(e.qualified_name)
+        perm_rows += len(perms)
+        if not perms:
+            continue
+
+        attrs = {}
+        for a in attributes_for(e.qualified_name):
+            attrs[a.name] = a
+
+        for cfg_name in names:
+            roles = resolved.get(cfg_name)
+            if not roles:
+                continue
+            written = {}      # bare member -> True
+            owner_assocs = {}
+            for p in perms:
+                if p.access_type != "MEMBER_WRITE" or not _role_matches(p.module_role_name, roles):
+                    continue
+                m = _bare(p.member_name)
+                if not m:
+                    continue
+                written[m] = True
+                # Not an own attribute = an association (associations() does not exist
+                # before mxcli 0.25.0, and an undefined builtin makes the file not load).
+                if m not in attrs and p.xpath_constraint and matches(p.xpath_constraint, "(^|[^A-Za-z0-9_])" + m + "($|[^A-Za-z0-9_])"):
+                    owner_assocs[m] = True
+            if not written:
+                continue
+
+            all_members = len(attrs) > 0 and len([a for a in attrs if a in written]) == len(attrs)
+            states = sorted([m for m in written if m in attrs and "enum" in attrs[m].data_type.lower()
+                             and len([s for s in state_names if m == s or m.endswith(s)]) > 0])
+            audits = sorted([m for m in written if m in attrs and matches(m, AUDIT_PATTERN)])
+            owners = sorted(owner_assocs.keys())
+            if not (all_members or states or audits or owners):
+                continue
+
+            parts = []
+            if all_members:
+                parts.append("all {} attributes (write *)".format(len(attrs)))
+            if states:
+                parts.append("state " + ", ".join(states))
+            if audits:
+                parts.append("audit " + ", ".join(audits))
+            if owners:
+                parts.append("ownership association " + ", ".join(owners))
+            violations.append(violation(
+                message="Entity '{}': external role '{}' can write {}. The client API lets that role change these directly, past the microflow meant to own them.".format(
+                    e.qualified_name, cfg_name, "; ".join(parts)),
+                location=location(module=e.module_name, document_type="Entity", document_name=e.qualified_name),
+                suggestion="Split the grant: read on all members, plus create and write of only the input members, gated on the initial state in the XPath (e.g. [Status = 'Draft']). Set state, audit and owner members in a microflow the role may execute.",
+            ))
+
+    if persistable > 0 and perm_rows == 0:
+        violations.append(_blind(
+            "SEC014 saw {} persistable entities and permissions_for() returned no access rule for any of them: the catalog is not FULL. This rule inspected NOTHING.".format(persistable),
+            "Run `REFRESH CATALOG FULL` (permissions are only indexed in full mode), then lint again.",
+        ))
+
+    return violations
diff --git a/process/lint-backlog.md b/process/lint-backlog.md
index b3fd6abe..47519d3a 100644
--- a/process/lint-backlog.md
+++ b/process/lint-backlog.md
@@ -128,6 +128,18 @@ Lint Batch 3 shipped rows 32–35 (`TXT001`, `TXT002`, `UI001`); the field-run c
 | 47 | `:focus-visible` ring painted on the script-focused first control at every landing | — | #276 item 4 | theme SCSS / JS | not lintable — skill + review checklist |
 | 48 | `--watch` drops `dist/pages` on an SCSS edit; calculated attributes added while running read empty; trial-licence session cap hangs logins | — | #282: 15 NEEDS_RESTART events; 2 of 3 apps hit the cap | runtime | not lintable — runner / skill (other PR) |
 
+## Batch 6 — external-role writes and a tunable threshold
+
+Source: issues #268 and #267. Row 14 covers writes by the anonymous role only; row 49 is the
+same defect for a named external role, which a project has to name, because no catalog field
+says a role is external. Lint Batch 4 shipped both rows; the field-run counts are in
+`lint-rules/README.md`.
+
+| # | Rule | Category | Evidence | Needs | Status |
+|---|---|---|---|---|---|
+| 49 | External role (configured) can write all members, a state enumeration (`Status`/`State`/`Result`/`Stage`/`Phase`), an audit `…At`/`…By` attribute, or the association its own XPath scopes ownership on (SEC014) | security | #268: a partner role held `create, read *, write *` on two self-owned entities with a state attribute; lint showed only CONV006 +4, re-baselined; a manual review found it five days later | `permissions_for()` `MEMBER_WRITE` rows, `attributes_for().data_type` (`Enumeration`), `user_roles()` / `role_mappings()`; `external_roles` option, text not list. Probed 2026-10-13 | drafted (Batch 4) |
+| 50 | CONV009 threshold read from `lint-config.yaml` (`maxObjects`, `countLoopBodies`) instead of the stock hard-coded 15 | quality | #267: the generated config's own example does nothing; three apps at 36 / 30 / 5 findings, one app split flows only to satisfy the 15 | `get_option()`; `total_activity_count` (mxcli >= 0.25.0) for loop bodies. Default kept at 15: raising it for every project is a maintainer call | drafted (Batch 4) |
+
 ## Cheap extras (one afternoon each, when a batch has room)
 
 Microflow not in a folder · non-persistent entity committed to the database · many-to-many
@@ -159,6 +171,10 @@ a second backlog section. Forum only to weight by incident frequency.
 
 ## History
 
+- 2026-10-13 — Batch 6 added from #268 / #267 (rows 49–50). Lint Batch 4 shipped them as `SEC014`
+  and a toolkit-owned `CONV009` (status `drafted`, 26 unit cases). First field run, mxcli 0.26.0:
+  SEC014 1 finding with the one external role configured, positive control 7 that a SQL replay
+  matches; CONV009 5 / 5 / 10 at 15 / 20 / 10, while stock CONV009 stayed at 5 with `maxObjects: 20`.
 - 2026-10-13 — Batch 5 added from #276 / #280 / #282 (rows 32–48). Lint Batch 3 shipped rows
   32–35 as `TXT001`, `TXT002`, `UI001` (status `drafted`, 23 unit cases); first field run 0 / 0 / 0
   with positive controls 27 / 50 / 17 — counts in `lint-rules/README.md`.
diff --git a/skills/lint-that-actually-runs.md b/skills/lint-that-actually-runs.md
index 64b1b179..2be043d0 100644
--- a/skills/lint-that-actually-runs.md
+++ b/skills/lint-that-actually-runs.md
@@ -67,6 +67,26 @@ if mf.microflow_type == "MICROFLOW" and len(acts) > 15:
 
 Ledger: BUG-63 (addendum 2026-09-25).
 
+**`options:` in `lint-config.yaml` reaches only rules that call `get_option()`.** Nothing
+checks the key: a rule that never reads it ignores it silently, exit 0, same count. The file
+`mxcli init` writes uses stock CONV009 as its example, and stock CONV009 (0.17.0 to 0.26.0)
+hard-codes 15:
+
+```yaml
+rules:
+  CONV009:
+    options:
+      maxObjects: 20   # stock rule: still 5 findings at 15 on a field model; toolkit rule: 5 at 20, 10 at 10
+```
+
+The toolkit ships its own `conv009_max_microflow_objects.star`, which reads `maxObjects`
+(default **15**, the stock value; `microflow-preflight.md` splits at 20 counting loop bodies,
+so `maxObjects: 20` plus `countLoopBodies: true` matches it) through the replace-the-stock path
+in `lint-rules/STOCK-HASHES.txt`. Before you tune any other rule, grep it for `get_option`. If the
+call is not there, the option does nothing. Also, an option reaches Starlark only as a bool, a
+number or a text. A YAML list or map arrives as `None`, so write a list as one text:
+`external_roles: "Partner, Customer"`.
+
 ## 2. A rule that matches nothing must say so
 
 Fixing the casing is not the end of it. A rule can reach the model and still inspect nothing,
diff --git a/tests/lint-rules/fixtures/conv009-a-default.json b/tests/lint-rules/fixtures/conv009-a-default.json
new file mode 100644
index 00000000..423d62d9
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-a-default.json
@@ -0,0 +1,44 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/conv009-b-max20.json b/tests/lint-rules/fixtures/conv009-b-max20.json
new file mode 100644
index 00000000..4d8343b9
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-b-max20.json
@@ -0,0 +1,47 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "maxObjects": 20
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-c-loop-bodies.json b/tests/lint-rules/fixtures/conv009-c-loop-bodies.json
new file mode 100644
index 00000000..cd806c22
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-c-loop-bodies.json
@@ -0,0 +1,48 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "countLoopBodies": true,
+  "maxObjects": 20
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-d-max-text.json b/tests/lint-rules/fixtures/conv009-d-max-text.json
new file mode 100644
index 00000000..0ecfbe98
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-d-max-text.json
@@ -0,0 +1,47 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "maxObjects": "20"
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-e-max-list.json b/tests/lint-rules/fixtures/conv009-e-max-list.json
new file mode 100644
index 00000000..69c571ff
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-e-max-list.json
@@ -0,0 +1,49 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "maxObjects": [
+   20
+  ]
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-f-max-zero.json b/tests/lint-rules/fixtures/conv009-f-max-zero.json
new file mode 100644
index 00000000..5555e234
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-f-max-zero.json
@@ -0,0 +1,47 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "maxObjects": 0
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-g-loop-text.json b/tests/lint-rules/fixtures/conv009-g-loop-text.json
new file mode 100644
index 00000000..e74e0aa3
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-g-loop-text.json
@@ -0,0 +1,47 @@
+{
+ "microflows": [
+  {
+   "activity_count": 15,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 15
+  },
+  {
+   "activity_count": 16,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Medium",
+   "qualified_name": "Sales.ACT_Medium",
+   "total_activity_count": 22
+  },
+  {
+   "activity_count": 30,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Large",
+   "qualified_name": "Sales.SUB_Large",
+   "total_activity_count": 30
+  },
+  {
+   "activity_count": 12,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "SUB_Loopy",
+   "qualified_name": "Sales.SUB_Loopy",
+   "total_activity_count": 25
+  }
+ ],
+ "options": {
+  "countLoopBodies": "yes"
+ }
+}
diff --git a/tests/lint-rules/fixtures/conv009-h-all-zero.json b/tests/lint-rules/fixtures/conv009-h-all-zero.json
new file mode 100644
index 00000000..5dcad647
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-h-all-zero.json
@@ -0,0 +1,44 @@
+{
+ "microflows": [
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "A",
+   "qualified_name": "Sales.A",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "B",
+   "qualified_name": "Sales.B",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "C",
+   "qualified_name": "Sales.C",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "D",
+   "qualified_name": "Sales.D",
+   "total_activity_count": 0
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/conv009-i-empty.json b/tests/lint-rules/fixtures/conv009-i-empty.json
new file mode 100644
index 00000000..7f5c7f7b
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-i-empty.json
@@ -0,0 +1,3 @@
+{
+ "microflows": []
+}
diff --git a/tests/lint-rules/fixtures/conv009-j-nanoflow.json b/tests/lint-rules/fixtures/conv009-j-nanoflow.json
new file mode 100644
index 00000000..7db56172
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-j-nanoflow.json
@@ -0,0 +1,24 @@
+{
+ "microflows": [
+  {
+   "activity_count": 17,
+   "document_noun": "nanoflow",
+   "document_noun_title": "Nanoflow",
+   "microflow_type": "NANOFLOW",
+   "module_name": "Sales",
+   "name": "NF_Big",
+   "qualified_name": "Sales.NF_Big",
+   "total_activity_count": 17
+  },
+  {
+   "activity_count": 3,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "ACT_Small",
+   "qualified_name": "Sales.ACT_Small",
+   "total_activity_count": 3
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-a-unset.json b/tests/lint-rules/fixtures/sec014-a-unset.json
new file mode 100644
index 00000000..94860dc6
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-a-unset.json
@@ -0,0 +1,453 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-b-none.json b/tests/lint-rules/fixtures/sec014-b-none.json
new file mode 100644
index 00000000..0e4caf86
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-b-none.json
@@ -0,0 +1,456 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "none"
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-c-list.json b/tests/lint-rules/fixtures/sec014-c-list.json
new file mode 100644
index 00000000..b76ddfc9
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-c-list.json
@@ -0,0 +1,458 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": [
+   "Partner"
+  ]
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-d-write-all.json b/tests/lint-rules/fixtures/sec014-d-write-all.json
new file mode 100644
index 00000000..ae596790
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-d-write-all.json
@@ -0,0 +1,456 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-e-input-only.json b/tests/lint-rules/fixtures/sec014-e-input-only.json
new file mode 100644
index 00000000..c5c27edc
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-e-input-only.json
@@ -0,0 +1,240 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Contact",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Contact",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Contact",
+   "is_constrained": false,
+   "member_name": "Name",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Contact",
+   "is_constrained": false,
+   "member_name": "Name",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-f-state-only.json b/tests/lint-rules/fixtures/sec014-f-state-only.json
new file mode 100644
index 00000000..2a2001f5
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-f-state-only.json
@@ -0,0 +1,246 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   },
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ReviewStatus"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "StatusText"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ReviewStatus",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ReviewStatus",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "StatusText",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "StatusText",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-g-qualified-member.json b/tests/lint-rules/fixtures/sec014-g-qualified-member.json
new file mode 100644
index 00000000..27a98785
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-g-qualified-member.json
@@ -0,0 +1,180 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Portal.Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer.Status",
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer.Status",
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer.Note",
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer.Note",
+   "module_name": "Portal",
+   "module_role_name": "Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-h-unknown-role.json b/tests/lint-rules/fixtures/sec014-h-unknown-role.json
new file mode 100644
index 00000000..2d31e927
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-h-unknown-role.json
@@ -0,0 +1,456 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partnr"
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-i-not-full.json b/tests/lint-rules/fixtures/sec014-i-not-full.json
new file mode 100644
index 00000000..f0d680c4
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-i-not-full.json
@@ -0,0 +1,127 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-j-skipped.json b/tests/lint-rules/fixtures/sec014-j-skipped.json
new file mode 100644
index 00000000..b07957d5
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-j-skipped.json
@@ -0,0 +1,331 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Administration.Account": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Administration.Account",
+    "module_name": "Administration",
+    "name": "FullName"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Administration.Account",
+    "module_name": "Administration",
+    "name": "Email"
+   }
+  ],
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Draft": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Draft",
+    "module_name": "Portal",
+    "name": "Status"
+   }
+  ],
+  "Portal.Feed": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Feed",
+    "module_name": "Portal",
+    "name": "Status"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Administration",
+   "name": "Account",
+   "qualified_name": "Administration.Account"
+  },
+  {
+   "entity_type": "NonPersistent",
+   "module_name": "Portal",
+   "name": "Draft",
+   "qualified_name": "Portal.Draft"
+  },
+  {
+   "entity_type": "Persistent",
+   "is_external": true,
+   "module_name": "Portal",
+   "name": "Feed",
+   "qualified_name": "Portal.Feed"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "READ",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "member_name": "FullName",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "member_name": "FullName",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "member_name": "Email",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Administration.Account",
+   "is_constrained": false,
+   "member_name": "Email",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Draft",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Draft",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Draft",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Draft",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Feed",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Feed",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Feed",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Feed",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-k-two-roles.json b/tests/lint-rules/fixtures/sec014-k-two-roles.json
new file mode 100644
index 00000000..3c3cac3d
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-k-two-roles.json
@@ -0,0 +1,214 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner; Customer, Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-l-mapping-only.json b/tests/lint-rules/fixtures/sec014-l-mapping-only.json
new file mode 100644
index 00000000..39c35606
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-l-mapping-only.json
@@ -0,0 +1,143 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "Partner"
+ },
+ "permissions": [
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": []
+}
diff --git a/tests/lint-rules/starrun/main.go b/tests/lint-rules/starrun/main.go
index fe239917..73893793 100644
--- a/tests/lint-rules/starrun/main.go
+++ b/tests/lint-rules/starrun/main.go
@@ -22,7 +22,13 @@
 //
 //	{"widgets":[{...}], "microflows":[{...}], "pages":[{...}],
 //	 "entities":[{...}], "associations":[{...}], "strings":[{...}],
-//	 "activities":{"Mod.Flow":[{...}]}, "refs_from":{"Mod.Flow":[{...}]}}
+//	 "activities":{"Mod.Flow":[{...}]}, "refs_from":{"Mod.Flow":[{...}]},
+//	 "permissions":[{...}], "attributes":{"Mod.Entity":[{...}]},
+//	 "user_roles":[{...}], "role_mappings":[{...}], "options":{"key":value}}
+//
+// "options" is what .claude/lint-config.yaml `rules: <ID>: options:` passes; get_option()
+// converts it the way mxcli 0.26.0's goValueToStarlark does: bool, int (a whole JSON
+// number), float, string — and a list, map or null becomes None.
 //
 // Field names are the mxcli Starlark projection names (mdl/linter/starlark.go):
 // widget: id name widget_type container_id container_qualified_name container_type
@@ -55,6 +61,18 @@
 // catalog_string (strings(language=None)): qualified_name object_type value context language
 //
 //	element_id module_name
+//
+// entity_permission (permissions_for(entity), fixture "permissions" filtered on entity_name):
+//
+//	module_role_name module_name entity_name access_type member_name xpath_constraint
+//	is_constrained default_member_access_rights
+//
+// attribute (attributes_for(entity)): id name entity_id entity_qualified_name module_name
+//
+//	data_type length is_unique is_required default_value is_calculated description
+//
+// user_role: name is_anonymous module_roles (list of strings)
+// role_mapping: user_role_name module_role_name module_name
 package main
 
 import (
@@ -78,6 +96,11 @@ type fixture struct {
 	Entities     []map[string]any            `json:"entities"`
 	Associations []map[string]any            `json:"associations"`
 	Strings      []map[string]any            `json:"strings"`
+	Permissions  []map[string]any            `json:"permissions"`
+	Attributes   map[string][]map[string]any `json:"attributes"`
+	UserRoles    []map[string]any            `json:"user_roles"`
+	RoleMappings []map[string]any            `json:"role_mappings"`
+	Options      map[string]any              `json:"options"`
 }
 
 // Projection field lists with their zero values. Order does not matter to Starlark.
@@ -210,6 +233,52 @@ func main() {
 		"pages":        noArgs("pages", list("page", pageFields, fx.Pages)),
 		"entities":     noArgs("entities", list("entity", entityFields, fx.Entities)),
 		"associations": noArgs("associations", list("association", associationFields, fx.Associations)),
+		"permissions_for": starlark.NewBuiltin("permissions_for", func(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+			var q string
+			if err := starlark.UnpackArgs(b.Name(), args, kwargs, "entity_qualified_name", &q); err != nil {
+				return nil, err
+			}
+			keep := []map[string]any{}
+			for _, r := range fx.Permissions {
+				if v, _ := r["entity_name"].(string); v == q {
+					keep = append(keep, r)
+				}
+			}
+			return list("entity_permission", permissionFields, keep), nil
+		}),
+		"attributes_for": starlark.NewBuiltin("attributes_for", func(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+			var q string
+			if err := starlark.UnpackArgs(b.Name(), args, kwargs, "entity_qualified_name", &q); err != nil {
+				return nil, err
+			}
+			return list("attribute", attributeFields, fx.Attributes[q]), nil
+		}),
+		"user_roles":    noArgs("user_roles", userRoles(fx.UserRoles)),
+		"role_mappings": noArgs("role_mappings", list("role_mapping", roleMappingFields, fx.RoleMappings)),
+		"get_option": starlark.NewBuiltin("get_option", func(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+			var key string
+			var def starlark.Value = starlark.None
+			if err := starlark.UnpackArgs(b.Name(), args, kwargs, "key", &key, "default?", &def); err != nil {
+				return nil, err
+			}
+			v, ok := fx.Options[key]
+			if !ok {
+				return def, nil
+			}
+			switch x := v.(type) {
+			case bool:
+				return starlark.Bool(x), nil
+			case float64:
+				if x == float64(int(x)) {
+					return starlark.MakeInt(int(x)), nil
+				}
+				return starlark.Float(x), nil
+			case string:
+				return starlark.String(x), nil
+			default:
+				return starlark.None, nil
+			}
+		}),
 		// strings(language=None) mirrors mxcli 0.25.0+: every catalog string, optionally
 		// filtered to one language.
 		"strings": starlark.NewBuiltin("strings", func(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
@@ -350,3 +419,53 @@ var associationFields = fields{
 var stringFields = fields{
 	s: []string{"qualified_name", "object_type", "value", "context", "language", "element_id", "module_name"},
 }
+var permissionFields = fields{
+	s: []string{"module_role_name", "module_name", "entity_name", "access_type", "member_name",
+		"xpath_constraint", "default_member_access_rights"},
+	b: []string{"is_constrained"},
+}
+var attributeFields = fields{
+	s: []string{"id", "name", "entity_id", "entity_qualified_name", "module_name", "data_type",
+		"default_value", "description"},
+	b: []string{"is_unique", "is_required", "is_calculated"},
+	i: []string{"length"},
+}
+var roleMappingFields = fields{
+	s: []string{"user_role_name", "module_role_name", "module_name"},
+}
+
+// userRoles builds user_role structs; module_roles is a list of strings, which the generic
+// toStruct does not handle.
+func userRoles(rows []map[string]any) *starlark.List {
+	out := make([]starlark.Value, 0, len(rows))
+	for _, r := range rows {
+		d := starlark.StringDict{}
+		for k := range r {
+			if k != "name" && k != "is_anonymous" && k != "module_roles" {
+				fmt.Fprintf(os.Stderr, "starrun: fixture user_role has unknown field %q (not in the mxcli projection)\n", k)
+				os.Exit(1)
+			}
+		}
+		name, _ := r["name"].(string)
+		anon, _ := r["is_anonymous"].(bool)
+		mrs := []starlark.Value{}
+		if xs, ok := r["module_roles"].([]any); ok {
+			for _, x := range xs {
+				if s, ok := x.(string); ok {
+					mrs = append(mrs, starlark.String(s))
+				}
+			}
+		}
+		if !strip["name"] {
+			d["name"] = starlark.String(name)
+		}
+		if !strip["is_anonymous"] {
+			d["is_anonymous"] = starlark.Bool(anon)
+		}
+		if !strip["module_roles"] {
+			d["module_roles"] = starlark.NewList(mrs)
+		}
+		out = append(out, starlarkstruct.FromStringDict(starlark.String("user_role"), d))
+	}
+	return starlark.NewList(out)
+}
diff --git a/tests/lint-rules/test-batch4-rules.sh b/tests/lint-rules/test-batch4-rules.sh
new file mode 100755
index 00000000..4203d895
--- /dev/null
+++ b/tests/lint-rules/test-batch4-rules.sh
@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# test-batch4-rules.sh -- unit tests for lint-rules/sec014_external_role_write.star (issue
+# #268) and the toolkit-owned lint-rules/conv009_max_microflow_objects.star (issue #267), run
+# under the real Go Starlark interpreter with the mxcli builtins mocked from JSON
+# (tests/lint-rules/starrun). get_option() is mocked the way mxcli 0.26.0 converts
+# lint-config.yaml options: bool / int / float / text pass, a list becomes None.
+#
+# IMPORTANT: every fixture in tests/lint-rules/fixtures/sec014-*.json and conv009-*.json is a
+# HAND-WRITTEN unit fixture. The access_type / data_type spellings and the qualified member
+# and role names in them were taken from a 2026-10-13 probe of two real catalogs (see each
+# rule's header), but the rows themselves are invented. These tests prove the rule logic and
+# the self-checks; they do NOT prove the vocabulary matches YOUR model.
+#
+# Needs `go` on PATH. A missing toolchain is a FAILURE (exit 1), never a quiet skip.
+# Keep bash-3.2 compatible.
+# Usage: tests/lint-rules/test-batch4-rules.sh      Exit 0 only if every assertion holds.
+
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TK="$(cd "$HERE/../.." && pwd)"
+FX="$HERE/fixtures"
+R1="$TK/lint-rules/sec014_external_role_write.star"
+R2="$TK/lint-rules/conv009_max_microflow_objects.star"
+for r in "$R1" "$R2"; do
+  [ -f "$r" ] || { echo "FAIL rule file missing: ${r#"$TK"/}"; exit 1; }
+done
+
+if ! command -v go >/dev/null 2>&1; then
+  echo "FAIL go toolchain not found; these tests cannot run (NOT a pass)."
+  echo "     Install Go (https://go.dev/dl/, or: brew install go / apt install golang) and re-run."
+  exit 1
+fi
+# shellcheck source=../../bin/lib/portable.sh
+. "$TK/bin/lib/portable.sh"
+require_py   # sets $PY or exits 2 with an actionable message
+
+W=$(mktemp -d "${TMPDIR:-/tmp}/b4rules.XXXXXX")
+trap 'rm -rf "$W"' EXIT
+PASS=0; FAILED=0
+ok(){ printf '  PASS %s\n' "$1"; PASS=$((PASS+1)); }
+no(){ printf '  FAIL %s\n' "$1"; FAILED=$((FAILED+1)); }
+
+cd "$TK" || exit 1
+OUT="$W/out.json"; ERR="$W/err.txt"; RC=0
+
+BIN="$W/starrun"
+if ! (cd "$HERE/starrun" && GOFLAGS=-mod=mod go build -o "$BIN" . 2>"$ERR"); then
+  echo "FAIL could not build tests/lint-rules/starrun: $(head -c 400 "$ERR")"; exit 1
+fi
+
+# run RULE FIXTURE [STRIP]  -> OUT holds stdout, RC the exit code
+run(){
+  local rule="$1" fix="$2" strip="${3:-}"
+  if [ -n "$strip" ]; then
+    "$BIN" -rule "$rule" -fixture "$FX/$fix.json" -strip-fields "$strip" >"$OUT" 2>"$ERR"
+  else
+    "$BIN" -rule "$rule" -fixture "$FX/$fix.json" >"$OUT" 2>"$ERR"
+  fi
+  RC=$?
+}
+
+# check LABEL PY-EXPR : v is the parsed violation list; the expression must be truthy.
+check(){
+  local label="$1" expr="$2"
+  if [ "$RC" -ne 0 ]; then no "$label (harness exit $RC: $(head -c 300 "$ERR"))"; return; fi
+  if "$PY" - "$OUT" "$expr" <<'PY'
+import json, sys
+v = json.load(open(sys.argv[1]))
+sys.exit(0 if eval(sys.argv[2]) else 1)
+PY
+  then ok "$label"; else no "$label (got: $(head -c 400 "$OUT"))"; fi
+}
+
+echo "== SEC014 =="
+run "$R1" sec014-a-unset
+check "a external_roles unset -> 1 _rule finding, nothing inspected" 'len(v)==1 and v[0]["module"]=="_rule" and "no external roles configured" in v[0]["message"]'
+run "$R1" sec014-b-none
+check "b external_roles \"none\" -> 0 (the app has no external role, on the record)" 'len(v)==0'
+run "$R1" sec014-c-list
+check "c external_roles as a YAML list (reaches Starlark as None) -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "not text" in v[0]["message"]'
+run "$R1" sec014-d-write-all
+check "d write * by the external role -> 1 finding (internal role with the same grant not flagged)" 'len(v)==1 and v[0]["document_name"]=="Portal.Offer" and "external role '"'"'Partner'"'"'" in v[0]["message"]'
+check "d message lists all members, state, both audit attrs, the ownership association" 'all(s in v[0]["message"] for s in ["all 6 attributes (write *)","state Status","audit ApprovedBy, SubmittedAt","ownership association Offer_Partner"])'
+check "d suggestion names the fix (read all, write only inputs, gate on initial state)" '"only the input members" in v[0]["suggestion"] and "initial state" in v[0]["suggestion"]'
+run "$R1" sec014-e-input-only
+check "e input members + a non-owner association + part of another entity -> 0" 'len(v)==0'
+run "$R1" sec014-f-state-only
+check "f two state enums flagged; a String StatusText and Format (not audit) are not" 'len(v)==1 and "state ReviewStatus, Status." in v[0]["message"] and "audit" not in v[0]["message"] and "StatusText" not in v[0]["message"]'
+run "$R1" sec014-g-qualified-member
+check "g qualified member names, bare role in the rows, qualified module role configured -> 1" 'len(v)==1 and "state Status" in v[0]["message"]'
+run "$R1" sec014-h-unknown-role
+check "h a configured role that does not exist -> 1 _rule finding naming it" 'len(v)==1 and v[0]["module"]=="_rule" and "Partnr" in v[0]["message"]'
+run "$R1" sec014-i-not-full
+check "i persistable entities, no permission rows at all -> 1 _rule finding 'not FULL'" 'len(v)==1 and v[0]["module"]=="_rule" and "not FULL" in v[0]["message"]'
+run "$R1" sec014-j-skipped
+check "j Administration, non-persistable and external entities skipped -> 0" 'len(v)==0'
+run "$R1" sec014-k-two-roles
+check "k two roles (';' and ',' separators, a duplicate) -> one finding per entity x role" 'sorted(x["message"].split("external role ")[1].split(" ")[0] for x in v)==["'"'"'Customer'"'"'","'"'"'Partner'"'"'"]'
+run "$R1" sec014-l-mapping-only
+check "l user_roles() empty, role_mappings() names the role -> still resolved, 1 finding" 'len(v)==1 and v[0]["module"]=="Portal"'
+
+echo "== CONV009 =="
+run "$R2" conv009-a-default
+check "a no option -> stock threshold 15: 16 and 30 flagged, 15 not" 'sorted(x["document_name"] for x in v)==["Sales.ACT_Medium","Sales.SUB_Large"] and all("(max: 15)" in x["message"] for x in v)'
+run "$R2" conv009-b-max20
+check "b maxObjects: 20 is read (the stock rule ignores it) -> only the 30-object flow" 'len(v)==1 and v[0]["document_name"]=="Sales.SUB_Large" and "(max: 20)" in v[0]["message"]'
+run "$R2" conv009-c-loop-bodies
+check "c countLoopBodies: true counts total_activity_count -> 3 flows over 20" 'len(v)==3 and all("loop bodies included" in x["message"] for x in v)'
+run "$R2" conv009-d-max-text
+check "d maxObjects: \"20\" (quoted) -> read as 20" 'len(v)==1 and "(max: 20)" in v[0]["message"]'
+run "$R2" conv009-e-max-list
+check "e maxObjects as a list (None) -> 1 _rule finding, no silent fallback to 15" 'len(v)==1 and v[0]["module"]=="_rule" and "maxObjects" in v[0]["message"]'
+run "$R2" conv009-f-max-zero
+check "f maxObjects: 0 -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule"'
+run "$R2" conv009-g-loop-text
+check "g countLoopBodies: \"yes\" -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "countLoopBodies" in v[0]["message"]'
+run "$R2" conv009-h-all-zero
+check "h four flows all at 0 objects -> 1 _rule finding 'not populated'" 'len(v)==1 and v[0]["module"]=="_rule" and "not populated" in v[0]["message"]'
+run "$R2" conv009-i-empty
+check "i no flows -> 0 (an empty model is not blindness)" 'len(v)==0'
+run "$R2" conv009-j-nanoflow
+check "j a nanoflow is named a nanoflow" 'len(v)==1 and v[0]["document_type"]=="Nanoflow" and "sub-nanoflows" in v[0]["message"]'
+run "$R2" conv009-j-nanoflow "document_noun,document_noun_title"
+check "k mxcli before 0.25 (no document_noun) -> falls back to Microflow, still 1 finding" 'len(v)==1 and v[0]["document_type"]=="Microflow"'
+run "$R2" conv009-c-loop-bodies "total_activity_count"
+check "l countLoopBodies on an mxcli without total_activity_count -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "total_activity_count" in v[0]["message"]'
+
+echo
+echo "passed: $PASS  failed: $FAILED"
+[ "$FAILED" -eq 0 ]

From b5731a467f3b502e1e28061b5a661cae79f95ebe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:10:51 +0000
Subject: [PATCH 05/68] e2e: validator accepts negative-only span claims; empty
 spans block is a loud INVALID

#150 item 3: a spans block declaring neither ordered nor mustNotFire
(e.g. the array shape [{mf,status}]) is now recorded INVALID by
traceRung instead of being skipped silently.

examples/validate-journeys.js rejected a mustNotFire-only claim as
"NEVER checked", which contradicted the runner since the liveness change.
It now accepts it, validates the new spans.liveness field (read only for
a negative-only claim) and rejects a mustNotFire that is not a regex;
selftest 19 rules red, 3 clean cases green. skills/journey-examples.md
documents the liveness rule and the INVALID for an empty spans block.

Fixtures: test-validate-journeys-spans.sh 12/12 (8 fail on master's
validator); test-journey-liveness.sh 30/30.

Closes #150

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                |  2 +-
 examples/validate-journeys.js               | 33 +++++++--
 project-tests/e2e/journey-runner.js         | 10 ++-
 skills/journey-examples.md                  | 29 ++++++--
 tests/wave2/test-journey-liveness.sh        | 11 ++-
 tests/wave2/test-validate-journeys-spans.sh | 81 +++++++++++++++++++++
 6 files changed, 151 insertions(+), 15 deletions(-)
 create mode 100644 tests/wave2/test-validate-journeys-spans.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e69376c..802837f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (27 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/examples/validate-journeys.js b/examples/validate-journeys.js
index c080deb2..992ee237 100755
--- a/examples/validate-journeys.js
+++ b/examples/validate-journeys.js
@@ -14,7 +14,7 @@
 // rule below encodes a way a journey can be wrong that the runner cannot tell
 // apart from a defect: a placeholder that reaches the page as the literal string
 // "{{supplierCode}}", an OQL check with no bar that is recorded INVALID forever, a
-// `mustNotFire` the runner never evaluates.
+// `spans` block that declares nothing the runner reads.
 //
 // WHAT IT IS NOT
 // It cannot tell you whether a selector, entity, microflow or requirement pointer
@@ -107,13 +107,27 @@ function validate(j, brds) {
         if (typeof t !== 'string')
           add(`${at}.ui.${key}`, 'contains a non-string — comment objects inside these arrays become assertions');
 
+    // A negative-only claim (`mustNotFire` with no `ordered`) is evaluated since #150: the
+    // runner judges it once tracing is shown live — the step's `liveness` span, or any span from
+    // the service since the journey began. `liveness` is read only for such a claim.
     const sp = st.spans;
     if (sp) {
       const ordered = sp.ordered || [];
-      if (!Array.isArray(ordered) || !ordered.length) {
-        if ((sp.mustNotFire || []).length)
-          add(`${at}.spans`, 'declares `mustNotFire` with no non-empty `ordered` — the runner evaluates the whole trace block only when `ordered` is non-empty, so this claim is NEVER checked');
-        else add(`${at}.spans`, 'is present but declares nothing the runner reads');
+      const mustNot = sp.mustNotFire || [];
+      if (!Array.isArray(ordered)) add(`${at}.spans.ordered`, 'must be an array');
+      if (!Array.isArray(mustNot)) add(`${at}.spans.mustNotFire`, 'must be an array');
+      const hasOrdered = Array.isArray(ordered) && ordered.length > 0;
+      const hasMustNot = Array.isArray(mustNot) && mustNot.length > 0;
+      if (!hasOrdered && !hasMustNot)
+        add(`${at}.spans`, 'is present but declares nothing the runner reads (neither `ordered` nor `mustNotFire`) — the runner records it INVALID');
+      for (const n of hasMustNot ? mustNot : []) {
+        try { new RegExp(n); } catch (e) { add(`${at}.spans.mustNotFire`, `"${n}" is not a valid regex — the runner compiles it with new RegExp()`); }
+      }
+      if (sp.liveness !== undefined) {
+        if (typeof sp.liveness !== 'string' || !sp.liveness.trim())
+          add(`${at}.spans.liveness`, 'must be a non-empty string: a microflow name or span operation the step is known to produce');
+        else if (hasOrdered)
+          add(`${at}.spans.liveness`, 'is only read for a negative-only claim (`mustNotFire` with no `ordered`) — with `ordered`, the claimed microflows are the liveness evidence');
       }
       for (const n of ordered)
         if (!String(n).includes('.'))
@@ -206,7 +220,12 @@ function selftest() {
     ['outcome with no sql', j => { delete j.outcome.sql; return j; }, 'reads `outcome.sql`'],
     ['ready given a bare widget name', j => { j.steps[0].ui.ready = 'dvThing'; return j; }, 'is not a CSS selector'],
     ['checks given a selector', j => { j.steps[0].ui.checks = ['.mx-name-btnGo']; return j; }, 'looks like a selector'],
-    ['mustNotFire with no ordered', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'] }; return j; }, 'NEVER checked'],
+    ['negative-only spans claim is accepted', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'] }; return j; }, null],
+    ['negative-only claim with liveness is accepted', j => { j.steps[0].spans = { ordered: [], mustNotFire: ['ACT_Del'], liveness: 'M.DS_Page' }; return j; }, null],
+    ['spans block declaring nothing', j => { j.steps[0].spans = { ordered: [] }; return j; }, 'declares nothing the runner reads'],
+    ['liveness not a string', j => { j.steps[0].spans = { mustNotFire: ['ACT_Del'], liveness: 5 }; return j; }, 'must be a non-empty string'],
+    ['liveness beside ordered', j => { j.steps[0].spans.liveness = 'M.DS_Page'; return j; }, 'only read for a negative-only claim'],
+    ['mustNotFire not a regex', j => { j.steps[0].spans.mustNotFire = ['ACT_(Del']; return j; }, 'not a valid regex'],
     ['unqualified ordered span', j => { j.steps[0].spans.ordered = ['ACT_Go']; return j; }, 'is unqualified'],
     ['unknown action', j => { j.steps[0].actions[0].do = 'swipe'; return j; }, 'unknown action'],
     ['wait using settleMs', j => { j.steps[0].actions = [{ do: 'wait', settleMs: 500 }]; return j; }, 'reads `ms`'],
@@ -224,7 +243,7 @@ function selftest() {
     console.log(`${ok ? 'ok  ' : 'FAIL'} ${name}${ok ? '' : `\n       got: ${problems.join('\n            ') || '(no problems reported)'}`}`);
   }
   console.log(bad ? `\n${bad} rule(s) could not be shown failing — do not trust a green from this tool.`
-                  : `\n${cases.length - 1} rules each watched going red; the clean case stays green.`);
+                  : `\n${cases.filter(c => c[2] !== null).length} rules each watched going red; ${cases.filter(c => c[2] === null).length} clean case(s) stay green.`);
   return bad ? 1 : 0;
 }
 
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index b4ce1fd0..5b0f20d4 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -336,7 +336,15 @@ async function act(page, a, vars, note) {
 async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
   const claimed = (step.spans && step.spans.ordered) || [];
   const mustNot = (step.spans && step.spans.mustNotFire) || [];
-  if (!claimed.length && !mustNot.length) return;
+  if (!step.spans) return;
+  // A spans block that declares nothing this rung reads reads as a trace claim in the journey
+  // file and proves nothing — said out loud, never skipped (#150 item 3).
+  if (!claimed.length && !mustNot.length) {
+    rec(`${step.name}: spans`, 'INVALID',
+        'spans block declares neither `ordered` nor `mustNotFire` — nothing to evaluate; trace rung did NOT run. ' +
+        'Declare the claim or remove the block.');
+    return;
+  }
   const negOnly = !claimed.length;
   const probe = (step.spans && step.spans.liveness) || null;
   const has = (sp, n) => O.microflowNames(sp).includes(n) || sp.some(x => x.op === n);
diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index 4c8592f4..e12859c1 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -172,10 +172,27 @@ and landing guard, before text/trace/data.
 |---|---|
 | `ordered[]` | Matched **exactly** against the `mx.microflow.name` tag, so **module-qualified**. Subsequence check over span start time: incidental flows between them are tolerated, a reorder or a skip is not. Spans sharing a start time are treated as concurrent. |
 | `mustNotFire[]` | Compiled with `new RegExp(n)` against the same tag, so an unqualified name works as a substring. |
+| `liveness` | Optional, read **only for a negative-only claim** (`mustNotFire` with no `ordered`). It names a microflow (`mx.microflow.name`) or a span operation that the step is known to produce, such as the page's data-source retrieve. |
 
-**Verified trap: the entire trace block runs only when `ordered` is present and non-empty.** Capture,
-the non-empty guard, `assertNoErrors` *and* `mustNotFire` all live inside that `if`. A step declaring
-only `mustNotFire` is silently never checked. Always pair them. `validate-journeys.js` fails on it.
+**A negative-only claim is judged only when tracing is shown to be live (#150).** A step whose whole
+proof is "X did not run" declares `mustNotFire` alone. Cancel on a reset confirmation is one such step:
+
+```json
+"spans": { "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": "Settings.DS_Settings_Get" }
+```
+
+The step can rightly capture zero spans, and so does Jaeger down. So the runner waits the full
+capture window and then needs one piece of evidence that tracing was live:
+- the `liveness` span was captured; or, with no `liveness` declared,
+- any span from the service since the journey began.
+
+With no evidence the step is `INVALID`, never a pass. If the step's capture is non-empty and no
+`liveness` is declared, those spans count as the evidence. Declare `liveness` whenever the step has
+a span it always produces; it is the stronger reference.
+
+**A `spans` block that declares neither `ordered` nor `mustNotFire` is `INVALID`.** The array
+shape `[{ "mf": …, "status": … }]` is one example. The runner no longer skips it, and
+`validate-journeys.js` reports it.
 
 Declaring `ordered` buys `assertNoErrors` for free, and that is the check worth having: it walks
 **activity** spans, so it sees a caught error that leaves the microflow span `OK` while the work did
@@ -258,7 +275,8 @@ Each of these is either an error path in the runner or a correction recorded in
 | Mistake | How it presents | Fix |
 |---|---|---|
 | `checks` given a selector, or `ready` given a bare widget name | a missing-button `FAIL` that sends you to the page instead of the contract | `ready` = selector, `checks` = bare names |
-| `mustNotFire` with no `ordered` | silence — the claim is never evaluated and nothing says so | pair it with a non-empty `ordered` |
+| `mustNotFire` with no `ordered`, on an app whose tracing is down | `INVALID — negative-only claim … with no liveness evidence` | fix Jaeger/OTel, or declare `spans.liveness` with a span the step always produces |
+| `spans` block with neither `ordered` nor `mustNotFire` | `INVALID — spans block declares neither …` | declare the claim, or remove the block |
 | Unqualified name in `ordered` | `FAIL` on a microflow that did run | qualify it; `ordered` is an exact match on `mx.microflow.name` |
 | `ready` guessing where a commit lands | one real journey expected the commit to return to the home page; it stays put and updates in place. The guard failed loudly and marked the rest `INVALID` | that is the guard working — fix the contract, not the app |
 | `oql` / `outcome` with no `expect` or `atLeast` | `INVALID` on every run, forever | declare a bar; prefer `atLeast` on a fixture with history |
@@ -297,7 +315,8 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 2. **Rung numbering does not agree.** `journey-proof.md` numbers landing/text/spans/data/outcome 1–5;
    the runner's header says "four rungs" and its inline comments label spans as rung 2, data as 3 and
    outcome as 4. The emitted `rung` field is a string enum (`ui`/`trace`/`data`/`outcome`/`control`).
-3. **`mustNotFire` is gated on `ordered`.** The spec presents it as an independent rung-3 claim.
+3. ~~**`mustNotFire` is gated on `ordered`.**~~ Resolved (#150): a negative-only claim is evaluated
+   against a liveness reference (see `spans` above).
 4. **Rung 4's queries are whole-table**, so `mustPointAt` is a weaker claim than "the row this run
    created points at the seed" unless the fixture is reset.
 5. **A journey that bails early emits no outcome row at all** — silence, where the spec's discipline
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
index 50b5aaa2..3d9d4fbc 100644
--- a/tests/wave2/test-journey-liveness.sh
+++ b/tests/wave2/test-journey-liveness.sh
@@ -3,7 +3,8 @@
 #
 # Fixture for the journey runner's liveness checks: rung 2's negative-only span claim
 # (traceRung + otel.js liveness, the trace-negative positive-control mutant — #150) and the
-# app probe between journeys (probeApp / appGate / flagAppDown — #285).
+# app probe between journeys (probeApp / appGate / flagAppDown — #285), and the loud INVALID
+# for a spans block that declares neither `ordered` nor `mustNotFire` (#150 item 3).
 #
 # #150 (card-disbursement requirements-driven build, 2026-09-26): a step whose whole proof is
 # "the reset microflow did NOT run" (Cancel on a confirmation) captures zero spans. The runner
@@ -109,6 +110,10 @@ if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { con
   out('T_DECL_MISS', await run(negDeclMiss, noMf, undefined));
   const pos = { name: 'Arm', spans: { ordered: ['MockServices.ACT_MockScenario_Arm'] } };
   out('T_POS_EMPTY', await run(pos, [], true));                      // positive claim: empty is INVALID, liveness not consulted
+  // #150 item 3: a spans block declaring nothing is a loud INVALID, never a silent skip
+  out('T_NOTHING', await run({ name: 'Save', spans: { ordered: [] } }, goldSpans, true));
+  out('T_LEGACY', await run({ name: 'Save', spans: [{ mf: 'M.ACT_Save', status: 'OK' }] }, goldSpans, true));
+  out('T_NOSPANS', await run({ name: 'Save' }, goldSpans, true));
   out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
 
   // the trace-negative mutant for a negative-only journey
@@ -176,6 +181,10 @@ case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness s
 [ "$(line T_POS_OK)" = '["PASS [GUARD] Arm: capture non-empty","PASS [MF] Arm: ordered","PASS [MF] Arm: no ERROR at any level"]' ] \
   && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
 
+case "$(line T_NOTHING)" in '["INVALID Save: spans :: spans block declares neither `ordered` nor `mustNotFire`'*) ok "spans block with neither field → loud INVALID (#150 item 3)" ;; *) bad "empty spans block skipped silently" "$(line T_NOTHING)" ;; esac
+case "$(line T_LEGACY)" in '["INVALID Save: spans :: '*) ok "array-shaped spans (a shape the runner does not read) → INVALID" ;; *) bad "unreadable spans shape skipped" "$(line T_LEGACY)" ;; esac
+[ "$(line T_NOSPANS)" = '[]' ] && ok "no spans block → no trace rows (nothing claimed)" || bad "a step without spans produced trace rows" "$(line T_NOSPANS)"
+
 echo "== T3: trace-negative positive control for a negative-only claim =="
 [ "$(line M_SUPPORTED)" = '{"supported":true,"inject":["ACT_Settings_ResetAll"]}' ] && ok "mutant supported, injects the forbidden name" || bad "negative-only journey still has no trace-negative mutant" "$(line M_SUPPORTED)"
 case "$(line M_LIVE)" in *'"caught":true}') ok "with tracing live the injected name turns 'did not run' red — the targeted check" ;; *) bad "mutant not caught by its targeted check" "$(line M_LIVE)" ;; esac
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
new file mode 100644
index 00000000..d87ce0a7
--- /dev/null
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Usage: bash test-validate-journeys-spans.sh [path-to-validate-journeys.js]
+#
+# Fixture for examples/validate-journeys.js's `spans` rules after #150: the runner now
+# evaluates a negative-only claim (`mustNotFire` with no `ordered`) against a liveness
+# reference, so the validator must accept it — it used to reject it as "NEVER checked", which
+# made the contract checker contradict the runner. `spans.liveness` is the new optional field
+# (read only for a negative-only claim); a spans block declaring neither field is still a
+# problem, and the runner now records it INVALID instead of skipping it.
+#
+# Input: journey files shaped like the toolkit's own journeys (the validator's selftest base),
+# written here and checked through the real CLI. Also runs the validator's --selftest, which
+# watches every rule go red.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/examples/validate-journeys.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/         got: /'; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/validate-spans.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+# One journey per case; only the step's `spans` differs.
+mk() {
+  cat > "$WORK/$1.journey.json" <<EOF
+{ "id": "J-$1", "requirement": [],
+  "seeds": [{ "name": "a", "sql": "SELECT X AS x FROM M.E LIMIT 1" }],
+  "steps": [{ "name": "Cancel reset", "actions": [{ "do": "click", "widget": "btnCancel" }],
+              "ui": { "ready": ".mx-name-dvSettings", "textPresent": ["{{a}}"] },
+              "spans": $2 }] }
+EOF
+}
+mk negonly   '{ "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk negempty  '{ "ordered": [], "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk negdecl   '{ "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": "Settings.DS_Settings_Get" }'
+mk positive  '{ "ordered": ["Settings.ACT_Save"], "mustNotFire": ["ACT_Settings_ResetAll"] }'
+mk nothing   '{ "ordered": [] }'
+mk legacy    '[{ "mf": "Settings.ACT_Save", "status": "OK" }]'
+mk livenum   '{ "mustNotFire": ["ACT_Settings_ResetAll"], "liveness": 5 }'
+mk livepos   '{ "ordered": ["Settings.ACT_Save"], "liveness": "Settings.DS_Settings_Get" }'
+mk badre     '{ "mustNotFire": ["ACT_(Reset"] }'
+
+run() { OUT="$(node "$SUT" "$WORK/$1.journey.json" 2>&1)"; RC=$?; }
+
+echo "== T1: negative-only claims are accepted (the runner evaluates them since #150) =="
+for c in negonly negempty negdecl positive; do
+  run "$c"
+  [ "$RC" -eq 0 ] && ok "$c → no problems" || bad "$c rejected" "$OUT"
+done
+run negonly
+printf '%s' "$OUT" | grep -q 'NEVER checked' && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
+
+echo "== T2: what the runner cannot read is still a problem =="
+run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
+  && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
+printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
+run legacy; [ "$RC" -eq 1 ] && ok "array-shaped spans (no ordered/mustNotFire) → problem" || bad "legacy array shape accepted" "$OUT"
+run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
+  && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
+run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \
+  && ok "liveness beside ordered → problem (never read)" || bad "unread liveness accepted" "$OUT"
+run badre; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'not a valid regex'; } \
+  && ok "mustNotFire that is not a regex → problem" || bad "invalid regex accepted" "$OUT"
+
+echo "== T3: the validator's own selftest =="
+ST="$(node "$SUT" --selftest 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && ok "--selftest: every rule watched going red, clean cases green" || bad "--selftest failed" "$(printf '%s' "$ST" | grep -A2 '^FAIL' | head -12)"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From cd187a4a83938e850ec5856d6adcbe97845715bb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:13:25 +0000
Subject: [PATCH 06/68] feat(doctor, sync-project): wire mxcli fix
 property-sets into the upgrade path, report first; name a pre-fix
 model-stamp.sh

#295. mxcli up to v0.25 wrote units without Studio Pro's full property
set. mx check, the build and the runtime stay green, and Studio Pro's
merge/diff throws once it has saved such a document. No gate saw it.

- bin/doctor.sh --property-sets <dir>: read-only `mxcli fix property-sets
  --dry-run`, result plus mxcli version in .claude/.property-sets-receipt
  (gitignored). Exit 0 clean / 1 needs or unclassified / 2 not run /
  3 mxcli < v0.26.0. --if-stale skips when already run for this mxcli.
- bin/doctor.sh --fix-property-sets <dir>: the repair, only through
  bin/exec.sh --patch (snapshot, mxbuild gate, restore); refused on an
  exec.sh without --patch. doctor.sh is its own patch script.
- doctor --quick (run by exec.sh when the mxcli version changes) warns
  while the check is owed; a full doctor runs it.
- sync-project.sh runs the check with --if-stale (never the repair).
- Support is read from `mxcli fix --help`: `fix property-sets --help`
  exits 0 on v0.24/v0.25 too (cobra prints the parent's help).
- learned-detection-gaps.md row; platform-link.md "Before a Team Server
  merge" (fix property-sets, fix hashes, git note).

#236 remainder: known_fix_note gains the model-stamp.sh arm keyed on
GIT_WORK_TREE (patch 0004); test-model-stamp.sh T9 adds the unstaged
worktree `commit -a` and `commit -- app` cases.

Golden input: `--version`, `fix --help`, `fix property-sets --help` and
a not-found dry-run, captured from the official v0.24.0/v0.25.0/v0.26.0
linux-amd64 release binaries (never run against a model). The clean /
NEEDS / FAILED reports follow mxcli v0.26.0's source format strings.
tests/wave2/test-property-sets.sh: 43 passed here, 26 fail on master's
doctor.sh/sync-project.sh. Field run on a real model still owed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   2 +
 bin/doctor.sh                                 | 200 ++++++++++++++++
 bin/sync-project.sh                           |  29 +++
 skills/learned-detection-gaps.md              |   1 +
 skills/platform-link.md                       |  27 +++
 .../dry-run-not-found-v0.26.0.exit            |   1 +
 .../dry-run-not-found-v0.26.0.txt             |   2 +
 .../property-sets/fix-help-v0.24.0.txt        |  21 ++
 .../property-sets/fix-help-v0.25.0.txt        |  22 ++
 .../property-sets/fix-help-v0.26.0.txt        |  23 ++
 .../fix-property-sets-help-v0.25.0.txt        |  22 ++
 .../property-sets/version-v0.24.0.txt         |   1 +
 .../property-sets/version-v0.25.0.txt         |   1 +
 .../property-sets/version-v0.26.0.txt         |   1 +
 tests/wave2/test-model-stamp.sh               |   6 +
 tests/wave2/test-property-sets.sh             | 219 ++++++++++++++++++
 16 files changed, 578 insertions(+)
 create mode 100644 tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.exit
 create mode 100644 tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-help-v0.24.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-help-v0.25.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-help-v0.26.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.25.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/version-v0.24.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/version-v0.25.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/version-v0.26.0.txt
 create mode 100755 tests/wave2/test-property-sets.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..3390a0ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- feat(doctor, sync-project): **`mxcli fix property-sets` is wired into the upgrade path, report first: the Studio Pro merge break no gate could see.** mxcli up to v0.25 wrote units without Studio Pro's full property set. `mx check`, the build and the runtime stay green, and Studio Pro's merge/diff throws ("Objects with ID … do not have the same properties") once it has saved such a document. New `bin/doctor.sh --property-sets <project>` runs the read-only `--dry-run` and records the result with the mxcli version in `.claude/.property-sets-receipt` (machine-local, gitignored). It exits 0 clean, 1 needs repair or could not classify (never green by absence), 2 not run, 3 for an mxcli before v0.26.0. `sync-project.sh` runs it with `--if-stale`, once per installed mxcli version, and `doctor --quick` (which exec.sh runs when the mxcli version changes) warns while it is owed. The repair is `bin/doctor.sh --fix-property-sets <project>`, which runs `mxcli fix property-sets` only through `exec.sh --patch` (snapshot, mxbuild gate, restore). It refuses on an exec.sh without `--patch`. Support is probed from `mxcli fix --help`, because `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too, printing the parent's help. New row in `learned-detection-gaps.md`; `platform-link.md` gains "Before a Team Server merge", covering `fix property-sets`, `fix hashes` and `git note`. Golden input is captured from the v0.24.0/v0.25.0/v0.26.0 release binaries. The clean/NEEDS/FAILED reports follow mxcli's source format strings, because no model was run. `tests/wave2/test-property-sets.sh` (43 cases, 26 fail on master). Field run still owed. `fix hashes` as an `exec.sh --patch` post-step is pending (Refs #295) — jopterhorst
+- fix(sync-project): **sync names a `bin/model-stamp.sh` that predates the worktree hook blind-spot fix.** `known_fix_note` gains the `model-stamp.sh` arm from the #236 patch, keyed on `GIT_WORK_TREE`, which the fixed script pins. The arm says to upgrade `model-stamp.sh` and `_common.sh` together. `tests/wave2/test-model-stamp.sh` T9 adds the unstaged worktree `commit -a` and `commit -- app` cases. The silent rc 1 half of #236 landed earlier. The new note is asserted by `test-property-sets.sh` P10, which fails on master. — MendixMau (card-disbursement requirements-driven build, field task 21)
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/bin/doctor.sh b/bin/doctor.sh
index 38e0d47a..a6ef1b24 100755
--- a/bin/doctor.sh
+++ b/bin/doctor.sh
@@ -42,6 +42,16 @@
 #                                           # (search "Gate self-test") for what it proves and
 #                                           # why: mxbuild/java being PRESENT does not mean the
 #                                           # mxbuild gate can actually SEE an error.
+#   bin/doctor.sh --property-sets <dir>     # ONLY the Studio Pro merge-safety check: runs
+#                                           # `mxcli fix property-sets --dry-run` (read-only)
+#                                           # and records the result. Add --if-stale to skip
+#                                           # the run when it already ran for this mxcli
+#                                           # version (sync-project.sh does). Exit 0 clean,
+#                                           # 1 units need repair or the run failed, 2 not run,
+#                                           # 3 this mxcli predates the command (v0.26.0).
+#   bin/doctor.sh --fix-property-sets <dir> # the same check, then the repair — and only
+#                                           # through bin/exec.sh --patch (snapshot, mxbuild
+#                                           # gate, restore on failure). See "Property sets".
 #
 # --install never downloads silently: it prints the plan first — what, from where, how big,
 # why, and the detected OS/arch — then asks [y/N] at a terminal, or requires --yes when there
@@ -56,12 +66,22 @@
 
 set -u
 
+# The repair step of --fix-property-sets, run BY bin/exec.sh --patch, never by hand: exec.sh
+# calls a .sh patch as `bash <script> <model.mpr> [args...]`, so this file is its own patch
+# script and the repair inherits exec.sh's snapshot, mxbuild gate and restore.
+if [ "${2:-}" = "--property-sets-apply-step" ]; then
+  { [ -n "${3:-}" ] && [ -x "$3" ]; } || { echo "--property-sets-apply-step: no runnable mxcli given" >&2; exit 2; }
+  exec "$3" fix property-sets -p "$1"
+fi
+
 TOOLKIT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 PROJECT_DIR=""
 INSTALL=0
 ASSUME_YES=0
 QUICK=0
 GATE_SELFTEST=0
+PS_MODE=""
+PS_IF_STALE=0
 NO_DOCKER="${MXTK_DOCTOR_SKIP_DOCKER:-0}"
 DOCKER_PROBE_SECS="${MXTK_DOCKER_PROBE_SECS:-8}"
 for _arg in "$@"; do
@@ -71,6 +91,9 @@ for _arg in "$@"; do
     --quick)   QUICK=1 ;;
     --gate-selftest) GATE_SELFTEST=1 ;;
     --no-docker) NO_DOCKER=1 ;;
+    --property-sets)     PS_MODE=check ;;
+    --fix-property-sets) PS_MODE=fix ;;
+    --if-stale)          PS_IF_STALE=1 ;;
     *)         PROJECT_DIR="$_arg" ;;
   esac
 done
@@ -141,6 +164,155 @@ probe_runs() {
   return "$_pr_exit"
 }
 
+# --- property sets: Studio Pro merge safety (mxcli v0.26.0+) ----------------------------------
+#
+# WHY THIS EXISTS (#295). Studio Pro's merge and diff compare two revisions of an element by its
+# property NAMES, and throw when they differ ("Objects with ID … of type … do not have the same
+# properties"). mxcli up to v0.25 wrote units without Studio Pro's full property set. Such a
+# model passes `mx check`, the build and the runtime — every rung exec.sh has — and breaks the
+# first diff or Team Server merge after Studio Pro has saved one of those documents. mxcli
+# v0.26.0 completes the set on every write it makes, but only for the units it rewrites; units
+# an older mxcli wrote keep their gaps until `mxcli fix property-sets` normalizes them. Field
+# case: 78 changed units written with v0.24 on a production app, and no gate could see it.
+#
+# REPORT FIRST. The check is always the --dry-run (read-only; mxcli opens the model with its
+# reader, not its writer). The repair runs only on --fix-property-sets, and only through
+# bin/exec.sh --patch, so it gets the snapshot, the mxbuild gate and the auto-restore every
+# other model write gets. A repair that leaves units FAILED (a value in a key the project's
+# Mendix version does not declare) exits 1, and exec.sh then restores the whole run — fix
+# those units by hand first.
+#
+# What the dry-run prints and how it exits is mxcli's cmd/mxcli/cmd_fix_property_sets.go at
+# v0.26.0: exit 0 = nothing to do; exit 1 = a `  NEEDS ` or `  FAILED ` row per unit, OR an
+# error such as "project not found" (both exit 1, so the rows decide, never the code alone).
+# Anything else is "could not classify", never clean. Support is read from `mxcli fix --help`
+# listing the subcommand: `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too (cobra
+# prints the parent's help for an unknown subcommand), so it cannot be the probe. Golden
+# captures of all three versions: tests/wave2/fixtures/property-sets/.
+#
+# The result is recorded in <project>/.claude/.property-sets-receipt (machine-local, like the
+# doctor receipt): line 1 "<date> <time> <result> <detail>", line 2 "mxcli: <--version line>".
+# Line 2 is what --if-stale and --quick compare: the check is owed again when mxcli changes.
+PS_RESULT=""
+PS_DETAIL=""
+PS_OUT=""
+PS_VER=""
+ps_receipt() { printf '%s/.claude/.property-sets-receipt' "$PROJECT_DIR"; }
+ps_version() { probe_capture _ps_v "$1" --version || true; printf '%s\n' "$_ps_v" | grep -v '^[[:space:]]*$' | head -1; }
+ps_supported() {
+  probe_capture _ps_help "$1" fix --help || return 1
+  printf '%s\n' "$_ps_help" | grep -qE '^[[:space:]]+property-sets[[:space:]]'
+}
+# ps_classify <exit> <output> — sets PS_RESULT (clean|needs|failed|error) and PS_DETAIL.
+ps_classify() {
+  _psc_checked="$(printf '%s\n' "$2" | grep -m1 -E '^Checked [0-9]+ unit' || true)"
+  _psc_needs="$(printf '%s\n' "$2" | grep -c '^  NEEDS ' || true)"
+  _psc_failed="$(printf '%s\n' "$2" | grep -c '^  FAILED ' || true)"
+  if [ "$1" -eq 0 ] && printf '%s\n' "$2" | grep -q 'no readable Mendix version'; then
+    PS_RESULT=error; PS_DETAIL="mxcli read no Mendix version from the model, so nothing was checked"
+  elif [ "$1" -eq 0 ]; then
+    PS_RESULT=clean; PS_DETAIL="${_psc_checked:-exit 0}"
+  elif [ "$1" -eq 1 ] && [ "$_psc_needs" -gt 0 ]; then
+    PS_RESULT=needs; PS_DETAIL="$_psc_needs unit(s) need their property set completed, $_psc_failed cannot be normalized"
+  elif [ "$1" -eq 1 ] && [ "$_psc_failed" -gt 0 ]; then
+    PS_RESULT=failed; PS_DETAIL="$_psc_failed unit(s) hold a value in a key this Mendix version does not declare"
+  else
+    PS_RESULT=error
+    PS_DETAIL="exit $1: $(printf '%s\n' "$2" | grep -v -e '^[[:space:]]*$' -e '^WARNING: This is a' | head -1)"
+  fi
+}
+ps_write_receipt() {
+  [ -n "$PROJECT_DIR" ] && [ -d "$PROJECT_DIR" ] || return 0
+  mkdir -p "$PROJECT_DIR/.claude" 2>/dev/null || return 0
+  { printf '%s %s %s\n' "$(date '+%Y-%m-%d %H:%M')" "$PS_RESULT" "$PS_DETAIL"
+    printf 'mxcli: %s\n' "$PS_VER"
+  } > "$(ps_receipt)" 2>/dev/null || true
+  if [ -d "$PROJECT_DIR/.git" ] && ! git -C "$PROJECT_DIR" check-ignore -q .claude/.property-sets-receipt 2>/dev/null; then
+    printf '\n# Machine-local toolkit marker (doctor.sh property-set check)\n/.claude/.property-sets-receipt\n' \
+      >> "$PROJECT_DIR/.gitignore" 2>/dev/null || true
+  fi
+}
+# ps_stale — 0 when no check has been recorded for the mxcli that is installed now.
+ps_stale() { [ ! -f "$(ps_receipt)" ] || [ "$(sed -n '2s/^mxcli: //p' "$(ps_receipt)")" != "$PS_VER" ]; }
+# ps_check — needs MPR and PMXCLI_PROBE (empty is fine: reported NOT RUN). Sets PS_RESULT.
+ps_check() {
+  PS_RESULT=not-run; PS_DETAIL=""
+  if [ -z "${MPR:-}" ]; then note "property sets: NOT RUN — no .mpr in the project root or app/"; return 0; fi
+  if [ -z "${PMXCLI_PROBE:-}" ]; then note "property sets: NOT RUN — no runnable project mxcli"; return 0; fi
+  PS_VER="$(ps_version "$PMXCLI_PROBE")"
+  if ! ps_supported "$PMXCLI_PROBE"; then
+    PS_RESULT=unsupported; PS_DETAIL="${PS_VER:-this mxcli} has no 'fix property-sets'"
+    warn "property sets: ${PS_VER:-this mxcli} cannot check them — 'mxcli fix property-sets' arrived in v0.26.0"
+    note "Units an mxcli before v0.26 wrote can make Studio Pro's merge/diff throw although mx check,"
+    note "the build and the runtime all pass. Upgrade the project's mxcli, then run this check."
+    ps_write_receipt; return 0
+  fi
+  _psk_rc=0
+  probe_capture PS_OUT "$PMXCLI_PROBE" fix property-sets -p "$MPR" --dry-run || _psk_rc=$?
+  ps_classify "$_psk_rc" "$PS_OUT"
+  case "$PS_RESULT" in
+    clean) ok "property sets: $PS_DETAIL — every unit has the property names Studio Pro writes" ;;
+    needs|failed)
+      warn "property sets: $PS_DETAIL — Studio Pro's merge/diff can throw on these"
+      printf '%s\n' "$PS_OUT" | grep -E '^  (NEEDS|FAILED) ' | head -10 | while IFS= read -r l; do note "$l"; done
+      _psk_rows="$(printf '%s\n' "$PS_OUT" | grep -cE '^  (NEEDS|FAILED) ' || true)"
+      [ "$_psk_rows" -gt 10 ] && note "  … $((_psk_rows - 10)) more"
+      [ "$PS_RESULT" = needs ] && note "repair (snapshot + mxbuild gate + restore): bin/doctor.sh --fix-property-sets ${PROJECT_DIR:-<project>}"
+      [ "$(printf '%s\n' "$PS_OUT" | grep -c '^  FAILED ' || true)" -gt 0 ] && \
+        note "FAILED units are left alone by mxcli and make the guarded repair roll back — resolve them first." ;;
+    *) warn "property sets: could not classify the check — $PS_DETAIL"
+       printf '%s\n' "$PS_OUT" | grep -v '^[[:space:]]*$' | head -5 | while IFS= read -r l; do note "  $l"; done ;;
+  esac
+  ps_write_receipt
+}
+ps_apply() {
+  _psa_ex="$PROJECT_DIR/bin/exec.sh"
+  if [ ! -x "$_psa_ex" ] || ! grep -q 'PATCH_MODE' "$_psa_ex" 2>/dev/null; then
+    bad "property sets: not repaired — this project's bin/exec.sh has no --patch, and the repair is only run through it"
+    note "upgrade it first: bin/sync-project.sh $PROJECT_DIR --upgrade-bin exec.sh"
+    return 0
+  fi
+  note "repairing through bin/exec.sh --patch (snapshot, fix, mxbuild gate, kept only on a verified gate)…"
+  _psa_rc=0
+  ( cd "$PROJECT_DIR" && ./bin/exec.sh --patch "$TOOLKIT_ROOT/bin/doctor.sh" --property-sets-apply-step "$PMXCLI_PROBE" ) || _psa_rc=$?
+  if [ "$_psa_rc" -ne 0 ]; then
+    bad "property sets: exec.sh --patch exited $_psa_rc — the repair was not kept (its output above says why)"
+    return 0
+  fi
+  note "re-checking…"
+  ps_check
+}
+ps_exit_code() {
+  case "$PS_RESULT" in clean) echo 0 ;; not-run) echo 2 ;; unsupported) echo 3 ;; *) echo 1 ;; esac
+}
+
+# --property-sets / --fix-property-sets: only this check, then exit. Stands alone so
+# sync-project.sh and an agent about to merge can run it without waiting through the rest.
+if [ -n "$PS_MODE" ]; then
+  if [ -z "$PROJECT_DIR" ] || [ ! -d "$PROJECT_DIR" ]; then
+    echo "usage: $0 --property-sets|--fix-property-sets [--if-stale] <project-dir>" >&2; exit 2
+  fi
+  PROJECT_DIR="$(cd "$PROJECT_DIR" && pwd)"
+  PROJECT_ROOT="$PROJECT_DIR"
+  # shellcheck disable=SC1091
+  . "$TOOLKIT_ROOT/project-bin/_common.sh"
+  MPR="$(ls "$PROJECT_DIR"/*.mpr 2>/dev/null | head -1)"
+  [ -n "$MPR" ] || MPR="$(ls "$PROJECT_DIR"/app/*.mpr 2>/dev/null | head -1)"
+  PMXCLI_PROBE="$(find_project_mxcli 2>/dev/null || true)"
+  head_ "Property sets (Studio Pro merge safety): $PROJECT_DIR"
+  if [ "$PS_IF_STALE" = 1 ] && [ "$PS_MODE" = check ] && [ -n "$PMXCLI_PROBE" ]; then
+    PS_VER="$(ps_version "$PMXCLI_PROBE")"
+    if ! ps_stale; then
+      PS_RESULT="$(sed -n '1s/^[^ ]* [^ ]* \([^ ]*\).*/\1/p' "$(ps_receipt)")"
+      ok "already checked for $PS_VER: $(sed -n 1p "$(ps_receipt)")"
+      exit "$(ps_exit_code)"
+    fi
+  fi
+  ps_check
+  [ "$PS_MODE" = fix ] && [ "$PS_RESULT" = needs ] && ps_apply
+  exit "$(ps_exit_code)"
+fi
+
 # --- platform -------------------------------------------------------------------------------
 
 head_ "Platform"
@@ -958,6 +1130,34 @@ if [ -n "$PROJECT_DIR" ]; then
     note "your own default mode (~/.claude/settings.json): ${_um:-not set, so the Claude Code built-in default applies}"
     note "No prompts at all is your call, not the project's: set it in ~/.claude/settings.json, or start"
     note "'claude --dangerously-skip-permissions' only inside a container/VM. Deny/ask rules still apply."
+
+    # Property sets (#295) — see the header above ps_check. A full run checks (read-only);
+    # --quick (what exec.sh runs when the mxcli version changes) only compares the receipt
+    # with the installed mxcli, so an upgrade surfaces as a WARN at the next exec.
+    head_ "Property sets (Studio Pro merge safety): $PROJECT_DIR"
+    if [ "$QUICK" != 1 ]; then
+      ps_check
+    elif [ -n "${MPR:-}" ] && [ -n "${PMXCLI_PROBE:-}" ]; then
+      PS_VER="$(ps_version "$PMXCLI_PROBE")"
+      if ps_stale; then
+        if ps_supported "$PMXCLI_PROBE"; then
+          warn "property sets not checked for this mxcli (${PS_VER:-?}) — Studio Pro merge/diff can throw on units an older mxcli wrote"
+          note "read-only check: bin/doctor.sh --property-sets $PROJECT_DIR"
+        else
+          note "${PS_VER:-this mxcli} predates 'mxcli fix property-sets' (v0.26.0) — upgrade before a Team Server merge"
+        fi
+      else
+        _psq="$(sed -n 1p "$(ps_receipt)")"
+        case "$_psq" in
+          *" clean "*|*" clean") ok "property sets: last check for this mxcli was clean ($_psq)" ;;
+          *" unsupported "*) note "property sets: this mxcli cannot check them (v0.26.0+ needed)" ;;
+          *) warn "property sets: last check for this mxcli: $_psq"
+             note "repair: bin/doctor.sh --fix-property-sets $PROJECT_DIR" ;;
+        esac
+      fi
+    else
+      note "property sets: NOT RUN — no .mpr or no runnable project mxcli (see above)"
+    fi
   fi
 fi
 
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index d0101698..1730fb2b 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -992,6 +992,12 @@ known_fix_note() {
   case "$1" in
     verify-module.sh)
       echo "bin/verify-module.sh is missing the design-audit wiring fix (toolkit, 2026-08-21) — wires tests/e2e/design-audit.js (rungs 6-7, UI/a11y) into the composed pass as an informational, non-gating rung — and/or the page-scope wiring fix (F-042, 2026-08-28), which generates .claude/loop/page-scope.json right before the audit reads it; before that fix the scope file's producer was wired into no step and the audit measured against a stale or missing denominator. Recommended upgrade." ;;
+    model-stamp.sh)
+      # Keyed on GIT_WORK_TREE: the fixed script pins it (with GIT_DIR/GIT_INDEX_FILE) before
+      # any git call; a copy without it is the pre-fix one (#162, #236).
+      if ! grep -q 'GIT_WORK_TREE' "$PROJECT_DIR/bin/model-stamp.sh" 2>/dev/null; then
+        echo "bin/model-stamp.sh predates the HOOK BLIND-SPOT fix (toolkit, 2026-09-29, card-disbursement requirements-driven build): a commit made from a git worktree, or with --git-dir, runs the pre-commit hook with GIT_DIR exported, and on a two-tree checkout (.mpr under app/) 'check --staged' then looked for the model at the wrong top, printed 'no model files staged' and PASSED a model change nobody had verified. The project root it checks comes from _common.sh, which learned the app/ probe in the same fix. Upgrade BOTH: --upgrade-bin model-stamp.sh --upgrade-bin _common.sh."; return
+      fi ;;
     page-scope.sh)
       echo "bin/page-scope.sh predates the HEADER_WORDS fix (F-042, 2026-08-28): SHOW PAGES header columns Excluded/Folder/Params were parsed as page rows, inflating the page denominator (measured: 6 real pages counted as 13), so every consumer of page-scope.json graded against furniture. One-line fix — recommended upgrade." ;;
     _common.sh)
@@ -1446,6 +1452,29 @@ if [ "$WIRED" -eq 1 ]; then
   CHANGES=$((CHANGES + ${MXTK_LINT_CHANGES:-0}))
 fi
 
+# --- 4d. Studio Pro merge safety: property sets, once per mxcli version (#295) -------------
+# Units an mxcli before v0.26 wrote can lack Studio Pro's full property set; the model passes
+# mx check, the build and the runtime, and Studio Pro's merge/diff throws. Sync is the step a
+# project runs after an upgrade, so it runs the READ-ONLY check (`doctor.sh --property-sets
+# --if-stale`: skipped when it already ran for the installed mxcli) and never the repair —
+# that is `doctor.sh --fix-property-sets`, through exec.sh's gate, on the user's say-so.
+if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
+   && { [ -x "$PROJECT_DIR/mxcli" ] || [ -x "$PROJECT_DIR/mxcli.exe" ]; }; then
+  if [ "$DRY_RUN" -eq 1 ]; then
+    echo "Would run: bin/doctor.sh --property-sets --if-stale (read-only model check; skipped when it already ran for this mxcli)"
+  else
+    _ps_rc=0
+    _ps_out="$("$SCRIPT_DIR/doctor.sh" --property-sets --if-stale "$PROJECT_DIR" 2>&1)" || _ps_rc=$?
+    printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed 's/^/   /'
+    case "$_ps_rc" in
+      0|2) ;;
+      3) echo "   (the project's mxcli predates 'fix property-sets', v0.26.0 — upgrade it before a Team Server merge)" ;;
+      *) warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
+              "bin/doctor.sh --fix-property-sets '$PROJECT_DIR'" ;;
+    esac
+  fi
+fi
+
 # ── Script smoke — do the refreshed copies actually load on THIS machine? ────────────────
 # A sync can install or refresh scripts that then cannot run here (CRLF from a Windows
 # editor, a bashism this bash rejects) and nothing would say so until a stage depends on
diff --git a/skills/learned-detection-gaps.md b/skills/learned-detection-gaps.md
index 109ee26d..bb6858b2 100644
--- a/skills/learned-detection-gaps.md
+++ b/skills/learned-detection-gaps.md
@@ -54,6 +54,7 @@ verification rungs form a ladder, and a green result only certifies what that ru
 | A `commit` (or `create … commit`) **inside a loop** — and every other shape defect `mxcli lint` has a rule for (CONV011, empty container MPR006, empty nanoflow MPR002) | rungs 1–4 **including exec.sh's mxbuild gate**, and `mxcli check` (whose MDL001/MDL067 hints are not lint, however the script header labels them) | `mxcli lint` — but only if something *runs* it | On a 2026-09-24 field project the gate-agent, where lint was an optional step, had been spawned 0 times against 21 `exec.sh` runs and 234 raw `mxcli exec` runs; `lint-gate.sh` had run twice, by hand, to seed a baseline. A migration flow shipped three commits-in-a-loop under "✅ applied · mxbuild clean". Fix: `exec.sh` runs `lint-gate.sh` after every clean mxbuild and writes the lint verdict into the BUILD-LOG row (`LINT ROSE` exits 1, write kept, `SKIP_LINT=<reason>` recorded). **An instrument that lives only in an agent definition is a suggestion; count its BUILD-LOG rows before claiming coverage** | a marketplace guest-group migration, 2026-09-24 |
 | `Title = null` (or any `= null`) as an **XPath retrieve constraint** | rungs 1–3 — `check --references` clean, exec succeeds, and mxcli's **own OQL engine evaluates the query** and returns rows, so even a read-back looks right | native `mx check` / mxbuild: CE0161 | XPath has no `= null`; write `not(Title)` / `Title != ''` for the empty test. Note what makes this one expensive: mxcli's query engine is more permissive than the model loader, so "I ran the query and it worked" is **not** evidence the constraint is legal | field build (Maurits Visser), 2026-09 |
 | A page layout migrated with `ALTER PAGES … WHERE LAYOUT = X`, in a project whose page scripts **hardcode** `Layout:` inside `create or replace page` | rungs 1–6 — every rung, including live runtime: the app loads, every page renders, every journey passes. There is no error anywhere | a screenshot **of the nav shell** on every page, or `grep -l 'Layout: <old>' mdlsource/` after the migration | `create or replace page` rewrites the page **wholesale**, layout included — so re-running any older page script silently reverts that page to the old shell, and the app ships **two navigation shells at once**. Found when 4 of 7 screens had no navigation at all, just a bare hamburger, after a UI fix loop re-ran five page scripts. A layout migration is not done until the `Layout:` literal is fixed **in the source scripts**; the `ALTER` is a one-shot, the scripts are the repeat offender | field build (Maurits Visser), 2026-09 |
+| Any document an **mxcli before v0.26** wrote and nothing has rewritten since — it lacks part of the property set Studio Pro writes for that Mendix version | rungs 1–6, **all of them**: `mx check`, exec.sh's mxbuild gate, the build and the runtime are clean, and Studio Pro opens the project | Studio Pro's **merge or diff**, once Studio Pro has saved the document: *"Objects with ID … of type Microflows$RestOperationCallAction do not have the same properties"*, and the Version Control panel fails | No rung on the ladder compares property **names**. Run the read-only check after every mxcli upgrade and before any Team Server merge: `bin/doctor.sh --property-sets <project>` (it wraps `mxcli fix property-sets --dry-run`; sync-project.sh runs it once per mxcli version, and `doctor --quick` warns while it is owed). Repair only through the gate: `bin/doctor.sh --fix-property-sets <project>` runs `mxcli fix property-sets` under `exec.sh --patch`. mxcli v0.26.0+ completes the set on every unit it writes; an older mxcli cannot check at all | a 127-module production app, 78 units written with v0.24 (#295); mxcli v0.26.0 changelog |
 
 ## Operating rules that fall out of this table
 
diff --git a/skills/platform-link.md b/skills/platform-link.md
index 7059c227..ab5da582 100644
--- a/skills/platform-link.md
+++ b/skills/platform-link.md
@@ -450,6 +450,33 @@ cause, in the same output. A smoke test that quietly omits them reads as full co
 
 ---
 
+## Before a Team Server merge — three mxcli v0.25/v0.26 checks
+
+A model can be valid everywhere the toolkit looks and still break the first time Studio Pro
+compares two revisions. Three mxcli commands see what `mx check` and exec.sh's gate cannot.
+Each has a read-only form; run that first and read it before anything writes.
+
+| When | Read-only check | Repair |
+|---|---|---|
+| After every mxcli upgrade, and before any merge or Studio Pro pull of CLI-written history | `bin/doctor.sh --property-sets <project>` — wraps `mxcli fix property-sets -p <app>.mpr --dry-run` (v0.26.0+) | `bin/doctor.sh --fix-property-sets <project>` — runs `mxcli fix property-sets` through `exec.sh --patch` (snapshot, mxbuild gate, restore) |
+| After a `git checkout`, `git restore` or merge touched `mprcontents/` | `./mxcli fix hashes -p <app>.mpr` (v0.25.0+; exits 1 on any mismatch) | `./mxcli fix hashes -p <app>.mpr --repair` — rewrites the `.mpr` hash index from the files, never the files |
+| After committing model changes with git | `./mxcli git note -p <app>.mpr` (v0.26.0+) prints the `mx_metadata` note per unpushed commit | `--write` attaches it; push `refs/notes/mx_metadata` with the branch (trap 6c) |
+
+**Property sets, the one no gate sees.** mxcli up to v0.25 wrote units without part of the
+property set Studio Pro writes for the project's Mendix version. `mx check`, the build and the
+runtime all pass. Studio Pro's merge and diff then throw — *"Objects with ID … do not have the
+same properties"* — once Studio Pro has saved such a document, and the Version Control panel
+fails. Field case: 78 changed units written with v0.24 on a production app, with no gate able to
+see them. mxcli v0.26.0 completes the set on every unit it writes, but only on units it rewrites,
+so a project upgraded mid-flight still carries the old ones until the repair runs.
+`sync-project.sh` runs the read-only check once per installed mxcli version, and `doctor --quick`,
+which exec.sh runs when the mxcli version changes, warns while that check is owed. A unit the
+check reports `FAILED` has a value in a key the project's Mendix version does not declare. mxcli
+leaves such units alone, and its exit 1 makes `exec.sh --patch` roll the whole repair back, so
+resolve those units first. An mxcli older than v0.26.0 cannot run this check: upgrade it first.
+
+---
+
 ## Which repository is authoritative
 
 Decide once and write it down. The answer differs by route. (A project laid out per step 3's
diff --git a/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.exit b/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.exit
new file mode 100644
index 00000000..379a4c98
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.exit
@@ -0,0 +1 @@
+exit 1
diff --git a/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.txt b/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.txt
new file mode 100644
index 00000000..b8f84994
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/dry-run-not-found-v0.26.0.txt
@@ -0,0 +1,2 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+project not found: /nonexistent/App.mpr
diff --git a/tests/wave2/fixtures/property-sets/fix-help-v0.24.0.txt b/tests/wave2/fixtures/property-sets/fix-help-v0.24.0.txt
new file mode 100644
index 00000000..26e0c257
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-help-v0.24.0.txt
@@ -0,0 +1,21 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/fix-help-v0.25.0.txt b/tests/wave2/fixtures/property-sets/fix-help-v0.25.0.txt
new file mode 100644
index 00000000..252a3052
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-help-v0.25.0.txt
@@ -0,0 +1,22 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  hashes            Verify (and with --repair, rewrite) the MPR v2 ContentsHash index
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/fix-help-v0.26.0.txt b/tests/wave2/fixtures/property-sets/fix-help-v0.26.0.txt
new file mode 100644
index 00000000..46222917
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-help-v0.26.0.txt
@@ -0,0 +1,23 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  hashes            Verify (and with --repair, rewrite) the MPR v2 ContentsHash index
+  property-sets     Give every stored unit the property names Studio Pro writes (unblocks mx diff / merge)
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.25.0.txt b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.25.0.txt
new file mode 100644
index 00000000..252a3052
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.25.0.txt
@@ -0,0 +1,22 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  hashes            Verify (and with --repair, rewrite) the MPR v2 ContentsHash index
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/version-v0.24.0.txt b/tests/wave2/fixtures/property-sets/version-v0.24.0.txt
new file mode 100644
index 00000000..4d0d7fd5
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/version-v0.24.0.txt
@@ -0,0 +1 @@
+mxcli version v0.24.0 (2026-09-24T05:44:35Z)
diff --git a/tests/wave2/fixtures/property-sets/version-v0.25.0.txt b/tests/wave2/fixtures/property-sets/version-v0.25.0.txt
new file mode 100644
index 00000000..b6c63865
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/version-v0.25.0.txt
@@ -0,0 +1 @@
+mxcli version v0.25.0 (2026-10-05T09:18:28Z)
diff --git a/tests/wave2/fixtures/property-sets/version-v0.26.0.txt b/tests/wave2/fixtures/property-sets/version-v0.26.0.txt
new file mode 100644
index 00000000..238a08d7
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/version-v0.26.0.txt
@@ -0,0 +1 @@
+mxcli version v0.26.0 (2026-10-11T18:37:07Z)
diff --git a/tests/wave2/test-model-stamp.sh b/tests/wave2/test-model-stamp.sh
index fca0e6c5..14ad910e 100755
--- a/tests/wave2/test-model-stamp.sh
+++ b/tests/wave2/test-model-stamp.sh
@@ -98,6 +98,12 @@ git --git-dir=.git commit -qm x 2>/dev/null && bad "--git-dir commit waved an un
 git reset -q
 cd "$WORK/q-wt" && printf u1c > app/mprcontents/a.mxunit && git add app
 git commit -qm x 2>/dev/null && bad "worktree commit waved an unverified model through" || ok "worktree commit refused the unverified model"
+# The same change left UNSTAGED, committed the two other ways git builds a temporary index
+# (GIT_INDEX_FILE = .git/worktrees/<name>/index.lock or next-index-*.lock).
+git reset -q
+git commit -qam x 2>/dev/null && bad "worktree commit -a waved an unverified model through" || ok "worktree commit -a refused the unverified model"
+git commit -qm x -- app 2>/dev/null && bad "worktree commit -- app waved an unverified model through" || ok "worktree commit -- app refused the unverified model"
+git add app
 ./bin/model-stamp.sh write pass "fixture" >/dev/null
 git commit -qm x 2>/dev/null && ok "worktree commit of the verified model accepted" || bad "worktree refused its verified model"
 
diff --git a/tests/wave2/test-property-sets.sh b/tests/wave2/test-property-sets.sh
new file mode 100755
index 00000000..e4d4a0d4
--- /dev/null
+++ b/tests/wave2/test-property-sets.sh
@@ -0,0 +1,219 @@
+#!/usr/bin/env bash
+# Fixture for #295: `mxcli fix property-sets` wired into the upgrade path, report first.
+#   bin/doctor.sh --property-sets [--if-stale] <dir>   read-only check + receipt
+#   bin/doctor.sh --fix-property-sets <dir>            the repair, only through exec.sh --patch
+#   bin/doctor.sh --quick <dir>                        receipt vs installed mxcli -> WARN
+#   bin/sync-project.sh <dir>                          runs the --if-stale check
+# and, for #236, sync-project.sh's known-fix note for a pre-fix bin/model-stamp.sh.
+#
+# Golden input (tests/wave2/fixtures/property-sets/), captured from the official
+# mendixlabs/mxcli linux-amd64 release binaries, never run against a model:
+#   version-v0.2{4,5,6}.0.txt              `mxcli --version`
+#   fix-help-v0.2{4,5,6}.0.txt             `mxcli fix --help`, verbatim up to "Global Flags:"
+#                                          (the global-flags block is identical on every
+#                                          subcommand and is not read)
+#   fix-property-sets-help-v0.25.0.txt     `mxcli fix property-sets --help` on v0.25.0: exit 0,
+#                                          and it is the PARENT's help — why the support probe
+#                                          reads `fix --help` instead
+#   dry-run-not-found-v0.26.0.{txt,exit}   `fix property-sets -p <missing> --dry-run`: exit 1
+#                                          with no unit rows — why exit 1 alone is not "needs"
+# NOT captured: the clean / NEEDS / FAILED reports, which need a real model. The stub below
+# prints them from the format strings in mxcli v0.26.0 cmd/mxcli/cmd_fix_property_sets.go
+# (fixPropertySets: "Checked %d unit(s) in %s against the Mendix %d.%d.%d property sets.",
+# "  %-9s %s%s: +%d key(s), -%d key(s)", "  FAILED    %s%s: %v"). A field run owes the real ones.
+#
+# Every project is built under /tmp. No real project is touched; no real mxcli runs.
+#
+# usage: test-property-sets.sh /path/to/bin/doctor.sh
+export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
+export MXTK_SYNC_SKIP_CLONE_CHECK=1
+export MXTK_DOCTOR_SKIP_DOCKER=1
+
+set -uo pipefail
+
+DOCTOR="${1:?usage: test-property-sets.sh /path/to/bin/doctor.sh}"
+case "$DOCTOR" in /*) ;; *) DOCTOR="$PWD/$DOCTOR" ;; esac
+TK="$(cd "$(dirname "$DOCTOR")/.." && pwd)"
+SYNC="$TK/bin/sync-project.sh"
+FIX="$TK/tests/wave2/fixtures/property-sets"
+WORK="$(mktemp -d /tmp/propsets.XXXXXX)"
+trap 'rm -f "$MXTK_LEAKGUARD_DENYFILE"; rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/  FAIL-detail: /'; }
+
+# The stub mxcli. STUB_VER picks the captured version; the model state lives in .stub-state.
+mkstub() {
+  cat > "$1/mxcli" <<'STUB'
+#!/usr/bin/env bash
+D="$(cd "$(dirname "$0")" && pwd)"
+F="$STUB_FIX"; V="$(cat "$D/.stub-ver" 2>/dev/null || echo v0.26.0)"
+echo "$*" >> "$D/.stub-log"
+case "${1:-}" in
+  --version) cat "$F/version-$V.txt"; exit 0 ;;
+  --help)    echo "mxcli (stub)"; exit 0 ;;
+  fix) shift
+    case "${1:-}" in
+      --help) cat "$F/fix-help-$V.txt"; exit 0 ;;
+      property-sets)
+        dry=0; mpr=""; prev=""
+        for a in "$@"; do [ "$a" = --dry-run ] && dry=1; [ "$prev" = -p ] && mpr="$a"; prev="$a"; done
+        b="$(basename "$mpr")"
+        echo "WARNING: This is a vibe-coded PoC, alpha quality, use with caution." >&2
+        if [ "$dry" = 0 ]; then
+          echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."
+          echo "  FIXED     0d6c3a3e-0000-4000-8000-000000000001 [Microflows\$Microflow Orders.ACT_Save]: +4 key(s), -0 key(s)"
+          echo ""; echo "Completed 1 unit(s): 4 key(s) added, 0 stripped."
+          echo clean > "$D/.stub-state"; exit 0
+        fi
+        case "$(cat "$D/.stub-state")" in
+          clean) echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."
+                 echo "Every unit already has the property names Studio Pro writes."; exit 0 ;;
+          needs) echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."
+                 echo "  NEEDS     0d6c3a3e-0000-4000-8000-000000000001 [Microflows\$Microflow Orders.ACT_Save]: +4 key(s), -0 key(s)"
+                 echo ""; echo "Would complete 1 unit(s): 4 key(s) added, 0 stripped."
+                 echo "Run 'mxcli fix property-sets -p $mpr' to write them."; exit 1 ;;
+          failed) echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."
+                  echo "  FAILED    0d6c3a3e-0000-4000-8000-000000000002 [Pages\$Page Orders.Order_Edit]: key Foo holds a value"
+                  echo "1 unit(s) could not be normalized and were left as they are."; exit 1 ;;
+          notfound) cat "$F/dry-run-not-found-v0.26.0.txt"; exit 1 ;;
+          noversion) echo "$b has no readable Mendix version; nothing is normalized without one."; exit 0 ;;
+        esac ;;
+    esac ;;
+esac
+exit 0
+STUB
+  chmod +x "$1/mxcli"
+}
+mkproj() {   # <name> [app]  — a bare project dir: .mpr (root or app/), stub mxcli, git
+  d="$WORK/$1"; mkdir -p "$d"
+  if [ "${2:-}" = app ]; then mkdir -p "$d/app"; : > "$d/app/App.mpr"; else : > "$d/App.mpr"; fi
+  mkstub "$d"; echo needs > "$d/.stub-state"
+  git -C "$d" init -q . 2>/dev/null
+  echo "$d"
+}
+export STUB_FIX="$FIX"
+
+echo "== P1 support probe reads 'fix --help', from the real captures =="
+grep -qE '^[[:space:]]+property-sets[[:space:]]' "$FIX/fix-help-v0.26.0.txt" && ok "v0.26.0 capture lists property-sets" || bad "v0.26.0 capture lacks property-sets"
+grep -q 'property-sets' "$FIX/fix-help-v0.25.0.txt" && bad "v0.25.0 capture lists property-sets" || ok "v0.25.0 capture does not list it"
+head -1 "$FIX/fix-property-sets-help-v0.25.0.txt" | grep -q "model-fixing tools" && ok "v0.25.0 'fix property-sets --help' is the parent's help (why it is not the probe)" || bad "capture shape changed"
+for v in v0.24.0 v0.25.0; do
+  P="$(mkproj old-$v)"; echo "$v" > "$P/.stub-ver"
+  OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
+  [ "$RC" -eq 3 ] && printf '%s' "$OUT" | grep -q "arrived in v0.26.0" && ok "$v: exit 3, says v0.26.0 is needed" || bad "$v: rc=$RC" "$OUT"
+  grep -q -- '--dry-run' "$P/.stub-log" && bad "$v: ran the dry-run on a binary without the command" || ok "$v: no dry-run attempted"
+done
+
+echo "== P2 clean model =="
+P="$(mkproj clean)"; echo clean > "$P/.stub-state"
+OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && printf '%s' "$OUT" | grep -q "ok    property sets: Checked 3 unit(s)" && ok "clean: exit 0 with the Checked line" || bad "clean: rc=$RC" "$OUT"
+R="$P/.claude/.property-sets-receipt"
+sed -n 1p "$R" 2>/dev/null | grep -q " clean " && sed -n 2p "$R" | grep -qx "mxcli: mxcli version v0.26.0 (2026-10-11T18:37:07Z)" \
+  && ok "receipt records result and mxcli version" || bad "receipt wrong" "$(cat "$R" 2>&1)"
+grep -qx '/.claude/.property-sets-receipt' "$P/.gitignore" 2>/dev/null && ok "receipt is gitignored (machine-local)" || bad "receipt not gitignored"
+grep -q -- 'property-sets -p .*/App.mpr --dry-run' "$P/.stub-log" && ok "the check is the --dry-run" || bad "dry-run not used" "$(cat "$P/.stub-log")"
+
+echo "== P3 units need completing =="
+P="$(mkproj needs)"
+OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && ok "needs: exit 1" || bad "needs: rc=$RC" "$OUT"
+printf '%s' "$OUT" | grep -q "WARN  property sets: 1 unit(s) need" && ok "needs: WARN with the count" || bad "needs: no WARN" "$OUT"
+printf '%s' "$OUT" | grep -q "NEEDS     0d6c3a3e" && ok "needs: unit row shown" || bad "needs: row missing" "$OUT"
+printf '%s' "$OUT" | grep -q -- "--fix-property-sets" && ok "needs: names the gated repair" || bad "needs: no repair hint" "$OUT"
+grep -v -- '--dry-run' "$P/.stub-log" | grep -q 'property-sets' && bad "needs: the check WROTE (ran without --dry-run)" || ok "needs: nothing written"
+
+echo "== P4 failed / error / no version — never clean =="
+for st in failed notfound noversion; do
+  P="$(mkproj st-$st)"; echo "$st" > "$P/.stub-state"
+  OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
+  [ "$RC" -eq 1 ] && ! printf '%s' "$OUT" | grep -q "ok    property sets" && ok "$st: exit 1, no ok line" || bad "$st: rc=$RC" "$OUT"
+done
+printf '%s' "$OUT" | grep -q "no Mendix version" && ok "noversion: says nothing was checked" || bad "noversion wording" "$OUT"
+
+echo "== P5 --if-stale: once per mxcli version =="
+P="$(mkproj stale)"; echo clean > "$P/.stub-state"
+"$DOCTOR" --property-sets --if-stale "$P" >/dev/null 2>&1
+n1="$(grep -c -- '--dry-run' "$P/.stub-log")"
+OUT="$("$DOCTOR" --property-sets --if-stale "$P" 2>&1)"; RC=$?
+n2="$(grep -c -- '--dry-run' "$P/.stub-log")"
+[ "$n1" -eq 1 ] && [ "$n2" -eq 1 ] && [ "$RC" -eq 0 ] && printf '%s' "$OUT" | grep -q "already checked" \
+  && ok "same mxcli: not re-run, exit from the receipt" || bad "same mxcli: n1=$n1 n2=$n2 rc=$RC" "$OUT"
+sed -i.bak '2s/.*/mxcli: mxcli version v0.25.0 (2026-10-05T09:18:28Z)/' "$P/.claude/.property-sets-receipt"
+"$DOCTOR" --property-sets --if-stale "$P" >/dev/null 2>&1
+n3="$(grep -c -- '--dry-run' "$P/.stub-log")"
+[ "$n3" -eq 2 ] && ok "mxcli changed since the receipt: re-run" || bad "after a version change n3=$n3"
+
+echo "== P6 two-tree checkout (.mpr under app/) =="
+P="$(mkproj twotree app)"; echo clean > "$P/.stub-state"
+"$DOCTOR" --property-sets "$P" >/dev/null 2>&1; RC=$?
+[ "$RC" -eq 0 ] && grep -q -- "-p $P/app/App.mpr --dry-run" "$P/.stub-log" && ok "checks app/App.mpr" || bad "two-tree rc=$RC" "$(cat "$P/.stub-log")"
+
+echo "== P7 --fix-property-sets writes only through exec.sh --patch =="
+P="$(mkproj fix-noexec)"
+OUT="$("$DOCTOR" --fix-property-sets "$P" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "FAIL  property sets: not repaired" && ok "no exec.sh: refused, exit 1" || bad "no exec.sh: rc=$RC" "$OUT"
+grep -v -- '--dry-run' "$P/.stub-log" | grep -q 'property-sets' && bad "no exec.sh: wrote anyway" || ok "no exec.sh: nothing written"
+mkdir -p "$P/bin"; printf '#!/usr/bin/env bash\n# pre---patch exec.sh\nexit 0\n' > "$P/bin/exec.sh"; chmod +x "$P/bin/exec.sh"
+OUT="$("$DOCTOR" --fix-property-sets "$P" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "upgrade-bin exec.sh" && ok "exec.sh without --patch: refused, names the upgrade" || bad "old exec.sh: rc=$RC" "$OUT"
+# An exec.sh with the --patch contract (project-bin/exec.sh: `bash <script> <model.mpr> [args...]`).
+cat > "$P/bin/exec.sh" <<'EX'
+#!/usr/bin/env bash
+# stub of the --patch contract; PATCH_MODE
+echo "exec.sh $*" >> .exec-log
+[ "$1" = --patch ] || exit 9
+shift; s="$1"; shift
+bash "$s" "$(pwd)/App.mpr" "$@"
+EX
+chmod +x "$P/bin/exec.sh"
+OUT="$("$DOCTOR" --fix-property-sets "$P" 2>&1)"; RC=$?
+grep -q -- "--patch $TK/bin/doctor.sh --property-sets-apply-step $P/mxcli" "$P/.exec-log" 2>/dev/null \
+  && ok "repair dispatched as exec.sh --patch doctor.sh --property-sets-apply-step <mxcli>" || bad "dispatch" "$(cat "$P/.exec-log" 2>&1)"
+grep -qx "fix property-sets -p $P/App.mpr" "$P/.stub-log" && ok "the patch step ran the write form on the model" || bad "write form" "$(cat "$P/.stub-log")"
+[ "$RC" -eq 0 ] && printf '%s' "$OUT" | grep -q "re-checking" && sed -n 1p "$P/.claude/.property-sets-receipt" | grep -q " clean " \
+  && ok "re-checked after the repair: clean, exit 0" || bad "post-repair rc=$RC" "$OUT"
+P="$(mkproj fix-clean)"; echo clean > "$P/.stub-state"; mkdir -p "$P/bin"; cp "$WORK/fix-noexec/bin/exec.sh" "$P/bin/"
+"$DOCTOR" --fix-property-sets "$P" >/dev/null 2>&1; RC=$?
+[ "$RC" -eq 0 ] && [ ! -f "$P/.exec-log" ] && ok "clean model: no repair dispatched" || bad "clean model dispatched a repair (rc=$RC)"
+
+echo "== P8 --quick compares the receipt with the installed mxcli =="
+P="$(mkproj quick)"; echo clean > "$P/.stub-state"
+OUT="$("$DOCTOR" --quick "$P" 2>&1)"
+printf '%s' "$OUT" | grep -q "WARN  property sets not checked for this mxcli" && ok "no receipt: WARN (exec.sh surfaces it)" || bad "no receipt" "$(printf '%s' "$OUT" | grep -i -A2 'property')"
+grep -q -- '--dry-run' "$P/.stub-log" && bad "--quick ran the model check" || ok "--quick did not run the model check"
+"$DOCTOR" --property-sets "$P" >/dev/null 2>&1
+OUT="$("$DOCTOR" --quick "$P" 2>&1)"
+printf '%s' "$OUT" | grep -q "ok    property sets: last check for this mxcli was clean" && ok "receipt current + clean: ok line" || bad "current receipt" "$(printf '%s' "$OUT" | grep -i -A2 'property')"
+echo needs > "$P/.stub-state"; "$DOCTOR" --property-sets "$P" >/dev/null 2>&1
+OUT="$("$DOCTOR" --quick "$P" 2>&1)"
+printf '%s' "$OUT" | grep -q "WARN  property sets: last check for this mxcli:.* needs " && ok "receipt says needs: WARN persists" || bad "needs receipt" "$(printf '%s' "$OUT" | grep -i -A2 'property')"
+
+echo "== P9 sync-project.sh runs the check, never the repair =="
+S="$WORK/syncp"; mkdir -p "$S"; : > "$S/App.mpr"
+MXTK_NO_GUIDE=1 "$TK/bin/init-project.sh" "$S" >/dev/null 2>&1
+[ -f "$S/CLAUDE.local.md" ] || { echo "FIXTURE ERROR: init did not scaffold $S"; exit 2; }
+mkstub "$S"; echo needs > "$S/.stub-state"
+OUT="$("$SYNC" "$S" --dry-run 2>&1)"
+printf '%s' "$OUT" | grep -q "Would run: bin/doctor.sh --property-sets --if-stale" && ok "--dry-run: says it would run the check" || bad "dry-run line" "$(printf '%s' "$OUT" | tail -5)"
+[ ! -f "$S/.stub-log" ] || ! grep -q property-sets "$S/.stub-log" && ok "--dry-run: did not run it" || bad "--dry-run ran mxcli"
+OUT="$("$SYNC" "$S" 2>&1)"; RC=$?
+[ "$RC" -eq 0 ] && printf '%s' "$OUT" | grep -q "WARN  property sets: 1 unit(s) need" && ok "plain sync: check runs, its WARN shown" || bad "plain sync rc=$RC" "$(printf '%s' "$OUT" | grep -i -B1 -A3 'property')"
+printf '%s' "$OUT" | grep -q "⚠️  property sets: Studio Pro's merge/diff can throw" && ok "plain sync: counted as a sync warning with the repair command" || bad "sync warning" "$(printf '%s' "$OUT" | grep -i 'property')"
+grep -v -- '--dry-run' "$S/.stub-log" | grep -q 'property-sets' && bad "sync wrote to the model" || ok "sync did not repair"
+n1="$(grep -c -- '--dry-run' "$S/.stub-log")"; "$SYNC" "$S" >/dev/null 2>&1; n2="$(grep -c -- '--dry-run' "$S/.stub-log")"
+[ "$n1" -eq "$n2" ] && ok "second sync, same mxcli: check not re-run" || bad "re-ran: $n1 -> $n2"
+
+echo "== P10 (#236) sync names a pre-fix bin/model-stamp.sh =="
+grep -v 'GIT_WORK_TREE' "$TK/project-bin/model-stamp.sh" > "$S/bin/model-stamp.sh"; chmod +x "$S/bin/model-stamp.sh"
+OUT="$("$SYNC" "$S" --dry-run --no-refresh 2>&1)"
+printf '%s' "$OUT" | grep -q "bin/model-stamp.sh is LOCALLY MODIFIED" && ok "pre-fix copy reported as modified" || bad "not reported" "$(printf '%s' "$OUT" | grep model-stamp)"
+printf '%s' "$OUT" | grep -q "predates the HOOK BLIND-SPOT fix.*--upgrade-bin model-stamp.sh --upgrade-bin _common.sh" && ok "known-fix note names the blind spot and both files" || bad "no HOOK BLIND-SPOT note" "$(printf '%s' "$OUT" | grep -A1 model-stamp)"
+{ cat "$TK/project-bin/model-stamp.sh"; echo "# local edit"; } > "$S/bin/model-stamp.sh"
+OUT="$("$SYNC" "$S" --dry-run --no-refresh 2>&1)"
+printf '%s' "$OUT" | grep -q "HOOK BLIND-SPOT" && bad "a fixed-but-edited copy got the note" || ok "a fixed-but-edited copy gets no note"
+
+echo ""
+echo "property-sets: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

From fc966d74107cb3b3e7c34333ca85c4b36a474d50 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 13:14:03 +0000
Subject: [PATCH 07/68] e2e: rewrite example.journey.json into the shape the
 runner reads

The shipped example had drifted from journey-runner.js: name/role instead
of id/persona, a `value` seed instead of `sql`, page/expectPage/
expectText/click instead of actions + ui.ready/textPresent, spans as an
array of {mf,status} (now a loud INVALID), and SQL-style
<module>$<entity> queries where the runner sends OQL. validate-journeys.js
reported 3 problems on it; now 0. All 7 positive-control mutants are
supported on it; journey-runner.selftest.js (which falls back to it) and
test-journey-preflight.sh (back-compat cases) pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                           |  2 +-
 project-tests/e2e/example.journey.json | 68 ++++++++++++++++++--------
 2 files changed, 48 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 802837f1..100899d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/project-tests/e2e/example.journey.json b/project-tests/e2e/example.journey.json
index 27cd39e9..f25e08f8 100644
--- a/project-tests/e2e/example.journey.json
+++ b/project-tests/e2e/example.journey.json
@@ -20,63 +20,89 @@
     "so a single good historical row carries the assertion. A data block that carries",
     "assocMustBeSet with no scope must be reported [WEAK EVIDENCE], never silently accepted.",
     "",
-    "Names below are placeholders. Replace <Module>/<Entity>/<Page> with your own."
+    "Names below are placeholders. Replace <Module>/<Entity>/<Widget>/<Microflow> with your own.",
+    "Every key here is one journey-runner.js reads (examples/validate-journeys.js reports 0",
+    "problems on this file). The field-by-field tour is skills/journey-examples.md.",
+    "Add \"persona\": \"<TEST_USER>\" when the journey proves one role's access path — a run signed in as anyone else records the journey INVALID and does not walk it."
   ],
-
-  "name": "Example",
-  "role": "<the persona who performs this journey>",
-  "goal": "One sentence in the user's language. Not 'the microflow succeeds'.",
-
+  "id": "J-EXAMPLE-01",
+  "title": "Example — open the overview, submit the form, see the row on its parent",
+  "requirement": [],
   "seeds": [
     {
       "name": "parentKey",
-      "$comment": "Referenced later as {{parentKey}}. Seeds are the only values a step may assume exist.",
-      "value": "EXAMPLE-0001"
+      "$comment": "Referenced later as {{parentKey}}. Seeds are the only values a step may assume exist; they are read from the live DB, never hardcoded. Every OQL column is aliased.",
+      "sql": "SELECT p.<KeyAttribute> AS k FROM <Module>.<Parent> AS p LIMIT 1"
     }
   ],
-
   "steps": [
     {
       "name": "Open the overview and see the seeded row",
-      "page": "<Module>.<Page_Overview>",
       "$comment": "rung 1 landing guard + rung 2 what the screen says. Without the guard an assertion grades the PREVIOUS page.",
-      "expectPage": "<Module>.<Page_Overview>",
-      "expectText": ["{{parentKey}}"]
+      "actions": [
+        {
+          "do": "nav",
+          "item": "<menu item title>"
+        }
+      ],
+      "ui": {
+        "ready": ".mx-name-<overviewGrid>",
+        "textPresent": [
+          "{{parentKey}}"
+        ]
+      }
     },
     {
       "name": "Submit the form",
-      "click": "<button label or selector>",
-      "$comment": "rung 3 ordered spans, rung 4 data effects. An empty span list is a fault, never a pass — [].every() is true.",
-      "spans": [
-        { "mf": "<Module>.<Microflow>", "status": "OK" }
+      "$comment": "rung 3 ordered spans, rung 4 data effects. A capture with zero spans is a fault, never a pass — [].every() is true. A step whose only proof is that something did NOT run declares mustNotFire alone (plus spans.liveness); see journey-examples.md.",
+      "actions": [
+        {
+          "do": "click",
+          "widget": "<btnSubmit>"
+        }
       ],
+      "ui": {
+        "ready": ".mx-name-<detailView>"
+      },
+      "spans": {
+        "ordered": [
+          "<Module>.<Microflow>"
+        ],
+        "mustNotFire": [
+          "<Microflow that must not run, e.g. a delete>"
+        ]
+      },
       "data": {
         "creates": "<Module>.<Entity>",
         "delta": 1,
-        "scope": { "newRowsBy": "id" },
+        "scope": {
+          "newRowsBy": "id"
+        },
         "assocMustBeSet": [
           {
             "entity": "<Module>.<Entity>",
             "assoc": "<Module>.<Entity>_<Parent>",
             "target": "<Module>.<Parent>",
-            "mustPointAt": { "attr": "<KeyAttribute>", "value": "{{parentKey}}" }
+            "mustPointAt": {
+              "attr": "<KeyAttribute>",
+              "value": "{{parentKey}}"
+            }
           }
         ],
         "oql": [
           {
             "label": "the new row exists and is not a draft",
-            "sql": "SELECT COUNT(*) AS n FROM <module>$<entity> WHERE status <> 'Draft'",
+            "sql": "SELECT COUNT(e.ID) AS n FROM <Module>.<Entity> AS e WHERE e.<Status> != 'Draft'",
             "atLeast": 1
           }
         ]
       }
     }
   ],
-
   "outcome": {
     "$comment": "rung 5. The thing the user actually came for, asserted once, in their terms.",
     "label": "the parent shows the submitted row",
-    "sql": "SELECT COUNT(*) AS n FROM <module>$<entity> e JOIN <module>$<parent> p ON e.parent_id = p.id WHERE p.<keyattribute> = '{{parentKey}}'",
+    "sql": "SELECT COUNT(e.ID) AS n FROM <Module>.<Entity> AS e WHERE e/<Module>.<Entity>_<Parent>/<Module>.<Parent>/<KeyAttribute> = '{{parentKey}}'",
     "atLeast": 1
   }
 }

From dc951263f2e25006e26d01bfd2958f227cdfa5ed Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:17:59 +0000
Subject: [PATCH 08/68] chore(context): free baseline word budget without
 dropping rules

The always-on baseline tier counted by bin/render-routing.sh --check was
at 79,735 of its 80,000-word cap. This frees 3,772 words (now 75,964)
by moving narrative and setup-only text out of baseline files, keeping
every rule, STOP, denominator and gate cell in place, each rule still
paired with a one-line failure example plus a pointer to the full text.

- conversion-runbook.md, source-triage.md, interview-protocol.md: long
  incident narratives -> one line + pointer; originals verbatim in new
  on-demand process/baseline-incident-history.md (R1-R20, AR1, ST1-ST4,
  IP1-IP3). Runbook's duplicate open-questions status table now defers
  to interview-protocol.md section 4.
- agent-roles.md: the six template shapes (setup-only) moved to
  agents/README.md, which installers never copy (explicit MXTK_AGENTS).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                         |   1 +
 agents/README.md                     | 258 +++++++++++++++++++++++++
 process/baseline-incident-history.md | 270 +++++++++++++++++++++++++++
 skills/agent-roles.md                | 262 ++------------------------
 skills/conversion-runbook.md         | 122 ++++--------
 skills/interview-protocol.md         |  34 ++--
 skills/source-triage.md              |  57 ++----
 7 files changed, 607 insertions(+), 397 deletions(-)
 create mode 100644 agents/README.md
 create mode 100644 process/baseline-incident-history.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b46921d3..982e7f1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/agents/README.md b/agents/README.md
new file mode 100644
index 00000000..e5b9b46c
--- /dev/null
+++ b/agents/README.md
@@ -0,0 +1,258 @@
+# Agent template shapes — illustrative bodies for the six dev-process agents
+
+**Not an agent.** This file is documentation that sits next to the six stubs; the installers copy
+the named list in `bin/lib/install-manifest.sh` (`MXTK_AGENTS`), never a glob over this folder, so
+it is never installed into a project's `.claude/agents/`.
+
+**Read it at setup only** — when completing a stub per `skills/agent-roles.md` → "How to generate
+these for a new project". The shipped stubs (`agents/<name>-agent.md`) are what `bin/init-agents.sh`
+copies and what `bin/sync-project.sh` refreshes; where a stub and a shape below disagree, the stub
+wins. The shapes are kept because they state the role's rules compactly (for example ba-agent's
+extraction vs translation mode, and which half of a module brief each role writes).
+
+Moved out of `skills/agent-roles.md` (2026-10-13; verbatim except the `model:` lines, which now name the tier and defer to the stub that pins it) so the always-on baseline does not carry
+setup-time text every session (CLAUDE.md skill-authoring rule 6).
+
+## Template shapes (adapt, don't copy verbatim)
+
+### ba-agent
+```
+---
+name: ba-agent
+description: "Owns discovery, interview gates, AND per-module briefs for {{PROJECT}} (conversion-runbook.md Stages P, 0-2, 4, 7). Two modes: EXTRACTION (P-2, no spec yet -> produce BRDs) and TRANSLATION (Stage 4 -> turn validation-clean BRDs into module briefs). Use for intake, triage, requirements, any proposal-with-evidence interview, and authoring module briefs."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You run discovery, the interview gates, and module-brief authoring for {{PROJECT}}. You never touch the `.mpr` and never run `mxcli exec` — you produce decisions and records, not model changes.
+
+**Paths:** resolve all project paths (KB, BRDs, wireframes, briefs, architecture, stage HTML) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
+
+## Your two modes
+- **Extraction (Stages P–2):** no spec exists yet. Produce BRDs from source/SME via the interview protocol.
+- **Translation (Stage 4, per module):** BRDs exist. Turn them into a **module brief** (`architecture/modules/<Module>/module-brief.md`, per `module-brief.md`) — the `mdl-agent`'s single entry point. **Having BRDs does not mean your job is done** — translation is the second half. If briefs don't exist, this mode was skipped.
+
+## Ground rules
+- Follow `query-the-model.md` before asking anything: check the KB/source, the current Mendix model (via a query, not the BRD), and only ask the user the part that's a genuine decision.
+- Run the full interview protocol from `conversion-runbook.md` §1 at every gate: homework first, 2-4 options with evidence, assumptions stated out loud, user answers in the terminal, decision written to the stage HTML *and* `PROJECT.md`, unknowns default + `ASSUMED` + proceed.
+- Never invent legacy intent from code alone — that's what Path C (the SME interview) is for. Log it as an open question if no SME is available, don't guess.
+- `✋` gates (Stage 0 Triage) do not resolve to `ASSUMED` — they need an explicit `CONFIRMED` answer before the run proceeds.
+- **Module briefs (translation mode):** you own the brief file and write the business layer (roles/journeys, screens-per-role, the access table, field-level validation, edge cases, open questions). Pull `architect-agent` for the technical layer (domain summary, write-mode plan, cross-module deps). Point to source artifacts — never duplicate wireframe or domain-model content into the brief. Produce briefs just-in-time (module N after N−1 gates), not all upfront.
+
+## Workflow (extraction / gate mode)
+1. Identify which stage's gate you're running (from `conversion-runbook.md` §2).
+2. Do the homework: read {{KB_PATH}}, {{SOURCE_PATH}}, and query the live model if the question touches it.
+3. Draft the proposal (options + evidence + assumptions) and the stage HTML surface at {{STAGE_HTML_PATH}}.
+4. Ask the user; record the answer in {{STAGE_HTML_PATH}} and `PROJECT.md` as `CONFIRMED`, or apply the recommendation and mark it `ASSUMED` with the risk if the user has no answer yet (non-✋ gates only).
+5. Update `PROJECT.md`'s open-questions register.
+
+## Workflow (translation mode — authoring a module brief)
+1. Read `module-brief.md` for the format and ownership rules.
+2. Read the module's BRDs, wireframes, and the build-plan access-table slice. Query the live model for exact names.
+3. Write the business layer of `architecture/modules/<Module>/module-brief.md`; request the technical layer from `architect-agent`.
+4. Run the brief's ready-check. Any unresolved item stays an open question the `mdl-agent` must escalate — do not paper over it.
+
+## Report back
+Which gate or brief you produced, the decision(s) recorded, which are `CONFIRMED` vs `ASSUMED`, and what's still open.
+```
+
+### architect-agent
+```
+---
+name: architect-agent
+description: "Owns Stage 3 (Architecture & Design) and Stage 4 (Build Plan) for {{PROJECT}} — module boundaries, blueprint, fit-gap, build plan. Use once BRDs are validation-clean. Never touches mxcli."
+model: <strong tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You own architecture and build-plan decisions for {{PROJECT}}. Hard rule: you never run `mxcli exec` and never write MDL — that's `mdl-agent`'s job, downstream of your build plan.
+
+**Paths:** resolve all project paths (BRDs, architecture, design, briefs, build plan) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
+
+## Ground rules
+- Follow `modularize-domain.md`'s boundary criteria; default to one module + folders unless a candidate clears >=1 criterion.
+- Run the Stage 3/4 interview gates from `conversion-runbook.md` §2 — module boundaries, buy/build/stub per fit-gap item, target security model, data volumes/NFRs, integration contracts, branding, acceptance criteria, environment/DTAP. These are `✋` gates: no `ASSUMED` past them, only `CONFIRMED`.
+- Query the live model (`query-the-model.md`) before referencing any marketplace module in the build plan — `SHOW ENTITIES IN <module>` first, always.
+- **Module briefs — you contribute the technical layer when `ba-agent` requests it** (`ba-agent` owns the file and drives; see `module-brief.md`). Your layer: domain summary (pointer to the domain MDL for exact names, not a copy), the write-mode plan per element (CLI / MCP+MDL / hand-rolled MCP, per `learned-mdl-preflight.md` Step 0), cross-module dependencies, stub-vs-real integrations, and any arch constraint that applies to this module. Point to source artifacts; never duplicate them into the brief.
+
+## Workflow
+1. Read the validation-clean BRDs and any existing `architecture/`, `design/` artifacts.
+2. Propose module boundaries / fit-gap decisions with evidence; run the interview protocol.
+3. Write `.mx-brd.json`, `architecture/` (blueprint, wiring diagrams, fit-gap.md), and once approved, `architecture/build-plan.md` — numbered, dependency-ordered.
+4. Record every decision in `PROJECT.md`.
+
+## Report back
+Boundaries/decisions proposed vs. confirmed, the build plan's pending-decisions count, and anything still blocking Stage 5.
+```
+
+### mdl-agent
+```
+---
+name: mdl-agent
+description: "Drafts and syntax-validates mxcli MDL scripts for {{PROJECT}}. Use when a microflow/page/domain-model script needs to be written or fixed, before it's executed against the real .mpr."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You write MDL scripts for {{PROJECT}}. You draft and validate — you never execute against the real `.mpr`.
+
+## Paths — read the Wiring block, don't hardcode them here
+All project paths (MPR, `mdlsource/`, module briefs, wireframes, design system, StyleGallery,
+architecture, build plan, BRDs) live in the **`## Wiring` block of the project-root `CLAUDE.local.md`** —
+the single source of truth. Read it at the start of every task and resolve paths from it. When a rule
+below names an asset ("the wireframe", "the brief"), it means the path from that block.
+
+## Ground rules
+This file is a **router**: the detailed rules live in the skills it names — open them, don't rely on
+this summary. The hard STOPs below are inline on purpose; never route around them.
+
+- **Read the module brief first — your single entry point.** Read the module's brief (briefs path in
+  the Wiring block; format in `module-brief.md`): roles/access, screens, validation, write-mode plan,
+  pointers. **No brief → STOP and report** — a missing brief means `ba-agent` translation mode was
+  skipped; do not synthesize the module from raw BRDs yourself.
+- **An unchecked open question in the brief is a stop sign.** If one touches what you're building,
+  surface that specific question to the main session (for `ba-agent`) — never fill it from training data.
+- Business rules come from the brief and {{BUSINESS_RULES_SOURCE}}; read the domain-model script
+  (Wiring block) for exact, case-sensitive names. Don't guess names or rules.
+- **Write mode, per operation, up front:** run `learned-mdl-preflight.md` Step 0 — the default is the
+  CLI through `bin/exec.sh`; its STOP table overrides that for operations mxcli corrupts or cannot
+  express, which go to Studio Pro by hand. State the mode per op in your report, and flag any op that
+  needs Studio Pro so the main session sequences the handoff.
+- Annotate selectively (`learned-microflow-patterns.md`); always annotate a CE-error fix.
+- **Pages/snippets — run the full pre-flight in `ui-preflight-pages.md`** (wireframe → tokens →
+  gallery reuse → cross-check) and include its UI cross-reference block in your report. **No wireframe
+  → STOP** — do not guess layout or bindings. Reuse existing gallery components; don't reimplement
+  them as plain text.
+- **Complex microflows:** confirm alignment against the brief's technical layer + the architecture
+  blueprint (Wiring block) before drafting. Report any mismatch.
+- **Grants co-located** with the element (per the brief's access table): `grant execute` ends the
+  microflow script, `grant view` ends the page script, entity grants end the domain script.
+
+### Trivial-change fast path
+For a genuinely mechanical script — a forward-reference stub, an added enum value, a rename, a
+constant, a pure domain-attribute add with no page — skip the UI pre-flight and per-page review
+(there's no rendered surface to verify). Still required: read the brief for names, the
+`learned-mdl-preflight.md` STOP check, `mxcli check`, and the mxbuild gate. Anything that adds/alters
+a page, widget, or user-facing microflow is **not** trivial — treat as full-discipline when unsure.
+
+## Workflow
+1. **Read the `## Wiring` block** in the project-root `CLAUDE.local.md` — resolve all paths from it.
+2. **Read the module brief** (briefs path from Wiring) — if missing, STOP and report.
+3. Read the task spec (which elements this build unit covers) against the brief.
+4. Read the necessary skill file(s) and existing MDL for exact names (the brief points to them).
+5. For pages/snippets: locate the wireframe (named in the brief) — if missing, STOP. Then complete `ui-preflight-pages.md` in full.
+6. For complex microflows: confirm alignment against the brief + architecture blueprint.
+7. Write the script to the requested path (under the mdlsource dir from Wiring) — grants co-located.
+8. Run `mxcli check <path> -p <MPR from Wiring> --references` and iterate until clean.
+8a. **Log the dispatch** (discharges the `dispatch` obligation, `bin/lib/obligations.tsv`): under the
+    project root, `mkdir -p .claude/loop/dispatch/<Module>/` (Module from the brief) then append one
+    TAB-separated line to `.claude/loop/dispatch/<Module>/scripts.tsv`:
+    `<date>	<script path from step 7>	<check result from step 8>` — date as `YYYY-MM-DD`. This is the
+    only record that this module's scripting went through mdl-agent's preflight rather than being
+    drafted in the main session; it owes no denominator, just the line.
+9. Do NOT run `mxcli exec` — that stays in the main session under the user's confirmation.
+
+## Report back
+Plain-language summary of what the script does, the file path, the check result, and any open questions or unverified-syntax risks. For page scripts, include the full UI cross-reference block.
+```
+
+### gate-agent
+```
+---
+name: gate-agent
+description: "Runs {{PROJECT}}'s build/quality gates after a script has been executed against the .mpr, and reports pass/fail with a digested error list. Use after any mxcli exec, not before."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You verify {{PROJECT}} after changes have already been applied to the `.mpr`. Read-only / verification-only — never write files, never run `mxcli exec`.
+
+## Gates to run (in order)
+1. **Model check**: {{MODEL_CHECK_COMMAND}}. Expect 0 CE errors.
+2. **Compile gate** (if applicable): {{COMPILE_GATE_COMMAND}}.
+3. **Lint, always**: read the lint cell `bin/exec.sh` wrote into the BUILD-LOG row (it runs
+   `bin/lint-gate.sh` after every clean mxbuild); a `LINT ROSE` cell fails the script. Re-run
+   {{LINT_COMMAND}} only for the per-document list. Never re-baseline to make a row green.
+
+## Known gotchas
+{{PROJECT_SPECIFIC_GOTCHAS — e.g. stale .mpr.lock files, access-grant drops after CREATE OR REPLACE, stale proxy folders after a module rename}}
+
+## Report back
+Pass/fail per gate, the exact error list if any, and whether failures match a known-gotcha pattern. Terse — a status report, not a narrative.
+```
+
+### test-agent
+```
+---
+name: test-agent
+description: "Walks happy-path and edge-case UI tests against the running {{PROJECT}} app and reports pass/fail per scenario. Use after a gate-agent pass, once a feature is expected to be clickable end-to-end."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You test {{PROJECT}}'s running UI. Verification-only — never edit MDL, never touch the `.mpr`, never run `mxcli exec`.
+
+## Before you start
+- Read {{TEST_SETUP_SKILL_REFS}} for this project's exact test setup (demo user, how the app is started, DB assertion pattern).
+- Confirm the app is actually running before testing; if it isn't, that's a blocker to report, not something to silently work around.
+
+## Workflow
+1. Take the scenario list you were given.
+2. Log in as {{DEMO_USER}}, not the admin account, unless the scenario specifically calls for admin.
+3. Walk each scenario step, capturing what happened.
+4. Cross-check state-changing results against the database rather than trusting the UI alone.
+
+## Report back
+Per-scenario pass/fail, the exact failing step (if any) with expected vs. observed, and any UI/data mismatches. Don't narrate every click.
+```
+
+### review-agent
+```
+---
+name: review-agent
+description: "Closes a module in {{PROJECT}}: runs the model-side review instruments, then LOOKS at every page in the module and says whether it is logical, whether it looks right, and whether it matches the design. Use when a module's build and gate stages are done. Diagnostic only — never fixes anything."
+model: <mid tier — copy the alias the shipped stub pins>
+tools: Read, Grep, Glob, Bash
+---
+
+You run `skills/module-review.md` for {{PROJECT}}. Read that skill in full before you start; this
+file only tells you where things are.
+
+## What you own
+Stage 3's model-side instruments, and **stage 4 — the LOOK**. Stage 4 is the reason you exist.
+Stages 1–3 are already covered by mdl-agent, gate-agent, test-agent and `bin/verify-module.sh`;
+none of them can answer "is this screen logical, does it look right, does it match our design",
+and a module has repeatedly shipped broken because nobody asked.
+
+## The page set is every page in the module
+```
+{{MXCLI}} -p {{MPR}} -c "SHOW PAGES IN <Module>"
+```
+Not the pages a journey visited. A page no test touches is the highest-risk page in the module.
+Report the denominator: `12 of 12 pages reviewed`, never "reviewed the module".
+
+## Order
+1. `bin/verify-module.sh <Module>` results — read them, do not re-run them.
+2. `node tests/e2e/design-audit.js` — the mechanical sweep (classes, a11y, overflow). Where it
+   and your eye overlap, it wins.
+3. **Then look**, page by page, per module-review.md §4c/§4d/§4e. Navigate via the nav menu or a
+   button, never a direct URL.
+4. Write the report to `design/ui-reviews/ui-review-<YYYY-MM-DD>.html` and append every P1/P2 to
+   `docs/improvement-register.md`.
+
+## When an input is missing, you assess anyway
+A missing wireframe, an absent design system, an uninstalled `design-audit.js`, a module with no
+brief — none of these is permission to skip a page. Follow module-review.md's
+**"Degrade to judgement, never to silence"** table: name what is missing, name what you assessed
+against instead, and still deliver a verdict per page. Reduced fidelity is reported as reduced
+fidelity. It is never reported as a pass, and never reported as nothing.
+
+## You never fix
+No MDL, no `mxcli exec`, no edits to the model or the theme. You have no Write or Edit tool. End
+by asking which P1/P2 findings should be fixed — the fix routes back through mdl-agent.
+
+## Project specifics
+- MPR: {{MPR}} · app URL: {{APP_URL}} · demo user: {{DEMO_USER}}
+- Wireframes: {{WIREFRAME_DIR}} · design system: {{DESIGN_SYSTEM}} · StyleGallery: {{STYLEGALLERY}}
+- All of the above resolve from the `## Wiring` block of `CLAUDE.local.md` — read it at task start.
+```
diff --git a/process/baseline-incident-history.md b/process/baseline-incident-history.md
new file mode 100644
index 00000000..9a3fe133
--- /dev/null
+++ b/process/baseline-incident-history.md
@@ -0,0 +1,270 @@
+# Baseline incident history — the full stories behind the always-on rules
+
+**Read on demand, never at session start.** The always-on (baseline) skills state each rule
+with a one-line failure example and a pointer here. This file holds the long form: the
+incident narratives, measurements and design history that used to sit inline in those skills,
+moved verbatim so the evidence survives while the baseline stays inside the
+`bin/render-routing.sh --check` word budget (CLAUDE.md skill-authoring rule 6, "write for the
+trigger, then stop").
+
+Each section id (`R1`, `AR2`, …) is what the pointer in the skill cites. The section text is
+the original wording, unedited — when a rule's justification is challenged, cite from here.
+Nothing in this file is a rule on its own; the rule lives in the skill that points here.
+
+## R1 — Entry-mode misrouting incidents
+
+_From `skills/conversion-runbook.md`._
+
+(Real misrouting incident, 2026-07-14: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate," proposing to skip 0–4 — exactly what rules 2–3 exist to prevent. Second incident, 2026-09-22: `intake.md` Q1 offered only three modes, so a session changing a live app could not pick the fourth even though `gate-check.sh` already recognised it — rule 1 and the table row below are the fix.)
+
+## R2 — Why Stage 0 runs in every entry mode (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+This distinction was implicit until 2026-08-20, when a customer round made the cost of leaving it
+implicit measurable. A project whose source was markdown files plus database tables was classified
+requirements-driven — reasonably, given the rules above. The mode's row then said "skip 0", so
+Stage 0 was skipped **whole**: no source characterisation, no `analysis/` folder, no triage
+artifact, and — the expensive one — **no scope conversation**, because CAC-1 fires after Stage 0
+and Stage 0 never ran. Extraction was then run anyway and pulled in far more than the subsystems
+under discussion, which nothing downstream was positioned to notice: Stage 2's gate checks that
+BRDs are *validation-clean*, and a hundred clean BRDs describing things nobody asked for pass it.
+
+## R3 — Why the docs-ready path exists (2026-09-09)
+
+_From `skills/conversion-runbook.md`._
+
+**Why this path exists (2026-09-09).** A project of exactly this shape was slow and token-hungry
+through Stages 1–4, for measured reasons: every session read the raw HTML (3–10× the tokens of
+its text), and the ledger asked for one disposition per file — every sidecar `.png`, `.css` and
+`.js` included — for a corpus nothing extracts. Nothing below skips a gate; it names the shortest
+honest route through them, and every command here was run against the gates before it was written.
+
+## R4 — The accumulated open-questions stream that rotted (2026-08-12)
+
+_From `skills/conversion-runbook.md`._
+
+**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks. But the pipeline generates a second stream all the time: every `openQuestions` entry a BRD records, every row added to `analysis/sme-questions.md`. Those were never wired to anything, and they rotted. Measured on one real project (2026-08-12): 46 rows in `sme-questions.md` against 7 mentions of an answer, ~35 unresolved BRD `openQuestions`, one status reading *"Open — routed to sme-questions.md F1/F2"* — routed to a file nobody opens. Several were not merely unasked but already **decided**: *"ASSUMED drafting position (a), hardcode — taken to keep this BRD buildable… NOT a settled product decision"* is a real product choice (hardcode vs. build a configurable rules engine) taken unilaterally and never shown to anyone. And 23 distinct free-text status strings meant nothing could count them, which is why nothing ever surfaced them.
+
+## R5 — Attended run with no questions (2026-07-14)
+
+_From `skills/conversion-runbook.md`._
+
+(Real incident, 2026-07-14: an attended run produced architecture diagrams and a design system through Stage 3 without a single question reaching the user — "a solo run never stalls" was read as "never ask." It means "an *authorized* solo run doesn't deadlock," nothing more.)
+
+## R8 — Settled change routed through three subagents (2026-07-23)
+
+_From `skills/conversion-runbook.md`._
+
+(Real incident, 2026-07-23: a "flip 2 entities to persistent + add 2 new entities" change — already fully settled in conversation — was routed through ba-agent twice and architect-agent once, ~270k combined tokens, for what was fundamentally a handful of document edits. The user called it out directly. The fix isn't skipping the record, it's skipping the dispatch when there's nothing left to decide.)
+
+## R9 — Gate script never run through a full Stage 5 (2026-09-19)
+
+_From `skills/conversion-runbook.md`._
+
+**Why (measured, 2026-09-19, two field builds of the same app).** A full Stage-5 build closed with all seven screens built, a green mxbuild
+   gate, and 11 of 37 acceptance rows confirmed. `gate-check.sh` had run exactly once, at
+   scaffold time. The `look` obligation, the wiring sweep, journeys and coherence were all
+   `PENDING` and nobody saw it, because nothing asked. When the gate was finally run as a
+   deliberate second pass, the seven screens scored 0, 18, 40, 40, 58, 58 and 69 percent against
+   their own wireframes on an element checklist — one screen matched none of its wireframe's
+   elements at all. Every one of those defects was visible to a gate that never ran.
+
+## R10 — Why dispatch is written down (2026-09-14)
+
+_From `skills/conversion-runbook.md`._
+
+**Why this is written down (2026-09-14).** The six agent stubs have carried model tiers since
+they were generated (`architect-agent` on the strong tier, the other five on the mid tier), and
+§2's Owner rows name who is accountable for each stage. Nothing said *when* the main session
+hands work over — so in the token-path A/B (nine runs, Stages P–4) the main session did nearly
+everything itself, at its own model's price, and only two skills (`brd-generation.md`,
+`image-transcription.md`) ever asked for a fan-out. Owner is accountability; this table is the
+runtime rule.
+
+## R12 — Checkpoints named nowhere in the runbook (until 2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+**Every stage transition has a packaged checkpoint. Here is where they attach.** The `skills/checkpoints/`
+CAC files run the §1 interview protocol at the busiest transitions; they write to `PROJECT.md`,
+never to a separate state file. Until 2026-08-20 this runbook — the file every session is required
+to read — **named none of them**, and they were reachable only from `skills/migration-pipeline.md`.
+A requirements-driven session never loads that skill, so it never fired a single checkpoint, and
+CAC-1's scope brainstorm silently did not exist outside migration mode. Checkpoints are wired to
+*stages* here, not to pipeline phases, precisely so that a project running no pipeline still gets
+them.
+
+## R16 — Grade before inventory: a rubric question instead of a scope conversation (2026-08-19)
+
+_From `skills/conversion-runbook.md`._
+
+Doing this out of order is a real, reported failure (2026-08-19): a Stage 0 run on a four-file
+documents-only corpus produced a correct ten-dimension grade and then asked the user a closed,
+rubric-shaped gate question — because the grade was the only artifact in front of it. The
+instruction to present a source map already existed here; nothing produced the map, so the agent
+asked what the tooling gave it something to ask about.
+
+## R17 — Documents plus a database misrouted as prose (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+(The paragraph below followed "Does not apply stops at the extraction rows" and restated the rule of the preceding "Decide that on evidence" paragraph; it was merged into that paragraph.)
+
+**A source that is documents plus a database is not a documents-only source.** A schema, a table
+dump, or an ORM model file is extractable structure and grades as such — the presence of markdown
+alongside it does not downgrade it. This is the shape that misroutes most often in presales
+(2026-08-20): the corpus *reads* like requirements, so it gets treated as prose, and the entities
+that were sitting right there in the schema get re-derived by hand later.
+
+## R18 — Why CAC-1b exists: extraction over-reach (2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+**Closes with CAC-1b** (`skills/checkpoints/checkpoint-extraction.md`) — the scope-out
+confirmation. It is a checkpoint you run, not a gate that stops you, and the reason is worth
+keeping in front of you.
+
+Stage 0 confirms scope *in*: what we intend to cover. It cannot confirm scope *out*, because
+nobody knows what extraction will actually produce until it has produced it. On the customer round
+that prompted this, extraction ran across the whole corpus rather than the subsystems under
+discussion, and the over-reach was invisible until modules were being built — every downstream
+gate measured *quality*, and the output was perfectly good BRDs about the wrong things. A
+validation-clean BRD for a subsystem nobody asked for is a clean pass at every remaining gate in
+this runbook.
+
+So before any BRD is written: put the extraction result next to the Stage 0 scope decision, name
+the delta, and get a decision on it. Do it before the BRDs rather than after — writing them first
+makes narrowing feel expensive, which is exactly when people stop narrowing.
+
+**Nothing enforces this and nothing should.** A script can only check that a `CONFIRMED` row
+exists in `PROJECT.md`, and an agent can type that row without asking anyone — so the check
+cannot tell the conversation from the string, which is the only thing worth telling apart. (A
+blocking version of this gate existed for part of 2026-08-20 and was removed the same day; see
+`skills/skills-over-scripts.md`.) If the checkpoint gets skipped, run it late against the BRD set
+you already have — with the extraction report in hand you can see what actually came out, which
+is better input than the triage map ever was.
+
+## R19 — Stage 1 surface history (until 2026-08-20)
+
+_From `skills/conversion-runbook.md`._
+
+Until 2026-08-20 this was `node generate-report.js` inside each pipeline, so requirements-driven and greenfield projects could not produce the file their own Stage 1 gate requires, despite this row promising it.
+
+## R20 — Stage 2 surface history (until 2026-08-19)
+
+_From `skills/conversion-runbook.md`._
+
+Until 2026-08-19 this was `enrichment-summary.html`, built three times inside three pipelines against three different BRD key shapes — each copy rendered blanks for the other two’s output, and non-migration projects got no surface at all despite this row promising one.
+
+## AR1 — "Five" agents, and the review that never looked (2026-08-20)
+
+_From `skills/agent-roles.md`._
+
+> **This file said "five" until 2026-08-20, and that cost the review.** `review-agent` — the owner
+> of `module-review.md` stage 4, the LOOK — has been scaffolded by `bin/lib/install-manifest.sh`
+> and routed to its skills for some time, but this file never listed it. So every session that set
+> agents up "per `agent-roles.md`" completed five, left the sixth an inert stub, and then ran a
+> module review with no configured owner for the one stage that finds the escaped defects.
+> Measured consequence: an end-to-end run that executed journeys, DB/OQL assertions and the monkey
+> pass, reported them, and never looked at a single page. **The count is load-bearing. It is six.**
+
+## ST1 — "Already used as triage input" — the deck nobody read (2026-09-02)
+
+_From `skills/source-triage.md`._
+
+> **A claim that another document already handled a file is a claim to verify, not an
+> answer.** Real incident, 2026-09-02, a VBA migration: intake Q4 ("documents not yet accounted
+> for?") was closed with *"the .pptx is already inside `source/` and was already used as triage
+> input by the Group A–D triage pass"*. The triage was derived from the `.cls` exports and never
+> named the deck; its 22 diagrams — the only place the workflow engine's X/M/E semantics were
+> written down — went unread for two months of BRDs, blueprint and build plan, and a `CONFIRMED`
+> architecture decision had to be reversed. The wrong answer *reads* right because it cites a
+> document. The right form is the ledger's: **name the artifact, and let the gate grep it.** A
+> text read of a deck is not the deck either — a 25-slide, 22-image container is consumed when
+> the disposition says `--pages 25 --media 22`, not when its title appears in a summary.
+
+## ST2 — Mixed corpora routed wholesale down the document path
+
+_From `skills/source-triage.md`._
+
+Mixed corpora are where this goes wrong, and they are the normal case in presales. The folder
+*reads* like requirements, so the whole thing is sent down the document path (`kb-generation.md`,
+Path B) and comes back as prose — including the entities that were sitting in the schema, which
+then get re-derived by hand three stages later. Prose is the right reading method for prose and
+the wrong one for structure. Choosing per artifact is this step's job; routing a whole corpus by
+how it looks at a glance is the failure it exists to prevent.
+
+## ST3 — Field evidence for read-vs-parse: one export, one spec, one inventory (2026-09-07)
+
+_From `skills/source-triage.md`._
+
+**Field evidence, 2026-09-07** — a no-code app replacement whose corpus was one data export
+(`.ods`), one 3.5 MB reverse-engineering spec (`.html`) and one workflow inventory (`.md`):
+
+- The **export parser corrected the documents written about it**: 53 stored columns against
+  128–175 documented (~120 are computed in the platform — neither attributes to model nor data to
+  migrate), four different spellings of one foreign key across four sheets, 15 sheets where the
+  spec documented 17, plus per-sheet volumes. No reading of any document produces one of those.
+- A **regex classifier over the spec's prose scored ~50% precision and ~50% recall** against a
+  user-confirmed sample, and was deleted the same day. It read the spec's "what the recording
+  covered" bullets as requirements, truncated sentences at inline HTML tags, and matched none of
+  the negative-form statements ("there is no role model", "no reminders, no escalation") that
+  carried some of the sharpest requirements in the document. The same agent's plain read of the
+  same file, at intake, was better in one pass.
+- The user's question is the rule in one line: *"do we need an extractor for html & md files?
+  Can't we just analyse and conclude what it should be? But when it's ppt and images better yes?"*
+
+## ST4 — Why "both, not either" is spelled out (2026-09-07)
+
+_From `skills/source-triage.md`._
+
+**Why this is spelled out (2026-09-07).** `conversion-runbook.md`'s Stage-0 applicability table
+said the extraction call was **`N/A` for requirements-driven**, flatly — while this skill and the
+shipped `triage.md` header said `N/A` only where the corpus holds no extractable structure, "on
+evidence, never on the entry-mode label". The runbook is the file every session is required to
+read first, so the unconditional version was the one that got followed. On the project that
+surfaced it — requirements-driven, corpus of one spec, one workflow inventory and **one platform
+data export** — following the runbook literally would have marked extraction `N/A` and left the
+export unparsed. That parser went on to correct the very documents written about the app: 53
+stored columns against 128–175 documented, four spellings of one foreign key across four sheets,
+15 sheets where the spec said 17. Same shape as the `toolkit-guide.html` first-touch incident in
+`CLAUDE.md`: a rule stated conditionally in its owning file and unconditionally in the front
+door, where the front door wins. The runbook now defers here.
+
+## IP1 — Branding question batch-approved as a recommended default (2026-08-19)
+
+_From `skills/interview-protocol.md`._
+
+*Real incident, 2026-08-19 (PROJECT-B).* "Are there branding inputs?" went in as line 7
+of a seven-item Stage 3 gate batch, carrying the recommended default *"no branding assets
+provided — use Atlas defaults."* The user approved the batch. There was in fact a real art
+direction — top-bar layout, industrial look, grey background, cool colours, the client wordmark in
+the shell — and a WCAG 2.1 AA target, and neither had ever been asked for. Both surfaced only
+when the user challenged the finished design system and asked why nobody had checked. The
+question had been treated as a `gap`. The recommendation was the entire defect: it converted
+"I don't know" into "I've decided", and a batch approval swallowed it.
+
+## IP2 — "AskUserQuestion doesn't seem installed" — the Copilot dry run (2026-08-19)
+
+_From `skills/interview-protocol.md`._
+
+*Why this is spelled out (real incident, 2026-08-19).* A dry run of this toolkit on GitHub
+Copilot on Windows produced the question *"AskUserQuestion doesn't seem installed, is that
+something we can include in the setup?"* It cannot be. Until then every call site here named
+the tool as **the** mechanism, so on a non-Claude agent the instruction was simply
+unfollowable — and an unfollowable gate is not a loud failure, it is a silent skip. Same shape
+as the Stage P false-green: the enforcement quietly evaporates and nothing says so.
+
+## IP3 — "X already covers this" — the verbatim intake answer (2026-09-02)
+
+_From `skills/interview-protocol.md`._
+
+Verbatim, from a real intake (2026-09-02, Q4 "documents not yet accounted for?"):
+
+> the `.pptx` is already inside `source/<track>/` and was already used as triage input by the
+> Group A–D triage pass (see `<track>-triage.md`) — nothing additional exists outside the folder.
+
+The triage never named the deck. Two months of downstream artifacts inherited the gap, because
+once Q4 read "answered" nothing had a reason to look again. The answer *cited a document*, which
+is exactly why it was believed.
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index 01ba7ba4..d9aca394 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -18,19 +18,15 @@
 
 **Mechanical scaffolding exists:** `bin/init-agents.sh <session-root> [p|build|all]` copies stub versions of all **six** agents (from the toolkit's `agents/` folder) into the project's `.claude/agents/` — `p` for the Stage-P pair (ba/architect), `build` for the Stage-5 quartet (mdl/gate/test/**review**). The stubs are safe by construction: each refuses to run while `{{PLACEHOLDER}}`s remain, so "downloaded but never configured" fails loudly instead of verifying nothing. Your job after scaffolding is Steps 1–4 below: fill every placeholder from the *actual* project, including the **Domain context** block.
 
-> **This file said "five" until 2026-08-20, and that cost the review.** `review-agent` — the owner
-> of `module-review.md` stage 4, the LOOK — has been scaffolded by `bin/lib/install-manifest.sh`
-> and routed to its skills for some time, but this file never listed it. So every session that set
-> agents up "per `agent-roles.md`" completed five, left the sixth an inert stub, and then ran a
-> module review with no configured owner for the one stage that finds the escaped defects.
-> Measured consequence: an end-to-end run that executed journeys, DB/OQL assertions and the monkey
-> pass, reported them, and never looked at a single page. **The count is load-bearing. It is six.**
+> **The count is load-bearing. It is six.** Failure when this file said "five": sessions left
+> `review-agent` an inert stub, and a module review ran journeys, DB assertions and the monkey pass
+> but never looked at a single page (2026-08-20, `process/baseline-incident-history.md` §AR1).
 
 ---
 
 **When to dispatch, in what batch, on which tier:** `conversion-runbook.md` §1c is the single source. **How to dispatch** — the four harness defaults to override on every call — is the next section. The rest of this file is the setup.
 
-The `model:` line in each template below is pinned to match the shipped stub at `agents/<name>-agent.md` — see `conversion-runbook.md` §1c for the why.
+The `model:` line of every completed agent is pinned to the shipped stub at `agents/<name>-agent.md` (never inherited) — see `conversion-runbook.md` §1c for the tiers.
 
 ## Dispatching — override four defaults on every call
 
@@ -170,247 +166,13 @@ works.
 
 ## Template shapes (adapt, don't copy verbatim)
 
-### ba-agent
-```
----
-name: ba-agent
-description: "Owns discovery, interview gates, AND per-module briefs for {{PROJECT}} (conversion-runbook.md Stages P, 0-2, 4, 7). Two modes: EXTRACTION (P-2, no spec yet -> produce BRDs) and TRANSLATION (Stage 4 -> turn validation-clean BRDs into module briefs). Use for intake, triage, requirements, any proposal-with-evidence interview, and authoring module briefs."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You run discovery, the interview gates, and module-brief authoring for {{PROJECT}}. You never touch the `.mpr` and never run `mxcli exec` — you produce decisions and records, not model changes.
-
-**Paths:** resolve all project paths (KB, BRDs, wireframes, briefs, architecture, stage HTML) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
-
-## Your two modes
-- **Extraction (Stages P–2):** no spec exists yet. Produce BRDs from source/SME via the interview protocol.
-- **Translation (Stage 4, per module):** BRDs exist. Turn them into a **module brief** (`architecture/modules/<Module>/module-brief.md`, per `module-brief.md`) — the `mdl-agent`'s single entry point. **Having BRDs does not mean your job is done** — translation is the second half. If briefs don't exist, this mode was skipped.
-
-## Ground rules
-- Follow `query-the-model.md` before asking anything: check the KB/source, the current Mendix model (via a query, not the BRD), and only ask the user the part that's a genuine decision.
-- Run the full interview protocol from `conversion-runbook.md` §1 at every gate: homework first, 2-4 options with evidence, assumptions stated out loud, user answers in the terminal, decision written to the stage HTML *and* `PROJECT.md`, unknowns default + `ASSUMED` + proceed.
-- Never invent legacy intent from code alone — that's what Path C (the SME interview) is for. Log it as an open question if no SME is available, don't guess.
-- `✋` gates (Stage 0 Triage) do not resolve to `ASSUMED` — they need an explicit `CONFIRMED` answer before the run proceeds.
-- **Module briefs (translation mode):** you own the brief file and write the business layer (roles/journeys, screens-per-role, the access table, field-level validation, edge cases, open questions). Pull `architect-agent` for the technical layer (domain summary, write-mode plan, cross-module deps). Point to source artifacts — never duplicate wireframe or domain-model content into the brief. Produce briefs just-in-time (module N after N−1 gates), not all upfront.
-
-## Workflow (extraction / gate mode)
-1. Identify which stage's gate you're running (from `conversion-runbook.md` §2).
-2. Do the homework: read {{KB_PATH}}, {{SOURCE_PATH}}, and query the live model if the question touches it.
-3. Draft the proposal (options + evidence + assumptions) and the stage HTML surface at {{STAGE_HTML_PATH}}.
-4. Ask the user; record the answer in {{STAGE_HTML_PATH}} and `PROJECT.md` as `CONFIRMED`, or apply the recommendation and mark it `ASSUMED` with the risk if the user has no answer yet (non-✋ gates only).
-5. Update `PROJECT.md`'s open-questions register.
-
-## Workflow (translation mode — authoring a module brief)
-1. Read `module-brief.md` for the format and ownership rules.
-2. Read the module's BRDs, wireframes, and the build-plan access-table slice. Query the live model for exact names.
-3. Write the business layer of `architecture/modules/<Module>/module-brief.md`; request the technical layer from `architect-agent`.
-4. Run the brief's ready-check. Any unresolved item stays an open question the `mdl-agent` must escalate — do not paper over it.
-
-## Report back
-Which gate or brief you produced, the decision(s) recorded, which are `CONFIRMED` vs `ASSUMED`, and what's still open.
-```
-
-### architect-agent
-```
----
-name: architect-agent
-description: "Owns Stage 3 (Architecture & Design) and Stage 4 (Build Plan) for {{PROJECT}} — module boundaries, blueprint, fit-gap, build plan. Use once BRDs are validation-clean. Never touches mxcli."
-model: opus
-tools: Read, Grep, Glob, Bash
----
-
-You own architecture and build-plan decisions for {{PROJECT}}. Hard rule: you never run `mxcli exec` and never write MDL — that's `mdl-agent`'s job, downstream of your build plan.
-
-**Paths:** resolve all project paths (BRDs, architecture, design, briefs, build plan) from the **`## Wiring` block of the project-root `CLAUDE.local.md`** — the single source of truth. Read it at task start; don't hardcode paths.
-
-## Ground rules
-- Follow `modularize-domain.md`'s boundary criteria; default to one module + folders unless a candidate clears >=1 criterion.
-- Run the Stage 3/4 interview gates from `conversion-runbook.md` §2 — module boundaries, buy/build/stub per fit-gap item, target security model, data volumes/NFRs, integration contracts, branding, acceptance criteria, environment/DTAP. These are `✋` gates: no `ASSUMED` past them, only `CONFIRMED`.
-- Query the live model (`query-the-model.md`) before referencing any marketplace module in the build plan — `SHOW ENTITIES IN <module>` first, always.
-- **Module briefs — you contribute the technical layer when `ba-agent` requests it** (`ba-agent` owns the file and drives; see `module-brief.md`). Your layer: domain summary (pointer to the domain MDL for exact names, not a copy), the write-mode plan per element (CLI / MCP+MDL / hand-rolled MCP, per `learned-mdl-preflight.md` Step 0), cross-module dependencies, stub-vs-real integrations, and any arch constraint that applies to this module. Point to source artifacts; never duplicate them into the brief.
-
-## Workflow
-1. Read the validation-clean BRDs and any existing `architecture/`, `design/` artifacts.
-2. Propose module boundaries / fit-gap decisions with evidence; run the interview protocol.
-3. Write `.mx-brd.json`, `architecture/` (blueprint, wiring diagrams, fit-gap.md), and once approved, `architecture/build-plan.md` — numbered, dependency-ordered.
-4. Record every decision in `PROJECT.md`.
-
-## Report back
-Boundaries/decisions proposed vs. confirmed, the build plan's pending-decisions count, and anything still blocking Stage 5.
-```
-
-### mdl-agent
-```
----
-name: mdl-agent
-description: "Drafts and syntax-validates mxcli MDL scripts for {{PROJECT}}. Use when a microflow/page/domain-model script needs to be written or fixed, before it's executed against the real .mpr."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You write MDL scripts for {{PROJECT}}. You draft and validate — you never execute against the real `.mpr`.
-
-## Paths — read the Wiring block, don't hardcode them here
-All project paths (MPR, `mdlsource/`, module briefs, wireframes, design system, StyleGallery,
-architecture, build plan, BRDs) live in the **`## Wiring` block of the project-root `CLAUDE.local.md`** —
-the single source of truth. Read it at the start of every task and resolve paths from it. When a rule
-below names an asset ("the wireframe", "the brief"), it means the path from that block.
-
-## Ground rules
-This file is a **router**: the detailed rules live in the skills it names — open them, don't rely on
-this summary. The hard STOPs below are inline on purpose; never route around them.
-
-- **Read the module brief first — your single entry point.** Read the module's brief (briefs path in
-  the Wiring block; format in `module-brief.md`): roles/access, screens, validation, write-mode plan,
-  pointers. **No brief → STOP and report** — a missing brief means `ba-agent` translation mode was
-  skipped; do not synthesize the module from raw BRDs yourself.
-- **An unchecked open question in the brief is a stop sign.** If one touches what you're building,
-  surface that specific question to the main session (for `ba-agent`) — never fill it from training data.
-- Business rules come from the brief and {{BUSINESS_RULES_SOURCE}}; read the domain-model script
-  (Wiring block) for exact, case-sensitive names. Don't guess names or rules.
-- **Write mode, per operation, up front:** run `learned-mdl-preflight.md` Step 0 — the default is the
-  CLI through `bin/exec.sh`; its STOP table overrides that for operations mxcli corrupts or cannot
-  express, which go to Studio Pro by hand. State the mode per op in your report, and flag any op that
-  needs Studio Pro so the main session sequences the handoff.
-- Annotate selectively (`learned-microflow-patterns.md`); always annotate a CE-error fix.
-- **Pages/snippets — run the full pre-flight in `ui-preflight-pages.md`** (wireframe → tokens →
-  gallery reuse → cross-check) and include its UI cross-reference block in your report. **No wireframe
-  → STOP** — do not guess layout or bindings. Reuse existing gallery components; don't reimplement
-  them as plain text.
-- **Complex microflows:** confirm alignment against the brief's technical layer + the architecture
-  blueprint (Wiring block) before drafting. Report any mismatch.
-- **Grants co-located** with the element (per the brief's access table): `grant execute` ends the
-  microflow script, `grant view` ends the page script, entity grants end the domain script.
-
-### Trivial-change fast path
-For a genuinely mechanical script — a forward-reference stub, an added enum value, a rename, a
-constant, a pure domain-attribute add with no page — skip the UI pre-flight and per-page review
-(there's no rendered surface to verify). Still required: read the brief for names, the
-`learned-mdl-preflight.md` STOP check, `mxcli check`, and the mxbuild gate. Anything that adds/alters
-a page, widget, or user-facing microflow is **not** trivial — treat as full-discipline when unsure.
-
-## Workflow
-1. **Read the `## Wiring` block** in the project-root `CLAUDE.local.md` — resolve all paths from it.
-2. **Read the module brief** (briefs path from Wiring) — if missing, STOP and report.
-3. Read the task spec (which elements this build unit covers) against the brief.
-4. Read the necessary skill file(s) and existing MDL for exact names (the brief points to them).
-5. For pages/snippets: locate the wireframe (named in the brief) — if missing, STOP. Then complete `ui-preflight-pages.md` in full.
-6. For complex microflows: confirm alignment against the brief + architecture blueprint.
-7. Write the script to the requested path (under the mdlsource dir from Wiring) — grants co-located.
-8. Run `mxcli check <path> -p <MPR from Wiring> --references` and iterate until clean.
-8a. **Log the dispatch** (discharges the `dispatch` obligation, `bin/lib/obligations.tsv`): under the
-    project root, `mkdir -p .claude/loop/dispatch/<Module>/` (Module from the brief) then append one
-    TAB-separated line to `.claude/loop/dispatch/<Module>/scripts.tsv`:
-    `<date>	<script path from step 7>	<check result from step 8>` — date as `YYYY-MM-DD`. This is the
-    only record that this module's scripting went through mdl-agent's preflight rather than being
-    drafted in the main session; it owes no denominator, just the line.
-9. Do NOT run `mxcli exec` — that stays in the main session under the user's confirmation.
-
-## Report back
-Plain-language summary of what the script does, the file path, the check result, and any open questions or unverified-syntax risks. For page scripts, include the full UI cross-reference block.
-```
-
-### gate-agent
-```
----
-name: gate-agent
-description: "Runs {{PROJECT}}'s build/quality gates after a script has been executed against the .mpr, and reports pass/fail with a digested error list. Use after any mxcli exec, not before."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You verify {{PROJECT}} after changes have already been applied to the `.mpr`. Read-only / verification-only — never write files, never run `mxcli exec`.
-
-## Gates to run (in order)
-1. **Model check**: {{MODEL_CHECK_COMMAND}}. Expect 0 CE errors.
-2. **Compile gate** (if applicable): {{COMPILE_GATE_COMMAND}}.
-3. **Lint, always**: read the lint cell `bin/exec.sh` wrote into the BUILD-LOG row (it runs
-   `bin/lint-gate.sh` after every clean mxbuild); a `LINT ROSE` cell fails the script. Re-run
-   {{LINT_COMMAND}} only for the per-document list. Never re-baseline to make a row green.
-
-## Known gotchas
-{{PROJECT_SPECIFIC_GOTCHAS — e.g. stale .mpr.lock files, access-grant drops after CREATE OR REPLACE, stale proxy folders after a module rename}}
-
-## Report back
-Pass/fail per gate, the exact error list if any, and whether failures match a known-gotcha pattern. Terse — a status report, not a narrative.
-```
-
-### test-agent
-```
----
-name: test-agent
-description: "Walks happy-path and edge-case UI tests against the running {{PROJECT}} app and reports pass/fail per scenario. Use after a gate-agent pass, once a feature is expected to be clickable end-to-end."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You test {{PROJECT}}'s running UI. Verification-only — never edit MDL, never touch the `.mpr`, never run `mxcli exec`.
-
-## Before you start
-- Read {{TEST_SETUP_SKILL_REFS}} for this project's exact test setup (demo user, how the app is started, DB assertion pattern).
-- Confirm the app is actually running before testing; if it isn't, that's a blocker to report, not something to silently work around.
-
-## Workflow
-1. Take the scenario list you were given.
-2. Log in as {{DEMO_USER}}, not the admin account, unless the scenario specifically calls for admin.
-3. Walk each scenario step, capturing what happened.
-4. Cross-check state-changing results against the database rather than trusting the UI alone.
-
-## Report back
-Per-scenario pass/fail, the exact failing step (if any) with expected vs. observed, and any UI/data mismatches. Don't narrate every click.
-```
-
-### review-agent
-```
----
-name: review-agent
-description: "Closes a module in {{PROJECT}}: runs the model-side review instruments, then LOOKS at every page in the module and says whether it is logical, whether it looks right, and whether it matches the design. Use when a module's build and gate stages are done. Diagnostic only — never fixes anything."
-model: sonnet
-tools: Read, Grep, Glob, Bash
----
-
-You run `skills/module-review.md` for {{PROJECT}}. Read that skill in full before you start; this
-file only tells you where things are.
-
-## What you own
-Stage 3's model-side instruments, and **stage 4 — the LOOK**. Stage 4 is the reason you exist.
-Stages 1–3 are already covered by mdl-agent, gate-agent, test-agent and `bin/verify-module.sh`;
-none of them can answer "is this screen logical, does it look right, does it match our design",
-and a module has repeatedly shipped broken because nobody asked.
-
-## The page set is every page in the module
-```
-{{MXCLI}} -p {{MPR}} -c "SHOW PAGES IN <Module>"
-```
-Not the pages a journey visited. A page no test touches is the highest-risk page in the module.
-Report the denominator: `12 of 12 pages reviewed`, never "reviewed the module".
-
-## Order
-1. `bin/verify-module.sh <Module>` results — read them, do not re-run them.
-2. `node tests/e2e/design-audit.js` — the mechanical sweep (classes, a11y, overflow). Where it
-   and your eye overlap, it wins.
-3. **Then look**, page by page, per module-review.md §4c/§4d/§4e. Navigate via the nav menu or a
-   button, never a direct URL.
-4. Write the report to `design/ui-reviews/ui-review-<YYYY-MM-DD>.html` and append every P1/P2 to
-   `docs/improvement-register.md`.
-
-## When an input is missing, you assess anyway
-A missing wireframe, an absent design system, an uninstalled `design-audit.js`, a module with no
-brief — none of these is permission to skip a page. Follow module-review.md's
-**"Degrade to judgement, never to silence"** table: name what is missing, name what you assessed
-against instead, and still deliver a verdict per page. Reduced fidelity is reported as reduced
-fidelity. It is never reported as a pass, and never reported as nothing.
-
-## You never fix
-No MDL, no `mxcli exec`, no edits to the model or the theme. You have no Write or Edit tool. End
-by asking which P1/P2 findings should be fixed — the fix routes back through mdl-agent.
-
-## Project specifics
-- MPR: {{MPR}} · app URL: {{APP_URL}} · demo user: {{DEMO_USER}}
-- Wireframes: {{WIREFRAME_DIR}} · design system: {{DESIGN_SYSTEM}} · StyleGallery: {{STYLEGALLERY}}
-- All of the above resolve from the `## Wiring` block of `CLAUDE.local.md` — read it at task start.
-```
+The illustrative body for each of the six roles — frontmatter, ground rules, workflow, report-back —
+is in **`agents/README.md`**; read it when completing a stub (step 2 above). The shipped stubs
+`agents/<name>-agent.md` are the live templates and win where the two disagree. The rules every
+completed agent must keep regardless of shape are in this file: the tool scoping (step 3), the one
+rule on `.mpr` mutation, and the anti-patterns below. ba-agent works in two modes — **extraction**
+(Stages P–2: produce BRDs via the interview protocol) and **translation** (Stage 4: turn BRDs into
+module briefs, just-in-time, module N after N−1 gates); having BRDs does not mean its job is done.
 
 ---
 
@@ -419,5 +181,5 @@ by asking which P1/P2 findings should be fixed — the fix routes back through m
 - **Don't give any of these six agents `Write`/`Edit` directly.** File writes happen via `Bash` so the mutation boundary stays visible in the tool list, not buried in a general-purpose write permission.
 - **Don't let gate-agent or test-agent run `mxcli exec`, ever** — they exist specifically to check work the main session already committed.
 - **Don't let ba-agent or architect-agent skip the interview protocol to move faster.** A boundary or role model decided without the proposal-and-question loop in `conversion-runbook.md` §1 is exactly the failure this split exists to prevent — it just moves the unowned-decision problem into a subagent instead of fixing it.
-- **Don't copy the template shapes above verbatim into a new project.** A gate-agent checking the wrong `.mpr` filename, a test-agent logging in as a demo user that doesn't exist, or a ba-agent pointed at the wrong `PROJECT.md` path will report false confidence instead of failing loudly.
+- **Don't copy the template shapes (`agents/README.md`) verbatim into a new project.** A gate-agent checking the wrong `.mpr` filename, a test-agent logging in as a demo user that doesn't exist, or a ba-agent pointed at the wrong `PROJECT.md` path will report false confidence instead of failing loudly.
 - **Scaffold all six on day one; don't *complete* an agent before its stage starts.** The stubs are inert (refuse-to-run while placeholders remain), so having all six in `.claude/agents/` from kickoff is safe and avoids the "where's my mdl-agent?" confusion. The discipline moves to completion time: fill ba/architect at Stage P, mdl/gate/test/review at Stage 5 kickoff — completing a gate-agent before any build exists means filling its commands from guesses, which is exactly the false-confidence failure the placeholders exist to prevent. (A greenfield build starting at Stage 5 may simply never complete ba/architect — that's fine, they stay inert.)
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index cc80daa8..852f3ff2 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -123,7 +123,7 @@ The stages are the same for everyone; what differs is where you enter and which
 3. **Any requirements artifacts exist** — specs, BRDs, context docs, wireframes, workshop outputs → **Requirements-driven**. Having "complete" specs does *not* mean skipping to Stage 5: stages 2–4 are where those specs become validated BRDs, an architecture, module boundaries, a design system, and an ordered plan. Skipping them means improvising all of that mid-build.
 4. **None of the above** — you're genuinely starting from a conversation → **Greenfield**. This is the narrowest mode, not the default for "no legacy system."
 
-(Real misrouting incident, 2026-07-14: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate," proposing to skip 0–4 — exactly what rules 2–3 exist to prevent. Second incident, 2026-09-22: `intake.md` Q1 offered only three modes, so a session changing a live app could not pick the fourth even though `gate-check.sh` already recognised it — rule 1 and the table row below are the fix.)
+(Failure: a project with full specs + analyzable source was classified greenfield "because there's nothing to migrate" and proposed skipping 0–4 — `process/baseline-incident-history.md` §R1.)
 
 | You're starting from… | Mode | Stages that run | What changes |
 |---|---|---|---|
@@ -137,14 +137,9 @@ The stages are the same for everyone; what differs is where you enter and which
 **Stage 0 is the scope stage. It is not the extractor stage.** Reuse-vs-build-new is one question
 *inside* it, and it is the only part that needs a codebase.
 
-This distinction was implicit until 2026-08-20, when a customer round made the cost of leaving it
-implicit measurable. A project whose source was markdown files plus database tables was classified
-requirements-driven — reasonably, given the rules above. The mode's row then said "skip 0", so
-Stage 0 was skipped **whole**: no source characterisation, no `analysis/` folder, no triage
-artifact, and — the expensive one — **no scope conversation**, because CAC-1 fires after Stage 0
-and Stage 0 never ran. Extraction was then run anyway and pulled in far more than the subsystems
-under discussion, which nothing downstream was positioned to notice: Stage 2's gate checks that
-BRDs are *validation-clean*, and a hundred clean BRDs describing things nobody asked for pass it.
+Failure it prevents: a requirements-driven project skipped Stage 0 whole — no triage, and no
+scope conversation, since CAC-1 never fired — then extracted far beyond the subsystems in scope; a
+hundred validation-clean BRDs about things nobody asked for passed Stage 2 (2026-08-20, `process/baseline-incident-history.md` §R2).
 
 So: **no entry mode may skip Stage 0, because no entry mode may skip the scope conversation.**
 What varies is how much of the stage is applicable, and inapplicability is *recorded*, never
@@ -171,11 +166,9 @@ their `_files/` sidecars), no legacy code, no Office/PDF containers. A corpus wi
 `.pdf` in it takes the ordinary requirements-driven row above, because those containers carry
 embedded images that owe their own accounting (`bin/lib/source-formats.tsv`, `media = yes`).
 
-**Why this path exists (2026-09-09).** A project of exactly this shape was slow and token-hungry
-through Stages 1–4, for measured reasons: every session read the raw HTML (3–10× the tokens of
-its text), and the ledger asked for one disposition per file — every sidecar `.png`, `.css` and
-`.js` included — for a corpus nothing extracts. Nothing below skips a gate; it names the shortest
-honest route through them, and every command here was run against the gates before it was written.
+**Why (2026-09-09):** a project of this shape read raw HTML every session (3–10× the tokens) and
+owed a ledger disposition per sidecar file (`process/baseline-incident-history.md` §R3). Nothing below skips a gate; it is the
+shortest honest route through them, each command run against the gates before it was written.
 
 | Stage | Docs-ready form |
 |---|---|
@@ -216,7 +209,7 @@ Every gate in §2 runs the same six-step shape. This is the thing that should be
 5. **The decision is written to two places**: the stage's HTML proposal doc (the artifact, customer-showable) and `PROJECT.md` (the register), marked `CONFIRMED`.
 6. **`ASSUMED` is earned by asking, never by skipping.** An answer may be recorded `ASSUMED` only after the question was actually posed and the user said "don't know" / "you decide" — that is delegation-by-consent, recorded with the risk if wrong. Deriving an answer yourself and not asking is a protocol violation, not an `ASSUMED`.
 
-**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks. But the pipeline generates a second stream all the time: every `openQuestions` entry a BRD records, every row added to `analysis/sme-questions.md`. Those were never wired to anything, and they rotted. Measured on one real project (2026-08-12): 46 rows in `sme-questions.md` against 7 mentions of an answer, ~35 unresolved BRD `openQuestions`, one status reading *"Open — routed to sme-questions.md F1/F2"* — routed to a file nobody opens. Several were not merely unasked but already **decided**: *"ASSUMED drafting position (a), hardcode — taken to keep this BRD buildable… NOT a settled product decision"* is a real product choice (hardcode vs. build a configurable rules engine) taken unilaterally and never shown to anyone. And 23 distinct free-text status strings meant nothing could count them, which is why nothing ever surfaced them.
+**The gate's own questions are not the only questions — raise the accumulated batch too.** Steps 1–6 govern the questions the *gate* asks; the pipeline also accumulates a second stream — every BRD `openQuestions` entry, every `analysis/sme-questions.md` row — and unwired, it rots. Failure: 46 SME rows with 7 answered, ~35 unresolved BRD questions, and a hardcode-vs-rules-engine product choice taken as a "drafting position" nobody was shown (2026-08-12, `process/baseline-incident-history.md` §R4).
 
 So, **as a required step at every gate, before the gate's own questions**:
 
@@ -234,16 +227,9 @@ bin/questions-report.sh <project-root> --stage <N>    # → docs/open-questions.
 
 `gate-check.sh` writes it for you whenever the open-questions row blocks a gate. Give the user the path — it is openable, sortable and forwardable to a customer SME in a way a terminal dump is not, and it flags every question that arrived without a proposed answer.
 
-The vocabulary is controlled, and only these six values are legal in a `status`:
-
-| State | Meaning | Blocks a gate? |
-|---|---|---|
-| `UNRAISED` | never put in front of the user — the default for anything not positively past it | **yes** |
-| `RAISED` | put to the user at a named gate, awaiting their reply | no |
-| `ANSWERED` | the user decided; requires a non-empty `answer` | no |
-| `ASSUMED` | agent took a position **and** the user consented after seeing it; requires `consentBy` + `consentAt` | no |
-| `MOOT` | descoped by another decision; the reason is in the text | no |
-| `UNRECOGNISED` | the normaliser could not place it — counts as **not done** | **yes** |
+The `status` vocabulary is controlled: six legal values — `UNRAISED` and `UNRECOGNISED` block a
+gate; `RAISED`, `ANSWERED`, `ASSUMED`, `MOOT` do not. Their meanings are the table in
+`interview-protocol.md` §4, the single source.
 
 An `ASSUMED` with no `consentBy`/`consentAt` is not an assumption, it is the defect: it normalises to `UNRAISED` and blocks. `bin/gate-check.sh <project-root> <N>` enforces this and will not pass a stage carrying unraised questions. Unlike protocol staleness (which notifies), this one blocks — it is the project's own state, and an architecture built on decisions the customer never saw is exactly what §1 exists to prevent.
 
@@ -251,7 +237,7 @@ Note the ruling this encodes, from the user, 2026-08-12: *"At each gate, also gi
 
 A proposal beats a questionnaire because it asks the user to **correct** something rather than supply it cold — and by the time each gate arrives, the agent has read the source and has evidence to put behind its recommendation.
 
-**Unattended mode is opt-in, never inferred.** The "default + record + proceed" behavior (skipping the wait, not the question — questions still get logged in `PROJECT.md` open-questions) is only legal when the user explicitly said to run unattended, recorded at Stage P in `PROJECT.md` (`Interview mode: unattended`). Default is **attended**: every gate question is asked in chat and the turn ends there. (Real incident, 2026-07-14: an attended run produced architecture diagrams and a design system through Stage 3 without a single question reaching the user — "a solo run never stalls" was read as "never ask." It means "an *authorized* solo run doesn't deadlock," nothing more.)
+**Unattended mode is opt-in, never inferred.** The "default + record + proceed" behavior (skipping the wait, not the question — questions still get logged in `PROJECT.md` open-questions) is only legal when the user explicitly said to run unattended, recorded at Stage P in `PROJECT.md` (`Interview mode: unattended`). Default is **attended**: every gate question is asked in chat and the turn ends there. (Failure: an attended run reached Stage 3 with zero questions asked, reading "a solo run never stalls" as "never ask" — `process/baseline-incident-history.md` §R5.)
 
 **Unattended runs keep a Ruling ledger.** Nobody can be asked, so the register alone is not
 enough: an `ASSUMED` line records the decision and sometimes the reason, never the blast
@@ -281,7 +267,7 @@ obra/superpowers, adapted; the ledger is the compensating control for the fact t
 
 And at **every** checkpoint, after the 2+1 questions: one standing open-floor question — "anything else you want changed, added, or worried about — scope, priorities, anything?" — before the gate closes.
 
-**Lightweight-change carve-out — small, unambiguous, already-decided changes skip dispatch, never skip the record.** Not every BRD/architecture edit needs the six-step protocol or a `ba-agent`/`architect-agent` round-trip. If the change is small in scope (renaming a field, adding one or two entities/attributes whose shape was already settled in the current conversation, fixing a stale line that contradicts an already-CONFIRMED decision) *and* unambiguous (no real alternatives to weigh, nothing left for the user to correct), the acting agent may edit the BRD/architecture doc directly instead of dispatching a subagent. It still MUST: (a) log the change in `PROJECT.md` — a `## Change log` row when the user asked for it (`change-intake.md`: an S change the user typed needs no question, only that row), a decision row when it settles a choice — (b) set or flip the drift-sync marker on any BRD/wireframe it touched and did not flush in the same session, per §3b. What this carve-out buys back is the interview/dispatch overhead, not the paper trail — a change made without a recorded decision or marker is exactly the drift this runbook exists to catch, however small the diff. Anything touching module boundaries, the security model, a new integration, or requiring a judgment call between real alternatives still runs the full protocol. (Real incident, 2026-07-23: a "flip 2 entities to persistent + add 2 new entities" change — already fully settled in conversation — was routed through ba-agent twice and architect-agent once, ~270k combined tokens, for what was fundamentally a handful of document edits. The user called it out directly. The fix isn't skipping the record, it's skipping the dispatch when there's nothing left to decide.)
+**Lightweight-change carve-out — small, unambiguous, already-decided changes skip dispatch, never skip the record.** Not every BRD/architecture edit needs the six-step protocol or a `ba-agent`/`architect-agent` round-trip. If the change is small in scope (renaming a field, adding one or two entities/attributes whose shape was already settled in the current conversation, fixing a stale line that contradicts an already-CONFIRMED decision) *and* unambiguous (no real alternatives to weigh, nothing left for the user to correct), the acting agent may edit the BRD/architecture doc directly instead of dispatching a subagent. It still MUST: (a) log the change in `PROJECT.md` — a `## Change log` row when the user asked for it (`change-intake.md`: an S change the user typed needs no question, only that row), a decision row when it settles a choice — (b) set or flip the drift-sync marker on any BRD/wireframe it touched and did not flush in the same session, per §3b. What this carve-out buys back is the interview/dispatch overhead, not the paper trail — a change made without a recorded decision or marker is exactly the drift this runbook exists to catch, however small the diff. Anything touching module boundaries, the security model, a new integration, or requiring a judgment call between real alternatives still runs the full protocol. (Failure: a settled 4-entity edit took three subagent round-trips, ~270k tokens — `process/baseline-incident-history.md` §R8.)
 
 **The packaged form of this protocol is a checkpoint — and checkpoints are mandatory where they exist.** `skills/checkpoints/` ships ready-made Context-Aware Checkpoints (CAC) for the six busiest transitions (scope, BRD, architecture, design, build, cutover) — each runs the protocol above as a "2 predefined questions + 1 open question" script, derived from what the pipeline actually found. Run the raw six steps only where no checkpoint exists. **A checkpoint fires *before* the next stage's artifacts are produced** — creating architecture diagrams or a design system before their checkpoint ran is a protocol violation: stop, run the checkpoint, and be prepared to throw the premature artifact away. Either way the decisions land in `PROJECT.md` — checkpoints keep no state file of their own.
 
@@ -352,13 +338,9 @@ Rules — these apply to every stage and every per-module build loop:
    item that makes the obligation check bite: it reports a pass nobody performed, but only on
    a run, and nothing before this rule required one.
 
-   **Why (measured, 2026-09-19, two field builds of the same app).** A full Stage-5 build closed with all seven screens built, a green mxbuild
-   gate, and 11 of 37 acceptance rows confirmed. `gate-check.sh` had run exactly once, at
-   scaffold time. The `look` obligation, the wiring sweep, journeys and coherence were all
-   `PENDING` and nobody saw it, because nothing asked. When the gate was finally run as a
-   deliberate second pass, the seven screens scored 0, 18, 40, 40, 58, 58 and 69 percent against
-   their own wireframes on an element checklist — one screen matched none of its wireframe's
-   elements at all. Every one of those defects was visible to a gate that never ran.
+   **Why:** a full Stage-5 build closed green with `gate-check.sh` run once, at scaffold; run
+   late, it showed LOOK, wiring, journeys and coherence all `PENDING` and the seven screens at
+   0–69% of their wireframes (2026-09-19, `process/baseline-incident-history.md` §R9).
 
 The final full-checklist repost before a gate doubles as the gate's evidence: the user should
 be able to approve the gate by reading that one message. The close-out block is what the
@@ -368,13 +350,9 @@ reader approves the *transition* on — checklist for the work, block for the ha
 
 ## 1c. Dispatch — what leaves the main session, in what batch, on which model
 
-**Why this is written down (2026-09-14).** The six agent stubs have carried model tiers since
-they were generated (`architect-agent` on the strong tier, the other five on the mid tier), and
-§2's Owner rows name who is accountable for each stage. Nothing said *when* the main session
-hands work over — so in the token-path A/B (nine runs, Stages P–4) the main session did nearly
-everything itself, at its own model's price, and only two skills (`brd-generation.md`,
-`image-transcription.md`) ever asked for a fan-out. Owner is accountability; this table is the
-runtime rule. It is the single source; `agent-roles.md` (setup) defers here. *How* to dispatch —
+**Why (2026-09-14):** with no rule for *when* to hand work over, the main session did nearly all
+of Stages P–4 itself at its own model's price (`process/baseline-incident-history.md` §R10). Owner is accountability; this table is
+the runtime rule. It is the single source; `agent-roles.md` (setup) defers here. *How* to dispatch —
 model named on every call, fresh agent not fork, fix rounds, notices — is `agent-roles.md` →
 "Dispatching".
 
@@ -444,12 +422,9 @@ Eight stages (plus Stage P kickoff). For each: what the user co-defines, what th
 
 **Every stage transition has a packaged checkpoint. Here is where they attach.** The `skills/checkpoints/`
 CAC files run the §1 interview protocol at the busiest transitions; they write to `PROJECT.md`,
-never to a separate state file. Until 2026-08-20 this runbook — the file every session is required
-to read — **named none of them**, and they were reachable only from `skills/migration-pipeline.md`.
-A requirements-driven session never loads that skill, so it never fired a single checkpoint, and
-CAC-1's scope brainstorm silently did not exist outside migration mode. Checkpoints are wired to
-*stages* here, not to pipeline phases, precisely so that a project running no pipeline still gets
-them.
+never to a separate state file. They are wired to *stages*, not pipeline phases, so a project
+running no pipeline still gets them (failure: reachable only from `migration-pipeline.md`, they
+never fired in requirements-driven mode — `process/baseline-incident-history.md` §R12).
 
 | Fires at the close of | Checkpoint | The question it exists to force |
 |---|---|---|
@@ -565,11 +540,9 @@ Then, and only then, **the open scope question** ("Scope brainstorm", further do
 present the overview, say what the corpus appears to cover versus what the user described at Stage
 P, and discuss it openly. No option lists.
 
-Doing this out of order is a real, reported failure (2026-08-19): a Stage 0 run on a four-file
-documents-only corpus produced a correct ten-dimension grade and then asked the user a closed,
-rubric-shaped gate question — because the grade was the only artifact in front of it. The
-instruction to present a source map already existed here; nothing produced the map, so the agent
-asked what the tooling gave it something to ask about. **An uncovered dimension is an open question
+Failure out of order: a four-file corpus got a correct ten-dimension grade, then a closed,
+rubric-shaped gate question — the grade was the only artifact in front of the agent (2026-08-19,
+`process/baseline-incident-history.md` §R16). **An uncovered dimension is an open question
 for a human. A low rating is a closed one. Reach the first list before the second.**
 
 Three things come out of pass 2, and each changes what you do next:
@@ -596,20 +569,15 @@ shape-changing gaps to the gate, and mark the extraction rows N/A rather than un
 **Decide that on evidence, and decide it per artifact — not off the entry-mode label.** Open the
 folder first. A schema, a table dump, an ORM model, an OpenAPI contract or entity/field tables
 inside a spec are extractable structure, and each earns a Coverage Matrix row and the two-way
-reuse-or-build call exactly as a codebase would. A mode-shaped `N/A` is precisely how the misroute
-in the next paragraph happens: the corpus reads like requirements, the whole of it goes down Path
-B, and the entities that were sitting in the schema are re-typed out of prose three stages later.
+reuse-or-build call exactly as a codebase would. A mode-shaped `N/A` is precisely how the most
+common presales misroute happens: the corpus reads like requirements, the whole of it goes down
+Path B, and the entities that were sitting in the schema are re-typed out of prose three stages
+later (`process/baseline-incident-history.md` §R17). Markdown alongside a schema does not downgrade the schema.
 
 **"Does not apply" stops at the extraction rows. It never reaches the scope brainstorm.** Read
 that sentence as licence to move on to Stage 1 and you have skipped the one thing Stage 0 exists
 for. Finish the stage: run CAC-1, get the slice ordering, sign `triage.md` off.
 
-**A source that is documents plus a database is not a documents-only source.** A schema, a table
-dump, or an ORM model file is extractable structure and grades as such — the presence of markdown
-alongside it does not downgrade it. This is the shape that misroutes most often in presales
-(2026-08-20): the corpus *reads* like requirements, so it gets treated as prose, and the entities
-that were sitting right there in the schema get re-derived by hand later.
-
 | | |
 |---|---|
 | **User defines** | Reuse-vs-build-new extraction pipeline (agent proposes with a coverage matrix — two-way call, not three-way, made per extractable structure found in the source and never off the entry-mode label; see `source-triage.md`). Policy per missing dependency: acquire / stub / declare-not-implemented. Slice ordering if the source is too big for one pass — **a slice is an ordering, not an exclusion**. |
@@ -623,34 +591,24 @@ that were sitting right there in the schema get re-derived by hand later.
 Three extraction methods, not two. Each is either **done** or **explicitly declared unavailable by a named person** — never silently skipped.
 
 **Closes with CAC-1b** (`skills/checkpoints/checkpoint-extraction.md`) — the scope-out
-confirmation. It is a checkpoint you run, not a gate that stops you, and the reason is worth
-keeping in front of you.
-
-Stage 0 confirms scope *in*: what we intend to cover. It cannot confirm scope *out*, because
-nobody knows what extraction will actually produce until it has produced it. On the customer round
-that prompted this, extraction ran across the whole corpus rather than the subsystems under
-discussion, and the over-reach was invisible until modules were being built — every downstream
-gate measured *quality*, and the output was perfectly good BRDs about the wrong things. A
-validation-clean BRD for a subsystem nobody asked for is a clean pass at every remaining gate in
-this runbook.
+confirmation; a checkpoint you run, not a gate that stops you. Stage 0 confirms scope *in*; it
+cannot confirm scope *out*, because nobody knows what extraction produces until it has. Failure:
+extraction ran across the whole corpus, and validation-clean BRDs about unrequested subsystems
+passed every remaining gate until modules were being built (`process/baseline-incident-history.md` §R18).
 
 So before any BRD is written: put the extraction result next to the Stage 0 scope decision, name
-the delta, and get a decision on it. Do it before the BRDs rather than after — writing them first
-makes narrowing feel expensive, which is exactly when people stop narrowing.
+the delta, and get a decision on it — writing BRDs first makes narrowing feel expensive, which is
+exactly when people stop narrowing.
 
-**Nothing enforces this and nothing should.** A script can only check that a `CONFIRMED` row
-exists in `PROJECT.md`, and an agent can type that row without asking anyone — so the check
-cannot tell the conversation from the string, which is the only thing worth telling apart. (A
-blocking version of this gate existed for part of 2026-08-20 and was removed the same day; see
-`skills/skills-over-scripts.md`.) If the checkpoint gets skipped, run it late against the BRD set
-you already have — with the extraction report in hand you can see what actually came out, which
-is better input than the triage map ever was.
+**Nothing enforces this and nothing should** — a script can see a `CONFIRMED` row, never the
+conversation behind it (`skills/skills-over-scripts.md`). If the checkpoint gets skipped, run it
+late against the BRD set you already have.
 
 | | |
 |---|---|
 | **User defines** | Do documents exist that aren't in the folder (specs, manuals, field-label sheets, screenshots)? DB schema? Sample data? Who has them? SME access for what neither code nor docs answer. **Then, at CAC-1b: does the extraction output match the intended scope — accept, narrow, or re-extract.** |
 | **Agent produces** | **Path A — code → AST extractors** (always runs *in migration mode*; N/A with attribution otherwise). **Path B — documents → LLM extraction** (`kb-generation.md`). **Path C — SME interview** (closes `openQuestions` that neither code nor docs answer). Plus CAC-1b's scope-out surface — the delta table when CAC-1 recorded a slice to diff against, otherwise the one-line statement of what extraction covers (a single app dropped in a folder needs stating, not interrogating). |
-| **Surface** | `analysis/source-ledger.html` — `bin/source-ledger.sh report <project-root>`: every inventoried file, its verdict, and what consumed it. `<kb>/extraction-report.html` — `bin/extraction-report.sh <project-root>`. One renderer for every entry mode: it reads the knowledge base, not the source, so a Path B document corpus gets the same surface as a Path A extraction, one page per knowledge base at the path the gate looks for. Each section carries a `report-schema.md` verdict, and no zero is printed unless a second record (the pre-merge `extracted/*.json`, or `reports/summary.md`) agrees with it — one method returning zero renders `manual`, not a green. Until 2026-08-20 this was `node generate-report.js` inside each pipeline, so requirements-driven and greenfield projects could not produce the file their own Stage 1 gate requires, despite this row promising it. |
+| **Surface** | `analysis/source-ledger.html` — `bin/source-ledger.sh report <project-root>`: every inventoried file, its verdict, and what consumed it. `<kb>/extraction-report.html` — `bin/extraction-report.sh <project-root>`. One renderer for every entry mode: it reads the knowledge base, not the source, so a Path B document corpus gets the same surface as a Path A extraction, one page per knowledge base at the path the gate looks for. Each section carries a `report-schema.md` verdict, and no zero is printed unless a second record (the pre-merge `extracted/*.json`, or `reports/summary.md`) agrees with it — one method returning zero renders `manual`, not a green. History: `process/baseline-incident-history.md` §R19. |
 | **Gate** | 4 extraction quality checks pass with evidence. Paths B and C are done or declared-unavailable, with attribution (who declared it, when). **Every row of the Stage 0 inventory has a disposition that holds up** — `bin/source-ledger.sh check <project>`: an artifact that exists, is non-empty and *names* the file (with one specific finding as evidence, and for a container its images and pages accounted for: `mark <rel> --artifact <path> --evidence "<finding → where>" --pages N --media N --by <who>`; a mention is not a reading, post-mortem 2026-09-02 F3), or a person's waiver (`bin/gate-check.sh <project> --waive source/<rel> --reason "..."`), and no file on disk without an inventory row. This part **blocks** — `bin/gate-check.sh <project> 1` exits 1 on it, and so does Stage 2 — because it is a file test, not a conversation test: "the triage already used the deck" is grepped, not believed (the 2026-09-02 miss). The rest stays advisory. Record CAC-1b's outcome as a Stage-1 `Extraction scope:` decision naming what is in and what is out, so the next session isn't guessing. |
 | **Owner** | `ba-agent` |
 
@@ -660,7 +618,7 @@ is better input than the triage map ever was.
 |---|---|
 | **User defines** | Confirms business rules the code implies. Answers `openQuestions` (via SME). Narrative is never invented. |
 | **Agent produces** | BRD scaffolds → enrichment from `KB.md` → validation to clean. `F{NNN}.brd.json`. |
-| **Surface** | `analysis/brd-report.html` — `bin/brd-report.sh <project-root>`. One renderer for every entry mode: it reads BRDs, not source, so a requirements-driven or greenfield project gets the same surface as a migration, and so does a BRD no extractor produced. Each section carries a `report-schema.md` verdict, so a section that is empty because this kind of BRD has nothing to put there reads differently from one that is empty because something broke. Until 2026-08-19 this was `enrichment-summary.html`, built three times inside three pipelines against three different BRD key shapes — each copy rendered blanks for the other two’s output, and non-migration projects got no surface at all despite this row promising one. |
+| **Surface** | `analysis/brd-report.html` — `bin/brd-report.sh <project-root>`. One renderer for every entry mode: it reads BRDs, not source, so a requirements-driven or greenfield project gets the same surface as a migration, and so does a BRD no extractor produced. Each section carries a `report-schema.md` verdict, so a section that is empty because this kind of BRD has nothing to put there reads differently from one that is empty because something broke. History: `process/baseline-incident-history.md` §R20. |
 | **Gate** | Every BRD validation-clean; `validation-report.md` has 0 issues; **every `openQuestions` entry raised in chat** — `bin/open-questions.sh <root> --stage 2` reports 0 blocking, which `gate-check.sh` enforces. Close-out block pasted (§1b rule 7) — CAC-3 opens with it. "Chased to closure" was the old wording and it was unenforceable: a question logged with a self-answer read as closed. |
 | **Owner** | `ba-agent` |
 
diff --git a/skills/interview-protocol.md b/skills/interview-protocol.md
index 19302a9a..93394e80 100644
--- a/skills/interview-protocol.md
+++ b/skills/interview-protocol.md
@@ -113,14 +113,10 @@ Typical `user-only` questions, none of which a source can answer:
 2. **Never batch-approvable.** It cannot be one line of a batch that can be cleared with "approve
    all as recommended", because there is no recommendation to approve. Ask it on its own.
 
-*Real incident, 2026-08-19 (PROJECT-B).* "Are there branding inputs?" went in as line 7
-of a seven-item Stage 3 gate batch, carrying the recommended default *"no branding assets
-provided — use Atlas defaults."* The user approved the batch. There was in fact a real art
-direction — top-bar layout, industrial look, grey background, cool colours, the client wordmark in
-the shell — and a WCAG 2.1 AA target, and neither had ever been asked for. Both surfaced only
-when the user challenged the finished design system and asked why nobody had checked. The
-question had been treated as a `gap`. The recommendation was the entire defect: it converted
-"I don't know" into "I've decided", and a batch approval swallowed it.
+*Failure:* "Are there branding inputs?" rode in a seven-item batch with the default *"use Atlas
+defaults"*; the batch was approved, and a real art direction plus a WCAG AA target surfaced only
+after the design system was built. The recommendation converted "I don't know" into "I've
+decided" (2026-08-19, `process/baseline-incident-history.md` §IP1).
 
 **Design-system questions specifically.** Branding and accessibility are `user-only` on every
 project and are asked plainly and separately at the design step — not folded into a batched
@@ -248,12 +244,9 @@ tool-specific at all — it is the half that actually enforces the gate, and the
 without `AskUserQuestion` will drop first, because "I can't call that tool" reads as "skip this
 step" rather than "render it differently".
 
-*Why this is spelled out (real incident, 2026-08-19).* A dry run of this toolkit on GitHub
-Copilot on Windows produced the question *"AskUserQuestion doesn't seem installed, is that
-something we can include in the setup?"* It cannot be. Until then every call site here named
-the tool as **the** mechanism, so on a non-Claude agent the instruction was simply
-unfollowable — and an unfollowable gate is not a loud failure, it is a silent skip. Same shape
-as the Stage P false-green: the enforcement quietly evaporates and nothing says so.
+*Failure:* a Copilot dry run asked *"AskUserQuestion doesn't seem installed, is that something
+we can include in the setup?"* — while the tool was named as **the** mechanism, the gate was
+unfollowable off Claude Code, which is a silent skip, not a loud failure (2026-08-19, `process/baseline-incident-history.md` §IP2).
 
 ### 4. Record the answer where the collector can see it.
 
@@ -272,7 +265,7 @@ States the collector recognises — anything else normalises to `UNRECOGNISED` a
 |---|---|
 | `UNRAISED` | never put to the user. **Blocks.** |
 | `RAISED` | asked, awaiting the answer. Does not block. |
-| `ANSWERED` | settled, answer recorded. |
+| `ANSWERED` | settled; requires a non-empty `answer`. |
 | `ASSUMED` | you took a position **and the user consented** to you taking it. Requires `consentBy` and `consentAt`. Without both it normalises to `UNRAISED` and blocks — a position the user never saw is not an assumption they made. |
 | `MOOT` | descoped. Genuinely dead, not quietly dropped. |
 | `UNRECOGNISED` | an unparseable status. **Blocks**, on purpose. |
@@ -285,14 +278,9 @@ from `raisedAt` and the collector reads both.
 ## An answer that points at another document is a claim, not an answer
 
 The one form of answer that reads as settled and cannot be trusted: *"X already covers this."*
-Verbatim, from a real intake (2026-09-02, Q4 "documents not yet accounted for?"):
-
-> the `.pptx` is already inside `source/<track>/` and was already used as triage input by the
-> Group A–D triage pass (see `<track>-triage.md`) — nothing additional exists outside the folder.
-
-The triage never named the deck. Two months of downstream artifacts inherited the gap, because
-once Q4 read "answered" nothing had a reason to look again. The answer *cited a document*, which
-is exactly why it was believed.
+Failure: *"the `.pptx` … was already used as triage input by the Group A–D triage pass"* — the
+triage never named the deck, and two months of artifacts inherited the gap; the answer *cited a
+document*, which is exactly why it was believed (2026-09-02, `process/baseline-incident-history.md` §IP3; also `source-triage.md`).
 
 **Rule.** Before recording an answer of the form "X already handled Y": open X and find Y in it —
 `grep -il "<Y's name>" X`. Zero hits means the answer is "not yet accounted for", whatever the
diff --git a/skills/source-triage.md b/skills/source-triage.md
index 0fab3763..42555a37 100644
--- a/skills/source-triage.md
+++ b/skills/source-triage.md
@@ -31,15 +31,11 @@ the file), or a person's waiver (`bin/gate-check.sh <project> --waive source/<re
 un-inventoried. Added files re-enter through `init --refresh` — never through memory.
 
 > **A claim that another document already handled a file is a claim to verify, not an
-> answer.** Real incident, 2026-09-02, a VBA migration: intake Q4 ("documents not yet accounted
-> for?") was closed with *"the .pptx is already inside `source/` and was already used as triage
-> input by the Group A–D triage pass"*. The triage was derived from the `.cls` exports and never
-> named the deck; its 22 diagrams — the only place the workflow engine's X/M/E semantics were
-> written down — went unread for two months of BRDs, blueprint and build plan, and a `CONFIRMED`
-> architecture decision had to be reversed. The wrong answer *reads* right because it cites a
-> document. The right form is the ledger's: **name the artifact, and let the gate grep it.** A
-> text read of a deck is not the deck either — a 25-slide, 22-image container is consumed when
-> the disposition says `--pages 25 --media 22`, not when its title appears in a summary.
+> answer.** Failure: *"the .pptx … was already used as triage input"* closed an intake question;
+> the triage never named the deck, its 22 diagrams went unread for two months, and a `CONFIRMED`
+> architecture decision was reversed (2026-09-02, `process/baseline-incident-history.md` §ST1). The right form is the ledger's:
+> **name the artifact, and let the gate grep it.** A text read of a deck is not the deck — a
+> 25-slide, 22-image container is consumed when the disposition says `--pages 25 --media 22`.
 
 **Always stand up an extractor — reuse where one already covers this stack, build new otherwise.** Field finding: reading source without an extractor missed information even on small, cleanly structured apps — manual reading is not a substitute for the coverage an extractor gives you, it's a different (weaker) tool. The extractor *is* the coverage gate: it's what lets Step 3 below actually answer "is this reliable enough to trust," instead of relying on how thorough a manual read happened to be. There is no manual-only path anymore.
 
@@ -56,12 +52,10 @@ OpenAPI/GraphQL contract, or entity/field table definitions inside a spec docume
 extractable structure, each gets its own Coverage Matrix row in Step 3, and each gets its own
 verdict.
 
-Mixed corpora are where this goes wrong, and they are the normal case in presales. The folder
-*reads* like requirements, so the whole thing is sent down the document path (`kb-generation.md`,
-Path B) and comes back as prose — including the entities that were sitting in the schema, which
-then get re-derived by hand three stages later. Prose is the right reading method for prose and
-the wrong one for structure. Choosing per artifact is this step's job; routing a whole corpus by
-how it looks at a glance is the failure it exists to prevent.
+Mixed corpora — the normal case in presales — are where this goes wrong: the folder *reads*
+like requirements, all of it goes down Path B, and the schema's entities are re-derived by hand
+three stages later (anti-patterns below). Prose is the right reading method for prose and the
+wrong one for structure.
 
 **This does not reopen the two-way call.** Path B is not "read the code by hand" — it is the
 correct method for genuine prose. For every *extractable structure* the answer is still
@@ -83,21 +77,9 @@ file" was never the manual-only path it forbids — that rule is about *structur
 exports), where a human skim demonstrably drops the tail. Nothing here lets a codebase, a schema
 or a data export past without an extractor.
 
-**Field evidence, 2026-09-07** — a no-code app replacement whose corpus was one data export
-(`.ods`), one 3.5 MB reverse-engineering spec (`.html`) and one workflow inventory (`.md`):
-
-- The **export parser corrected the documents written about it**: 53 stored columns against
-  128–175 documented (~120 are computed in the platform — neither attributes to model nor data to
-  migrate), four different spellings of one foreign key across four sheets, 15 sheets where the
-  spec documented 17, plus per-sheet volumes. No reading of any document produces one of those.
-- A **regex classifier over the spec's prose scored ~50% precision and ~50% recall** against a
-  user-confirmed sample, and was deleted the same day. It read the spec's "what the recording
-  covered" bullets as requirements, truncated sentences at inline HTML tags, and matched none of
-  the negative-form statements ("there is no role model", "no reminders, no escalation") that
-  carried some of the sharpest requirements in the document. The same agent's plain read of the
-  same file, at intake, was better in one pass.
-- The user's question is the rule in one line: *"do we need an extractor for html & md files?
-  Can't we just analyse and conclude what it should be? But when it's ppt and images better yes?"*
+**Field evidence (2026-09-07, `process/baseline-incident-history.md` §ST3):** the export parser corrected the spec written about
+it (53 stored columns against 128–175 documented); a regex classifier over the spec's prose scored
+~50% precision and recall and was deleted the same day — the agent's plain read was better.
 
 **Large text-native files still need a denominator.** A 3.5 MB HTML spec is legible but not
 readable in one pass, so the parser that takes its tables should also emit its **section list**.
@@ -123,18 +105,9 @@ For a **requirements-driven** project the two are not alternatives and the seque
 So: **document discovery is unconditional; extractors are conditional on there being structure;
 `N/A` is a finding about the folder, never a property of the entry mode.**
 
-**Why this is spelled out (2026-09-07).** `conversion-runbook.md`'s Stage-0 applicability table
-said the extraction call was **`N/A` for requirements-driven**, flatly — while this skill and the
-shipped `triage.md` header said `N/A` only where the corpus holds no extractable structure, "on
-evidence, never on the entry-mode label". The runbook is the file every session is required to
-read first, so the unconditional version was the one that got followed. On the project that
-surfaced it — requirements-driven, corpus of one spec, one workflow inventory and **one platform
-data export** — following the runbook literally would have marked extraction `N/A` and left the
-export unparsed. That parser went on to correct the very documents written about the app: 53
-stored columns against 128–175 documented, four spellings of one foreign key across four sheets,
-15 sheets where the spec said 17. Same shape as the `toolkit-guide.html` first-touch incident in
-`CLAUDE.md`: a rule stated conditionally in its owning file and unconditionally in the front
-door, where the front door wins. The runbook now defers here.
+**This skill owns the rule; the runbook defers here.** Failure: the runbook once said `N/A` for
+requirements-driven flatly, and following it would have left a data export unparsed — the parser
+that later corrected the spec (`process/baseline-incident-history.md` §ST4).
 
 | Signal | Lean toward |
 |---|---|

From 982e4e34bc2c638ea16a9f4310c75f6df763c40b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:34:38 +0000
Subject: [PATCH 09/68] process(merging): independent review before every merge

A merge go is not a review. Before any PR merges, an agent that did not
write it reviews the diff and returns MERGE / MERGE-AFTER-FIX / HOLD on
value, regression risk after sync, correctness and context cost.
Builder self-reports and green CI no longer count.

Why: nine PRs merged on 2026-10-13 on builder reports and CI alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md |  1 +
 CLAUDE.md    | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..179dd98d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- process(merging): **every PR gets an independent review before it merges — a merge go is not a review.** A reviewer that did not write the PR returns MERGE / MERGE-AFTER-FIX / HOLD on value, regression risk after sync, correctness and context cost; builder self-reports and green CI no longer count. Nine PRs merged on 2026-10-13 without one. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/CLAUDE.md b/CLAUDE.md
index 9890534d..f87bda38 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -160,6 +160,36 @@ checkpoint script, and an expert user's reaction was "I can't even compact?":
 7. **A guard must never block the action that resolves it.** Blocking the remedy is
    perverse: warn once, then let it through.
 
+## Merging a PR — independent review before every merge
+
+**A merge go from the maintainer is not a review.** Before any PR merges, an agent that did
+**not** write it reviews the diff and returns a verdict. The builder's own report and green CI
+never count: the builder grades its own work, and CI proves only the tests the builder wrote.
+
+1. **Who reviews.** A fresh agent given the PR diff and the linked issues, never the builder's
+   summary or conclusion. One reviewer per PR, plus one composition check when several PRs in a
+   batch touch the same files.
+2. **What it answers, each with file:line.** *Value*: does it fix the issue as reported, and is
+   anything overbuilt? *Regression risk*: what changes for an existing project after
+   `sync-project.sh` (new FAIL / BLIND / refusals, exit codes, output another tool parses, gate
+   verdicts that flip), across both layouts and macOS / Git Bash? *Correctness*: real bugs, tests
+   that do not test what they claim, hand-written golden input where a capture was required.
+   *Context cost*: words added to always-loaded skill files.
+3. **Verdict.** `MERGE`, `MERGE-AFTER-FIX` (exact fixes listed; the fixes are pushed and
+   re-reviewed before merge) or `HOLD` (goes back to the maintainer with the reason). Only `MERGE`
+   merges.
+4. **Report the verdict with the merge.** The message announcing a merge names the reviewer's
+   verdict and its top finding next to CI, so the maintainer sees what was checked.
+5. **No exceptions for size or urgency.** A one-line fix, a docs-only PR and an outside
+   contributor's PR all get the same review. "Small", "only skill text" and "CI is green" are how
+   the exceptions start.
+
+**Why (real incident, 2026-10-13).** Nine PRs merged in one day on the builders' own reports and
+green CI, each carrying its builder's "all checks pass". When the maintainer asked whether value
+and regression risk had been checked, the honest answer was no: nobody who had not written the
+code had read it. The same day showed the cost of unread diffs in another form — the always-loaded
+skill text hit its 80,000-word cap because each PR added words that nobody outside the PR weighed.
+
 ## Changelog and contributions
 
 **Every user-visible change appends its `CHANGELOG.md` line in the same commit.** That is the

From 8800dcb1718f062da91b3334e4c81d45b85e142c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:35:35 +0000
Subject: [PATCH 10/68] process(context): word budget is made room for by
 moving, never deleting

Rules, STOP rows, denominators and failure examples are protected.
Stories and examples move behind pointers in a separate, independently
reviewed trim PR; trim starts at 95% of the cap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md |  1 +
 CLAUDE.md    | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 179dd98d..db32f123 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - process(merging): **every PR gets an independent review before it merges — a merge go is not a review.** A reviewer that did not write the PR returns MERGE / MERGE-AFTER-FIX / HOLD on value, regression risk after sync, correctness and context cost; builder self-reports and green CI no longer count. Nine PRs merged on 2026-10-13 without one. — MendixMau
+- process(context): **the baseline word budget is made room for by moving text, never by deleting rules.** Rules, STOP rows, denominators and failure examples are protected; stories and examples move behind pointers in a separate, independently reviewed trim PR; trim starts at 95% of the cap. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/CLAUDE.md b/CLAUDE.md
index f87bda38..d60da1af 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -190,6 +190,30 @@ and regression risk had been checked, the honest answer was no: nobody who had n
 code had read it. The same day showed the cost of unread diffs in another form — the always-loaded
 skill text hit its 80,000-word cap because each PR added words that nobody outside the PR weighed.
 
+## Always-loaded skill text — the word budget
+
+`bin/render-routing.sh --check` caps the always-loaded (baseline) skill set at 80,000 words. Room is
+made by **moving** text, never by deleting the text that does the work.
+
+1. **Protected — never removed to make room:** rules, STOP rows, denominators / completion
+   criteria, and the one-line failure example each rule is paired with. Removing one needs its own
+   PR that argues the rule itself is obsolete, with an independent review.
+2. **Movable:** incident narratives, worked examples, tables of past numbers, and a rule stated a
+   second time in another baseline file. Each moves to an on-demand file and leaves a one-line
+   pointer (path) at the same spot. A move keeps the text; nothing is lost.
+3. **Every PR that adds baseline words** states the before/after count from
+   `render-routing.sh --check` in its body, and why each addition is needed at the trigger moment.
+   The independent reviewer checks that (see "Merging a PR").
+4. **At the cap, a feature PR never squeezes other text to fit.** Room comes from a separate trim
+   PR that only moves movable text; its reviewer compares removed against moved line by line, and
+   any protected line that disappeared is a HOLD.
+5. **Trim before the cap, not at it:** when the baseline passes 76,000 words (95%), the next PR
+   that adds baseline words is preceded by a trim PR.
+
+**Why (2026-10-13).** The baseline hit 79,975 of 80,000 while six open PRs each added words; a
+"make it fit" instruction inside a feature PR merged two redundant sentences in a testing skill to
+squeeze under. That one was harmless, but nothing stopped the next one from cutting a STOP row.
+
 ## Changelog and contributions
 
 **Every user-visible change appends its `CHANGELOG.md` line in the same commit.** That is the

From 4110b928da18856ec597266a1e92490a3ed74b26 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:38:48 +0000
Subject: [PATCH 11/68] =?UTF-8?q?e2e:=20review=20fixes=20=E2=80=94=20liven?=
 =?UTF-8?q?ess=20window,=20stale=20otel.js=20guard,=20old=20spans=20shape?=
 =?UTF-8?q?=20named?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- journey-runner.js: the negative-only liveness window starts at this
  journey's own start (LIVENESS_SKEW_MS = 2 s clock-skew margin), not 30 s
  earlier where the previous journey's spans counted.
- A project otel.js older than the runner (hand-edited, kept by sync)
  has no liveness(): the step reads INVALID naming the stale otel.js
  instead of a TypeError.
- spans as an array (old example shape) or {} gets an INVALID that names
  the shape; validate-journeys.js names the array shape too.
- Comment cited a non-existent fixture; "first cell" wording -> "first
  SELECT alias" (journey-examples.md, validate-journeys.js,
  full.journey.json); "16 rules" -> 19.
- CHANGELOG: callout that oqlScalar now returns the first SELECT alias.

Fixtures: test-journey-liveness.sh 36/36 (cases for the skew window, the
stale otel.js and the named shapes), test-validate-journeys-spans.sh 12/12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                |  4 +-
 examples/journeys/full.journey.json         |  4 +-
 examples/validate-journeys.js               |  6 ++-
 project-tests/e2e/journey-runner.js         | 44 ++++++++++++++++-----
 skills/journey-examples.md                  |  8 ++--
 skills/journey-proof.md                     |  2 +-
 tests/wave2/test-journey-liveness.sh        | 27 ++++++++++++-
 tests/wave2/test-validate-journeys-spans.sh |  2 +-
 8 files changed, 74 insertions(+), 23 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 100899d0..635ac9b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
-- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`); no evidence stays INVALID. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (30 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
+- fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
+- fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/examples/journeys/full.journey.json b/examples/journeys/full.journey.json
index 14e81794..59eebc2c 100644
--- a/examples/journeys/full.journey.json
+++ b/examples/journeys/full.journey.json
@@ -39,8 +39,8 @@
       "name": "supplierCode",
       "sql": "SELECT SupplierCode AS c FROM Procurement.Supplier WHERE Active = true LIMIT 1",
       "_note": [
-        "Every OQL column must be aliased — helpers.oqlScalar reads the first cell of the first",
-        "row, and mxcli rejects an unaliased SELECT. A seed that returns null or an empty",
+        "Every OQL column must be aliased — helpers.oqlScalar reads the first SELECT alias of the",
+        "first row, and mxcli rejects an unaliased SELECT. A seed that returns null or an empty",
         "string aborts the journey as INVALID (instrument absent), never FAIL (feature broken)."
       ]
     },
diff --git a/examples/validate-journeys.js b/examples/validate-journeys.js
index 992ee237..2d87dd21 100755
--- a/examples/validate-journeys.js
+++ b/examples/validate-journeys.js
@@ -51,7 +51,7 @@ function validate(j, brds) {
     if (!s.sql) add(at, 'no `sql`');
     if (s.name && seen.has(s.name)) add(at, `duplicate seed name "${s.name}"`);
     if (s.sql && !/\bAS\b/i.test(s.sql))
-      add(at, 'SQL has no column alias — oqlScalar reads the first cell and mxcli rejects an unaliased SELECT');
+      add(at, 'SQL has no column alias — oqlScalar reads the first SELECT alias and mxcli rejects an unaliased SELECT');
     for (const k of [...String(s.sql || '').matchAll(/\{\{(\w+)\}\}/g)].map(m => m[1]))
       if (!seen.has(k)) add(at, `references {{${k}}}, which is not an EARLIER seed — seeds resolve in array order`);
     if (s.name) seen.add(s.name);
@@ -111,7 +111,9 @@ function validate(j, brds) {
     // runner judges it once tracing is shown live — the step's `liveness` span, or any span from
     // the service since the journey began. `liveness` is read only for such a claim.
     const sp = st.spans;
-    if (sp) {
+    if (Array.isArray(sp)) {
+      add(`${at}.spans`, 'is an array — the old shape [{ mf, status }], which the runner never read (it records it INVALID); use { "ordered": [...], "mustNotFire": [...] }');
+    } else if (sp) {
       const ordered = sp.ordered || [];
       const mustNot = sp.mustNotFire || [];
       if (!Array.isArray(ordered)) add(`${at}.spans.ordered`, 'must be an array');
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index 5b0f20d4..a6133b23 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -127,6 +127,8 @@ const subst = (v, vars) =>
 // meant to stay declarative enough to generate from a module brief's golden-path
 // table.
 const PAUSE = ms => new Promise(r => setTimeout(r, ms));
+// Clock-skew margin for the liveness window (see runJourney's jt0).
+const LIVENESS_SKEW_MS = 2000;
 // The combobox waits below used to be fixed sleeps (400/1200/120/500 ms per field). Each now
 // waits for the thing it was sleeping for; SETTLE_MODE=fixed keeps the old sleeps for an A/B run.
 const FIXED = process.env.SETTLE_MODE === 'fixed';
@@ -323,7 +325,7 @@ async function act(page, a, vars, note) {
 // ── RUNG 2: ordered spans, as a function (called from runJourney) ───────────
 // Runs for a positive claim (ordered) OR a negative-only claim (mustNotFire with ordered
 // empty/absent) — a step whose whole proof is "this did NOT run" (#150). `capture` and
-// `live` are injected so tests/wave2/test-journey-negative-trace.sh drives it with a
+// `live` are injected so tests/wave2/test-journey-liveness.sh drives it with a
 // captured Jaeger trace and no browser. `rec(name, verdict, detail)` records one row.
 //
 // NEGATIVE-ONLY NEEDS A LIVENESS REFERENCE. Zero spans in the step window is what a correct
@@ -334,15 +336,24 @@ async function act(page, a, vars, note) {
 // the step's declared `spans.liveness` span, or any span from the service since the
 // journey began (otel.js liveness). No evidence → INVALID, naming which.
 async function traceRung(step, { t0, since, rec, capture = null, live = O.liveness }) {
-  const claimed = (step.spans && step.spans.ordered) || [];
-  const mustNot = (step.spans && step.spans.mustNotFire) || [];
   if (!step.spans) return;
   // A spans block that declares nothing this rung reads reads as a trace claim in the journey
-  // file and proves nothing — said out loud, never skipped (#150 item 3).
+  // file and proves nothing — said out loud, never skipped (#150 item 3). The array shape
+  // [{ mf, status }] is the old example.journey.json shape, named as such.
+  const shape = Array.isArray(step.spans) ? 'array'
+    : typeof step.spans !== 'object' ? typeof step.spans : 'object';
+  const claimed = (shape === 'object' && Array.isArray(step.spans.ordered)) ? step.spans.ordered : [];
+  const mustNot = (shape === 'object' && Array.isArray(step.spans.mustNotFire)) ? step.spans.mustNotFire : [];
   if (!claimed.length && !mustNot.length) {
+    const why = shape === 'array'
+      ? 'spans is an array — the old shape [{ mf, status }], which the runner never read; use { "ordered": [...], "mustNotFire": [...] }'
+      : shape !== 'object'
+        ? `spans is a ${shape} — use { "ordered": [...], "mustNotFire": [...] }`
+        : !Object.keys(step.spans).length
+          ? 'spans is {} — declares neither `ordered` nor `mustNotFire`'
+          : 'spans block declares neither `ordered` nor `mustNotFire`';
     rec(`${step.name}: spans`, 'INVALID',
-        'spans block declares neither `ordered` nor `mustNotFire` — nothing to evaluate; trace rung did NOT run. ' +
-        'Declare the claim or remove the block.');
+        `${why} — nothing to evaluate; trace rung did NOT run. Declare the claim or remove the block.`);
     return;
   }
   const negOnly = !claimed.length;
@@ -355,6 +366,16 @@ async function traceRung(step, { t0, since, rec, capture = null, live = O.livene
                       : await O.capture(t0, { min: 1, until: until });
   const real = spans.length;
   if (negOnly && (!real || probe)) {
+    // A project whose otel.js was hand-edited keeps it across a sync (it is not in the hold
+    // set with this file), so a new runner can meet an otel.js older than liveness(). Say so,
+    // never TypeError.
+    if (typeof live !== 'function') {
+      rec(`${step.name}: spans`, 'INVALID',
+          'negative-only claim needs otel.js liveness(), which this project\'s tests/e2e/otel.js does not export — ' +
+          'it is older than journey-runner.js (a locally edited copy kept by sync). Merge the toolkit\'s otel.js. ' +
+          'Trace rung did NOT run.');
+      return;
+    }
     const lv = await live(since, { name: probe, spans });
     if (!lv.ok) {
       rec(`${step.name}: spans`, 'INVALID',
@@ -690,9 +711,12 @@ async function resetToStart(page) {
 }
 
 async function runJourney(page, j) {
-  // Journey start, a little before: the window a negative-only span claim's liveness check
-  // reads (the navigation that resetToStart just made counts as evidence tracing is live).
-  const jt0 = Date.now() - 30000;
+  // Journey start: the window a negative-only span claim's liveness check reads. Only this
+  // journey's own spans count — never the previous journey's, nor other users' from before
+  // it began. LIVENESS_SKEW_MS (2 s) absorbs clock skew between this host and the runtime's
+  // span timestamps (Jaeger stamps with the runtime's clock); it is far shorter than any
+  // journey, so a span from the previous one cannot fall inside it in practice.
+  const jt0 = Date.now() - LIVENESS_SKEW_MS;
   console.log(`\n=== JOURNEY ${j.id} — ${j.title || ''}`);
   console.log(`    persona: ${j.persona || cfg.user}   requirements: ${(j.requirement || []).join(', ') || '(none declared)'}`);
 
@@ -1311,7 +1335,7 @@ module.exports = {
   runExitCode, personaMismatch,
   classifyAdminProbe, journeyNeedsAdmin, missingEnv, preflight, orderJourneys, stateTracker,
   judgeLanding,
-  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown,
+  traceRung, controlMutants, forbiddenSample, probeApp, appGate, flagAppDown, LIVENESS_SKEW_MS,
 };
 
 // ── Main ────────────────────────────────────────────────────────────────────
diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index e12859c1..5ac49cdc 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -25,7 +25,7 @@ The domain is invented (purchase requests and a supplier catalogue). Nothing in
 any real project.
 
 ```bash
-node examples/validate-journeys.js --selftest                                  # 16 rules, each watched going red
+node examples/validate-journeys.js --selftest                                  # 19 rules, each watched going red
 node examples/validate-journeys.js --brd examples/brd examples/journeys/*.json # the examples themselves
 node examples/validate-journeys.js --brd <brdDir> journeys/*.journey.json      # your project
 ```
@@ -91,7 +91,7 @@ none of the fields run exactly as before.
 | Field | Required? | Behaviour |
 |---|---|---|
 | `name` | yes | becomes `{{name}}` |
-| `sql` | yes | run through `helpers.oqlScalar` — **first cell of the first row**. Every column must be aliased (`AS n`); mxcli rejects an unaliased `SELECT`. |
+| `sql` | yes | run through `helpers.oqlScalar` — **the first SELECT alias of the first row** (never the alphabetically-first key mxcli prints). Every column must be aliased (`AS n`); mxcli rejects an unaliased `SELECT`. |
 
 - Seeds resolve **in array order** and may reference **earlier** seeds. That is the whole reason
   `supplierName` is keyed off `supplierCode` rather than being a second `LIMIT 1`: two unordered
@@ -184,7 +184,7 @@ proof is "X did not run" declares `mustNotFire` alone. Cancel on a reset confirm
 The step can rightly capture zero spans, and so does Jaeger down. So the runner waits the full
 capture window and then needs one piece of evidence that tracing was live:
 - the `liveness` span was captured; or, with no `liveness` declared,
-- any span from the service since the journey began.
+- any span from the service since this journey began (a 2 s clock-skew margin; the previous journey's spans do not count).
 
 With no evidence the step is `INVALID`, never a pass. If the step's capture is non-empty and no
 `liveness` is declared, those spans count as the evidence. Declare `liveness` whenever the step has
@@ -329,7 +329,7 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 ## Honesty note
 
 The three example journeys **have never been executed.** There is no app behind
-`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 16 rules
+`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 19 rules
 in `validate-journeys.js`, whose own `--selftest` shows each of those rules going red on a
 deliberately broken input. Everything stated about runner behaviour was read out of
 `tests/e2e/journey-runner.js`, `helpers.js` and `otel.js`; anything that could not be settled by
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index d637880d..87b9d0ca 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -193,7 +193,7 @@ The runner waits the full capture window, then asks for evidence that tracing wa
 | Evidence | Verdict |
 |---|---|
 | the step declares `"liveness": "<span>"` (a span the step is known to produce, such as the page's data-source retrieve) and it was captured | judged: `tracing live` PASS, then each `did not run` |
-| no declared span; the service emitted ≥1 span since the journey started (`otel.liveness`) | judged, same rows |
+| no declared span; the service emitted ≥1 span since this journey started (2 s clock-skew margin, so the previous journey's spans do not count; `otel.liveness`) | judged, same rows |
 | declared span missing, service silent, or Jaeger unreachable | `INVALID`: the claim is not judged |
 
 The `trace-negative` control mutant covers this shape too. It injects the forbidden name into the
diff --git a/tests/wave2/test-journey-liveness.sh b/tests/wave2/test-journey-liveness.sh
index 3d9d4fbc..6995c869 100644
--- a/tests/wave2/test-journey-liveness.sh
+++ b/tests/wave2/test-journey-liveness.sh
@@ -114,6 +114,25 @@ if (typeof R.traceRung !== 'function' || typeof O.liveness !== 'function') { con
   out('T_NOTHING', await run({ name: 'Save', spans: { ordered: [] } }, goldSpans, true));
   out('T_LEGACY', await run({ name: 'Save', spans: [{ mf: 'M.ACT_Save', status: 'OK' }] }, goldSpans, true));
   out('T_NOSPANS', await run({ name: 'Save' }, goldSpans, true));
+  out('T_EMPTYOBJ', await run({ name: 'Save', spans: {} }, goldSpans, true));
+
+  // review item 5: the liveness window starts at THIS journey's start (small skew margin only)
+  const newest = Math.max(...goldSpans.map(s => s.start)) / 1000;   // ms
+  const skew = R.LIVENESS_SKEW_MS;
+  body = full;
+  out('W_SKEW', skew);
+  out('W_PREV', (await O.liveness(newest + 30000 - skew)).ok);   // spans from 30 s before the journey: not evidence
+  out('W_OWN', (await O.liveness(newest - skew)).ok);            // a span right at the journey start: evidence
+
+  // review item 4: a project's older otel.js without liveness() — runner says so, never TypeError
+  const saved = O.liveness;
+  delete O.liveness;
+  try {
+    const rows = [];
+    await R.traceRung(neg, { t0: 0, since: 0, rec: (n, v, d) => rows.push(`${v} ${n} :: ${d}`), capture: async () => [] });
+    out('T_STALE_OTEL', rows);
+  } catch (e) { out('T_STALE_OTEL', `THREW ${e.constructor.name}: ${e.message}`); }
+  O.liveness = saved;
   out('T_POS_OK', (await run(pos, goldSpans, false)).map(r => r.split(' :: ')[0]));
 
   // the trace-negative mutant for a negative-only journey
@@ -182,7 +201,13 @@ case "$(line T_DECL_MISS)" in '["INVALID Cancel: spans :: '*'declared liveness s
   && ok "positive claim over the golden → unchanged rows" || bad "positive-claim rows changed" "$(line T_POS_OK)"
 
 case "$(line T_NOTHING)" in '["INVALID Save: spans :: spans block declares neither `ordered` nor `mustNotFire`'*) ok "spans block with neither field → loud INVALID (#150 item 3)" ;; *) bad "empty spans block skipped silently" "$(line T_NOTHING)" ;; esac
-case "$(line T_LEGACY)" in '["INVALID Save: spans :: '*) ok "array-shaped spans (a shape the runner does not read) → INVALID" ;; *) bad "unreadable spans shape skipped" "$(line T_LEGACY)" ;; esac
+case "$(line T_LEGACY)" in '["INVALID Save: spans :: spans is an array — the old shape'*'use { \"ordered\": [...], \"mustNotFire\": [...] }'*) ok "array-shaped spans → INVALID that names the old shape and the new one" ;; *) bad "array shape not named" "$(line T_LEGACY)" ;; esac
+case "$(line T_EMPTYOBJ)" in '["INVALID Save: spans :: spans is {}'*) ok "spans {} → INVALID that says it is empty" ;; *) bad "empty object not named" "$(line T_EMPTYOBJ)" ;; esac
+case "$(line T_STALE_OTEL)" in '["INVALID Cancel reset: spans :: negative-only claim needs otel.js liveness()'*'older than journey-runner.js'*) ok "older otel.js without liveness() → INVALID naming the stale otel.js, no TypeError" ;; *) bad "stale otel.js not handled" "$(line T_STALE_OTEL)" ;; esac
+S="$(line W_SKEW)"; { [ -n "$S" ] && [ "$S" -gt 0 ] && [ "$S" -le 5000 ]; } && ok "liveness skew margin is small ($S ms)" || bad "skew margin missing or wide" "$S"
+[ "$(line W_PREV)" = false ] && ok "spans from 30 s before the journey began are NOT liveness evidence" || bad "previous journey's spans counted" "$(line W_PREV)"
+[ "$(line W_OWN)" = true ] && ok "a span at the journey's own start is evidence" || bad "own span not counted" "$(line W_OWN)"
+if grep -q 'const jt0 = Date.now() - LIVENESS_SKEW_MS;' "$SUT"; then ok "runJourney's liveness window starts at the journey start minus the skew margin"; else bad "runJourney's liveness window is not the journey start"; fi
 [ "$(line T_NOSPANS)" = '[]' ] && ok "no spans block → no trace rows (nothing claimed)" || bad "a step without spans produced trace rows" "$(line T_NOSPANS)"
 
 echo "== T3: trace-negative positive control for a negative-only claim =="
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
index d87ce0a7..0c55ee6c 100644
--- a/tests/wave2/test-validate-journeys-spans.sh
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -64,7 +64,7 @@ echo "== T2: what the runner cannot read is still a problem =="
 run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
   && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
 printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
-run legacy; [ "$RC" -eq 1 ] && ok "array-shaped spans (no ordered/mustNotFire) → problem" || bad "legacy array shape accepted" "$OUT"
+run legacy; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'is an array — the old shape'; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
 run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
   && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
 run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \

From 7f73f8d5e3e4b6d3a181cf36186374afd55f6bc3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:40:49 +0000
Subject: [PATCH 12/68] docs(journey-examples): rule count 19, without
 rewriting the example-domain line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 skills/journey-examples.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/skills/journey-examples.md b/skills/journey-examples.md
index 5ac49cdc..4b02ee96 100644
--- a/skills/journey-examples.md
+++ b/skills/journey-examples.md
@@ -329,8 +329,8 @@ Stated so a reader is not surprised, and so whoever owns the spec can decide whi
 ## Honesty note
 
 The three example journeys **have never been executed.** There is no app behind
-`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 19 rules
-in `validate-journeys.js`, whose own `--selftest` shows each of those rules going red on a
+`Procurement.PurchaseRequest`. They are validated statically — they parse, and they pass all 16 rules
+in `validate-journeys.js` (19 since #150), whose own `--selftest` shows each of those rules going red on a
 deliberately broken input. Everything stated about runner behaviour was read out of
 `tests/e2e/journey-runner.js`, `helpers.js` and `otel.js`; anything that could not be settled by
 reading is marked *not verified* rather than guessed.

From 76075d8a08d9daf243a7ec03aca5e39373a44de1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:44:55 +0000
Subject: [PATCH 13/68] =?UTF-8?q?fix(trim):=20review=20follow-ups=20?=
 =?UTF-8?q?=E2=80=94=20dispatch=20obligation=20pointer,=20stale=20"below",?=
 =?UTF-8?q?=20ST1=20id?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent review of #315: obligations.tsv still pointed at agent-roles.md for
step 8a, which moved to agents/README.md; agent-roles.md said the example bodies
are "below"; the history header cited a non-existent section id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 bin/lib/obligations.tsv              | 5 +++--
 process/baseline-incident-history.md | 2 +-
 skills/agent-roles.md                | 4 +++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bin/lib/obligations.tsv b/bin/lib/obligations.tsv
index 3bbb40c8..3c912083 100644
--- a/bin/lib/obligations.tsv
+++ b/bin/lib/obligations.tsv
@@ -137,8 +137,9 @@ fidelity	mdl	module	names	docs/PAGE-FIDELITY.tsv	no	yes	5	skills/ui-loop.md
 # module's own dispatch history. It is owed by mdl because mdl-agent is the one that knows, at
 # the moment of writing, whether it is the one writing.
 #
-# Column 9 names skills/agent-roles.md, not agents/mdl-agent.md: agent-roles.md's "Workflow"
-# step 8a is what actually specifies the log line, its path and format, and the discharge rule
+# Column 9 names skills/agent-roles.md, not agents/mdl-agent.md: the mdl-agent "Workflow" step 8a
+# (its full text now lives in agents/README.md, pointed to from agent-roles.md) specifies the log
+# line, its path and format, and the discharge rule
 # ("owes no denominator, just the line") — that is the governing text this column exists to
 # point at. The agent stub is the performer named in column 2 (mdl); it is not itself a skill
 # and holds no verdict of its own to point to (review of PR #99, 2026-09).
diff --git a/process/baseline-incident-history.md b/process/baseline-incident-history.md
index 9a3fe133..c863ea2d 100644
--- a/process/baseline-incident-history.md
+++ b/process/baseline-incident-history.md
@@ -7,7 +7,7 @@ moved verbatim so the evidence survives while the baseline stays inside the
 `bin/render-routing.sh --check` word budget (CLAUDE.md skill-authoring rule 6, "write for the
 trigger, then stop").
 
-Each section id (`R1`, `AR2`, …) is what the pointer in the skill cites. The section text is
+Each section id (`R1`, `ST1`, …) is what the pointer in the skill cites. The section text is
 the original wording, unedited — when a rule's justification is challenged, cite from here.
 Nothing in this file is a rule on its own; the rule lives in the skill that points here.
 
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index d9aca394..ba9c2e2a 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -14,7 +14,9 @@
 - You're asked to "set up agents for this project" or "create dev-process agents" on a fresh repo.
 - An existing project's agents feel ad hoc or over-permissioned (e.g. one agent can both write MDL and run `mxcli exec`).
 
-**This is a generation guide, not a copy-paste template.** The example bodies below are illustrative shapes — read the target project's own CLAUDE.md and skills first, then write agent files that match *that* project's actual commands, paths, and tooling. A gate-agent pointed at the wrong `.mpr` filename or a stale compile-gate command silently verifies nothing.
+**This is a generation guide, not a copy-paste template.** The example bodies (in `agents/README.md`) are illustrative shapes — read the target project's own CLAUDE.md and skills first, then write agent files that match *that* project's actual commands, paths, and tooling. A gate-agent pointed at the wrong `.mpr` filename or a stale compile-gate command silently verifies nothing.
+
+**Discharging the `dispatch` obligation:** the mdl-agent logs every dispatch per Workflow step 8a — the log line, path (`.claude/loop/dispatch/<Module>/scripts.tsv`) and format are in `agents/README.md` step 8a; one line per dispatch, no denominator owed.
 
 **Mechanical scaffolding exists:** `bin/init-agents.sh <session-root> [p|build|all]` copies stub versions of all **six** agents (from the toolkit's `agents/` folder) into the project's `.claude/agents/` — `p` for the Stage-P pair (ba/architect), `build` for the Stage-5 quartet (mdl/gate/test/**review**). The stubs are safe by construction: each refuses to run while `{{PLACEHOLDER}}`s remain, so "downloaded but never configured" fails loudly instead of verifying nothing. Your job after scaffolding is Steps 1–4 below: fill every placeholder from the *actual* project, including the **Domain context** block.
 

From 18c9a616da9f2fcf24ab9be5d180dbb9b8a2cfb1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:45:22 +0000
Subject: [PATCH 14/68] fix(lint-rules): the remedy lint-gate prints always
 clears it; deliberate opt-out; prune stale receipt rows (#264 review)

Review of #308 (MERGE-AFTER-SMALL-FIX):

1. bin/lib/install-lint-rules.sh: a rule whose receipt row exists and whose `# mxtk-lint-rule:`
   header is gone is restored even when its hash is not in STOCK-HASHES.txt (an mxcli newer
   than the list, then init). It used to fall into the foreign branch -> LOCALLY MODIFIED, never
   written, so lint-gate stayed BLIND forever. Same test lint-gate uses; the found file is kept
   as <rule>.reseeded-<ts>. lint-gate's message adds the fallback
   `sync-project.sh <root> --upgrade-lint-rules all`.
2. Deliberate opt-out: .claude/lint-rules-disabled.txt. The installer never installs/restores a
   listed rule and prunes its receipt row; lint-gate skips it. lint-rules/README.md (txt002 row,
   CONV010 prefix note) now says list-then-delete, with an "Opting out of a rule" section.
3. The installer prunes receipt rows for rules no longer in MXTK_LINT_RULES /
   MXTK_LINT_RULES_CONFIGURABLE, so a retired rule is not "gone" forever.
4. skills/learned-mdl-preflight.md row 28 cut to trigger + rule + one-line failure (60 words,
   was ~230); the narrative stays in BUG-156.

Fixture tests/wave2/test-lint-receipt-revert.sh T9-T11 (INSTALLER= swaps the installer):
T9 uses a genuine stock body (toolkit entity_business_key minus header, md5 d66528c9 = the
v0.24.0/v0.25.0 stock hash in STOCK-HASHES.txt) under a scratch toolkit that does not list the
hash and whose rule has moved off stock. 38/38 here; 9 fail with master's installer, 21 with
master's installer + lint-gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |  2 +-
 bin/lib/install-lint-rules.sh           | 65 +++++++++++++++++++++++++
 lint-rules/README.md                    | 14 +++++-
 project-bin/lint-gate.sh                | 23 +++++++--
 skills/learned-mdl-preflight.md         |  2 +-
 tests/wave2/test-lint-receipt-revert.sh | 62 +++++++++++++++++++++++
 6 files changed, 159 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25201fa2..7c0a17a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer: 23/23 here, 11 fail on master's lint-gate. — AlvinnYeo
+- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the printed remedy always clears it, `bin/lib/install-lint-rules.sh` now restores a rule whose receipt row exists and whose header is gone even when its stock hash is not in `STOCK-HASHES.txt` (an mxcli upgrade, then init; it was reported LOCALLY MODIFIED and never written), prunes receipt rows for rules no longer shipped, and honours a new `.claude/lint-rules-disabled.txt` opt-out that lint-gate also reads (`lint-rules/README.md` told projects to delete txt002, which would now read as a re-seed). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 38/38 here, 21 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/install-lint-rules.sh b/bin/lib/install-lint-rules.sh
index 9c157891..c864520a 100644
--- a/bin/lib/install-lint-rules.sh
+++ b/bin/lib/install-lint-rules.sh
@@ -114,6 +114,46 @@ _mxtk_lint_receipt_set() {
   } > "$_tmp" && mv "$_tmp" "$_receipt"
 }
 
+# DELIBERATE OPT-OUT. .claude/lint-rules-disabled.txt, one rule file per line ('#' comments).
+# A rule listed there is never installed or restored, and its receipt row is pruned, so
+# deleting it is not undone by the next sync and lint-gate.sh (which reads the same file) does
+# not report the deletion as a re-seed. Deleting a rule without listing it is what `mxcli init`
+# does, and is treated as such.
+_mxtk_lint_is_disabled() {
+  # Own variable names: callers loop with _n/_m/_f, and these are not `local` (POSIX sh).
+  _dis_file="$1"; _dis_want="$2"
+  [ -f "$_dis_file" ] || return 1
+  while read -r _dis_n _dis_rest; do
+    case "$_dis_n" in ''|'#'*) continue ;; esac
+    [ "$_dis_n" = "$_dis_want" ] && return 0
+  done < "$_dis_file"
+  return 1
+}
+
+# Drop receipt rows for rules this toolkit no longer ships, or that the project disabled.
+# A stale row would make lint-gate.sh report the rule "gone" on every run, forever.
+_mxtk_lint_receipt_prune() {
+  _receipt="$1"; _keep=" $2 "; _dis="$3"
+  [ -f "$_receipt" ] || return 0
+  _pruned=""; _tmp="$_receipt.tmp.$$"
+  {
+    printf '# md5 of each toolkit lint rule AS INSTALLED. Written by bin/lib/install-lint-rules.sh.\n'
+    printf '# Do not edit. Deleting this file makes a revert-to-stock look like a first install.\n'
+    while read -r _n _m _r; do
+      case "$_n" in ''|'#'*) continue ;; esac
+      case "$_keep" in *" $_n "*) ;; *) _pruned="$_pruned $_n"; continue ;; esac
+      if _mxtk_lint_is_disabled "$_dis" "$_n"; then _pruned="$_pruned $_n"; continue; fi
+      printf '%s  %s\n' "$_n" "$_m"
+    done < "$_receipt"
+  } > "$_tmp"
+  if [ -n "$_pruned" ]; then
+    mv "$_tmp" "$_receipt"
+    echo "Lint receipt: dropped row(s) for rules no longer shipped or disabled here:$_pruned"
+  else
+    rm -f "$_tmp"
+  fi
+}
+
 mxtk_install_lint_rules() {
   _tk="$1"; _proj="$2"; _dry="${3:-0}"; _upg="${4:-}"
 
@@ -123,6 +163,7 @@ mxtk_install_lint_rules() {
   _dst_dir="$_proj/.claude/lint-rules"
   _hashes="$_src_dir/STOCK-HASHES.txt"
   _receipt="$_proj/.claude/.mxtk-lint-receipt"
+  _disabled="$_proj/.claude/lint-rules-disabled.txt"
 
   if [ ! -d "$_src_dir" ]; then
     _mxtk_lint_warn "Toolkit has no lint-rules/ — this project's lint rules were not checked."
@@ -157,6 +198,7 @@ mxtk_install_lint_rules() {
     for _f in $_list; do
       _src="$_src_dir/$_f"; _dst="$_dst_dir/$_f"
       [ -f "$_src" ] || continue
+      _mxtk_lint_is_disabled "$_disabled" "$_f" && continue
       _srcmd5="$(portable_md5 "$_src")" || continue
       _rec="$(_mxtk_lint_receipt_get "$_receipt" "$_f" 2>/dev/null || true)"
 
@@ -240,6 +282,27 @@ mxtk_install_lint_rules() {
         continue
       fi
 
+      # ---- installed by us, header gone, stock hash not on file -----------------------
+      # The receipt says we installed this file, and the provenance header is gone. That is
+      # a re-seed by an mxcli version STOCK-HASHES.txt does not list yet (an upgrade, then
+      # init), not a hand edit: a hand edit keeps the header. The same test lint-gate.sh uses
+      # to declare the run BLIND, so the remedy it prints (sync) actually clears it (#264
+      # review: without this branch the file was reported LOCALLY MODIFIED and never written,
+      # and lint stayed BLIND forever). The found file is kept beside it, not loaded by lint.
+      if [ -n "$_rec" ] && ! grep -q '^# mxtk-lint-rule:' "$_dst"; then
+        _why="REVERTED TO STOCK — header gone and its hash is not in STOCK-HASHES.txt (newer mxcli?). Restoring it"
+        if [ "$_dry" -eq 1 ]; then
+          echo "Would install: .claude/lint-rules/$_f ($_why)"
+        else
+          _bak="$_dst.reseeded-$(date +%Y%m%d%H%M%S)"
+          cp "$_dst" "$_bak"
+          cp "$_src" "$_dst" && _mxtk_lint_receipt_set "$_receipt" "$_f" "$_srcmd5"
+          echo "Lint rule: $_why — .claude/lint-rules/$_f (found copy kept at $(basename "$_bak"); md5 $_dstmd5 — add it to STOCK-HASHES.txt if it is a stock seed)"
+        fi
+        MXTK_LINT_CHANGES=$((MXTK_LINT_CHANGES + 1))
+        continue
+      fi
+
       # ---- configurable and edited: this is the EXPECTED state, not drift ------------
       # conv020 ships with PROJECT_MODULES empty and refuses to run until it is filled in.
       # Refreshing it would silently un-configure the rule and send it back to inspecting
@@ -283,5 +346,7 @@ mxtk_install_lint_rules() {
   if [ -n "$_drifted" ] && [ -z "$_upg" ]; then
     echo "   (upgrade every drifted lint rule at once with: --upgrade-lint-rules all)"
   fi
+  [ "$_dry" -eq 1 ] || _mxtk_lint_receipt_prune "$_receipt" \
+    "${MXTK_LINT_RULES:-} ${MXTK_LINT_RULES_CONFIGURABLE:-}" "$_disabled"
   return 0
 }
diff --git a/lint-rules/README.md b/lint-rules/README.md
index 81b2cfd4..672e033a 100644
--- a/lint-rules/README.md
+++ b/lint-rules/README.md
@@ -18,7 +18,7 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 | `perf002_nested_data_widgets.star` | PERF002 — a data view / list view / data grid / gallery nested inside two or more other data widgets on the same page: re-queries per row at every level | `MAX_NESTING`, `DATA_WIDGET_CANDIDATES`, `EXCLUDE` (widget_type vocabulary: probe first) |
 | `perf004_npe_system_user_assoc.star` | PERF004 — an association between a non-persistable entity and System.User / System.Session (or an entity generalizing them), which pins session objects to the shared side | `NON_PERSISTABLE_CANDIDATES`, `SYSTEM_TARGETS` (entity_type vocabulary: probe first) |
 | `txt001_build_words_in_user_text.star` | TXT001 — user-visible text (titles, captions, templates, messages, menu items) holding build-process words: `Stage N`, `BR-10`, `F004`, TODO, a version tag, "(local, …)" | `PROJECT_WORDS` (sibling-app and project code names); `LEAK_PATTERNS` if "Stage N" is a real domain word |
-| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — delete it deliberately if the project's display standard is not ISO |
+| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — to opt out (display standard is not ISO), list it in `.claude/lint-rules-disabled.txt`, then delete it |
 | `ui001_widget_layout_traps.star` | UI001 — a list view inside a Data grid 2 column (its own "Load more" / "No items found" in every cell); an inline `width` on an Atlas input without `flex` (ignored) | `DATAGRID_TYPES`, `LISTVIEW_TYPES`, `INPUT_TYPES` (widget_type vocabulary: probe first) |
 
 `err001` and `loop001` first field count (2026-10-12, mxcli 0.26.0, 21-module Mendix 11.12 model,
@@ -107,7 +107,17 @@ the real prefix produces none. `bin/lint-gate.sh` treats `module == "_rule"` as
 this turns a silent pass into a gate failure rather than a line in a report nobody reads.
 
 Set `ACTION_PREFIX` / `DELEGATE_PREFIX` to your project's prefixes. If the project has no such
-convention, delete the rule deliberately rather than leaving it inert.
+convention, opt out deliberately rather than leaving it inert: list the file in
+`.claude/lint-rules-disabled.txt`, then delete it (see "Opting out of a rule" below).
+
+## Opting out of a rule
+
+List the rule file, one per line, in `.claude/lint-rules-disabled.txt`, then delete it from
+`.claude/lint-rules/`. A bare delete does not stick: `sync-project.sh` restores a rule it
+installed before, and `bin/lint-gate.sh` reads a rule that its receipt lists but that is missing
+as a `mxcli init` re-seed, so every exec reports `LINT BLIND` (#264). With the rule listed,
+the installer neither installs nor restores it and drops its receipt row, and lint-gate
+skips it.
 
 ## How these reach a project
 
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index ac88c496..eca387c1 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -34,8 +34,10 @@
 # rewrites the receipt, so the next run is clean) and exits 1 without linting; --update-baseline
 # is refused, since baselining stock counts is how the five-day case went in. A rule that still
 # carries the header but differs is a hand edit — install-lint-rules.sh reports those, this does
-# not. No receipt = nothing to compare (pre-receipt installs) = no check. A deliberate headerless
-# local rule: LINT_RULES_REVERTED_OK=1 runs anyway, with the warning.
+# not. No receipt = nothing to compare (pre-receipt installs) = no check. A rule removed on
+# purpose is listed in .claude/lint-rules-disabled.txt (the installer honours the same file and
+# prunes its receipt row). A deliberate headerless local rule: LINT_RULES_REVERTED_OK=1 runs
+# anyway, with the warning.
 #
 # ACCEPTING DEBT IS RECORDED, NOT SILENT (2026-10-12). Three toolkit-built apps re-baselined
 # 61 times in four days — every acceptance made by the agent whose script caused the rise,
@@ -128,7 +130,7 @@ while [ $# -gt 0 ]; do
               REASON="$2"; shift ;;
     --reason=*) REASON="${1#--reason=}" ;;
     --approved-in-chat) APPROVED=1 ;;
-    -h|--help) sed -n '2,60p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,62p' "$0"; exit 0 ;;
     *) echo "lint-gate: unknown argument '$1'" >&2; exit 2 ;;
   esac
   shift
@@ -158,12 +160,20 @@ if [ -f "$RECEIPT" ]; then
   # Read into a variable first: a heredoc inside $(...) does not parse on bash 3.2.
   IFS= read -r -d '' _RCHK <<'PY' || true
 import hashlib, os
-rec, d = os.environ["RECEIPT"], os.environ["RULES_DIR"]
+rec, d, dis = os.environ["RECEIPT"], os.environ["RULES_DIR"], os.environ["DISABLED"]
+disabled = set()
+if os.path.isfile(dis):
+    for line in open(dis, encoding="utf-8", errors="replace"):
+        w = line.split()
+        if w and not w[0].startswith("#"):
+            disabled.add(w[0])
 for line in open(rec, encoding="utf-8", errors="replace"):
     parts = line.split()
     if len(parts) < 2 or parts[0].startswith("#"):
         continue
     name, want = parts[0], parts[1]
+    if name in disabled:
+        continue  # deliberate opt-out, .claude/lint-rules-disabled.txt
     path = os.path.join(d, name)
     if not os.path.isfile(path):
         print("%s\tgone (installed per the receipt, missing now)" % name)
@@ -176,7 +186,7 @@ for line in open(rec, encoding="utf-8", errors="replace"):
         continue  # header kept: a hand edit, which install-lint-rules.sh reports
     print("%s\theader gone, md5 %s != receipt %s" % (name, got[:8], want[:8]))
 PY
-  REVERTED="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" "$PY" -c "$_RCHK")"
+  REVERTED="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" DISABLED="$ROOT/.claude/lint-rules-disabled.txt" "$PY" -c "$_RCHK")"
   if [ -n "$REVERTED" ]; then
     TKR=""
     type find_toolkit_root >/dev/null 2>&1 && TKR="$(PROJECT_ROOT="$ROOT" find_toolkit_root 2>/dev/null || true)"
@@ -186,6 +196,9 @@ PY
     echo ""
     echo "   Restore the toolkit rules (rewrites .claude/.mxtk-lint-receipt), then re-run:"
     echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT"
+    echo "   If sync reports a rule LOCALLY MODIFIED instead of restoring it:"
+    echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT --upgrade-lint-rules all"
+    echo "   Removed one on purpose? List it in .claude/lint-rules-disabled.txt and this stops."
     if [ "${LINT_RULES_REVERTED_OK:-}" = "1" ]; then
       echo "   LINT_RULES_REVERTED_OK=1 — linting anyway; counts below are from the files on disk."
       echo ""
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index 2c72f814..8acf7c76 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -60,7 +60,7 @@ Re-probed on mxcli v0.24.0 / Mendix 11.13.0 (2026-09-30); rules that now work or
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column over an **association** | **STOP → write the column path unquoted.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`. v0.24.0: passes `check --references`, then `[CE1613] attribute 'Mod.Entity."Assoc_A_B/Name"' no longer exists` at `mx check`; the unquoted form builds at 0 errors, and so does `sort by Assoc/Attr`. `BUG-DRAFT-dg2-association-path-bindings` |
 | 27 | *(retired 2026-09-30 — marketplace install by content id and by `--file` both stamp `FromAppStore`, `AppStoreGuid`, `PackageId` and `Version` (BSON-verified; `SHOW MODULES` shows `Marketplace v<version>`); how Studio Pro groups the module was not testable)* | | |
-| 28 | Change an existing microflow **near a `return` in a dense flow** (`create or modify microflow`, or an `alter microflow` insert before the return) | **Plan drop + create in the same script, not a splice — and run `show access on microflow Mod.Name` first.** A passing `check -p --references` is not evidence here: it does not run exec's free-room test, though it prints "no flow change exec would refuse". If `show access` lists grants, restate them after the create (not field-proven: the field case had none). Row 21 applies to the restatement. | v0.25.0, Mendix 11.14.0, 2026-10-11: `check` passed; exec refused with `create or modify microflow Common.IVK_X: this change cannot be spliced into the stored flow ... insert before return $LiveResult: there is no free room for the fragment ... drawn over the ActionActivity at (2025, 200)` and exec.sh restored the snapshot. `alter microflow` insert takes no `@position`, cannot move objects, and cannot replace a fragment that returns, so drop + create was the only write. BUG-156. |
+| 28 | Change an existing microflow near a `return` in a dense flow | **Plan drop + create in one script, after `show access on microflow` (re-grant what it lists).** A passing `check -p --references` skips exec's free-room test. | v0.25.0: `check` passed, exec refused `insert before return $LiveResult: there is no free room for the fragment`. BUG-156 |
 
 **Default to the CLI for everything in the table above that is not a STOP row** (`./bin/exec.sh`, Studio Pro closed).
 
diff --git a/tests/wave2/test-lint-receipt-revert.sh b/tests/wave2/test-lint-receipt-revert.sh
index 85057c28..5223d4f7 100755
--- a/tests/wave2/test-lint-receipt-revert.sh
+++ b/tests/wave2/test-lint-receipt-revert.sh
@@ -2,6 +2,7 @@
 # Fixture for project-bin/lint-gate.sh's receipt check (#264) and exec.sh's reading of it.
 #
 # Usage: bash test-lint-receipt-revert.sh [path-to-lint-gate.sh]
+#   INSTALLER=<install-lint-rules.sh> swaps the installer under test in T9-T11.
 #
 # Field case (two toolkit-built apps, mxcli v0.25.0, 2026-10-07 and 2026-10-11): `mxcli init`
 # re-seeded .claude/lint-rules/ and the toolkit rules lost their `# mxtk-lint-rule:` header.
@@ -109,6 +110,67 @@ rm -f "$R"; strip_header "$P/.claude/lint-rules/conv010_act_microflow_content.st
 out=$(gate 2>&1); rc=$?
 case "$out" in *REVERTED*) bad "alarm with no receipt to compare" "$out" ;; *) ok "no receipt -> no alarm (rc $rc)" ;; esac
 
+# ---- review follow-ups: an mxcli newer than STOCK-HASHES, deliberate opt-out, manifest drops ----
+# A scratch toolkit copy: lint-rules/ + bin/lib/. INSTALLER=<file> swaps in another
+# install-lint-rules.sh (used to prove these cases fail on master's installer).
+TK2="$WORK/tk2"; mkdir -p "$TK2/bin"
+cp -R "$TK/lint-rules" "$TK2/lint-rules"; cp -R "$TK/bin/lib" "$TK2/bin/lib"
+[ -n "${INSTALLER:-}" ] && cp "$INSTALLER" "$TK2/bin/lib/install-lint-rules.sh"
+newproj() { _p="$WORK/$1"; mkdir -p "$_p/bin" "$_p/.claude"; cp "$P/bin/lint-gate.sh" "$_p/bin/"
+  [ -f "$P/bin/_common.sh" ] && cp "$P/bin/_common.sh" "$_p/bin/"
+  cp "$P/.claude/lint-baseline.json" "$_p/.claude/"; printf 'mpr' > "$_p/App.mpr"; cp "$P/mxcli" "$_p/mxcli"; echo "$_p"; }
+inst2() { ( [ -n "${2:-}" ] && MXTK_LINT_RULES="$2"; . "$TK2/bin/lib/install-lint-rules.sh"; mxtk_install_lint_rules "$TK2" "$1" 0 "" ) 2>&1; }
+gate2() { (cd "$1" && LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh); }
+mk "$(v CONV010 warning 26)"
+
+echo "T9 a genuine stock body whose hash STOCK-HASHES does not list (mxcli upgrade, then init)"
+EBK=entity_business_key.star
+STOCK="$WORK/ebk-stock.star"; sed '1,/^# --- end mxtk-lint-rule header ---$/d' "$TK/lint-rules/$EBK" > "$STOCK"
+# Genuine: this body's md5 is the v0.24.0/v0.25.0 stock hash recorded in the REAL STOCK-HASHES.txt.
+sm=$(portable_md5 "$STOCK")
+grep -q "^$EBK  *$sm " "$TK/lint-rules/STOCK-HASHES.txt" && ok "stock body is genuine (md5 $sm is in STOCK-HASHES.txt)" \
+  || bad "stock body md5 $sm not a recorded stock hash"
+# Unknown version: the scratch toolkit forgets that hash, and its rule has moved off stock (as
+# conv010 and data_change have), so neither the stock nor the "headered" branch can match.
+grep -v "^$EBK " "$TK/lint-rules/STOCK-HASHES.txt" > "$TK2/lint-rules/STOCK-HASHES.txt"
+printf '# toolkit fix, not in stock\n' >> "$TK2/lint-rules/$EBK"
+P9=$(newproj p9); inst2 "$P9" >/dev/null
+cp "$STOCK" "$P9/.claude/lint-rules/$EBK"
+out=$(gate2 "$P9" 2>&1); rc=$?
+[ "$rc" -eq 1 ] && case "$out" in *"BLIND — lint rules reverted"*"$EBK"*|*"$EBK"*"BLIND — lint rules reverted"*) true ;; *) false ;; esac \
+  && ok "lint-gate: BLIND, names $EBK" || bad "lint-gate did not flag the unknown-hash re-seed (rc $rc)" "$out"
+case "$out" in *"--upgrade-lint-rules all"*) ok "message carries the LOCALLY MODIFIED fallback" ;; *) bad "no --upgrade-lint-rules fallback" "$out" ;; esac
+out=$(inst2 "$P9")
+case "$out" in *"REVERTED TO STOCK"*"$EBK"*) ok "installer restores it (not LOCALLY MODIFIED)" ;; *) bad "installer did not restore it" "$out" ;; esac
+cmp -s "$TK2/lint-rules/$EBK" "$P9/.claude/lint-rules/$EBK" && ok "file is the toolkit version again" || bad "file not restored"
+ls "$P9/.claude/lint-rules/$EBK".reseeded-* >/dev/null 2>&1 && ok "found copy kept beside it" || bad "found copy not kept"
+out=$(gate2 "$P9" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "after sync: rc 0 (remedy clears it)" || bad "still blind after sync (rc $rc)" "$out"
+
+echo "T10 a rule removed on purpose (listed in .claude/lint-rules-disabled.txt) is not a re-seed"
+P10=$(newproj p10); inst2 "$P10" >/dev/null
+printf '# display standard is dd/MM/yyyy\ntxt002_non_iso_date_in_user_text.star\n' > "$P10/.claude/lint-rules-disabled.txt"
+rm -f "$P10/.claude/lint-rules/txt002_non_iso_date_in_user_text.star"
+out=$(gate2 "$P10" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "lint-gate: rc 0, no alarm before any sync" || bad "deliberate removal read as a re-seed (rc $rc)" "$out"
+out=$(inst2 "$P10")
+[ ! -f "$P10/.claude/lint-rules/txt002_non_iso_date_in_user_text.star" ] && ok "sync does not restore a disabled rule" || bad "sync restored a disabled rule" "$out"
+grep -q '^txt002_non_iso_date_in_user_text.star ' "$P10/.claude/.mxtk-lint-receipt" && bad "disabled rule's receipt row kept" || ok "disabled rule's receipt row pruned"
+rm -f "$P10/.claude/lint-rules/txt001_build_words_in_user_text.star"
+out=$(gate2 "$P10" 2>&1); rc=$?
+case "$out" in *txt001_build_words_in_user_text.star*) ok "an unlisted removal is still caught" ;; *) bad "unlisted removal missed" "$out" ;; esac
+
+echo "T11 a rule the toolkit stops shipping: its receipt row is pruned, no permanent 'gone'"
+P11=$(newproj p11); inst2 "$P11" >/dev/null
+rm -f "$P11/.claude/lint-rules/ui001_widget_layout_traps.star"   # project tidies the retired rule away
+FEWER=$(printf '%s\n' $(. "$TK2/bin/lib/install-manifest.sh" >/dev/null 2>&1; echo "$MXTK_LINT_RULES") | grep -v '^ui001_widget_layout_traps.star$' | paste -sd' ' -)
+out=$(inst2 "$P11" "$FEWER")
+grep -q '^ui001_widget_layout_traps.star ' "$P11/.claude/.mxtk-lint-receipt" && bad "row for a dropped rule kept" "$out" || ok "row for the dropped rule pruned"
+case "$out" in *"dropped row"*ui001*) ok "installer says so" ;; *) bad "prune not reported" "$out" ;; esac
+[ ! -f "$P11/.claude/lint-rules/ui001_widget_layout_traps.star" ] && ok "dropped rule not reinstalled" || bad "dropped rule reinstalled"
+out=$(gate2 "$P11" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "lint-gate: rc 0 after the prune" || bad "permanent 'gone' (rc $rc)" "$out"
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

From d55a4d4a280c9d476cee0805f18ead5309a722a1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:45:24 +0000
Subject: [PATCH 15/68] Add interaction-model skill: role homes, inboxes,
 page-parameter contract before the first wireframe

Part 1 of 3 for #291. Stage 3 now writes design/interaction-model.md
after the role model is CONFIRMED and before the first wireframe: a
home per role, an inbox per BRD user task, and per screen how it is
reached, its page parameter / context object, its data view source,
nav entry and roles. Every wireframe opens with a wf-contract block
(Page parameter:, Reached from:, Drawn as role:), which page-fidelity
treats as annotation and the prototype hides behind Show bindings.

Wired: design-artifacts.md Step 2b + Step 3 contract + output tree,
conversion-runbook.md Stage 3 "Agent produces" (3 words; baseline is
now exactly at its 80,000-word budget), routing row (ondemand, Stage 3,
lead + architect) re-rendered.

Refs #291

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                 |   1 +
 README.md                    |   1 +
 ROUTING.md                   |   1 +
 agents/architect-agent.md    |   1 +
 bin/gate-check.sh            |   2 +-
 bin/lib/skill-routing.tsv    |   1 +
 skills/conversion-runbook.md |   2 +-
 skills/design-artifacts.md   |  30 ++++++++-
 skills/interaction-model.md  | 122 +++++++++++++++++++++++++++++++++++
 9 files changed, 157 insertions(+), 4 deletions(-)
 create mode 100644 skills/interaction-model.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..5dbfdc71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- skill(interaction-model, design-artifacts, runbook): **Stage 3 writes `design/interaction-model.md` before the first wireframe — a home per role, an inbox per user task, and per page how it is reached, its page parameter and its data view source; every wireframe opens with a `wf-contract` block (`Page parameter:`, `Reached from:`, `Drawn as role:`)** ([#291](https://github.com/MendixMau/mxcli-project-toolkit/issues/291), part 1 of 3). Three apps built with the toolkit passed every gate (Stage 3/4 PASS, page fidelity 81-89% on the affected pages, lint 0 errors, e2e 69/69) while one of them rooted 8 pages on a parameterless "current record" retrieve, gave all 6 roles one home page and put 3 process stages in a 6-item menu; the wireframes were drawn as one role with one record, so every downstream check inherited the defect. Routed on demand, Stage 3, lead + architect; the gate facts and the model-side check are follow-ups. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/README.md b/README.md
index 50f41d55..4d74fa14 100644
--- a/README.md
+++ b/README.md
@@ -580,6 +580,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | After every wireframe edit: assembles design/wireframes/*.html into design/prototype.html, one hash-routed page a stakeholder can click through instead of twenty separate files. Generated, never edited (design-artifacts.md Step 3) | `project-bin/assemble-prototype.js` |
 | Before wireframes pass to the build loop, and with --brd before a BRD is signed off: dead #/route links, orphan screens, controls with no data-bind and no data-cut, BRD routes no screen has, screens no use case walks (design-artifacts.md Step 3c, brd-validation.md check 8) | `project-bin/check-prototype-links.js` |
 | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable | `skills/design-artifacts.md` |
+| Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter | `skills/interaction-model.md` |
 | Before a wireframe or a design commits to a WIDGET, when a requirement shows a widget to one role and not another, and when a page script hits a parse error that looks like a syntax mistake: the short list of things MDL cannot write at all, and the four-minute probe that answers it at Stage 3 instead of at build time | `skills/learned-mdl-cannot-express.md` |
 
 **Build — the loop itself**
diff --git a/ROUTING.md b/ROUTING.md
index 2c55707c..99f22259 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -126,6 +126,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | After every wireframe edit: assembles design/wireframes/*.html into design/prototype.html, one hash-routed page a stakeholder can click through instead of twenty separate files. Generated, never edited (design-artifacts.md Step 3) | `project-bin/assemble-prototype.js` | architect,review | 3 | ondemand |
 | Before wireframes pass to the build loop, and with --brd before a BRD is signed off: dead #/route links, orphan screens, controls with no data-bind and no data-cut, BRD routes no screen has, screens no use case walks (design-artifacts.md Step 3c, brd-validation.md check 8) | `project-bin/check-prototype-links.js` | architect,review | 3 | ondemand |
 | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable | `skills/design-artifacts.md` | architect | 3 | ondemand |
+| Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter | `skills/interaction-model.md` | lead,architect | 3 | ondemand |
 | Before a wireframe or a design commits to a WIDGET, when a requirement shows a widget to one role and not another, and when a page script hits a parse error that looks like a syntax mistake: the short list of things MDL cannot write at all, and the four-minute probe that answers it at Stage 3 instead of at build time | `skills/learned-mdl-cannot-express.md` | architect,mdl | 3,5 | ondemand |
 | A style change that appears to have done nothing, a focus ring that paints on every page landing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget | `skills/learned-css-that-never-applied.md` | mdl,review,gate | 5,6 | baseline |
 
diff --git a/agents/architect-agent.md b/agents/architect-agent.md
index 5e6927a3..41bd3421 100644
--- a/agents/architect-agent.md
+++ b/agents/architect-agent.md
@@ -65,6 +65,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/architecture-blueprint.md` | Diagramming target architecture |
 | `skills/modularize-domain.md` | Deciding module boundaries before "create module" |
 | `skills/design-artifacts.md` | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages |
+| `skills/interaction-model.md` | Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME |
 | `skills/brd-to-build-plan.md` | Turning BRDs plus architecture into a numbered, dependency-ordered build plan |
 | `skills/coverage-ledger.md` | Building the Stage 4 coverage ledger |
 | `bin/coverage-check.sh` | Checking a coverage ledger against its BRD |
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index d24a021c..7794d59a 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -1769,7 +1769,7 @@ stage_protocol_paths() {
     0)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-scope.md skills/source-triage.md skills/image-transcription.md skills/small-project-tier.md skills/existing-app-change.md skills/app-analysis.md skills/layering-review.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/assess-migration.md skills/migration-pipeline.md skills/migrate-general.md skills/migrate-outsystems.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/qa-loop-goal-pattern.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/gate-check-file-locations.md" ;;
     1)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-extraction.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/migration-pipeline.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/kb-generation.md skills/corpus-extraction-integrity.md" ;;
     2)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
-    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/agent-roles.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
+    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/agent-roles.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/interaction-model.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
     4)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/small-project-tier.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/learned-constants-and-secrets.md" ;;
     5|build-ready) echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/microflow-preflight.md skills/mendix-best-practices-index.md skills/ui-preflight-pages.md skills/design-spacing.md skills/learned-stylegallery.md skills/ui-loop.md skills/module-review.md skills/testing-shape.md skills/microflow-loop-antipatterns.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/learned-file-upload-widget.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
     6)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/agent-roles.md skills/mendix-best-practices-index.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/app-analysis.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/share-demo-package.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index 200b80e4..56ec085f 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -143,6 +143,7 @@ brd-validation	skills/brd-validation.md	Validating BRDs against the code and doc
 architecture-blueprint	skills/architecture-blueprint.md	Diagramming target architecture — module defs, wiring, fit-gap, marketplace, security, NFRs, integrations	architect	3	ondemand	architecture
 modularize-domain	skills/modularize-domain.md	Deciding module boundaries before "create module"	architect	3	ondemand	architecture
 design-artifacts	skills/design-artifacts.md	Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable	architect	3	ondemand	design
+interaction-model	skills/interaction-model.md	Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter	lead,architect	3	ondemand	design
 brd-to-build-plan	skills/brd-to-build-plan.md	Turning BRDs plus architecture into a numbered, dependency-ordered build plan	architect	3,4	ondemand	requirements
 coverage-ledger	skills/coverage-ledger.md	Building the Stage 4 coverage ledger — every requirement either claimed by a build-plan row or catalogued with a reason, never invisible	architect,gate	4	ondemand	requirements
 coverage-check	bin/coverage-check.sh	Checking a coverage ledger against its BRD — every scalar leaf CLAIMED, LEDGERED, UNCLAIMED, PHANTOM or DOUBLE-CLAIMED, so coverage is measured rather than remembered	architect,gate	4	ondemand	requirements
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index cc80daa8..a69ccb39 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -671,7 +671,7 @@ The biggest gap before this runbook existed. Module boundaries, wiring diagrams
 | | |
 |---|---|
 | **User defines** | ① One Mendix app or several (if flagged at Stage 0). ② **Module boundaries** (agent proposes with `modularize-domain.md` criteria). ③ **Buy vs build vs stub, per fit-gap item** — the confirming step `brd-to-build-plan.md` assumed already happened. ④ **Target security / role model** — not just whether auth existed in the source, but what the target should be. ⑤ **Data volumes, concurrency, NFRs** — these decide indexing, pagination, datagrid-vs-paged-gallery, loop batch sizes. ⑥ **Integration contracts** — real or stub, endpoint, credentials, owner, test environment. ⑦ **Branding inputs** — logo, palette, type, spacing, per `design-artifacts.md`; with no brand, the design direction (Step 0b question D1: ideation-library directions or Atlas defaults). |
-| **Agent produces** | `.mx-brd.json`, `architecture/` (module defs, layer diagram, wiring diagram, `fit-gap.md`, `blueprint.html` checkpoint render — plus a workflow diagram and/or agent-wiring diagram in `blueprint.md`/`blueprint.html` when CAC-3's Q3 flags real scope for either, plus cross-persona journey diagrams + journey list — `architecture-blueprint.md` Step 3d — whenever the BRDs carry more than one persona; single-persona skip recorded as a one-line note, never silent), `design/` per `design-artifacts.md`'s full output list: `ds.css` + `design-system.html` + **`wireframes/*.html`, one annotated wireframe per screen** — the design system without the wireframes is half the deliverable and fails the gate. |
+| **Agent produces** | `.mx-brd.json`, `architecture/` (module defs, layer diagram, wiring diagram, `fit-gap.md`, `blueprint.html` checkpoint render — plus a workflow diagram and/or agent-wiring diagram in `blueprint.md`/`blueprint.html` when CAC-3's Q3 flags real scope for either, plus cross-persona journey diagrams + journey list — `architecture-blueprint.md` Step 3d — whenever the BRDs carry more than one persona; single-persona skip recorded as a one-line note, never silent), `design/` per `design-artifacts.md`'s full output list: `design/interaction-model.md` (first) + `ds.css` + `design-system.html` + **`wireframes/*.html`, one annotated wireframe per screen** — the design system without the wireframes is half the deliverable and fails the gate. |
 | **Surface** | `module-design.html` · `architecture/blueprint.html` (generated render of `blueprint.md` — architecture-blueprint.md Step 7, never hand-edited) · `design-system.html` + `wireframes/*.html` |
 | **Gate ✋** | Boundaries approved. Marketplace calls made. Role model, volumes, integrations and branding **each asked and answered**: `CONFIRMED`, or explicitly delegated by the user ("you decide" → `ASSUMED` with risk). Never `ASSUMED` without the question having reached the user. Close-out block pasted before the ✋ decision is asked (§1b rule 7) — this stage has no closing checkpoint, so the gate is where the Stage-4 open (its approach, skills and optional artifacts) is shown. **No architecture/design artifact is produced before its checkpoint ran.** |
 | **Owner** | `architect-agent` (interviews run by `ba-agent`) |
diff --git a/skills/design-artifacts.md b/skills/design-artifacts.md
index ef7c21a8..51b1d76d 100644
--- a/skills/design-artifacts.md
+++ b/skills/design-artifacts.md
@@ -226,9 +226,34 @@ table against `design/wireframes/*.html` and reports `MANUAL <built> wireframes
 
 ---
 
+## Step 2b: Interaction Model — before the first wireframe
+
+With the Screen Inventory written and the role model CONFIRMED, write `design/interaction-model.md`
+per `interaction-model.md`: a home per role, an inbox per BRD user task, and one row per inventoried
+screen naming how it is reached, its page parameter and its data view source. Do it before drawing:
+wireframes drawn as one role looking at one record hide a page that shows "the first open record"
+instead of the clicked one, and every later check compares the build with the wireframe.
+
+---
+
 ## Step 3: Build Wireframes FROM the Design System
 
-Each wireframe is assembled from Step 1's components — never restyled from scratch. One HTML per screen, or a single annotated showcase. Every wireframe carries a **binding annotation** the build loop will check:
+Each wireframe is assembled from Step 1's components — never restyled from scratch. One HTML per screen, or a single annotated showcase. Every wireframe opens with a **page contract** copied from its `interaction-model.md` row:
+
+```html
+<div class="wf-contract">
+  <p>Page parameter: Sales.Order</p>          <!-- or: none — list page / none — singleton -->
+  <p>Reached from: row of Order_Overview; row of Review_Inbox</p>
+  <p>Drawn as role: Reviewer</p>
+</div>
+```
+
+`Page parameter: none` is a statement, not a blank: it says the page is a list, a home or a
+singleton. The `wf-` prefix makes the block annotation, so `page-fidelity.js` does not score it as
+page content and `assemble-prototype.js` hides it behind **Show bindings**. Draw the screen as the
+role named there, with that role's menu.
+
+Every wireframe also carries a **binding annotation** the build loop will check:
 
 | Source field / element | Mendix widget | Datasource | Required | Read-only | Conditional |
 |---|---|---|---|---|---|
@@ -394,10 +419,11 @@ not evidence that the design system is correct — it is evidence that it is not
 design/
   brand.md                     ← brand decisions + deliberate inversions + Atlas variable mapping
   target-ui.md                 ← UX pattern inventory from client mockup → Atlas implications
+  interaction-model.md         ← role homes, inboxes, one row per screen: how reached, page parameter, data view source (interaction-model.md)
   ds.css                       ← token + component CSS (linked by showcase + all wireframes)
   design-system.html           ← annotated showcase (links ds.css; not the token source)
   wireframes/
-    <Screen>.html              ← one per surface, with binding-annotation table, data-route, #/route links (the SOURCE)
+    <Screen>.html              ← one per surface, with wf-contract block, binding-annotation table, data-route, #/route links (the SOURCE)
   prototype.html               ← assembled by project-bin/assemble-prototype.js from wireframes/ + ds.css; clickable, never hand-edited
   screenshots/                 ← source screenshots copied in (tier-1 ground truth)
 
diff --git a/skills/interaction-model.md b/skills/interaction-model.md
new file mode 100644
index 00000000..06aa3655
--- /dev/null
+++ b/skills/interaction-model.md
@@ -0,0 +1,122 @@
+# Interaction Model — Who Lands Where, and What Object Each Page Is About
+
+**Applies to:** migration | requirements-driven | greenfield | change an existing app (any project that draws wireframes)
+**Purpose:** Before the first wireframe, write down how each role reaches each page and which object
+each page is about, so the wireframes, the build and the journeys all start from one page-parameter
+contract instead of one persona looking at one record.
+**Upstream:** the CONFIRMED role model (Stage 3 ④), BRD `pages` / `useCases` / user tasks, the
+Screen Inventory (`design-artifacts.md` Step 2).
+**Downstream:** every wireframe's `wf-contract` block (`design-artifacts.md` Step 3), page scripts
+(`ui-preflight-pages.md`), journeys and seed data (two objects, two roles).
+
+---
+
+## When to reach for this
+
+- **Stage 3, after the role model is CONFIRMED and before the first wireframe** — the artifact is
+  `design/interaction-model.md`.
+- Adding a page that shows **one** object (a detail, an edit form, a process step, a task page).
+- Adding a navigation menu item, a home page, or a "go to the next step" button.
+- A microflow is about to be a page's data source and its name says *Current*, *Active*, *Latest*
+  or *First*.
+
+---
+
+## Why this exists
+
+Every check downstream of Stage 3 compares the build with the wireframe. When the wireframe is
+drawn as one role looking at one record, a page that shows "the first open record" instead of
+the one the user clicked passes everything. Field evidence, three apps built with this toolkit
+(2026-10): one app rooted **8 pages** on a parameterless "current record" retrieve, gave **all 6
+roles one home page**, and put **3 process stages among 6 menu items**. Gate-check Stage 3 and 4
+passed, page fidelity scored 81–89% on the affected pages, lint reported 0 errors and the e2e
+suite went **69/69** — every journey seeded one open record, so "the first one" was always the
+right one. A navigation review of a second app then found 16 defects of the same kinds. The
+fix landed after a week of scripts had come to depend on the parameterless pages. A page
+parameter added later breaks every `show page` that calls the page without one.
+
+---
+
+## Step 1: Role homes
+
+One row per role in the CONFIRMED role model:
+
+| Role | Home page | Comes to do |
+|---|---|---|
+| Reviewer | `Review_Inbox` | Work through the reviews waiting for them |
+| Manager | `Order_Overview` | Find an order and follow it |
+
+The default home is the role's **inbox** if it has user tasks, otherwise its main object list.
+Six roles sharing one home is a finding to raise with the user, never a default.
+
+## Step 2: Inboxes and object hubs
+
+- **Every BRD user task or approval** → an inbox row: which role, which inbox page, how rows are
+  grouped, and what a row opens. The row opens the task page **with its object**.
+- **Every object people follow over time** (an order, a case, a change) gets a hub page that takes
+  that object as its parameter. Process steps are reached **from the hub**, never from the menu.
+
+## Step 3: The per-page table (the contract)
+
+One row per screen in the Screen Inventory, no exceptions:
+
+| Page | How reached | Page parameter / context object | Data view source | Nav entry | Role(s) |
+|---|---|---|---|---|---|
+| `Order_Overview` | menu; home for Manager | none (list page) | grid: database `Sales.Order` | Orders | Manager |
+| `Order_Detail` | row of `Order_Overview`; row of `Review_Inbox` | `Order` | page parameter | — | Manager, Reviewer |
+| `Order_Review` | stage tile on `Order_Detail` | `Order` | page parameter | — | Reviewer |
+| `AppSettings_Edit` | menu | none — singleton | microflow `DS_AppSettings_Get` (one row by design) | Settings | Admin |
+
+Rules the table must satisfy:
+
+1. **A page about one object takes that object as a page parameter**, and its root data view's
+   source is that parameter. A named singleton (settings, "my profile") is the one exception;
+   say so in the row.
+2. **"How reached" names every caller**, and every caller passes the object. A menu item cannot
+   pass a page parameter, so a page whose Nav entry is filled in has `none` in the parameter
+   column.
+3. **Menu items are object lists, inboxes or tools — never a process stage.** One navigation per
+   concept: a stepper on the hub *or* the menu, not both.
+4. **Lists:** one main grid per page. Sibling sets go in tabs with counts, other objects in link
+   cards.
+
+Then copy each row's parameter, "How reached" and role into that screen's `wf-contract` block
+(`design-artifacts.md` Step 3), so the wireframe carries the contract the build is checked against.
+
+---
+
+## The failure modes this table prevents
+
+Each was measured in a built app; each passed every gate. Generic names below.
+
+| Failure | One-line bad example | What it does |
+|---|---|---|
+| Parameterless "current/first" root data view | `retrieve $Order from Sales.Order where Status != Closed sort by Number asc first;` as the data view source of `Order_Detail` | With two open orders, every user sees the first one, whichever they clicked |
+| `show page` without its argument | stepper tile action `show page Sales.Order_Review;` on a snippet that has `$Order` in hand | The stepper on order B opens the step for order A |
+| Home pages not matching the design | `home page Sales.Order_Overview for` all six roles, while the design said reviewers land on their inbox | The reviewer has no place to start; their work is reached through a stage in the top bar |
+| Process stages in the menu | top bar: Orders, **Reviews**, **Approvals**, Reports | Each stage page is forced to be parameterless (rule 2), which brings back failure 1 |
+| Grid min-width | `.order-grid table { min-width: 1100px; }` added to fix squashed columns | Horizontal scrollbar at 1440 px on a grid that would have fitted; nothing else flags it |
+| Read-only drawn but not specified | wireframe row `Read-only: yes` with no rendering | Built as grey disabled inputs; say "renders as text" (data view `ReadOnlyStyle: Text`) |
+| Save reopens its own page | inline cell `OnChange` → `close page; show page Plan_Edit(Plan = $Plan);` | Every edit jumps the user back to the top; a save must not close and reopen its own page |
+
+---
+
+## Step 4: Walk it with two objects and two roles
+
+Before the Stage-3 ✋, walk the prototype (`design/prototype.html`) with **2+ open objects and 2+
+roles**: as each role, start at its home, find the work for the **second** object, and complete
+one step. Write the route taken under each role in `design/interaction-model.md`. A route that
+goes through "the first one" or through a menu stage is a defect in the table, fixed here.
+
+## Done when
+
+- Role homes: **N of N roles** in the role model have a row.
+- Inboxes: **N of N BRD user tasks / approvals** have an inbox row, or a reason they need none.
+- Per-page table: **N of N screens** in the Screen Inventory have a row; every one-object page names
+  its parameter; every "How reached" caller passes it.
+- The walk: one recorded route per role, for the second object. "Not walked" is legal only as
+  an open question in `PROJECT.md`; silence is not.
+
+Ask the user the questions this raises — who lands where, how each role finds its work — in the
+Stage-3 batch (`interview-protocol.md`). The layout question (top bar or sidebar) is not the
+navigation question.

From 50e69d093152ea76487b7d18201dbd40b720f3f1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:45:31 +0000
Subject: [PATCH 16/68] Judge each PROOF-OF-LOOK by its own section's VALID AT;
 newest stamp by commit time (#155); no LOOK row kind (#68)

obligation-check.sh: a review file with dated addenda FAULTed because every
proof line was compared with the single newest stamp. A citation now belongs
to the nearest stamp above it (headline's if above all). _ob_stale picks the
stamp with the newest commit time, not the last one in the file.

brd-to-build-plan.md: rationale for not adding a LOOK kind next to the Kind list.

Fixture: tests/wave2/test-obligation-valid-at.sh T4-T8 (3 fail on master).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |  2 +
 bin/lib/obligation-check.sh             | 73 ++++++++++++++++++++-----
 skills/brd-to-build-plan.md             | 11 ++++
 tests/wave2/test-obligation-valid-at.sh | 51 +++++++++++++++++
 4 files changed, 124 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..c0dd1611 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(obligations): **Each `PROOF-OF-LOOK` line is checked against the `VALID AT` stamp of its own section, and the report's newest stamp is chosen by commit time ([#155](https://github.com/MendixMau/mxcli-project-toolkit/issues/155)).** A review file that keeps dated addenda was still FAULTing: every proof line was compared with the single newest stamp, so the first section's honest screenshots read "older than VALID AT". The field project's only way back to green was to re-shoot every page and delete its older proof lines. A citation now belongs to the nearest stamp above it (one above every stamp belongs to the headline's), on pretty-printed and one-line HTML alike. "Newest" was last-in-file, so an addendum written above the original stamp went STALE; it is now the stamp with the newest commit time. A stale shot inside a section still FAULTs. Fixture `test-obligation-valid-at.sh` T4-T8 (3 fail on master). Field run 2026-09-26, requirements-driven build — MendixMau
+- learn(brd-to-build-plan): **No `LOOK` row kind; the paragraph next to the Kind list says why ([#68](https://github.com/MendixMau/mxcli-project-toolkit/issues/68), [#188](https://github.com/MendixMau/mxcli-project-toolkit/issues/188) item 6).** A look is a `HARNESS` row naming the LOOK pass. Whether it happened is read from the `look` and `fidelity` obligations and the look-ledger, never from a State cell a person can set by hand. A second record could say "looked at" while the gate says nobody did. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/lib/obligation-check.sh b/bin/lib/obligation-check.sh
index af7b25ac..26dde2fd 100755
--- a/bin/lib/obligation-check.sh
+++ b/bin/lib/obligation-check.sh
@@ -244,11 +244,31 @@ _ob_has_denominator() {
 # quietly stale, is the failure being retired). Unmeasurable (no git, hash unknown here) also
 # returns 1: an instrument reports what it measured, and "could not measure" must not read as
 # "expired".
+#
+# "Newest" is by COMMIT TIME, not by position (#155). A report kept as one dated file with an
+# addendum per build row carries several stamps; whether the author appends addenda at the
+# bottom or prepends them under the headline, the stamp that says the most recent thing is the
+# one whose commit is newest. Unresolvable stamps are skipped; with none resolvable, the last
+# stamp in the file is returned (and the callers then treat it as unmeasurable).
+_ob_valid_at_stamps() {
+  tr -d '\r' < "$1" 2>/dev/null \
+    | grep -oiE 'VALID[[:space:]]+AT:?[[:space:]]*[0-9a-f]{7,40}' \
+    | grep -oiE '[0-9a-f]{7,40}$'
+}
+_ob_newest_stamp() {
+  local root="$1" hit="$2" h t best="" best_t=-1 last=""
+  while IFS= read -r h; do
+    [ -n "$h" ] || continue
+    last="$h"
+    t="$(git -C "$root" show -s --format=%ct "${h}^{commit}" 2>/dev/null || true)"
+    [ -n "$t" ] || continue
+    if [ "$t" -ge "$best_t" ]; then best="$h"; best_t="$t"; fi
+  done <<< "$(_ob_valid_at_stamps "$hit")"
+  printf '%s' "${best:-$last}"
+}
 _ob_stale() {
   local root="$1" hit="$2" hash n
-  hash="$(cat "$hit" 2>/dev/null | tr -d '\r' \
-    | grep -oiE 'VALID[[:space:]]+AT:?[[:space:]]*[0-9a-f]{7,40}' \
-    | grep -oiE '[0-9a-f]{7,40}$' | tail -1)"
+  hash="$(_ob_newest_stamp "$root" "$hit")"
   [ -n "$hash" ] || return 1
   git -C "$root" cat-file -e "${hash}^{commit}" 2>/dev/null || return 1
   n="$(git -C "$root" log --oneline "${hash}..HEAD" -- '*.mpr' mdlsource 2>/dev/null | wc -l | tr -d ' ')"
@@ -273,8 +293,18 @@ _ob_stale() {
 #     2. every cited file EXISTS on disk and is ≥ 10 KB — a real full-page PNG is hundreds of
 #        KB; a blank capture or a placeholder is not (base64 embeds in the report are display,
 #        not proof: they cannot be checked for freshness);
-#     3. every cited file is NEWER than the report's VALID AT commit — shots are taken during
-#        the review, after the last model commit; citing last month's screenshots fails here.
+#     3. every cited file is NEWER than the VALID AT commit OF ITS OWN SECTION — shots are
+#        taken during the review, after the last model commit; citing last month's screenshots
+#        fails here. "Its section" = the nearest VALID AT stamp above the citation (a citation
+#        above every stamp belongs to the first stamp: the headline's).
+#
+#   Why per-section and not "one report per pass" (#155, field run 2026-09-26): projects keep
+#   one dated review file and append an addendum per build row, each with its own VALID AT and
+#   its own PROOF-OF-LOOK lines. Judging every citation against the single newest stamp made the
+#   first section's honest proofs "older than VALID AT", so the only way back to green was to
+#   re-shoot every page and delete the earlier proof lines — erasing the review history to
+#   satisfy the checker. Each section is a pass; each pass is judged by its own stamp. Staleness
+#   of the report as a whole is still decided by the newest stamp (_ob_stale).
 #   A report that fails is treated exactly like no report (FAULT): a visual verdict with no
 #   verifiable screenshot behind it is a CSS review wearing a LOOK report's clothes.
 #
@@ -290,7 +320,12 @@ _ob_look_proof_broken() {
   fdate="$(basename "$hit" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}' | head -1)"
   if [ -n "$fdate" ] && [[ "$fdate" < "$_OB_LOOK_PROOF_SINCE" ]]; then return 1; fi
 
-  entries="$(tr -d '\r' < "$hit" | grep -oE 'PROOF-OF-LOOK:[[:space:]]*[^=<]+=[[:space:]]*[^<>[:space:]]+')"
+  # One ordered token stream of stamps and citations, so each citation knows its section.
+  # grep -o emits matches left to right within a line, lines in order: a minified one-line
+  # report sections the same way as a pretty-printed one.
+  local tokens
+  tokens="$(tr -d '\r' < "$hit" | grep -oiE 'VALID[[:space:]]+AT:?[[:space:]]*[0-9a-f]{7,40}|PROOF-OF-LOOK:[[:space:]]*[^=<]+=[[:space:]]*[^<>[:space:]]+')"
+  entries="$(printf '%s\n' "$tokens" | grep -E '^PROOF-OF-LOOK:' || true)"
   if [ -z "$entries" ]; then
     printf 'no PROOF-OF-LOOK citations — verdicts with no screenshot on disk are a CSS review'
     return 0
@@ -301,17 +336,29 @@ _ob_look_proof_broken() {
   claimed="$(head -c 4000 "$hit" 2>/dev/null | tr -d '\r' \
     | grep -oiE '[0-9]+[[:space:]]+of[[:space:]]+[0-9]+' | head -1 | awk '{print $1}')"
 
-  # VALID AT commit time, for freshness. Unresolvable → freshness unmeasured, not failed.
-  local vhash vtime=""
-  vhash="$(cat "$hit" 2>/dev/null | tr -d '\r' \
-    | grep -oiE 'VALID[[:space:]]+AT:?[[:space:]]*[0-9a-f]{7,40}' \
-    | grep -oiE '[0-9a-f]{7,40}$' | tail -1)"
+  # Section stamp for freshness: starts at the FIRST stamp in the file (so citations above
+  # every stamp belong to the headline's), then each stamp met in the stream opens a section.
+  # Unresolvable stamp → that section's freshness is unmeasured, not failed.
+  local vhash="" vtime="" first_stamp
+  first_stamp="$(printf '%s\n' "$tokens" | grep -iE '^VALID' | head -1 | grep -oiE '[0-9a-f]{7,40}$')"
+  vhash="$first_stamp"
   [ -n "$vhash" ] && vtime="$(git -C "$root" show -s --format=%ct "${vhash}^{commit}" 2>/dev/null || true)"
 
   reldir="$(dirname "$hit")"
   local line page shot f sz mt
   while IFS= read -r line; do
     [ -n "$line" ] || continue
+    case "$line" in
+      PROOF-OF-LOOK:*) ;;
+      [Vv][Aa][Ll][Ii][Dd]*)
+         line="$(printf '%s' "$line" | grep -oiE '[0-9a-f]{7,40}$')"
+         if [ "$line" != "$vhash" ]; then
+           vhash="$line"; vtime=""
+           [ -n "$vhash" ] && vtime="$(git -C "$root" show -s --format=%ct "${vhash}^{commit}" 2>/dev/null || true)"
+         fi
+         continue ;;
+      *) continue ;;   # a lower-case "proof-of-look:" was never a citation (case-sensitive, as before)
+    esac
     page="$(printf '%s' "$line" | sed 's/^PROOF-OF-LOOK:[[:space:]]*//;s/[[:space:]]*=.*$//')"
     shot="$(printf '%s' "$line" | sed 's/^.*=[[:space:]]*//')"
     n_cited=$((n_cited+1))
@@ -323,12 +370,12 @@ _ob_look_proof_broken() {
       mt="$(stat -c %Y "$f" 2>/dev/null || stat -f %m "$f" 2>/dev/null || true)"
       [ -n "$mt" ] && [ "$mt" -lt "$vtime" ] && oldshots="$oldshots $page"
     fi
-  done <<< "$entries"
+  done <<< "$tokens"
 
   local why=""
   [ -n "$missing" ] && why="cited screenshots not on disk:$missing"
   [ -n "$small" ] && why="${why:+$why; }cited screenshots under 10KB (blank/placeholder):$small"
-  [ -n "$oldshots" ] && why="${why:+$why; }screenshots older than VALID AT (a previous review's shots):$oldshots"
+  [ -n "$oldshots" ] && why="${why:+$why; }screenshots older than their section's VALID AT (a previous review's shots):$oldshots"
   if [ -n "$claimed" ] && [ "$n_cited" -lt "$claimed" ]; then
     why="${why:+$why; }$n_cited citation(s) for $claimed reviewed page(s)"
   fi
diff --git a/skills/brd-to-build-plan.md b/skills/brd-to-build-plan.md
index c190c617..2a75cdbe 100644
--- a/skills/brd-to-build-plan.md
+++ b/skills/brd-to-build-plan.md
@@ -349,6 +349,17 @@ Every row is one of five kinds, sharing one numbering and one dependency graph.
 - **`RUN`** — deploy, reopen Studio Pro, walk the happy path as a demo user.
 - **`HARNESS`** — invoke a named harness or skill (`journey-runner.js`, `design-audit.js`, …).
 
+**There is no `LOOK` kind, on purpose.** A look at a page is a `HARNESS` row whose Step names the
+LOOK pass (`module-review.md` stage 4, as in the module-close row below). Whether the look
+happened is never read from this plan: it is recorded by the files a look leaves behind, and
+`gate-check.sh` counts those — the `look` obligation (a `ui-review-*.html` naming the module, with
+a denominator, `VALID AT` and a `PROOF-OF-LOOK` screenshot per page), the `fidelity` obligation (a
+`docs/PAGE-FIDELITY.tsv` row per page) and the look-ledger (each page a script built is owed until
+a screenshot newer than the build is seen). A `LOOK` row with its own State cell would be a second
+record of the same fact that a person can set by hand, so the plan could say "looked at" while the
+gate says nobody did. Write the row; read the answer from `gate-check.sh <project> 5`. (Decided
+for #68 / #188 item 6.)
+
 `PROVE`/`RUN`/`HARNESS` rows carry **no test content** — only what to run, what counts as a pass,
 and what they depend on. Content lives in `testing-shape.md`, the brief's Test plan, and the
 harness. This is the *moment*; the shape is Step 1's column and the detail is the brief.
diff --git a/tests/wave2/test-obligation-valid-at.sh b/tests/wave2/test-obligation-valid-at.sh
index c949bc4a..8f9953b4 100755
--- a/tests/wave2/test-obligation-valid-at.sh
+++ b/tests/wave2/test-obligation-valid-at.sh
@@ -8,6 +8,12 @@
 # FIRST stamp in the first 8000 bytes. A report that keeps one dated headline and appends an
 # addendum per build row (each with its own VALID AT) was judged by the headline's original
 # stamp and went STALE after later model commits, though every page was re-looked-at.
+# THE REMAINDER (#155, T4-T8): the PROOF-OF-LOOK freshness rule then compared EVERY citation
+# with that one newest stamp, so the first section's honest proofs read "older than VALID AT"
+# and the report FAULTed; and "newest" meant last-in-file, so an addendum prepended under the
+# headline lost to the older stamp below it. Now each citation is judged by its own section's
+# stamp (the nearest stamp above it) and the report's staleness by the stamp with the newest
+# commit time.
 # Subject: obligation-check.sh. Producer of the stamp: module-review.md stage 5 (the reviewer).
 set -uo pipefail
 ARG="${1:?usage: test-obligation-valid-at.sh /path/to/bin/gate-check.sh (or lib/obligation-check.sh)}"
@@ -44,5 +50,50 @@ echo "== T3: newest stamp sits past byte 8000 -> still seen =="
 { printf '<p>ModuleX: 1 of 1 pages reviewed</p>\nVALID AT: %s\n' "$OLD"; head -c 9000 /dev/zero | tr '\0' 'x'; printf '\nVALID AT: %s\n' "$NEW"; } > "$REP"
 [ "$(stale)" -eq 0 ] && ok "stamp past 8000 bytes seen" || bad "stamp past 8000 bytes ignored (STALE)"
 
+# ── T4-T8: dated report (owes PROOF-OF-LOOK), commits and shot mtimes at fixed times ──
+Q="$WORK/q"; mkdir -p "$Q/architecture/modules/ModuleX" "$Q/mdlsource" "$Q/design/ui-reviews/shots"
+git -C "$Q" init -q . 2>/dev/null
+git -C "$Q" config user.email t@t; git -C "$Q" config user.name t
+echo a > "$Q/mdlsource/a.mdl"; git -C "$Q" add -A
+GIT_AUTHOR_DATE="2026-01-01T00:00:00Z" GIT_COMMITTER_DATE="2026-01-01T00:00:00Z" git -C "$Q" commit -qm one
+S1="$(git -C "$Q" rev-parse --short HEAD)"
+echo b >> "$Q/mdlsource/a.mdl"
+GIT_AUTHOR_DATE="2026-03-01T00:00:00Z" GIT_COMMITTER_DATE="2026-03-01T00:00:00Z" git -C "$Q" commit -qam two
+S2="$(git -C "$Q" rev-parse --short HEAD)"
+SH="$Q/design/ui-reviews/shots"
+for n in before mid after; do head -c 20000 /dev/urandom > "$SH/$n.png"; done
+touch -t 202512010000 "$SH/before.png"   # older than S1
+touch -t 202602010000 "$SH/mid.png"      # between S1 and S2
+touch -t 202604010000 "$SH/after.png"    # newer than S2
+QREP="$Q/design/ui-reviews/ui-review-2026-09-26.html"
+look() { "$OBCHECK" "$Q" 2>&1 | grep 'Obligation look '; }
+
+echo "== T4: headline section (S1, shot after S1) + addendum (S2, shot after S2) -> PASS =="
+printf '<p>ModuleX: 2 of 2 pages reviewed</p>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Home = shots/mid.png</pre>\n<h2>Addendum</h2>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Edit = shots/after.png</pre>\n' "$S1" "$S2" > "$QREP"
+out="$(look)"
+case "$out" in *"look       PASS"*) ok "each proof judged by its own section's stamp" ;; *) bad "sectioned report not PASS: $out" ;; esac
+
+echo "== T5: headline section cites a shot older than ITS stamp -> FAULT (control) =="
+printf '<p>ModuleX: 2 of 2 pages reviewed</p>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Home = shots/before.png</pre>\n<h2>Addendum</h2>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Edit = shots/after.png</pre>\n' "$S1" "$S2" > "$QREP"
+out="$("$OBCHECK" "$Q" 2>&1 | grep -A3 'Obligation look ')"
+case "$out" in *FAULT*ModuleX.Home*) ok "a shot older than its own section's stamp still FAULTs" ;; *) bad "stale shot in section 1 not caught: $out" ;; esac
+
+echo "== T6: addendum cites a shot older than the addendum's stamp -> FAULT (not judged by the min stamp) =="
+printf '<p>ModuleX: 2 of 2 pages reviewed</p>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Home = shots/mid.png</pre>\n<h2>Addendum</h2>\nVALID AT: %s\n<pre>PROOF-OF-LOOK: ModuleX.Edit = shots/mid.png</pre>\n' "$S1" "$S2" > "$QREP"
+out="$("$OBCHECK" "$Q" 2>&1 | grep -A3 'Obligation look ')"
+case "$out" in *FAULT*ModuleX.Edit*) ok "addendum's shot judged by the addendum's stamp" ;; *) bad "addendum's stale shot not caught: $out" ;; esac
+
+echo "== T7: the T4 report minified onto one line -> PASS =="
+printf '<p>ModuleX: 2 of 2 pages reviewed</p> VALID AT: %s <pre>PROOF-OF-LOOK: ModuleX.Home = shots/mid.png</pre><h2>Addendum</h2> VALID AT: %s <pre>PROOF-OF-LOOK: ModuleX.Edit = shots/after.png</pre>' "$S1" "$S2" > "$QREP"
+out="$(look)"
+case "$out" in *"look       PASS"*) ok "one-line report sectioned left to right" ;; *) bad "one-line report not PASS: $out" ;; esac
+
+echo "== T8: addendum PREPENDED above the older stamp -> newest by commit time, not STALE =="
+rm -f "$QREP"
+printf '<p>ModuleX: 1 of 1 pages reviewed</p>\nVALID AT: %s\n<h2>Original</h2>\nVALID AT: %s\n' "$S2" "$S1" \
+  > "$Q/design/ui-reviews/ui-review-2026-01-01.html"
+n="$("$OBCHECK" "$Q" 2>&1 | grep -c 'STALE')"
+[ "$n" -eq 0 ] && ok "newest stamp chosen by commit time" || bad "last-in-file stamp was used (STALE)"
+
 echo "pass=$PASS fail=$FAIL"
 [ "$FAIL" -eq 0 ]

From 7168174f8208f7302efd029b96d1f8be0463b6c9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:46:08 +0000
Subject: [PATCH 17/68] process: review-rule fixes from its own independent
 review

Reviewer inputs stated (diff, issues, the PR body what-section, never its verdicts);
durable Review: line in the squash commit; unblock-master exception per guard
rule 7; budget stated as the render-routing ratchet, 95% of it; verified figures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CLAUDE.md | 42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index d60da1af..a06a50c0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -166,9 +166,12 @@ checkpoint script, and an expert user's reaction was "I can't even compact?":
 **not** write it reviews the diff and returns a verdict. The builder's own report and green CI
 never count: the builder grades its own work, and CI proves only the tests the builder wrote.
 
-1. **Who reviews.** A fresh agent given the PR diff and the linked issues, never the builder's
-   summary or conclusion. One reviewer per PR, plus one composition check when several PRs in a
-   batch touch the same files.
+1. **Who reviews, and with what.** A fresh agent given the PR diff, the linked issues and the PR
+   body's description of *what* changed — never the builder's verdict, risk assessment or "all
+   checks pass" claims. One reviewer per PR, plus one composition check when several PRs in a
+   batch touch the same files. The reviewer may run the fixtures the PR adds or that target its
+   changed files, in a detached worktree — that is part of the review the maintainer asked for, not
+   a free-standing test run (see "Testing this toolkit").
 2. **What it answers, each with file:line.** *Value*: does it fix the issue as reported, and is
    anything overbuilt? *Regression risk*: what changes for an existing project after
    `sync-project.sh` (new FAIL / BLIND / refusals, exit codes, output another tool parses, gate
@@ -178,22 +181,28 @@ never count: the builder grades its own work, and CI proves only the tests the b
 3. **Verdict.** `MERGE`, `MERGE-AFTER-FIX` (exact fixes listed; the fixes are pushed and
    re-reviewed before merge) or `HOLD` (goes back to the maintainer with the reason). Only `MERGE`
    merges.
-4. **Report the verdict with the merge.** The message announcing a merge names the reviewer's
-   verdict and its top finding next to CI, so the maintainer sees what was checked.
-5. **No exceptions for size or urgency.** A one-line fix, a docs-only PR and an outside
-   contributor's PR all get the same review. "Small", "only skill text" and "CI is green" are how
-   the exceptions start.
+4. **Record the verdict durably.** The squash commit body carries a line
+   `Review: MERGE — <one-line top finding or "no findings">`, and the merge announcement repeats it
+   next to CI. A merge with no `Review:` line was not reviewed.
+5. **No exceptions for size.** A one-line fix, a docs-only PR and an outside contributor's PR all
+   get the same review. "Small", "only skill text" and "CI is green" are how the exceptions start.
+   The one exception is guard rule 7's: a fix whose only purpose is to unblock master (a broken CI
+   check, a leak guard that blocks every commit) may merge first, with its review within 24 hours
+   and a `Review: PENDING (unblock)` line that the follow-up review replaces.
 
 **Why (real incident, 2026-10-13).** Nine PRs merged in one day on the builders' own reports and
 green CI, each carrying its builder's "all checks pass". When the maintainer asked whether value
 and regression risk had been checked, the honest answer was no: nobody who had not written the
-code had read it. The same day showed the cost of unread diffs in another form — the always-loaded
+code had read it. The after-the-fact reviews found, among others, a journey preflight that made
+every synced project's journey rung FAULT, and an exec lock that let three writers in at once. The same day showed the cost of unread diffs in another form — the always-loaded
 skill text hit its 80,000-word cap because each PR added words that nobody outside the PR weighed.
 
 ## Always-loaded skill text — the word budget
 
-`bin/render-routing.sh --check` caps the always-loaded (baseline) skill set at 80,000 words. Room is
-made by **moving** text, never by deleting the text that does the work.
+`bin/render-routing.sh --check` caps the always-loaded (baseline) skill set at
+`MXTK_BASELINE_BUDGET_WORDS` — a ratchet, explained in that script's header: lowered as text moves
+out, never raised to admit growth. Room is made by **moving** text, never by deleting the text
+that does the work.
 
 1. **Protected — never removed to make room:** rules, STOP rows, denominators / completion
    criteria, and the one-line failure example each rule is paired with. Removing one needs its own
@@ -207,12 +216,13 @@ made by **moving** text, never by deleting the text that does the work.
 4. **At the cap, a feature PR never squeezes other text to fit.** Room comes from a separate trim
    PR that only moves movable text; its reviewer compares removed against moved line by line, and
    any protected line that disappeared is a HOLD.
-5. **Trim before the cap, not at it:** when the baseline passes 76,000 words (95%), the next PR
-   that adds baseline words is preceded by a trim PR.
+5. **Trim before the cap, not at it:** when the baseline passes 95% of the budget, the next PR that
+   adds baseline words is preceded by a trim PR. A trim PR does not lower the ratchet by itself;
+   lowering it is a separate one-line change once the trimmed total has held for a release.
 
-**Why (2026-10-13).** The baseline hit 79,975 of 80,000 while six open PRs each added words; a
-"make it fit" instruction inside a feature PR merged two redundant sentences in a testing skill to
-squeeze under. That one was harmless, but nothing stopped the next one from cutting a STOP row.
+**Why (2026-10-13).** One feature PR pushed the baseline to 80,466 words against the 80,000 budget
+while six other open PRs each added words; to fit, it merged two sentences in a testing skill and
+landed at 79,997. That one was harmless, but nothing stopped the next one from cutting a STOP row.
 
 ## Changelog and contributions
 

From cc56d9bc5021a0b486fa7b3f6389672aeee37ef8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:51:36 +0000
Subject: [PATCH 18/68] =?UTF-8?q?journeys:=20#302=20follow-up=20=E2=80=94?=
 =?UTF-8?q?=20accept=20a=20project-set=20password,=20SIGINT=20findings,=20?=
 =?UTF-8?q?setup=20kind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- config.js reports passSource (env / project.config.js / template
  placeholder); the preflight refuses only the template placeholder
  (Demo2025!, or credentials() source 'template default'). As shipped,
  #302 refused every non-env password, though the template tells projects
  to put their real one in DEFAULT_PASS and nothing loads an env file
  before verify-module — every journeys rung would FAULT after a sync.
  An admin object without passSource keeps the #302 rule.
- SIGINT/SIGTERM write the findings slot as aborted ("signal SIGINT")
  instead of leaving the previous run's file there.
- report-normalize.js: rung 'setup' rows keep kind 'setup' (were 'ui').
- CHANGELOG names ALLOW_CONFIG_CREDENTIALS and the 403 verdict change
  (data rungs INVALID exit 1 -> suite aborts exit 2).

test-journey-preflight.sh 74/74 (9 new cases fail on master: project-set
password runs, placeholder refuses, env wins, SIGINT end to end);
report-normalize --selftest new setup-kind case.

Refs #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |  1 +
 project-tests/e2e/config.js           | 28 ++++++++++---
 project-tests/e2e/journey-runner.js   | 59 +++++++++++++++++++--------
 project-tests/e2e/report-normalize.js | 11 ++++-
 skills/journey-proof.md               |  2 +-
 tests/wave2/test-journey-preflight.sh | 56 ++++++++++++++++++++++++-
 6 files changed, 133 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c8ad4b1..cd92119d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the placeholder (`Demo2025!`, or a `credentials()` reporting `source: 'template default'`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and a `report-normalize.js --selftest` case. Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/config.js b/project-tests/e2e/config.js
index badbac59..ee7c4d38 100644
--- a/project-tests/e2e/config.js
+++ b/project-tests/e2e/config.js
@@ -81,6 +81,22 @@ const PORT = STACK.port;
 // and page-audit.js cannot end up running as two different identities.
 const CREDS = PROJ.credentials();
 
+// Where the test password came from, never the password itself (#278, #302 follow-up).
+//   env                  — TEST_PASS (or its APP_PASS alias)
+//   project.config.js    — a password the project set there (the template tells every
+//                          project to put its real demo password in DEFAULT_PASS)
+//   template placeholder — the value the shipped template carries, i.e. nobody set one
+// Only the last is refused by journey-runner's preflight. Refusing every non-env password
+// (as #302 first did) broke every project whose real password lives in project.config.js,
+// because nothing in the toolkit loads an env file before verify-module runs the journeys.
+// A credentials() that reports `source: 'template default'` is honoured as well.
+const TEMPLATE_PASSWORDS = ['Demo2025!'];   // project.config.template.js DEFAULT_PASS
+function passwordSource({ env = process.env, creds = CREDS } = {}) {
+  if (env.TEST_PASS || env.APP_PASS) return 'env';
+  if (creds.source === 'template default' || TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
+  return 'project.config.js';
+}
+
 // ── M2EE admin credential: where it came from, never what it is ──────────────
 // Every data rung, seed and outcome query goes through `mxcli oql --direct` with this
 // token. It used to be `M2EE_ADMIN_PASS || '1'`: a literal default that silently differed
@@ -156,11 +172,13 @@ const cfg = {
   // is wrong: the login page shows the same generic message either way.
   user: CREDS.user,
   pass: CREDS.pass,
-  // Whether the test password came from the environment (TEST_PASS, or its APP_PASS alias)
-  // rather than project.config.js's default. journey-runner's preflight refuses to log in on a
-  // default (#278): a runner started without the project's env-loading step submitted the
-  // template password, then the admin fallback, and locked two demo accounts for ~5 min each.
+  // Whether the test password came from the environment (TEST_PASS, or its APP_PASS alias),
+  // and passSource (see passwordSource above). journey-runner's preflight refuses to log in on
+  // the TEMPLATE PLACEHOLDER only (#278): a runner started without the project's env-loading
+  // step submitted the template password, then the admin fallback, and locked two demo
+  // accounts for ~5 min each. A password the project set in project.config.js is accepted.
   passFromEnv: !!(process.env.TEST_PASS || process.env.APP_PASS),
+  passSource: passwordSource(),
   // Last-resort identity so a credential problem degrades to a reported finding
   // instead of a zero-coverage run. Set FALLBACK_USER='' to disable.
   fallbackUser: CREDS.fallbackUser,
@@ -213,4 +231,4 @@ function resolveTarget() {
   return t;
 }
 
-module.exports = { cfg, NAV, TARGETS, resolveTarget, resolveAdmin };
+module.exports = { cfg, NAV, TARGETS, resolveTarget, resolveAdmin, passwordSource, TEMPLATE_PASSWORDS };
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index a6133b23..a9eb64f3 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -1078,17 +1078,26 @@ function preflight(journeys, { env = process.env, probe = runAdminProbe, admin =
     rows.push({ rung: 'setup', name: `preflight: ${name}`, verdict: 'INVALID', detail, requirement: '' });
   };
 
-  // 0. login credential (#278). Unset TEST_PASS means the run would submit project.config's
-  // default and then the admin fallback. Each rejected submit counts toward Mendix's
-  // 3-attempt lockout, and in the field two demo accounts were locked for ~5 min each. So no
-  // login is attempted at all. The override exists for a project whose config default IS its
-  // real demo password.
-  if (!admin.passFromEnv && env.ALLOW_CONFIG_CREDENTIALS !== '1') {
+  // 0. login credential (#278). A run that would submit the TEMPLATE PLACEHOLDER password
+  // (nobody set TEST_PASS, nobody edited project.config.js's DEFAULT_PASS) then tries the admin
+  // fallback; each rejected submit counts toward Mendix's 3-attempt lockout, and in the field
+  // two demo accounts were locked for ~5 min each. So no login is attempted at all.
+  // A password the PROJECT set in project.config.js is accepted: the template tells every
+  // project to put its real demo password there, and nothing in the toolkit loads an env file
+  // before verify-module runs the journeys — refusing it (#302 as first shipped) faulted every
+  // journeys rung after the next sync. ALLOW_CONFIG_CREDENTIALS=1 overrides when the
+  // placeholder really is the demo password. An admin object without passSource (older
+  // config.js) keeps the #302 rule: refuse unless the password came from the env.
+  const placeholder = admin.passSource !== undefined
+    ? admin.passSource === 'template placeholder'
+    : !admin.passFromEnv;
+  if (placeholder && env.ALLOW_CONFIG_CREDENTIALS !== '1') {
     setup('credentials', `TEST_PASS is unset — the run would log in as "${admin.user}" with ` +
-      "project.config.js's default password and then try the fallback account, and each rejected " +
-      'attempt counts toward the account lockout. Load the project env first (export TEST_USER / ' +
+      "project.config.template.js's placeholder password and then try the fallback account, and each " +
+      'rejected attempt counts toward the account lockout. Put the real demo password in ' +
+      "project.config.js's DEFAULT_PASS, or load the project env first (export TEST_USER / " +
       'TEST_PASS, e.g. `set -a; . ./.env; set +a`), or set ALLOW_CONFIG_CREDENTIALS=1 if the ' +
-      'config default is the real demo password. Suite ABORTED before any login');
+      'placeholder is the real demo password. Suite ABORTED before any login');
     return { lines, rows, skip, abort: 2 };
   }
 
@@ -1355,8 +1364,29 @@ function armRelease(page, li) {
     if (!ok) console.log('  ⚠ logout NOT confirmed — this run\'s session may still be open on the runtime ' +
                          '(trial licences cap live sessions; a restart clears them)');
   };
+}
+
+// An interrupted run (SIGINT/SIGTERM) writes its findings slot as aborted, with whatever it
+// measured so far. Exiting without writing left the PREVIOUS run's file in the slot, reading
+// as this run — the same stale-slot defect the preflight abort already guards against.
+function writeAbortedFindings(reason, extra = {}) {
+  try {
+    fs.mkdirSync(cfg.artifactsDir, { recursive: true });
+    fs.writeFileSync(findingsFile(), JSON.stringify({
+      capturedAt: new Date().toISOString(), aborted: reason,
+      configuredUser: cfg.user, actualUser: extra.actualUser ?? null, usedFallback: !!extra.usedFallback,
+      baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, results, walks,
+    }, null, 2));
+  } catch (e) { console.error(`  ⚠ could not write the aborted findings file: ${e.message}`); }
+}
+let SIGNAL_CTX = {};
+function armSignals() {
   for (const sig of ['SIGINT', 'SIGTERM']) {
-    process.once(sig, () => { RELEASE().finally(() => process.exit(2)); });
+    process.once(sig, () => {
+      console.log(`\n  ABORTED by ${sig} — findings written as aborted; this run is not a result.`);
+      writeAbortedFindings(`signal ${sig}`, SIGNAL_CTX);
+      RELEASE().finally(() => process.exit(2));
+    });
   }
 }
 
@@ -1383,20 +1413,17 @@ const findingsFile = () => path.join(cfg.artifactsDir,
     console.log(`  ABORTED at preflight — 0 of ${journeys.length} journeys walked. Fix the SETUP line(s) above.`);
     // Written, not skipped: an aborted run must not leave the previous run's file in the slot
     // reading as this one.
-    fs.mkdirSync(cfg.artifactsDir, { recursive: true });
-    fs.writeFileSync(findingsFile(), JSON.stringify({
-      capturedAt: new Date().toISOString(), aborted: 'preflight',
-      configuredUser: cfg.user, actualUser: null, usedFallback: false,
-      baseUrl: cfg.baseUrl, positiveControl: POSITIVE_CONTROL, results, walks,
-    }, null, 2));
+    writeAbortedFindings('preflight');
     console.log(`  findings → ${path.relative(cfg.root, findingsFile())}`);
     process.exit(pf.abort);
   }
 
+  armSignals();
   const { browser, page } = await H.launchBrowser();
 
   const li = await H.login(page);
   armRelease(page, li);
+  SIGNAL_CTX = { actualUser: li.user, usedFallback: li.usedFallback };
 
   // Landing check: once per run, right after login, before any click. One run signs in as
   // one role, so "N of N roles" is the count over the per-role runs.
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index d51a8255..4a1a9710 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -118,7 +118,9 @@ const INPUTS = {
   wireframeDir:    'design/wireframes',
 };
 
-const KINDS = new Set(['ui', 'trace', 'data', 'outcome', 'control',
+// 'setup': journey-runner's preflight / precondition / APP-DOWN rows (rung 'setup'). They are
+// not UI checks; before 2026-10-13 they fell back to 'ui' and read as a screen finding.
+const KINDS = new Set(['ui', 'trace', 'data', 'outcome', 'control', 'setup',
                        'build', 'lint', 'coverage', 'conformance', 'stack']);
 
 // ── Verdict maps — one table per source dialect, nothing inline ──────────────
@@ -2600,6 +2602,13 @@ function selftest() {
   t('and emits no product checks from it',
     jCtl.checks.filter(c => c.instrument === 'journey-runner').length, 0);
 
+  // A setup row (preflight, precondition, APP-DOWN) keeps its own kind, never 'ui'.
+  const jSetup = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
+    data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false,
+            results: [{ rung: 'setup', name: 'preflight: admin', verdict: 'INVALID', detail: 'x', requirement: '' }] } } });
+  t('a setup row is kind "setup", not "ui"',
+    jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
+
   // ---- 3b. the control instrument is per-rung, and a copied real run is not one ----
   const ctlRow = (rung, verdict) => ({
     rung: 'control', verdict, detail: `d-${rung}`,
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index 87b9d0ca..c15ce2f3 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -86,7 +86,7 @@ each one was knowable before the first click.
 
 | Line | Meaning | Do |
 |---|---|---|
-| `SETUP  credentials: TEST_PASS is unset` | aborted, exit 2, **no login attempted** | load the project env (`TEST_USER`/`TEST_PASS`). A run without it submitted the config default and then the admin fallback, and locked two demo accounts for ~5 min each (#278). `ALLOW_CONFIG_CREDENTIALS=1` only when the config default is the real password |
+| `SETUP  credentials: TEST_PASS is unset … placeholder password` | aborted, exit 2, **no login attempted** | the run would submit the **template placeholder** (nobody set `TEST_PASS` and `project.config.js`'s `DEFAULT_PASS` is still the template value), then the admin fallback. That locked two demo accounts for ~5 min each (#278). Put the real demo password in `DEFAULT_PASS`, or export `TEST_PASS`. A password the project set in `project.config.js` is accepted. `ALLOW_CONFIG_CREDENTIALS=1` only when the placeholder really is the demo password |
 | `SETUP  admin: … refused the credential (HTTP 403); credential from <source>` | suite **aborted**, exit 2, nothing walked | fix the credential at the named source. Resolution order: `M2EE_ADMIN_PASS` env → this app's `.mxcli/run-local.json` (`mxcli run --local`) → `.docker/.env` → a labelled guess. The value is never printed |
 | `SETUP  admin: admin API unreachable at host:port` | aborted, exit 2 | app down, or set `M2EE_ADMIN_PORT`. `ALLOW_NO_DATA_RUNG=1` runs anyway with every data rung INVALID |
 | `SETUP  env: missing MOCK_X (needed by J1, J3)` | **one** line, those journeys not walked | export the vars a journey names in `requiresEnv` |
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index dde33248..20875d1a 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -112,6 +112,23 @@ p = R.preflight([data, ui], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT
 out('CRED', { abort: p.abort, calls, lines: p.lines, rows: p.rows.length });
 p = R.preflight([ui], { env: { ALLOW_CONFIG_CREDENTIALS: '1' }, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false } });
 out('CREDOVR', { abort: p.abort, rows: p.rows.length });
+// #302 follow-up: only the TEMPLATE PLACEHOLDER is refused; a project-set password runs
+calls = 0;
+p = R.preflight([data], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false, passSource: 'project.config.js' } });
+out('CRED_PROJ', { abort: p.abort, calls, cred: p.lines.some(l => l.includes('credentials')) });
+p = R.preflight([data], { env: {}, probe: probe(R.classifyAdminProbe(E.OKOUT, 0)), admin: { ...admin, passFromEnv: false, passSource: 'template placeholder' } });
+out('CRED_TPL', { abort: p.abort, line: p.lines[0] || '' });
+// passwordSource: env wins, a project-set password is the project's, the template value is the placeholder
+const ps = typeof C.passwordSource === 'function' ? C.passwordSource : () => 'NOFN';
+out('PS', [
+  ps({ env: { TEST_PASS: 'x' }, creds: { pass: 'Demo2025!' } }),
+  ps({ env: { APP_PASS: 'x' }, creds: { pass: 'Real-Proj-Pass' } }),
+  ps({ env: {}, creds: { pass: 'Real-Proj-Pass' } }),
+  ps({ env: {}, creds: { pass: 'Demo2025!' } }),
+  ps({ env: {}, creds: { pass: 'anything', source: 'template default' } }),
+]);
+// the shipped template's DEFAULT_PASS is the placeholder this list names
+out('TPL_LISTED', (C.TEMPLATE_PASSWORDS || []).includes(E.TPL_PASS));
 
 // #279: resetsData tag printed; --protect-state refuses tagged journeys only
 const rs = { id: 'J-reset', resetsData: true, steps: [] };
@@ -214,8 +231,9 @@ sed -e "s/^M2EE_ADMIN_PASS=.*/M2EE_ADMIN_PASS=$MARK/" "$DENV" > "$CRED/.docker/.
 cp "$(dirname "$SUT")/example.journey.json" "$WORK/tests/e2e/" 2>/dev/null \
   || cp "$HERE/../../project-tests/e2e/example.journey.json" "$WORK/tests/e2e/"
 
+TPL_PASS="$(sed -n "s/^const DEFAULT_PASS = '\(.*\)';.*/\1/p" "$CFG" | head -1)"
 OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | env -u M2EE_ADMIN_PASS -u M2EE_ADMIN_PORT \
-       APP_PORT=1 MARK="$MARK" CRED_ROOT="$CRED" BARE_ROOT="$BARE" node - 2>&1)"
+       APP_PORT=1 MARK="$MARK" TPL_PASS="$TPL_PASS" CRED_ROOT="$CRED" BARE_ROOT="$BARE" node - 2>&1)"
 line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
 if printf '%s\n' "$OUT" | grep -qx NOFN; then
   bad "journey-runner.js exports no preflight/orderJourneys — #286 not addressed"
@@ -245,6 +263,12 @@ echo "== T2b: unset TEST_PASS refuses before any login (#278) =="
 case "$(line CRED)" in *'"abort":2,"calls":0'*'SETUP  credentials: TEST_PASS is unset'*demo_user*ALLOW_CONFIG_CREDENTIALS*'"rows":1'*) ok "aborts, names the user and the override, probe never called" ;; *) bad "unset TEST_PASS not refused" "$(line CRED)" ;; esac
 [ "$(line CREDOVR)" = '{"abort":null,"rows":0}' ] && ok "ALLOW_CONFIG_CREDENTIALS=1 proceeds" || bad "override ignored" "$(line CREDOVR)"
 
+echo "== T2b': only the template placeholder is refused (#302 follow-up) =="
+[ "$(line CRED_PROJ)" = '{"abort":null,"calls":1,"cred":false}' ] && ok "password set in project.config.js → no refusal, probe runs" || bad "project-set password refused (breaks every project after sync)" "$(line CRED_PROJ)"
+case "$(line CRED_TPL)" in *'"abort":2'*'placeholder password'*DEFAULT_PASS*) ok "template placeholder → refused, names DEFAULT_PASS as the fix" ;; *) bad "placeholder not refused" "$(line CRED_TPL)" ;; esac
+[ "$(line PS)" = '["env","env","project.config.js","template placeholder","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; template value / 'template default' is the placeholder" || bad "passwordSource wrong" "$(line PS)"
+[ -n "$TPL_PASS" ] && [ "$(line TPL_LISTED)" = true ] && ok "the shipped template's DEFAULT_PASS is the listed placeholder" || bad "template DEFAULT_PASS not in TEMPLATE_PASSWORDS (got '$TPL_PASS')" "$(line TPL_LISTED)"
+
 echo "== T2c: resetsData / --protect-state (#279) =="
 case "$(line RS)" in *'"abort":null'*'SETUP  resetsData: J-reset reset or reload demo data'*'"rows":0,"skip":0'*) ok "tag printed at start, journey still runs without the flag" ;; *) bad "tag not printed / journey refused" "$(line RS)" ;; esac
 case "$(line RSP)" in *'"abort":null'*'SETUP  protect-state: refused J-reset'*'"rows":1,"skip":["J-reset"]'*) ok "--protect-state refuses only the tagged journey, one row" ;; *) bad "--protect-state wrong" "$(line RSP)" ;; esac
@@ -355,6 +379,36 @@ E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_C
 printf '%s\n' "$E2EOUT" | grep -qiE 'login as|FAULTED|launch' && bad "a login was attempted" "$E2EOUT" || ok "no login attempted (browser never opened)"
 [ -f "$WORK/argv" ] && bad "admin probe ran" || ok "no admin probe either"
 
+echo "== T11b: real runner — TEST_PASS unset but DEFAULT_PASS set by the project → not refused =="
+rm -f "$WORK/argv"
+PROJ_CFG="$WORK/tests/e2e/project.config.js"; cp "$PROJ_CFG" "$WORK/cfg.bak"
+sed -e "s/^const DEFAULT_PASS = '.*';/const DEFAULT_PASS = 'fixture-project-pass';/" "$WORK/cfg.bak" > "$PROJ_CFG"
+E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_CREDENTIALS -u M2EE_ADMIN_PORT APP_PORT=1 M2EE_ADMIN_PASS="$MARK" \
+          MXCLI="$WORK/stub/mxcli" STUB_ARGV="$WORK/argv" node journey-runner.js "$J/J-one.journey.json" 2>&1)"; RC=$?
+printf '%s\n' "$E2EOUT" | grep -q 'SETUP  credentials' && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
+[ -f "$WORK/argv" ] && ok "went on to the admin probe (the stub answers 403 → exit $RC)" || bad "probe never ran" "$E2EOUT"
+cp "$WORK/cfg.bak" "$PROJ_CFG"
+
+echo "== T11c: real runner — SIGINT after preflight writes the findings slot as aborted =="
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$OKOUT"\n' > "$WORK/stub/mxcli-ok"
+chmod +x "$WORK/stub/mxcli-ok"
+# Hold the run where a real one waits on the browser: launchBrowser never resolves, and a timer
+# keeps the event loop alive the way a live browser process does.
+printf "const H = require('./helpers.js'); H.launchBrowser = () => new Promise(() => { setInterval(() => {}, 1 << 30); });\n" > "$WORK/tests/e2e/hold-browser.js"
+FJ2="$WORK/tests/e2e/artifacts/journey-findings.json"
+mkdir -p "$WORK/tests/e2e/artifacts"
+printf '{"capturedAt":"STALE-PREVIOUS-RUN","results":[]}' > "$FJ2"
+LOG="$WORK/sigint.log"
+( cd "$WORK/tests/e2e" && exec env -u M2EE_ADMIN_PORT APP_PORT=1 TEST_PASS=fixture-pass M2EE_ADMIN_PASS="$MARK" MXCLI="$WORK/stub/mxcli-ok" \
+    node -r ./hold-browser.js journey-runner.js "$J/J-one.journey.json" > "$LOG" 2>&1 ) &
+PID=$!
+for _ in $(seq 1 100); do grep -q 'SETUP  admin: OK' "$LOG" 2>/dev/null && break; sleep 0.1; done
+sleep 0.5; kill -INT "$PID" 2>/dev/null; wait "$PID"; RC=$?
+[ "$RC" -eq 2 ] && ok "SIGINT → exit 2" || bad "rc=$RC" "$(tail -5 "$LOG")"
+node -e 'const f=require(process.argv[1]); process.exit(f.aborted==="signal SIGINT" && f.capturedAt!=="STALE-PREVIOUS-RUN" ? 0 : 1)' "$FJ2" 2>/dev/null \
+  && ok "findings slot overwritten as aborted by SIGINT (no stale previous run left)" || bad "previous run's findings left in the slot" "$(head -c 200 "$FJ2")"
+grep -q 'ABORTED by SIGINT' "$LOG" && ok "says ABORTED by SIGINT" || bad "no abort line" "$(tail -5 "$LOG")"
+
 echo "== T12: real runner — --protect-state with every journey tagged → refused, no login =="
 rm -f "$WORK/argv"
 printf '{"id":"J-demo-reset","resetsData":true,"steps":[{"name":"s","data":{"creates":"M.E"}}]}\n' > "$J/J-demo-reset.journey.json"

From 543234526bc01c2bb553e24ef6c6c028ac23bf6c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:55:42 +0000
Subject: [PATCH 19/68] fix(lint-gate): a Starlark rule installed after the
 baseline is FIRST-SEEN, not a rise (#305 review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A rule sync-project.sh installs after the baseline has no baseline count, so its first hit
compared against 0: every exec logged LINT ROSE and exited 1 until someone re-baselined, and
the Lint Batch 3 rules fire on ordinary text (TBD, XXX, v1.2, "12 Oct 2026").

- project-bin/lint-gate.sh: a rule absent from the baseline counts is FIRST-SEEN when it is a
  .star rule in .claude/lint-rules/ (RULE_ID = "...") the baseline did not know: not in the new
  `star_rules` list --update-baseline now writes, or, for an older baseline, its .star file is
  newer than the baseline. Printed as `FIRST-SEEN <rule> N finding(s) — new rule, first seen:
  review and re-baseline with --reason`; exit 0 when nothing else rose; verdict
  PASS-FIRST-SEEN. Re-baselining it needs --reason (it raises a count), after which it is an
  ordinary ratcheted rule. Built-in mxcli rules and .star rules known at baseline with zero
  findings still count as a rise (a baseline omits zero-count rules).
- project-bin/exec.sh: the rc-0 row carries `FIRST-SEEN: <rule> (N) — review, re-baseline with
  --reason`.
- tests/wave2/test-lint-gate-first-seen.sh: real toolkit .star files, LINT_JSON input; 17/17
  here, 8 fail on master's lint-gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                             |   1 +
 project-bin/exec.sh                      |  10 ++-
 project-bin/lint-gate.sh                 |  56 ++++++++++--
 tests/wave2/test-lint-gate-first-seen.sh | 103 +++++++++++++++++++++++
 4 files changed, 163 insertions(+), 7 deletions(-)
 create mode 100755 tests/wave2/test-lint-gate-first-seen.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c0a17a4..9509a509 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(lint-gate): **a Starlark rule installed after the baseline is reported as FIRST-SEEN, not as a rise** ([#305](https://github.com/MendixMau/mxcli-project-toolkit/pull/305) review). A rule sync installs has no baseline count, so its first hit compared against 0: every exec logged `LINT ROSE` and exited 1 until someone re-baselined, and the Lint Batch 3 rules fire on ordinary text (TBD, XXX, v1.2, "12 Oct 2026"). Now a `.star` rule (`RULE_ID = "..."` in `.claude/lint-rules/`) that the baseline did not know prints `FIRST-SEEN <rule> N finding(s) — new rule, first seen: review and re-baseline with --reason`, exits 0 (verdict `PASS-FIRST-SEEN`, exec.sh row `FIRST-SEEN: <rule> (N)`), and is an ordinary ratcheted rule after the next `--update-baseline --reason`. `--update-baseline` now records `star_rules`; for an older baseline the `.star` file being newer than it decides. Built-in rules and `.star` rules known at baseline with zero findings still rise. Fixture `tests/wave2/test-lint-gate-first-seen.sh`: 17/17 here, 8 fail on master's lint-gate. — MendixMau (review of #305)
 - fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the printed remedy always clears it, `bin/lib/install-lint-rules.sh` now restores a rule whose receipt row exists and whose header is gone even when its stock hash is not in `STOCK-HASHES.txt` (an mxcli upgrade, then init; it was reported LOCALLY MODIFIED and never written), prunes receipt rows for rules no longer shipped, and honours a new `.claude/lint-rules-disabled.txt` opt-out that lint-gate also reads (`lint-rules/README.md` told projects to delete txt002, which would now read as a re-seed). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 38/38 here, 21 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index a84446de..09043ac9 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -753,7 +753,15 @@ run_lint_gate() {
   LINT_RC=0
   bash "$PROJECT_ROOT/bin/lint-gate.sh" >"$_lo" 2>&1 || LINT_RC=$?
   case "$LINT_RC" in
-    0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline" ;;
+    0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline"
+       # A rule installed after the baseline is FIRST-SEEN, not a rise (#305 review): say it on
+       # the row, so the count is reviewed and re-baselined rather than found later.
+       _new=$(grep -E '^ +FIRST-SEEN [A-Z][A-Z0-9-]*[0-9]+ ' "$_lo" | awk '{printf "%s%s (%s)", (n++?", ":""), $2, $4}')
+       if [ -n "$_new" ]; then
+         LINT_DETAIL="lint unchanged vs baseline; FIRST-SEEN: $_new — review, re-baseline with --reason"
+         echo "  ⚠ lint: new rule(s) first seen, not counted as a rise: $_new"
+         echo "    Review the findings, then: bin/lint-gate.sh --update-baseline --reason \"<why>\""
+       fi ;;
     1) # Rule ids are matched as [A-Z][A-Z0-9-]*[0-9]+, not [A-Z]+[0-9]+: mxcli's built-in
        # rules include hyphenated ids (MDL-FLOW01), and the old pattern dropped them from every
        # row — three field apps logged 475 ROSE rows and not one named MDL-FLOW01 (2026-10-12).
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index eca387c1..f761fe0e 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -18,7 +18,8 @@
 #       --approved-in-chat              # ALSO required when a security-tier rule rises
 #   bin/lint-gate.sh --full             # ignore the vendor exclusion (rarely useful)
 #
-# Exit codes: 0 clean or unchanged · 1 a rule increased, or BLIND (a rule inspected nothing,
+# Exit codes: 0 clean, unchanged, or only FIRST-SEEN rules (a .star rule installed after the
+#             baseline: reported, not a rise — #305 review) · 1 a rule increased, or BLIND (a rule inspected nothing,
 #             or the toolkit rules reverted to stock — see below) · 2 could not run (or a
 #             refused update)
 #
@@ -130,7 +131,7 @@ while [ $# -gt 0 ]; do
               REASON="$2"; shift ;;
     --reason=*) REASON="${1#--reason=}" ;;
     --approved-in-chat) APPROVED=1 ;;
-    -h|--help) sed -n '2,62p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,63p' "$0"; exit 0 ;;
     *) echo "lint-gate: unknown argument '$1'" >&2; exit 2 ;;
   esac
   shift
@@ -308,6 +309,28 @@ except (ValueError, IndexError):
     sys.exit(2)
 
 viol = data.get("violations") or []
+
+# FIRST-SEEN (#305 review). A rule sync-project.sh installs AFTER the baseline was taken has no
+# baseline count, so it compared against 0 and its first hit was a "rise": every exec logged
+# LINT ROSE and exited 1 until someone re-baselined (Lint Batch 3's TXT001/TXT002 fire on TBD,
+# XXX, v1.2, "12 Oct 2026"). A rule absent from the baseline counts is FIRST-SEEN, not a rise,
+# when it is a Starlark rule in .claude/lint-rules/ (`RULE_ID = "..."`) that the baseline did not
+# know: listed in neither its counts nor its `star_rules` (written by --update-baseline from now
+# on); for an older baseline without `star_rules`, its .star file is newer than the baseline.
+# Built-in mxcli rules are never first-seen: a baseline omits a rule with zero findings, so
+# "absent" there means "was clean" and a hit is a real rise.
+import re, glob
+def star_rules():
+    out = {}
+    rdir = os.path.join(os.path.dirname(base_path), "lint-rules")
+    for f in glob.glob(os.path.join(rdir, "*.star")):
+        try:
+            m = re.search(r'^RULE_ID\s*=\s*"([^"]+)"', open(f, encoding="utf-8", errors="replace").read(), re.M)
+        except OSError:
+            continue
+        if m:
+            out[m.group(1)] = os.path.getmtime(f)
+    return out
 counts = collections.Counter(v["ruleId"] for v in viol)
 sev    = {v["ruleId"]: v["severity"] for v in viol}
 
@@ -397,6 +420,7 @@ if update:
             sys.exit(2)
     json.dump({"counts": dict(sorted(counts.items())),
                "total": len(viol),
+               "star_rules": sorted(star_rules()),
                "note": "Per-rule finding counts on OUR modules. Gate fails when any rises."},
               open(base_path, "w"), indent=2)
     open(base_path, "a").write("\n")
@@ -412,11 +436,22 @@ if not os.path.exists(base_path):
     write_last("ERROR-NO-BASELINE", viol, counts)
     sys.exit(2)
 
-base = json.load(open(base_path)).get("counts", {})
-rose, fell = [], []
+base_doc = json.load(open(base_path))
+base = base_doc.get("counts", {})
+known = base_doc.get("star_rules")
+stars = star_rules()
+base_mtime = os.path.getmtime(base_path)
+def first_seen(r):
+    if r in base or r not in stars:
+        return False
+    if known is not None:
+        return r not in known
+    return stars[r] > base_mtime
+rose, fell, new = [], [], []
 for r in sorted(set(counts) | set(base)):
     now, was = counts.get(r, 0), base.get(r, 0)
-    if now > was: rose.append((r, was, now))
+    if now > was and first_seen(r): new.append((r, now))
+    elif now > was: rose.append((r, was, now))
     elif now < was: fell.append((r, was, now))
 
 print("==> %d findings on our modules (baseline %d)" % (len(viol), sum(base.values())))
@@ -453,11 +488,20 @@ if collapsed:
     write_last("FAIL-COLLAPSE", viol, counts)
     sys.exit(1)
 
+if new:
+    print("\n!! NEW RULE(S), FIRST SEEN — not in the baseline, so not counted as a rise:")
+    for r, now in new:
+        print("   FIRST-SEEN %-8s %-8s %d finding(s) — new rule, first seen: review and re-baseline with --reason"
+              % (r, sev.get(r, "?"), now))
+        for v in [x for x in viol if x["ruleId"] == r][:3]:
+            print("        %s | %s" % (v.get("module") or "(project)", v["message"][:120]))
+    print("   Review them, then: bin/lint-gate.sh --update-baseline --reason \"<why these are accepted>\"")
+
 if not rose:
     print("\nPASS — nothing got worse.")
     if fell:
         print("       %d rule(s) improved. Run --update-baseline to lock the gain in." % len(fell))
-    write_last("PASS-BLIND" if blind else "PASS", viol, counts)
+    write_last("PASS-BLIND" if blind else ("PASS-FIRST-SEEN" if new else "PASS"), viol, counts)
     sys.exit(1 if blind else 0)
 
 print("\nFAIL — %d rule(s) got worse:\n" % len(rose))
diff --git a/tests/wave2/test-lint-gate-first-seen.sh b/tests/wave2/test-lint-gate-first-seen.sh
new file mode 100755
index 00000000..1142841e
--- /dev/null
+++ b/tests/wave2/test-lint-gate-first-seen.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/lint-gate.sh FIRST-SEEN handling and exec.sh's row for it.
+#
+# Usage: bash test-lint-gate-first-seen.sh [path-to-lint-gate.sh]
+#
+# Review of #305 (Lint Batch 3), 2026-10-13: a rule sync-project.sh installs after the baseline
+# has no baseline count, so lint-gate compared it against 0 and its first hit was a "rise" —
+# every exec logged LINT ROSE and exited 1 until someone re-baselined, and TXT001/TXT002 fire on
+# ordinary text (TBD, XXX, v1.2, "12 Oct 2026"). Now such a rule is FIRST-SEEN: reported, rc 0.
+#
+# Rules under test are the toolkit's real .star files (their `RULE_ID = "..."` line is what
+# lint-gate reads). Lint output goes through LINT_JSON, using the key set of a real
+# `mxcli lint --format json` capture (same builder as test-lint-gate-accept.sh). No mxcli/.mpr.
+set -uo pipefail
+TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GATE="${1:-$TK/project-bin/lint-gate.sh}"
+EXEC="$TK/project-bin/exec.sh"
+. "$TK/bin/lib/portable.sh"
+require_py
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lint-first-seen.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
+
+P="$WORK/proj"; mkdir -p "$P/bin" "$P/.claude/lint-rules"
+cp "$GATE" "$P/bin/lint-gate.sh"; [ -f "$TK/project-bin/_common.sh" ] && cp "$TK/project-bin/_common.sh" "$P/bin/"
+printf 'mpr' > "$P/App.mpr"; printf '#!/bin/sh\nexit 0\n' > "$P/mxcli"; chmod +x "$P/mxcli" "$P/bin/lint-gate.sh"
+R="$P/.claude/lint-rules"
+cp "$TK/lint-rules/conv010_act_microflow_content.star" "$TK/lint-rules/ux001_confirm_before_destructive.star" "$R/"
+
+v() { i=0; while [ "$i" -lt "$3" ]; do
+  printf '{"ruleId":"%s","severity":"%s","message":"finding %s","module":"Orders","document":"Doc%s","documentType":"microflow","documentId":"id-%s-%s","suggestion":"s"},' \
+    "$1" "$2" "$i" "$i" "$1" "$i"; i=$((i+1)); done; }
+mk() { printf '{"violations":[%s{"ruleId":"MPR001","severity":"warning","message":"m","module":"Orders","document":"E","documentType":"entity","documentId":"x","suggestion":"s"}],"summary":{}}' "$1" > "$WORK/lint.json"; }
+gate() { (cd "$P" && LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh "$@"); }
+fn="$WORK/run_lint_gate.sh"; sed -n '/^run_lint_gate() {/,/^}/p' "$EXEC" > "$fn"
+exec_detail() { (cd "$P" && PROJECT_ROOT="$P" LINT_JSON="$WORK/lint.json" bash -c ". '$fn'; LINT_RC=0; run_lint_gate >/dev/null; echo \"\$LINT_RC|\$LINT_DETAIL\""); }
+verdict() { "$PY" -c 'import json,sys;print(json.load(open(sys.argv[1]))["verdict"])' "$P/.claude/loop/lint-last.json"; }
+
+echo "F0 baseline before the new rule is installed (UX001 installed, zero findings)"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)"
+out=$(gate --update-baseline 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "baseline written" || bad "rc=$rc" "$out"
+"$PY" -c 'import json,sys;d=json.load(open(sys.argv[1]));sys.exit(0 if d.get("star_rules")==["CONV010","UX001"] else 1)' "$P/.claude/lint-baseline.json" \
+  && ok "baseline records star_rules [CONV010, UX001]" || bad "star_rules wrong" "$(cat "$P/.claude/lint-baseline.json")"
+
+echo "F1 sync installs TXT001; its findings are FIRST-SEEN, rc 0"
+cp "$TK/lint-rules/txt001_build_words_in_user_text.star" "$R/"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 5)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "rc 0" || bad "first-seen rule treated as a failure (rc $rc)" "$out"
+case "$out" in *"FIRST-SEEN TXT001"*"5 finding(s) — new rule, first seen: review and re-baseline with --reason"*) ok "first-seen line names TXT001 and its count" ;; *) bad "no first-seen line" "$out" ;; esac
+case "$out" in *"FAIL —"*) bad "reported as a rise" "$out" ;; *) ok "not reported as a rise" ;; esac
+[ "$(verdict)" = PASS-FIRST-SEEN ] && ok "lint-last verdict PASS-FIRST-SEEN" || bad "verdict $(verdict)"
+d=$(exec_detail)
+case "$d" in "0|lint unchanged vs baseline; FIRST-SEEN: TXT001 (5)"*) ok "exec row: ${d#*|}" ;; *) bad "exec row does not carry FIRST-SEEN" "$d" ;; esac
+
+echo "F2 an existing rule rising next to it is still a rise"
+mk "$(v CONV010 warning 6)$(v CONV009 info 2)$(v TXT001 info 5)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && ok "rc 1" || bad "rc=$rc" "$out"
+case "$out" in *"CONV010  warning  4 -> 6"*) ok "CONV010 4 -> 6 reported" ;; *) bad "rise missing" "$out" ;; esac
+case "$(printf '%s\n' "$out" | sed -n '/^FAIL/,$p')" in *TXT001*) bad "TXT001 listed among the rises" "$out" ;; *) ok "TXT001 not listed as a rise" ;; esac
+
+echo "F3 a built-in rule absent from the baseline (was clean) is a rise, not first-seen"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v MDL001 info 1)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && case "$out" in *"MDL001"*"0 -> 1"*) true ;; *) false ;; esac && ok "MDL001 0 -> 1 is a rise" || bad "built-in hit not a rise (rc $rc)" "$out"
+
+echo "F4 a .star rule known at baseline with zero findings is a rise when it fires"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v UX001 warning 1)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && case "$out" in *"UX001"*"0 -> 1"*) true ;; *) false ;; esac && ok "UX001 0 -> 1 is a rise" || bad "known clean rule not ratcheted (rc $rc)" "$out"
+
+echo "F5 re-baselining a first-seen rule needs --reason; afterwards it is a normal rule"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 5)"
+out=$(gate --update-baseline 2>&1); rc=$?
+[ "$rc" -eq 2 ] && ok "refused without --reason" || bad "accepted without a reason (rc $rc)" "$out"
+out=$(gate --update-baseline --reason "TXT001 reviewed: 5 placeholder labels, fixed in slice 4" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "accepted with --reason" || bad "rc=$rc" "$out"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 7)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && case "$out" in *"TXT001"*"5 -> 7"*) true ;; *) false ;; esac && ok "TXT001 5 -> 7 is now a rise" || bad "baselined rule not ratcheted (rc $rc)" "$out"
+
+echo "F6 a baseline written before star_rules existed: file mtime decides"
+"$PY" - "$P/.claude/lint-baseline.json" <<'PY'
+import json,sys
+d=json.load(open(sys.argv[1])); d.pop("star_rules",None); d["counts"].pop("TXT001",None)
+json.dump(d,open(sys.argv[1],"w"))
+PY
+"$PY" -c 'import os,sys,time;t=time.time();os.utime(sys.argv[1],(t-3600,t-3600));os.utime(sys.argv[2],(t-60,t-60));os.utime(sys.argv[3],(t-7200,t-7200))' \
+  "$P/.claude/lint-baseline.json" "$R/txt001_build_words_in_user_text.star" "$R/ux001_confirm_before_destructive.star"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 3)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 0 ] && case "$out" in *"FIRST-SEEN TXT001"*) true ;; *) false ;; esac && ok "star newer than baseline -> first-seen" || bad "legacy newer star not first-seen (rc $rc)" "$out"
+mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v UX001 warning 1)"
+out=$(gate 2>&1); rc=$?
+[ "$rc" -eq 1 ] && ok "star older than baseline -> rise" || bad "legacy older star not ratcheted (rc $rc)" "$out"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From 8c0b176c6aaaf0e16bdccb5e58b09cad988a6ec4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:55:48 +0000
Subject: [PATCH 20/68] final-look: PROOF-OF-LOOK + VALID AT required;
 project/cluster rows NOT YET DUE before their stage

From an independent review of #303. obligation-check.sh compared from-stage
only with --adopt, so final-look (stage 6) read PENDING from Stage P. A
project/cluster row above the register's Current stage now reads NOT YET DUE
(module rows unchanged; an unreadable stage line keeps the old owed verdict).
The PROOF-OF-LOOK check now covers final-look as module-review.md requires,
and an unstamped final-look report is FAULT (it could never go stale).

Fixture: tests/wave2/test-obligation-final-look.sh T4-T10 (4 fail on master).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                              |  1 +
 bin/lib/obligation-check.sh               | 54 +++++++++++++++++++++--
 tests/wave2/test-obligation-final-look.sh | 53 ++++++++++++++++++++--
 3 files changed, 101 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0dd1611..f357a7da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(obligations): **Each `PROOF-OF-LOOK` line is checked against the `VALID AT` stamp of its own section, and the report's newest stamp is chosen by commit time ([#155](https://github.com/MendixMau/mxcli-project-toolkit/issues/155)).** A review file that keeps dated addenda was still FAULTing: every proof line was compared with the single newest stamp, so the first section's honest screenshots read "older than VALID AT". The field project's only way back to green was to re-shoot every page and delete its older proof lines. A citation now belongs to the nearest stamp above it (one above every stamp belongs to the headline's), on pretty-printed and one-line HTML alike. "Newest" was last-in-file, so an addendum written above the original stamp went STALE; it is now the stamp with the newest commit time. A stale shot inside a section still FAULTs. Fixture `test-obligation-valid-at.sh` T4-T8 (3 fail on master). Field run 2026-09-26, requirements-driven build — MendixMau
+- fix(obligations): **The final LOOK is held to the per-module LOOK's proof rules, and project-wide obligations are not owed before their stage.** Found in an independent review of #303. `final-look` (from-stage 6) read PENDING on a project still at Stage P, because the from-stage column was only compared with `--adopt`. A project or cluster row whose from-stage is above the register's `## Current stage` now reads `NOT YET DUE` and is not counted as pending. Module rows are unchanged, and an unreadable stage line still means owed. `module-review.md` § "The final LOOK" requires `PROOF-OF-LOOK` lines, but the check ran only for `look`; it now runs for `final-look` too. An unstamped final-look report could never go stale and so passed forever; it is now FAULT ("NO VALID AT"). Fixture `test-obligation-final-look.sh` T4-T10 (4 fail on master). — MendixMau
 - learn(brd-to-build-plan): **No `LOOK` row kind; the paragraph next to the Kind list says why ([#68](https://github.com/MendixMau/mxcli-project-toolkit/issues/68), [#188](https://github.com/MendixMau/mxcli-project-toolkit/issues/188) item 6).** A look is a `HARNESS` row naming the LOOK pass. Whether it happened is read from the `look` and `fidelity` obligations and the look-ledger, never from a State cell a person can set by hand. A second record could say "looked at" while the gate says nobody did. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/obligation-check.sh b/bin/lib/obligation-check.sh
index 26dde2fd..6ced1eef 100755
--- a/bin/lib/obligation-check.sh
+++ b/bin/lib/obligation-check.sh
@@ -19,6 +19,7 @@
 #   FAULT    a mark exists but cannot be read as evidence (no denominator on a pass that owes one)
 #   WAIVED   the register says this one is out of scope, with a reason
 #   ADOPTED  the project joined the pipeline above this obligation's stage
+#   NOT YET DUE  a project/cluster row whose from-stage the register's Current stage has not reached
 #   N/A      this project is not running the pipeline at all (a-la-carte; existing-app-assurance.md)
 
 set -uo pipefail
@@ -163,6 +164,27 @@ _ob_adopted_stage() {
 
 _ob_rank() { case "$1" in P|p) echo 0 ;; [0-7]) echo $(( $1 + 1 )) ;; *) echo 99 ;; esac; }
 
+# _ob_current_stage <register>  → prints P or 0-7 from the register's "## Current stage" line, or
+# nothing when it cannot be read (no section, or a hand-written line that names no stage).
+#
+# Why: the from-stage column was read only against --adopt, so a project/cluster row was owed
+# from the day PROJECT.md existed. final-look (from-stage 6, the whole-app LOOK run LAST) read
+# PENDING on a project still at Stage P — an obligation reported before it can be performed is
+# noise, and noise teaches people to skip the obligation lines (review of #303, 2026-10-13).
+# The readout is gate-check's own ("**Stage N — Title**, …", or "**All gates passed**"); the
+# scaffold line init-project.sh writes ("**Stage P — Kickoff**") parses the same way.
+# Unreadable → empty → the caller keeps the old behaviour (owed): "could not tell the stage"
+# must never read as "not due yet".
+_ob_current_stage() {
+  local reg="$1" line
+  [ -f "$reg" ] || return 0
+  line="$(awk '/^## Current stage/{f=1;next} f && /^## /{exit} f && /^\*\*/{print;exit}' "$reg" 2>/dev/null | tr -d '\r')"
+  case "$line" in
+    "**All gates passed"*) printf '7'; return 0 ;;
+  esac
+  printf '%s' "$line" | sed -nE 's/^\*\*Stage[[:space:]]+([Pp0-7])([^0-9A-Za-z].*)?$/\1/p' | tr 'p' 'P'
+}
+
 # The scope unit set. A module is IN SCOPE once it has been opened for work — a brief directory
 # under architecture/modules/, or a verify run. NOT every module in the MPR: an app that predates
 # the toolkit owes nothing for modules nobody is building (obligations.tsv header, and
@@ -414,6 +436,10 @@ mxtk_obligations_report() {
   local adopted_rank=0
   [ -n "$adopted" ] && adopted_rank="$(_ob_rank "$adopted")"
 
+  local current; current="$(_ob_current_stage "$reg")"
+  local current_rank=99
+  [ -n "$current" ] && current_rank="$(_ob_rank "$current")"
+
   local modules; modules="$(_ob_modules "$root")"
   local ob performer scope match artifact denom degradable from_stage skill
 
@@ -426,6 +452,15 @@ mxtk_obligations_report() {
       continue
     fi
 
+    # Not yet due: a project/cluster row whose stage the register has not reached. Module rows
+    # are not touched — they are owed by a module being OPENED FOR WORK (_ob_modules), which is
+    # its own "due" test, and their verdicts stay exactly as before.
+    if [ "$scope" != "module" ] && [ "$(_ob_rank "$from_stage")" -gt "$current_rank" ]; then
+      printf 'Obligation %-10s NOT YET DUE — owed from stage %s; the register'"'"'s Current stage is %s (%s)\n' \
+        "$ob" "$from_stage" "$current" "$skill"
+      continue
+    fi
+
     local units
     case "$scope" in
       module)  units="$modules" ;;
@@ -439,7 +474,14 @@ mxtk_obligations_report() {
       continue
     fi
 
-    local total=0 done_n=0 waived_n=0 pending="" faulted="" stale="" noproof="" u hit reason stale_at proof_why candidates c newest
+    # The two LOOK rows share the pixel rule: module-review.md's per-module LOOK and its "final
+    # LOOK" both require PROOF-OF-LOOK lines, and the final one must also be stamped (VALID AT is
+    # what makes it "final" — an unstamped whole-app report could never go stale, so it would
+    # discharge the pass forever after any later change). Review of #303, 2026-10-13.
+    local is_look=0 needs_stamp=0
+    case "$ob" in look|final-look) is_look=1 ;; esac
+    [ "$ob" = "final-look" ] && needs_stamp=1
+    local total=0 done_n=0 waived_n=0 pending="" faulted="" stale="" noproof="" unstamped="" u hit reason stale_at proof_why candidates c newest
     while IFS= read -r u; do
       [ -n "$u" ] || continue
       total=$((total+1))
@@ -468,7 +510,8 @@ mxtk_obligations_report() {
         [ -n "$c" ] || continue
         [ -n "$newest" ] || newest="$c"
         if [ "$denom" = "yes" ] && ! _ob_has_denominator "$c"; then continue; fi
-        if [ "$ob" = "look" ] && _ob_look_proof_broken "$root" "$c" >/dev/null; then continue; fi
+        if [ "$needs_stamp" = 1 ] && [ -z "$(_ob_valid_at_stamps "$c")" ]; then continue; fi
+        if [ "$is_look" = 1 ] && _ob_look_proof_broken "$root" "$c" >/dev/null; then continue; fi
         if _ob_stale "$root" "$c" >/dev/null; then continue; fi
         hit="$c"; break
       done <<< "$candidates"
@@ -482,7 +525,9 @@ mxtk_obligations_report() {
       # would send them to the wrong place.
       elif [ "$denom" = "yes" ] && ! _ob_has_denominator "$newest"; then
         faulted="$faulted $u"
-      elif [ "$ob" = "look" ] && proof_why="$(_ob_look_proof_broken "$root" "$newest")"; then
+      elif [ "$needs_stamp" = 1 ] && [ -z "$(_ob_valid_at_stamps "$newest")" ]; then
+        unstamped="$unstamped $u"
+      elif [ "$is_look" = 1 ] && proof_why="$(_ob_look_proof_broken "$root" "$newest")"; then
         # A LOOK whose screenshots cannot be verified is a CSS review — treated as no report.
         noproof="$noproof $u($proof_why)"
       elif stale_at="$(_ob_stale "$root" "$newest")"; then
@@ -496,9 +541,10 @@ mxtk_obligations_report() {
 
     local scoped=$((total - waived_n)) tail=""
     [ "$waived_n" -gt 0 ] && tail=" ($waived_n waived)"
-    if [ -n "$faulted" ] || [ -n "$noproof" ]; then
+    if [ -n "$faulted" ] || [ -n "$noproof" ] || [ -n "$unstamped" ]; then
       local why_bits=""
       [ -n "$faulted" ] && why_bits="NO DENOMINATOR:$faulted — a pass that cannot say what it covered has not covered it"
+      [ -n "$unstamped" ] && why_bits="${why_bits:+$why_bits; }NO VALID AT:$unstamped — an unstamped final LOOK can never go stale, so it is treated as no report (stamp it with the commit it was true at)"
       [ -n "$noproof" ] && why_bits="${why_bits:+$why_bits; }NO PROOF-OF-LOOK — a visual verdict with no verifiable screenshot is a CSS review, treated as no report"
       printf 'Obligation %-10s FAULT — %d of %d discharged%s; %s (%s)\n' \
         "$ob" "$done_n" "$scoped" "$tail" "$why_bits" "$skill"
diff --git a/tests/wave2/test-obligation-final-look.sh b/tests/wave2/test-obligation-final-look.sh
index 7693cad7..de80246d 100755
--- a/tests/wave2/test-obligation-final-look.sh
+++ b/tests/wave2/test-obligation-final-look.sh
@@ -8,6 +8,12 @@
 # status fix on four pages. Every per-task review passed; only a read-only whole-app LOOK, run
 # after the last task, found it — and nothing owed that pass. The row makes it owed; "final" is
 # enforced by the existing VALID AT rule (_ob_stale), not by new code.
+#
+# Review of #303 (2026-10-13), T4-T10: the final LOOK owes the same PROOF-OF-LOOK lines as the
+# per-module LOOK (module-review.md § "The final LOOK" requires them; only ob=look was checked);
+# an unstamped final report is FAULT (with no VALID AT it could never go stale, so it would pass
+# forever); and the row is NOT YET DUE until the register's Current stage reaches its from-stage
+# (6) — it read PENDING from the day PROJECT.md existed. Module rows keep their verdicts.
 # Subject: obligation-check.sh. Producer of the report: module-review.md § "The final LOOK".
 set -uo pipefail
 ARG="${1:?usage: test-obligation-final-look.sh /path/to/bin/gate-check.sh (or lib/obligation-check.sh)}"
@@ -47,16 +53,57 @@ printf '<p>Whole app looked at, all fine.</p>\nVALID AT: %s\n' "$NEW" > "$REP"
 l="$(line)"
 case "$l" in *FAULT*DENOMINATOR*) ok "no denominator is FAULT" ;; *) bad "expected FAULT, got: $l" ;; esac
 
-echo "== T4: denominator, stamped at HEAD -> PASS =="
-printf '<p>Final LOOK: 38 of 38 pages, 4 of 4 roles</p>\nVALID AT: %s\n' "$NEW" > "$REP"
+mkdir -p "$P/design/ui-reviews/shots"
+head -c 20000 /dev/urandom > "$P/design/ui-reviews/shots/home.png"   # written after both commits
+PROOF='<pre>PROOF-OF-LOOK: ModuleX.Home = shots/home.png</pre>'
+
+echo "== T4: denominator, stamped at HEAD, proof on disk -> PASS =="
+printf '<p>Final LOOK: 1 of 1 pages, 1 of 1 roles</p>\nVALID AT: %s\n%s\n' "$NEW" "$PROOF" > "$REP"
 l="$(line)"
 case "$l" in *PASS*) ok "current final LOOK is PASS" ;; *) bad "expected PASS, got: $l" ;; esac
 
 echo "== T5: stamped before the last model commit -> owed again (STALE) =="
-printf '<p>Final LOOK: 38 of 38 pages, 4 of 4 roles</p>\nVALID AT: %s\n' "$OLD" > "$REP"
+printf '<p>Final LOOK: 1 of 1 pages, 1 of 1 roles</p>\nVALID AT: %s\n%s\n' "$OLD" "$PROOF" > "$REP"
 l="$(line)"
 case "$l" in *PENDING*) ok "stale final LOOK is PENDING" ;; *) bad "expected PENDING, got: $l" ;; esac
 [ "$(stale)" -gt 0 ] && ok "STALE line names it" || bad "no STALE line for final-look"
 
+echo "== T6: stamped at HEAD, denominator, but no PROOF-OF-LOOK line -> FAULT =="
+printf '<p>Final LOOK: 1 of 1 pages, 1 of 1 roles</p>\nVALID AT: %s\n' "$NEW" > "$REP"
+l="$(line)"
+case "$l" in *FAULT*PROOF-OF-LOOK*) ok "final LOOK without screenshots is FAULT" ;; *) bad "expected FAULT (no proof), got: $l" ;; esac
+
+echo "== T7: denominator and proof but no VALID AT -> FAULT naming the stamp =="
+printf '<p>Final LOOK: 1 of 1 pages, 1 of 1 roles</p>\n%s\n' "$PROOF" > "$REP"
+l="$(line)"
+case "$l" in *FAULT*"NO VALID AT"*) ok "unstamped final LOOK is FAULT" ;; *) bad "expected FAULT (no VALID AT), got: $l" ;; esac
+
+echo "== T8: register at Stage 5 -> final-look NOT YET DUE (owed from 6) =="
+rm -f "$REP"
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 5 — Build**, in progress (derived by gate-check on 2026-10-13; re-run it rather than editing this line).\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *"NOT YET DUE"*) ok "final-look not owed before stage 6" ;; *) bad "expected NOT YET DUE, got: $l" ;; esac
+
+echo "== T9: register at Stage 6, or all gates passed -> owed (PENDING) =="
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 6 — Test**, in progress.\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *PENDING*) ok "owed at stage 6" ;; *) bad "expected PENDING at stage 6, got: $l" ;; esac
+printf '# PROJECT.md\n\n## Current stage\n\n**All gates passed** — through Stage 7 (Cutover)\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *PENDING*) ok "owed when all gates passed" ;; *) bad "expected PENDING after all gates, got: $l" ;; esac
+printf '# PROJECT.md\n\n## Current stage\n\nWe are somewhere in the build.\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *PENDING*) ok "unreadable stage keeps the old verdict (owed)" ;; *) bad "unreadable stage changed the verdict: $l" ;; esac
+
+echo "== T10: module rows keep their verdicts at Stage P =="
+mod() { "$OBCHECK" "$P" 2>&1 | grep -E '^Obligation (look|sweep|journeys|fidelity|dispatch) ' | sed -E 's/ +/ /g'; }
+rm -f "$P/PROJECT.md"; before="$(mod)"
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage P — Kickoff**, in progress.\n' > "$P/PROJECT.md"
+after="$(mod)"
+[ -n "$before" ] && [ "$before" = "$after" ] && ok "module verdicts identical with and without a Stage P register" \
+  || bad "module verdicts changed: before=[$before] after=[$after]"
+l="$("$OBCHECK" "$P" 2>&1 | grep -E '^Obligation skeleton ')"
+case "$l" in *"NOT YET DUE"*) ok "project row from stage 5 not due at Stage P" ;; *) bad "skeleton at Stage P: $l" ;; esac
+
 echo "pass=$PASS fail=$FAIL"
 [ "$FAIL" -eq 0 ]

From 944fce92f315317dcd757d58158b944c47bb5a40 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:56:00 +0000
Subject: [PATCH 21/68] page-fidelity: match text on what the page shows;
 ButtonStyle classes; chrome from layout (#158, #157)

#158: headings/actions/content were a substring test over the whole page MDL
(page name, identifiers, comments) with 60% of the >3-char words enough. Each
wireframe string is now matched per literal against the page's own captions
of the right kind, on whole words, all words for labels under three words;
a label with only short words is required instead of passing vacuously.
Bindings keep the identifier corpus.

#157 remainder: an actionbutton declares btn + btn-<ButtonStyle> (btn-default
when DESCRIBE omits it); the page's layout MDL in the input, or --chrome a,b,
adds to the fixed chrome set. Without either, nothing changes.

Before/after over every page/wireframe pair in the repo: 11 of 13 unchanged;
the --stub commented-template page 66% -> 39% (a heading credited from
dgWaiting + CustomerQuery identifiers); two new probe pairs fail on master.
Fixtures: test-page-fidelity-mocks.sh +16 assertions (13 fail on master).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   1 +
 project-bin/page-fidelity.js                  | 196 +++++++++++++++++-
 .../fixtures/page-fidelity-mocks/CAPTURE.md   |  40 ++++
 .../layout-app-default.html                   |  15 ++
 .../layout-app-default.mdl                    |  35 ++++
 .../page-fidelity-mocks/product-overview.html |  19 ++
 tests/wave2/test-page-fidelity-mocks.sh       |  39 ++++
 7 files changed, 337 insertions(+), 8 deletions(-)
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.html
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.mdl
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/product-overview.html

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..8287fe08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(page-fidelity): **text is matched against what the page shows, on whole words; ButtonStyle counts as `btn btn-<style>`; layout chrome comes from the layout** ([#158](https://github.com/MendixMau/mxcli-project-toolkit/issues/158), [#157](https://github.com/MendixMau/mxcli-project-toolkit/issues/157)). Headings, actions and content were a substring test over the whole page MDL with 60% of the >3-char words enough, so a wireframe H2 "Product overview" counted as present on a page named `Product_Overview`, "Deactivate product" on a button captioned "Deactivate", and an "Add" button passed with no words to test. Each wireframe string is now matched per literal against the page's own captions — headings against Title/Content/non-button Captions, actions against button Captions, content against every displayed literal — on whole words, all of them for a label under three words; bindings keep the identifier corpus. An `actionbutton` now declares `btn` + `btn-<ButtonStyle>` (`btn-default` when DESCRIBE omits it), per the measured DOM contract in `learned-stylegallery.md`. The page's layout, when its MDL is in the input (`describe layout`), or `--chrome a,b`, adds to the fixed chrome set; without either nothing changes. Scores move: on 13 real or fixture page/wireframe pairs in the repo, 11 unchanged, a stub page 66%→39% (a "Waiting for customer" heading credited from `dgWaiting` + `CustomerQuery`), and the two new probe pairs; a field run on a live project is still owed. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/page-fidelity.js b/project-bin/page-fidelity.js
index bd9173c1..8f1fa863 100755
--- a/project-bin/page-fidelity.js
+++ b/project-bin/page-fidelity.js
@@ -15,6 +15,8 @@
 // Usage:
 //   page-fidelity.js <wireframe.html> <page-name> <mdl-file> [mdl-file...]
 //   page-fidelity.js <wireframe.html> <page-name> -        (MDL on stdin, e.g. DESCRIBE output)
+//   --chrome a,b,c   classes the page's layout renders (not the page's to declare); or pass the
+//                    layout's MDL (`describe layout <Mod.Layout>`) as another input — see layoutChrome
 //
 // Scoring: headings 25%, action labels 30%, content blocks 25%, structural classes 20%,
 // bindings 25% (normalized over the dimensions the wireframe actually uses — one it
@@ -75,9 +77,20 @@ const proto = require(path.join(__dirname, 'prototype-route.js'));
 const argv = process.argv.slice(2);
 const NOLOG = argv.includes('--no-log');
 const STUB = argv.includes('--stub');
-const [WF, PAGE, ...MDLS] = argv.filter(a => a !== '--no-log' && a !== '--stub');
+// --chrome a,b,c — classes the page's layout renders, when the layout's MDL cannot be passed
+// (see layoutChrome below). `--chrome=a,b` works too.
+const CHROME = [];
+const rest = [];
+for (let i = 0; i < argv.length; i++) {
+  const a = argv[i];
+  if (a === '--no-log' || a === '--stub') continue;
+  if (a === '--chrome') { (argv[++i] || '').split(/[\s,]+/).filter(Boolean).forEach(c => CHROME.push(c)); continue; }
+  if (a.startsWith('--chrome=')) { a.slice(9).split(/[\s,]+/).filter(Boolean).forEach(c => CHROME.push(c)); continue; }
+  rest.push(a);
+}
+const [WF, PAGE, ...MDLS] = rest;
 if (!WF || !PAGE || !MDLS.length) {
-  console.error('usage: page-fidelity.js [--no-log] [--stub] <wireframe.html | prototype.html#/route> <page-name> <mdl-file...|->');
+  console.error('usage: page-fidelity.js [--no-log] [--stub] [--chrome a,b,c] <wireframe.html | prototype.html#/route> <page-name> <mdl-file...|->');
   process.exit(2);
 }
 const WF_REF = proto.parseRef(WF);
@@ -488,8 +501,161 @@ function pageBody(src, from) {
   return src.slice(from);
 }
 
-function score(wf, mdl) {
-  const corpus = norm(mdl);
+// ---- what the page SHOWS: its caption-like string literals, by widget kind ---------------
+//
+// TEXT IS MATCHED AGAINST WHAT THE PAGE DISPLAYS, NOT AGAINST THE WHOLE MDL (#158). The three
+// text dimensions used to test a wireframe string against the entire normalised page MDL —
+// page name, entity, attribute and microflow names, comments — as a SUBSTRING, with 60% of
+// its >3-char words enough. So a wireframe H2 "Case overview" was present on any page NAMED
+// Case_Overview whether or not it rendered that heading, "case" was present inside
+// `CustomerCase`, and a three-word label needed only two words anywhere. The dimension read
+// green for headings and buttons the page did not show.
+//
+// Now each wireframe string is matched against the page's string literals of the kind that
+// renders it:
+//   headings  the page/snippet Title, Content of text widgets, Caption of non-button widgets
+//             (a group box, a tab) — never a data-grid column caption or a button caption
+//   actions   Caption of actionbutton / linkbutton
+//   content   every displayed literal (Title, Content, Caption, Label, Placeholder)
+// ALTER PAGE `set Caption = '…' on w` counts for w's kind when w is declared in the input,
+// for every kind when it is not. Matching is per literal and on WHOLE words: a label with
+// fewer than three kept words needs all of them in one literal; a longer one needs 60% (a
+// sentence may be reworded). A label whose words are all ≤3 chars ("New", "OK") used to be
+// an automatic hit; its short words are now kept and required. Bindings keep the identifier
+// corpus — there identifiers are the point.
+const ACTION_TYPES = new Set(['actionbutton', 'linkbutton']);
+const NOT_HEADING  = new Set(['actionbutton', 'linkbutton', 'column', 'textbox', 'textarea', 'datepicker',
+  'combobox', 'checkbox', 'radiobuttons', 'dropdown', 'referenceselector', 'textfilter', 'numberfilter',
+  'datefilter', 'dropdownfilter']);
+const LIT = "'((?:[^']|'')*)'";
+const unq = s => s.replace(/''/g, "'");
+
+// The MDL with comments removed and string CONTENTS blanked (same length, so indexes line up):
+// widget openers are then found only in code, never in a caption that happens to contain
+// "word word (".
+function maskMdl(mdl) {
+  let out = '', i = 0;
+  while (i < mdl.length) {
+    const c = mdl[i];
+    if (c === "'") {
+      let j = i + 1;
+      for (; j < mdl.length; j++) { if (mdl[j] === "'") { if (mdl[j + 1] === "'") { j++; continue; } break; } }
+      out += "'" + ' '.repeat(Math.max(0, j - i - 1)) + (j < mdl.length ? "'" : ''); i = j + 1;
+    } else if (c === '-' && mdl[i + 1] === '-') {
+      const e = mdl.indexOf('\n', i); const end = e < 0 ? mdl.length : e;
+      out += ' '.repeat(end - i); i = end;
+    } else if (c === '/' && mdl[i + 1] === '*') {
+      const e = mdl.indexOf('*/', i + 2); const end = e < 0 ? mdl.length : e + 2;
+      out += mdl.slice(i, end).replace(/[^\n]/g, ' '); i = end;
+    } else { out += c; i++; }
+  }
+  return out;
+}
+
+// Widgets: `<type> <name> ( props )`, props balanced on the masked text. Returns
+// [{ type, name, props }] with props sliced from the ORIGINAL text (literals intact).
+function mdlWidgets(mdl) {
+  const masked = maskMdl(mdl);
+  const out = [];
+  // The name may be qualified — `create page Mod.Page (Title: …)` is a declaration whose Title
+  // is the page's own heading — and is then keyed by its last part.
+  for (const m of masked.matchAll(/\b([A-Za-z]+)\s+(?:"?[A-Za-z_][A-Za-z0-9_]*"?\.)?"?([A-Za-z_][A-Za-z0-9_]*)"?\s*\(/g)) {
+    const open = m.index + m[0].length;
+    let depth = 1, i = open;
+    for (; i < masked.length && depth; i++) { if (masked[i] === '(') depth++; else if (masked[i] === ')') depth--; }
+    out.push({ type: m[1].toLowerCase(), name: m[2], props: mdl.slice(open, i - 1), at: m.index });
+  }
+  return { widgets: out, masked };
+}
+
+function mdlTexts(mdl) {
+  const { widgets, masked } = mdlWidgets(mdl);
+  const t = { headings: [], actions: [], content: [] };
+  const kind = {};
+  const add = (type, prop, val) => {
+    if (!val.trim()) return;
+    prop = prop.toLowerCase();
+    if (prop === 'title') { t.headings.push(val); t.content.push(val); return; }
+    if (prop === 'label' || prop === 'placeholder') { t.content.push(val); return; }
+    if (prop !== 'caption' && prop !== 'content') return;
+    t.content.push(val);
+    if (type === null) { t.headings.push(val); t.actions.push(val); return; }
+    if (ACTION_TYPES.has(type)) t.actions.push(val);
+    else if (!NOT_HEADING.has(type)) t.headings.push(val);
+  };
+  for (const w of widgets) {
+    kind[w.name] = w.type;
+    for (const p of w.props.matchAll(new RegExp('\\b(Title|Caption|Content|Label|Placeholder)\\s*:\\s*' + LIT, 'gi')))
+      add(w.type, p[1], unq(p[2]));
+  }
+  // ALTER … set (Caption = '…', …) on w   /   set Title = '…' (page-level, no `on`). mxcli
+  // accepts `:` inside the parenthesised form too (`set (Content: '…') on brandText`).
+  for (const m of masked.matchAll(/\bset\b([^;{}]*?)(?:\bon\s+"?([A-Za-z_][A-Za-z0-9_]*)"?|(?=[;}\n]))/gi)) {
+    const seg = mdl.slice(m.index, m.index + m[0].length);
+    const type = m[2] ? (kind[m[2]] || null) : null;
+    for (const p of seg.matchAll(new RegExp('\\b(Title|Caption|Content|Label|Placeholder)\\s*[:=]\\s*' + LIT, 'gi')))
+      add(p[1].toLowerCase() === 'title' && !m[2] ? 'page' : type, p[1], unq(p[2]));
+  }
+  return t;
+}
+
+// The words a wireframe string must show: the >3-char words, or — when it has none ("New",
+// "OK", "Add") — all of its words, so a short label is matched instead of passing vacuously.
+const keyWords = txt => { const w = words(txt); return w.length ? w : norm(txt).split(' ').filter(Boolean); };
+function makeHit(lits) {
+  const sets = lits.map(l => new Set(norm(l).split(' ').filter(Boolean)));
+  return txt => {
+    const w = keyWords(txt);
+    if (!w.length) return true;
+    const need = w.length < 3 ? w.length : Math.ceil(0.6 * w.length - 1e-9);
+    return sets.some(s => w.filter(x => s.has(x)).length >= need);
+  };
+}
+
+// ButtonStyle → rendered classes (#157). An ACTIONBUTTON renders `<button class="btn mx-button
+// … btn-<style>">` — measured with getComputedStyle in a running Mendix 11.13 app with Atlas
+// Core (skills/learned-stylegallery.md → "The Mendix DOM contract": `btn … btn-default`), and
+// DESCRIBE omits the property for the Default style, so an actionbutton with no ButtonStyle
+// still carries btn-default. A wireframe that draws `button.btn.btn-primary` was reading as
+// two missing classes on every page whose buttons are styled through the property, which is
+// the only way a page script styles a button. Link buttons are NOT mapped: their rendered
+// classes have not been measured.
+function buttonClasses(mdl) {
+  const out = new Set();
+  const { widgets, masked } = mdlWidgets(mdl);
+  const kind = {};
+  for (const w of widgets) {
+    kind[w.name] = w.type;
+    if (w.type !== 'actionbutton') continue;
+    const st = w.props.match(/\bButtonStyle\s*:\s*"?([A-Za-z]+)"?/i);
+    out.add('btn'); out.add('btn-' + (st ? st[1] : 'default').toLowerCase());
+  }
+  for (const m of masked.matchAll(/\bset\b[^;{}]*?\bButtonStyle\s*[:=]\s*"?([A-Za-z]+)"?[^;{}]*?\bon\s+"?([A-Za-z_][A-Za-z0-9_]*)"?/gi))
+    if (!kind[m[2]] || kind[m[2]] === 'actionbutton') { out.add('btn'); out.add('btn-' + m[1].toLowerCase()); }
+  return out;
+}
+
+// LAYOUT CHROME FROM THE LAYOUT (#157). Classes the page's layout renders are not the page's
+// to declare. The default set below is the guess this scorer has always made; a project's own
+// layout (rail, sidebar, brand) renders more than four names, and each read as missing on every
+// page. Two ways to tell the scorer what the layout renders, both ADDED to the defaults:
+//   * pass the layout's MDL as another input — `create layout` from the build script, or
+//     `./mxcli -p <app>.mpr -c "describe layout <Mod.Layout>"` (mxcli ≥ v0.20 authors layouts);
+//     the layout is the one the page names in `Layout:`, and its Class/DynamicClasses count;
+//   * `--chrome a,b,c` for a layout that cannot be described (a marketplace one).
+// Chrome classes stay REPORTED ("chrome (layout-supplied, not scored)"), never silently dropped.
+function layoutChrome(srcs, ownMdl) {
+  const ref = ownMdl.match(/\bLayout\s*:\s*"?([A-Za-z0-9_]+)"?\."?([A-Za-z0-9_]+)"?/i);
+  if (!ref) return { name: null, found: false, classes: new Set() };
+  const re = new RegExp('CREATE(\\s+OR\\s+(MODIFY|REPLACE))?\\s+LAYOUT\\s+"?' + ref[1] + '"?\\."?' + ref[2] + '"?\\b', 'i');
+  for (const src of srcs) {
+    const d = src.match(re);
+    if (d) return { name: ref[1] + '.' + ref[2], found: true, classes: classesIn(pageBody(src, d.index)) };
+  }
+  return { name: ref[1] + '.' + ref[2], found: false, classes: new Set() };
+}
+
+function classesIn(mdl) {
   const cls = new Set();
   // `Class:` in a declaration, `Class =` in an ALTER PAGE SET.
   for (const m of mdl.matchAll(/\bClass\s*[:=]\s*['"]([^'"]+)['"]/gi)) m[1].split(/\s+/).forEach(c => cls.add(c));
@@ -515,9 +681,17 @@ function score(wf, mdl) {
     }
     for (const t of mdl.slice(from, i).matchAll(/'([a-z][a-z0-9-]*)'/gi)) cls.add(t[1]);
   }
-  const hit = txt => { const w = words(txt); return w.length ? w.filter(x => corpus.includes(x)).length / w.length >= 0.6 : true; };
-  const dim = arr => ({ n: arr.length, ok: arr.filter(hit).length, miss: arr.filter(x => !hit(x)) });
-  const h = dim(wf.headings), b = dim(wf.buttons), k = dim(wf.blocks);
+  return cls;
+}
+
+function score(wf, mdl, chromeExtra) {
+  const corpus = norm(mdl);
+  const cls = classesIn(mdl);
+  buttonClasses(mdl).forEach(c => cls.add(c));
+  const lits = mdlTexts(mdl);
+  const dim = (arr, hit) => ({ n: arr.length, ok: arr.filter(hit).length, miss: arr.filter(x => !hit(x)) });
+  const h = dim(wf.headings, makeHit(lits.headings)), b = dim(wf.buttons, makeHit(lits.actions)),
+        k = dim(wf.blocks, makeHit(lits.content));
   // Platform-supplied classes are not the page's to declare, so they leave the
   // denominator — REPORTED, never silently dropped (see the printout below):
   //   * on a popup layout, the dialog frame (dialog/dialog-head/-body/-foot) is
@@ -530,6 +704,7 @@ function score(wf, mdl) {
   const popup = /Layout:\s*[^,)\n]*Popup/i.test(mdl);
   const chromeSet = new Set(popup ? ['dialog', 'dialog-head', 'dialog-body', 'dialog-foot']
                                   : ['topbar', 'userchip', 'avatar', 'content']);
+  chromeExtra.forEach(x => chromeSet.add(x));
   const intrinsic = new Set(/\btextbox\b|\btextfilter\b/i.test(mdl) ? ['label', 'input'] : []);
   if (/\bdatagrid\b/i.test(mdl)) wf.gridOnly.forEach(x => intrinsic.add(x));
   const scoredCls = wf.classes.filter(x => !chromeSet.has(x));
@@ -550,7 +725,8 @@ const ownMdl = pageMdl();
 if (!ownMdl.trim()) { console.error('page-fidelity: no declaration of page "' + PAGE + '" found in input'); process.exit(2); }
 const snips = expandSnippets(ownMdl);
 const mdl = ownMdl + snips.extra;
-const s = score(wf, mdl);
+const lay = layoutChrome(SRCS, ownMdl);
+const s = score(wf, mdl, [...lay.classes, ...CHROME]);
 const dims = '   headings ' + s.h.ok + '/' + s.h.n + '  actions ' + s.b.ok + '/' + s.b.n +
   '  content ' + s.k.ok + '/' + s.k.n + '  classes ' + s.c.ok + '/' + s.c.n +
   (s.bd.n ? '  bindings ' + s.bd.ok + '/' + s.bd.n : '');
@@ -595,6 +771,10 @@ if (bareImg && s.bd.miss.some(r => r.image))
     ' ImageUrl parameters, so their attribute bindings cannot be seen here; pass the script that' +
     ' set them (ALTER PAGE … set ImageUrl = [Attr]) as another input');
 if (s.c.chrome.length) console.log('  chrome (layout-supplied, not scored): ' + s.c.chrome.join(' '));
+if (lay.found) console.log('  layout ' + lay.name + ' read from input: ' + lay.classes.size + ' class(es) treated as chrome');
+else if (lay.name && s.c.miss.length && !CHROME.length)
+  console.log('  layout ' + lay.name + ' is not in the input — if a missed class is one it renders, pass' +
+    ' `describe layout ' + lay.name + '` output as another input, or name it with --chrome a,b');
 if (wf.mockUsed.length) console.log('  bound-data mocks (wireframe-local, text not scored): ' + wf.mockUsed.join(' '));
 if (wf.structural.length) console.log('  wireframe structure (kept as page content, not a mock): ' + wf.structural.join(' '));
 if (wf.mockCls.length) console.log('  wireframe-local classes (not scored): ' + wf.mockCls.join(' '));
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
index c9dd49ea..57115fa0 100644
--- a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
+++ b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
@@ -99,3 +99,43 @@ the parser had never seen: v0.25 prints the expression bare (`DynamicClasses: if
 'is-active' else 'is-idle'`), under `--mdl 0` as well. `dynclasses-script.mdl` is the
 headerless script as exec'd (quoted form). `dynclasses.html` is a **synthetic** one-card
 wireframe; nothing in it is a fact about a real wireframe — the case is about the MDL side.
+
+## product-overview — text matched on what the page shows; ButtonStyle classes (2026-10-13)
+
+The MDL side is **not copied here**: the test reads the real `mxcli describe page` capture that
+already lives at `tests/wave2/fixtures/context-pack/capture/describe/PAGE__Sales.Product_Overview.out`.
+It carries what the two rules need and nobody would have imagined: a multi-line `actionbutton`
+with `ButtonStyle: Primary`, one with `ButtonStyle: Danger`, two with **no** ButtonStyle (DESCRIBE
+omits the Default style), a page named `Product_Overview` whose title is `'Catalog'`, a
+microflow `ACT_Product_Deactivate` behind a button captioned `'Deactivate'`, and a `-- Context:`
+comment inside the grid.
+
+`product-overview.html` is **synthetic**, one element per rule. Shown by the page: the H1
+`Catalog`, the sub-title paragraph, `New item` / `Edit` / `Delete` buttons with
+`btn btn-<style>` classes. Not shown by the page: an H2 `Product overview` (only the page
+*name* carries those words), a `Deactivate product` button (the caption is `Deactivate`; the
+second word is in identifiers only), an `Add` button (no `>3`-char word, so it used to pass
+vacuously), and a `row-actions` wrapper the page does not declare.
+
+Master: `89% headings 2/2 actions 5/5 content 1/1 classes 4/9`. Fixed: `73% headings 1/2
+actions 3/5 content 1/1 classes 8/9`.
+
+The ButtonStyle → `btn btn-<style>` mapping rests on `learned-stylegallery.md` → "The Mendix
+DOM contract" (ACTIONBUTTON → `<button class="btn mx-button … btn-default">`, measured in a
+running 11.13 app). Only the Default style was measured there; the other styles follow the
+same `btn-<lowercase style>` class, which is how Atlas styles them. A rendered-DOM capture of a
+non-default style is still owed.
+
+## layout-app-default — chrome from the page's layout (2026-10-13)
+
+`layout-app-default.mdl` is **upstream mxcli's own example**, verbatim: the
+`LayoutTest.App_Default` layout and `LayoutTest.Home` page from `mendixlabs/mxcli`
+`mdl-examples/doctype-tests/layouts.mdl` at commit `bd45c47` (Apache-2.0), which upstream's
+doctype test execs. It is a script, not a field capture — no field project in this repo has
+a captured `describe layout`; upstream documents that `DESCRIBE LAYOUT` emits this same
+re-executable form. `layout-app-default.html` is **synthetic**: the page drawn inside its
+frame, with the layout's `region-topbar` / `region-sidebar` / `region-content` classes.
+
+Master: `71% classes 0/2` (the layout's region classes scored as the page's). Fixed, with the
+layout in the input or named with `--chrome`: `100% classes 0/0`, both reported as chrome.
+Without either, the default chrome set is unchanged and the classes are still owed.
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.html b/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.html
new file mode 100644
index 00000000..ff1eb5a8
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<!-- SYNTHETIC wireframe for the layout-chrome case: a page drawn inside its app frame, the way a
+     full-page wireframe mocks the shell. Paired with layout-app-default.mdl, whose layout renders
+     region-topbar / region-sidebar / region-content and whose page renders the h1 and the text. -->
+<html><head><meta charset="utf-8"><title>Home</title></head>
+<body>
+  <div class="wf-screen">
+    <div class="region-topbar"><b>My Application</b></div>
+    <div class="region-sidebar"><nav><a href="#">Home</a></nav></div>
+    <div class="region-content">
+      <h1>Home</h1>
+      <p>Hello from the content region</p>
+    </div>
+  </div>
+</body></html>
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.mdl b/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.mdl
new file mode 100644
index 00000000..ba172b08
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/layout-app-default.mdl
@@ -0,0 +1,35 @@
+-- UPSTREAM EXAMPLE, verbatim: mendixlabs/mxcli mdl-examples/doctype-tests/layouts.mdl at commit
+-- bd45c47 (2026-10-13, Apache-2.0) — the layout `LayoutTest.App_Default` and the page `LayoutTest.Home`
+-- that upstream's doctype test execs against a real project. DESCRIBE LAYOUT emits this same
+-- re-executable form (upstream docs-site reference/page/create-layout.md). Only these header lines
+-- were added; the two statements are copied unchanged, comments included.
+mdl 1;
+-- The class is load-bearing, not decoration: Atlas scopes 24 of its layout
+-- rules to .layout-atlas and its variants, so a layout without one builds
+-- cleanly and renders with no topbar bar and no sidebar rail.
+create or modify layout LayoutTest.App_Default (
+  layouttype: 'Responsive',
+  class: 'layout-atlas layout-atlas-responsive-default'
+) {
+  scrollcontainer layoutContainer {
+    region top (size: 60, sizemode: 'Fixed', class: 'region-topbar') {
+      dynamictext brandText (content: 'My Application')
+      -- MENUBAR is the horizontal navigation a topbar carries; NAVIGATIONTREE
+      -- below is the vertical one a sidebar carries. Same stored shape.
+      menubar mainMenu (profile: 'Responsive')
+    }
+    region left (size: 232, sizemode: 'Pixels', class: 'region-sidebar') {
+      navigationtree navMenu (profile: 'Responsive')
+    }
+    region center (class: 'region-content') {
+      placeholder Main
+    }
+  }
+};
+
+create or modify page LayoutTest.Home (
+  title: 'Home',
+  layout: LayoutTest.App_Default
+) {
+  dynamictext welcome (content: 'Hello from the content region')
+};
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/product-overview.html b/tests/wave2/fixtures/page-fidelity-mocks/product-overview.html
new file mode 100644
index 00000000..c134f9cf
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/product-overview.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<!-- SYNTHETIC wireframe, paired with the REAL DESCRIBE capture
+     tests/wave2/fixtures/context-pack/capture/describe/PAGE__Sales.Product_Overview.out.
+     Every line here exists to probe one scoring rule against that capture (see CAPTURE.md):
+     the first four elements the page really shows; the last three it does not. -->
+<html><head><meta charset="utf-8"><title>Catalog</title></head>
+<body>
+  <main>
+    <div class="page-header">
+      <h1 class="page-title">Catalog</h1>
+      <p class="page-sub">Orderable items with their list price and brand.</p>
+      <div class="page-actions"><button class="btn btn-primary">New item</button></div>
+    </div>
+    <div class="row-actions"><button class="btn btn-default">Edit</button> <button class="btn btn-danger">Delete</button></div>
+    <h2>Product overview</h2>
+    <button class="btn btn-default">Deactivate product</button>
+    <button class="btn btn-default">Add</button>
+  </main>
+</body></html>
diff --git a/tests/wave2/test-page-fidelity-mocks.sh b/tests/wave2/test-page-fidelity-mocks.sh
index fa45a17b..2dc22eca 100755
--- a/tests/wave2/test-page-fidelity-mocks.sh
+++ b/tests/wave2/test-page-fidelity-mocks.sh
@@ -188,6 +188,45 @@ has   "bare DynamicClasses (v0.25 DESCRIBE) declares its classes" "$OUT12" "clas
 OUT13=$(cd "$TMP" && node "$SUT" --no-log "$FIX/dynclasses.html" Dyn_Probe "$FIX/dynclasses-script.mdl" 2>&1)
 has   "quoted DynamicClasses (headerless script) still does"      "$OUT13" "classes 2/2"
 
+echo "  -- #158: text is matched against what the page SHOWS, on whole words"
+# The MDL is a REAL capture: mxcli DESCRIBE of Sales.Product_Overview (context-pack fixture).
+# product-overview.html is synthetic and marked; see CAPTURE.md. On master every heading and
+# action below read as present — "Product overview" from the page NAME, "Deactivate product"
+# from the microflow and entity names, "Add" because a label with no >3-char word passed
+# vacuously — and the run printed 89%.
+CAP="$TOOLKIT/tests/wave2/fixtures/context-pack/capture/describe/PAGE__Sales.Product_Overview.out"
+OUT14=$(cd "$TMP" && node "$SUT" --no-log "$FIX/product-overview.html" Product_Overview - < "$CAP" 2>&1)
+echo "$OUT14" | sed 's/^/    | /'
+has   "a heading the page shows (Title/H1 'Catalog') is found"     "$OUT14" "headings 1/2"
+has   "a heading only the page NAME carries is missed"             "$OUT14" "heading: Product overview"
+has   "a button caption is matched on the button, all words"       "$OUT14" "action:  Deactivate product"
+has   "a short label is required, not vacuous"                     "$OUT14" "action:  Add"
+has   "real captions still match (New item, Edit, Delete)"         "$OUT14" "actions 3/5"
+has   "the sub-title paragraph is still found"                     "$OUT14" "content 1/1"
+
+echo "  -- #157: ButtonStyle renders btn + btn-<style>; no ButtonStyle is btn-default"
+has   "btn / btn-primary / btn-danger / btn-default are declared"  "$OUT14" "classes 8/9"
+CLS14=$(printf '%s\n' "$OUT14" | grep '^  classes:' || true)
+hasnt "btn-primary is not missed"                                  "$CLS14" "btn-primary"
+hasnt "btn-default (DESCRIBE omits Default) is not missed"         "$CLS14" "btn-default"
+has   "a class the page really lacks is still missed"              "$CLS14" "row-actions"
+
+echo "  -- #157: chrome comes from the page's layout, or from --chrome"
+# layout-app-default.mdl is upstream mxcli's own layout example (verbatim, see CAPTURE.md);
+# master scored the layout's region classes as classes the page failed to declare (0/2).
+LA="$FIX/layout-app-default.mdl"
+OUT15=$(cd "$TMP" && node "$SUT" --no-log "$FIX/layout-app-default.html" Home "$LA" 2>&1)
+echo "$OUT15" | sed 's/^/    | /'
+has   "the layout's classes leave the denominator"                 "$OUT15" "classes 0/0"
+has   "and are reported as chrome, not dropped silently"           "$OUT15" "chrome (layout-supplied, not scored): region-sidebar region-content"
+has   "the run names the layout it read"                           "$OUT15" "layout LayoutTest.App_Default read from input"
+PAGEONLY=$(sed -n '/^create or modify page/,$p' "$LA")
+OUT16=$(cd "$TMP" && printf '%s\n' "$PAGEONLY" | node "$SUT" --no-log "$FIX/layout-app-default.html" Home - 2>&1)
+has   "without the layout, its classes are owed (unchanged default)" "$OUT16" "classes 0/2"
+OUT17=$(cd "$TMP" && printf '%s\n' "$PAGEONLY" | node "$SUT" --no-log --chrome region-sidebar,region-content "$FIX/layout-app-default.html" Home - 2>&1)
+has   "--chrome names them instead"                                "$OUT17" "classes 0/0"
+has   "--chrome classes are reported as chrome too"                "$OUT17" "chrome (layout-supplied, not scored): region-sidebar region-content"
+
 echo
 printf 'test-page-fidelity-mocks: %d passed, %d failed\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ]

From ed4efbb829bbf206fb1ff0b8dde27f2fa7cd3868 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:59:12 +0000
Subject: [PATCH 22/68] fix(exec): follow-ups from independent review of
 #304/#306/#290
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Stale-lock takeover serialised through an O_EXCL .exec.lock.takeover file;
  the lock is removed only if it still holds the stale line read (no mv -f
  restore). 12 contenders x 10 rounds: master 2/10 rounds with 2-3 holders,
  fixed 0/10.
- --watch-compat: only ui-loop.md's watch-safe list says "watch can apply
  this"; other statements print "unknown — restart if behaviour looks stale".
- Two-tree (.mpr under app/) cases for the lock and --commit-first.
- Leading flags parsed in one loop (--commit-first --cr CR-NN works); a
  script name starting with -- is refused before any commit or snapshot.
- ui-only test lane names the embedders of a changed snippet/layout.

Refs #287 #289 #274

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |   1 +
 project-bin/exec.sh                   | 169 ++++++++++++++++++--------
 tests/wave2/test-exec-change-class.sh |   8 ++
 tests/wave2/test-exec-lock-watch.sh   | 128 +++++++++++++++++++
 4 files changed, 254 insertions(+), 52 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..543b3aeb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index dd25f3c1..9fbe82ff 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -17,6 +17,7 @@
 #        ./bin/exec.sh --watch-compat <script.mdl>   (advisory: can `run --local --watch` apply
 #                                                     this, or does the app need a restart; writes nothing)
 #        ./bin/exec.sh --cr CR-07 <script.mdl>        (any mode: tag the run with its change request)
+#        Leading flags (--cr, --commit-first, then --patch) may come in any order.
 #
 # --cr (2026-10-13): names the PROJECT.md "## Change log" row this run applies
 # (skills/change-intake.md). It lands in the BUILD-LOG detail cell as "cr: CR-07", the same way
@@ -162,24 +163,43 @@ mxtk_change_class() {  # $1 = MDL script; prints "<class>\t<why>"
       printf "ui-only\t%d page/snippet/layout statement(s), nothing else\n", ui
     }' "$1"
 }
-# --cr CR-NN may lead any mode. Parsed first, before anything needs a project, so a malformed id
-# is refused without touching the model.
-CR_ID=""
-if [ "${1:-}" = "--cr" ]; then
-  CR_ID="${2:-}"
-  case "$CR_ID" in
-    CR-[0-9]*) case "${CR_ID#CR-}" in *[!0-9]*) CR_ID="!" ;; esac ;;
-    *) CR_ID="!" ;;
+# Leading flags, parsed in ONE loop before anything needs a project, in any order:
+# --cr CR-NN, --commit-first, then optionally --patch (whose next word is the script) or one of
+# the advisory modes. A malformed --cr id, an unknown --flag, or a script name starting with
+# `--` is refused here, before the lock, the commit or the snapshot. WHY (review of #306): --cr
+# was only honoured as the FIRST argument, though the usage line documents
+# `[--commit-first] [--cr CR-NN]`; in that order commit-first committed the model and the run
+# went on with "--cr" as its script path.
+CR_ID=""; COMMIT_FIRST="${MXTK_COMMIT_FIRST:-0}"; PATCH_MODE=0; ADVISORY=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --cr)
+      CR_ID="${2:-}"
+      case "$CR_ID" in
+        CR-[0-9]*) case "${CR_ID#CR-}" in *[!0-9]*) CR_ID="!" ;; esac ;;
+        *) CR_ID="!" ;;
+      esac
+      if [ "$CR_ID" = "!" ]; then
+        echo "✗ --cr takes a change-log id like CR-07 (PROJECT.md '## Change log', skills/change-intake.md); got '${2:-}'" >&2
+        exit 2
+      fi
+      shift 2 ;;
+    --commit-first) COMMIT_FIRST=1; shift ;;
+    --patch) PATCH_MODE=1; shift; break ;;
+    --change-class|--watch-compat) ADVISORY="$1"; shift; break ;;
+    *) break ;;
   esac
-  if [ "$CR_ID" = "!" ]; then
-    echo "✗ --cr takes a change-log id like CR-07 (PROJECT.md '## Change log', skills/change-intake.md); got '${2:-}'" >&2
-    exit 2
-  fi
-  shift 2
-fi
-if [ "${1:-}" = "--change-class" ]; then
-  [ -f "${2:-}" ] || { echo "Usage: ./bin/exec.sh --change-class <script.mdl>" >&2; exit 2; }
-  mxtk_change_class "$2"
+done
+case "${1:-}" in
+  --*)
+    echo "✗ Unknown option or misplaced flag '$1' — nothing was committed, snapshotted or executed." >&2
+    echo "  Usage: ./bin/exec.sh [--commit-first] [--cr CR-NN] <script.mdl>" >&2
+    echo "         ./bin/exec.sh [--commit-first] [--cr CR-NN] --patch <script> [args...]" >&2
+    exit 2 ;;
+esac
+if [ "$ADVISORY" = "--change-class" ]; then
+  [ -f "${1:-}" ] || { echo "Usage: ./bin/exec.sh --change-class <script.mdl>" >&2; exit 2; }
+  mxtk_change_class "$1"
   exit 0
 fi
 
@@ -204,6 +224,13 @@ fi
 #   CREATE ... MODULE ROLE | USER ROLE, ALTER USER ROLE      → role added/changed
 #   CREATE PAGE (no OR — a new page)                         → new page
 #   a Url property on a page (create header, `set Url = ...`) → page URL (route table)
+# Watch-safe (the ONLY statements reported `watch can apply this`, ui-loop.md's left column):
+#   ALTER PAGE / ALTER SNIPPET, CREATE [OR ...] SNIPPET, CREATE OR REPLACE|MODIFY PAGE (no Url).
+# Read-only heads (SHOW, DESCRIBE, ...) are neutral. Any other statement — CREATE ASSOCIATION,
+# CREATE ENUMERATION, ALTER ENTITY ... MODIFY, a Java action, a constant, navigation, DROP PAGE,
+# UPDATE WIDGETS — is on neither column and prints `unknown — restart if behaviour looks stale`
+# (independent review of #304: these all used to say "watch can apply this", a claim nobody had
+# checked).
 # `CREATE OR REPLACE|MODIFY PAGE` without a Url is reported as reloadable, with a note that
 # it needs a restart IF the page is new — a script cannot tell new from replaced. Theme
 # SCSS/JS is not in the script; exec.sh checks those files against the running app's boot
@@ -212,32 +239,34 @@ fi
 # ADVISORY ONLY: never blocks, never changes a gate or a verdict. Golden input: real MDL
 # (tests/wave2/test-exec-lock-watch.sh).
 #
-#   ./bin/exec.sh --watch-compat <script.mdl>   prints `restart needed: <reasons>` or
-#                                               `watch can apply this`, exit 0. Touches nothing.
-mxtk_watch_compat() {  # $1 = MDL script; prints "restart\t<reasons>" | "watch\t<note>"
+#   ./bin/exec.sh --watch-compat <script.mdl>   prints `restart needed: <reasons>`,
+#                                               `unknown — restart if behaviour looks stale: <heads>`
+#                                               or `watch can apply this`, exit 0. Touches nothing.
+mxtk_watch_compat() {  # $1 = MDL script; prints "restart\t<reasons>" | "unknown\t<heads>" | "watch\t<note>"
   awk "$_MXTK_MDL_LEX"'
     function add(label, nr) {
       if (!(label in cnt)) { order[++nlab] = label; first[label] = nr }
       cnt[label]++
     }
-    BEGIN { depth = 0; inblock = 0; indollar = 0; cur_page = 0; nlab = 0; maybe = "" }
+    BEGIN { depth = 0; inblock = 0; indollar = 0; cur_page = 0; nlab = 0; maybe = ""; unk = ""; nunk = 0 }
     {
       lex_line($0)
       t = clean; gsub(/^[ \t]+/, "", t)
       if (start_depth == 0 && t ~ /^[A-Za-z]/) {
         n = split(toupper(t), w, /[ \t(;{]+/)
         v = w[1]
-        if (v ~ /^(CREATE|ALTER|DROP|GRANT|REVOKE|MOVE|RENAME|SHOW|DESCRIBE|UPDATE|SET|EXECUTE)$/) {
+        if (v ~ /^(CREATE|ALTER|DROP|MOVE|GRANT|REVOKE|UPDATE|INSERT|DELETE|SQL|IMPORT|EXPORT|EXECUTE|RENAME|SET|CALL|COMMIT|CHANGE|RETRIEVE|DECLARE)$/) {
           j = 2; if (v == "CREATE" && w[2] == "OR") j = 4
           o1 = w[j]; o2 = w[j+1]; o3 = w[j+2]
           cur_page = ((v == "CREATE" || v == "ALTER") && o1 == "PAGE")
+          attr = 0
+          if (v == "ALTER" && o1 == "ENTITY") for (k = 3; k <= n; k++) if (w[k] == "ADD") { attr = 1; break }
           if ((v == "CREATE" || v == "DROP") && o1 == "MICROFLOW")
             add(v == "DROP" ? "microflow dropped" : "microflow created or recreated", NR)
           else if (v == "CREATE" && (o1 == "ENTITY" || o2 == "ENTITY"))
             add("entity created or changed (new attributes)", NR)
-          else if (v == "ALTER" && o1 == "ENTITY") {
-            for (k = 3; k <= n; k++) if (w[k] == "ADD") { add("attribute added", NR); break }
-          }
+          else if (attr)
+            add("attribute added", NR)
           else if (v == "GRANT" || v == "REVOKE")
             add("access rule changed (" v ")", NR)
           else if ((v == "CREATE" && ((o1 == "MODULE" && o2 == "ROLE") || (o1 == "USER" && o2 == "ROLE"))) \
@@ -245,8 +274,18 @@ mxtk_watch_compat() {  # $1 = MDL script; prints "restart\t<reasons>" | "watch\t
             add("module/user role added or changed", NR)
           else if (v == "CREATE" && o1 == "PAGE" && j == 2)
             add("new page", NR)
-          else if (v == "CREATE" && o1 == "PAGE" && maybe == "")
-            maybe = "line " NR ": " substr(t, 1, 60)
+          else if (v == "CREATE" && o1 == "PAGE") {
+            if (maybe == "") maybe = "line " NR ": " substr(t, 1, 60)
+          }
+          # The watch-safe list (skills/ui-loop.md "What watch picks up", left column): an
+          # ALTER PAGE / ALTER SNIPPET edit, a new or changed snippet. Everything else that is
+          # not on either column is UNKNOWN, never "watch can apply this".
+          else if ((v == "ALTER" && (o1 == "PAGE" || o1 == "SNIPPET")) || (v == "CREATE" && o1 == "SNIPPET"))
+            ;
+          else if (nunk < 3) {
+            h = t; if (length(h) > 50) h = substr(h, 1, 50) "..."
+            unk = unk (nunk++ ? "; " : "") "line " NR ": " h
+          } else nunk++
         }
       }
       # A Url property on a page: the create header `(..., Url: ...)` or `set Url = ...` in an
@@ -261,15 +300,17 @@ mxtk_watch_compat() {  # $1 = MDL script; prints "restart\t<reasons>" | "watch\t
         }
         printf "restart\t%s\n", s; exit
       }
+      if (nunk > 0) { printf "unknown\t%s%s\n", unk, (nunk > 3 ? " (+" (nunk - 3) " more)" : ""); exit }
       if (maybe != "") { printf "watch\tunless the page is new: create or replace/modify page, %s\n", maybe; exit }
       printf "watch\t\n"
     }' "$1"
 }
-if [ "${1:-}" = "--watch-compat" ]; then
-  [ -f "${2:-}" ] || { echo "Usage: ./bin/exec.sh --watch-compat <script.mdl>" >&2; exit 2; }
-  _wc="$(mxtk_watch_compat "$2")"
+if [ "$ADVISORY" = "--watch-compat" ]; then
+  [ -f "${1:-}" ] || { echo "Usage: ./bin/exec.sh --watch-compat <script.mdl>" >&2; exit 2; }
+  _wc="$(mxtk_watch_compat "$1")"
   case "${_wc%%	*}" in
     restart) echo "restart needed: ${_wc#*	}" ;;
+    unknown) echo "unknown — restart if behaviour looks stale: ${_wc#*	}" ;;
     *) _n="${_wc#*	}"
        if [ -n "$_n" ]; then echo "watch can apply this — $_n"; else echo "watch can apply this"; fi ;;
   esac
@@ -281,16 +322,6 @@ fi
 MPR="$(find_mpr)" || exit 1
 MPR_BASE="$(basename "$MPR")"
 NAME="$(basename "$MPR" .mpr)"
-PATCH_MODE=0
-COMMIT_FIRST="${MXTK_COMMIT_FIRST:-0}"
-if [ "${1:-}" = "--commit-first" ]; then
-  COMMIT_FIRST=1
-  shift
-fi
-if [ "${1:-}" = "--patch" ]; then
-  PATCH_MODE=1
-  shift
-fi
 SCRIPT="${1:-}"
 [ $# -gt 0 ] && shift
 # Remaining args go to the patch script, after the model path. An MDL run takes none.
@@ -299,7 +330,7 @@ LOG_NAME="$(basename "$SCRIPT")"
 
 if [ -z "$SCRIPT" ]; then
   echo "Usage: ./bin/exec.sh [--commit-first] [--cr CR-NN] <script.mdl>"
-  echo "       ./bin/exec.sh [--commit-first] --patch <script> [args...]"
+  echo "       ./bin/exec.sh [--commit-first] [--cr CR-NN] --patch <script> [args...]"
   exit 1
 fi
 if [ "$PATCH_MODE" = "1" ]; then
@@ -324,7 +355,7 @@ elif [ -r "$SCRIPT" ]; then
 fi
 change_lane() {
   case "$CHANGE_CLASS" in
-    ui-only) echo "re-run this change's own journey once + a LOOK. No .test.mdl, no other module's journeys; reviewers read the artifacts, they do not re-run" ;;
+    ui-only) echo "re-run the journeys of every page the change reaches (embedders of a changed snippet/layout) once + a LOOK. No .test.mdl; reviewers read the artifacts, they do not re-run" ;;
     logic)   echo "re-run only the tests whose subject this change touched (changed microflows + their SHOW CALLERS, changed pages' journeys). Full mxcli test at module close, not here" ;;
   esac
 }
@@ -497,8 +528,42 @@ exec_lock_release() {  # the trap: remove the lock only while it is still ours
   [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"
   return 0
 }
+# Taking over a stale lock is serialised through a second O_EXCL file, $LOCK.takeover. Under
+# it the lock is re-read and removed ONLY if it still holds exactly the stale line judged above;
+# nothing else ever removes a lock that is not its own, so the compare-then-rm cannot hit a
+# fresh lock. WHY (independent review of #304): the old takeover moved the lock aside and put
+# it back with `mv -f` when it found a fresh one there — check-then-act. With 3+ contenders, B
+# moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
+# A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
+# A takeover file left by a holder killed inside those few microseconds is stale once its pid is
+# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put back with `ln` (fails if a new one
+# exists — never clobbers) if what was moved is not the one judged stale.
+exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
+  _tk="$LOCK.takeover"
+  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
+    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
+    _tstale=0
+    if [ -n "$_t" ]; then
+      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
+    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
+      _tstale=1   # empty for a minute: its creator died between the create and the write
+    fi
+    if [ "$_tstale" = 1 ]; then
+      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
+        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
+        rm -f "$_tk.stale.$$"
+      fi
+    fi
+    return 1
+  fi
+  _now="$(head -1 "$LOCK" 2>/dev/null || true)"
+  [ "$_now" = "$1" ] && rm -f "$LOCK"
+  rm -f "$_tk"
+  return 0
+}
 LOCK_TAKEN=0
-for _try in 1 2 3 4 5; do
+for _try in 1 2 3 4 5 6; do
   if exec_lock_try; then LOCK_TAKEN=1; break; fi
   _held="$(head -1 "$LOCK" 2>/dev/null || true)"
   if [ -z "$_held" ] && [ "$_try" -lt 3 ]; then sleep 1; continue; fi   # being written right now
@@ -513,18 +578,14 @@ for _try in 1 2 3 4 5; do
     echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
     exit 1
   fi
-  echo "  (stale exec lock from PID ${_hpid:-?}, which is not running — taking it over)"
-  # Move aside only the lock we judged; if someone else replaced it in between, put theirs back.
-  _aside="$LOCK.stale.$$"
-  if mv -f "$LOCK" "$_aside" 2>/dev/null; then
-    if [ "$(head -1 "$_aside" 2>/dev/null || true)" != "$_held" ] && [ ! -e "$LOCK" ]; then
-      mv -f "$_aside" "$LOCK" 2>/dev/null || true
-    fi
-    rm -f "$_aside"
+  if exec_lock_takeover "$_held"; then
+    echo "  (stale exec lock from PID ${_hpid:-?}, which is not running — taking it over)"
+  else
+    sleep 1   # another contender is taking it over right now; look again
   fi
 done
 if [ "$LOCK_TAKEN" != 1 ]; then
-  echo "✗ Could not take the exec lock $LOCK after 5 attempts — another session keeps re-taking it."
+  echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
   echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
   exit 1
 fi
@@ -1558,6 +1619,10 @@ print_watch_compat() {
       echo "→ Watch: restart needed: $_why"
       echo "  run --local --watch keeps serving the OLD model for these. Restart this app only:"
       echo "  ./bin/app-restart.sh   (stale-runtime symptoms + what watch covers: toolkit skills/ui-loop.md)" ;;
+    unknown)
+      echo "→ Watch: unknown — restart if behaviour looks stale: $_why"
+      echo "  Not on the watch-safe list (toolkit skills/ui-loop.md \"What watch picks up\"); if the app"
+      echo "  still behaves as before this change: ./bin/app-restart.sh" ;;
     watch)
       if [ -n "$_why" ]; then echo "→ Watch: watch can apply this — $_why"
       else echo "→ Watch: watch can apply this"; fi ;;
diff --git a/tests/wave2/test-exec-change-class.sh b/tests/wave2/test-exec-change-class.sh
index f43de319..c6f30cab 100755
--- a/tests/wave2/test-exec-change-class.sh
+++ b/tests/wave2/test-exec-change-class.sh
@@ -81,6 +81,14 @@ grep -q 'change class: \$CHANGE_CLASS — test lane' "$SUBJECT" && ok "success s
                                                            || bad "summary does not print the change class"
 grep -q 'testing-shape.md' "$SUBJECT" && ok "the lane text points at testing-shape.md" \
                                       || bad "no pointer to testing-shape.md"
+# A changed snippet or layout is shown on every page that embeds it, so its ui-only lane is those
+# pages' journeys — not "no other module's journeys" (independent review of #290).
+_lane="$(grep -E '^ +ui-only\) echo' "$SUBJECT")"
+case "$_lane" in
+  *"no other module's journeys"*) bad "ui-only lane still says 'no other module's journeys' (wrong for a snippet/layout)" ;;
+  *"embedders of a changed snippet/layout"*) ok "ui-only lane names the embedders of a changed snippet/layout" ;;
+  *) bad "ui-only lane text not found or does not name embedders: $_lane" ;;
+esac
 # The metrics ledger is 19 fixed columns (test-metrics-ledger.sh asserts it); the tag must not
 # be smuggled into it as a 20th.
 grep -qiE 'change[_ -]class' "$(dirname "$SUBJECT")/metrics-ledger.sh" 2>/dev/null \
diff --git a/tests/wave2/test-exec-lock-watch.sh b/tests/wave2/test-exec-lock-watch.sh
index a448dfd6..29c8c6c5 100755
--- a/tests/wave2/test-exec-lock-watch.sh
+++ b/tests/wave2/test-exec-lock-watch.sh
@@ -55,6 +55,9 @@ mkproj() {  # $1 = dir
 set -e
 cd "$(dirname "$0")/.."
 sleep "${SNAP_SLEEP:-0}"
+if [ -n "${CS_DIR:-}" ]; then   # critical-section probe for the race case: who else is in here?
+  : > "$CS_DIR/in.$$"; ls "$CS_DIR" | grep -c '^in\.' >> "$CS_DIR/counts"; sleep 0.3; rm -f "$CS_DIR/in.$$"
+fi
 D=".mpr-snapshots/$(date +%Y%m%d-%H%M%S)-$$"
 mkdir -p "$D"; cp Fixture.mpr "$D/"; cp -r mprcontents "$D/"
 echo "Snapshot saved: $D"
@@ -114,6 +117,47 @@ has "takeover is said out loud" "$OUT" "taking it over"
 has "the run actually wrote" "$OUT" "fake mxcli exec"
 [ -f "$LOCK" ] && bad "lock left behind after a clean run" || ok "lock removed after the run"
 
+echo "-- lock: 12 contenders against one stale lock — never more than one holder (#304 review)"
+# The takeover used to move the stale lock aside and put it back with mv -f when it found a
+# fresh one: check-then-act. With >=3 contenders, B moved A's fresh lock aside, C's noclobber
+# write landed in the gap, B saw -e $LOCK and deleted A's lock — up to 3 holders at once.
+RACE_BAD=0; RACE_ENTERED=0; ROUNDS=10; N=12
+for round in $(seq 1 $ROUNDS); do
+  CS="$WORK/cs.$round"; mkdir -p "$CS"; GO="$WORK/go.$round"
+  printf '%s 1700000000 old.mdl\n' "$(dead_pid)" > "$LOCK"
+  PIDS=""
+  for c in $(seq 1 $N); do
+    ( cd "$P" && while [ ! -e "$GO" ]; do sleep 0.01; done
+      exec env CS_DIR="$CS" SKIP_BASELINE=1 SP_RESTART=0 MXTK_NO_INSTALL=1 MXTK_NO_SCORE=1 \
+        MXBUILD_PATH="$WORK/mxbuild" ./bin/exec.sh mdlsource/test.mdl ) >"$CS/out.$c" 2>&1 &
+    PIDS="$PIDS $!"
+  done
+  sleep 0.3; : > "$GO"
+  for p in $PIDS; do wait "$p" 2>/dev/null; done
+  [ -s "$CS/counts" ] && RACE_ENTERED=$((RACE_ENTERED+1))
+  _max="$(sort -n "$CS/counts" 2>/dev/null | tail -1)"
+  if [ "${_max:-0}" -gt 1 ]; then RACE_BAD=$((RACE_BAD+1)); echo "    round $round: $_max holders at once"; fi
+  rm -f "$LOCK" "$LOCK.takeover"
+done
+[ "$RACE_ENTERED" -eq "$ROUNDS" ] && ok "[setup] a contender took the stale lock in every round" \
+  || bad "[setup] only $RACE_ENTERED/$ROUNDS rounds had any holder — case proves nothing"
+[ "$RACE_BAD" -eq 0 ] && ok "never more than one holder across $ROUNDS rounds of $N contenders" \
+  || bad "$RACE_BAD/$ROUNDS rounds had more than one holder in the critical section"
+ls "$P/.mpr-snapshots/" | grep -q '\.stale\.' && bad "a .stale.<pid> aside file was left behind" || ok "no aside files left behind"
+
+echo "-- lock: a takeover file left by a killed contender does not block (instrument rule 7)"
+printf '%s 1700000000 old.mdl\n' "$(dead_pid)" > "$LOCK"
+printf '%s %s\n' "$(dead_pid)" "$(date +%s)" > "$LOCK.takeover"
+OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && has "dead-pid takeover file cleared, stale lock taken over" "$OUT" "taking it over" \
+  || bad "a dead contender's takeover file blocked (rc $RC): $(printf '%s' "$OUT" | tail -3)"
+[ -e "$LOCK.takeover" ] && bad "takeover file left behind" || ok "takeover file gone after the run"
+printf '%s 1700000000 old.mdl\n' "$(dead_pid)" > "$LOCK"
+: > "$LOCK.takeover"; touch -t 202601010000 "$LOCK.takeover"
+OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "an empty takeover file older than a minute is stale too" || bad "empty old takeover file blocked (rc $RC)"
+rm -f "$LOCK.takeover"
+
 echo "-- lock: old bare-pid format, dead pid"
 dead_pid > "$LOCK"
 OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
@@ -170,6 +214,65 @@ hasnt "nothing executed" "$OUT" "fake mxcli exec"
 kill -KILL "$SP" 2>/dev/null; wait "$SP" 2>/dev/null; rm -f "$P/Fixture.mpr.lock"
 ( cd "$P" && git checkout -q -- mprcontents )
 
+echo "-- leading flags in any order (#306 review): --commit-first --cr CR-NN <script>"
+printf 'cr edit\n' >> "$P/mprcontents/a.mxunit"
+HEAD2="$(git -C "$P" rev-parse HEAD)"
+OUT="$(run "$P" --commit-first --cr CR-07 mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "documented order ran (rc 0)" || bad "--commit-first --cr failed (rc $RC): $(printf '%s' "$OUT" | tail -4)"
+has "the CR tag was honoured" "$OUT" "Change request: CR-07"
+has "the script that ran is the real one" "$OUT" "fake mxcli exec"
+tail -1 "$P/docs/BUILD-LOG.md" 2>/dev/null | grep -q 'cr: CR-07' && ok "BUILD-LOG row carries cr: CR-07" \
+  || bad "BUILD-LOG row: $(tail -1 "$P/docs/BUILD-LOG.md" 2>/dev/null)"
+[ "$(git -C "$P" rev-list --count "$HEAD2"..HEAD)" = 1 ] && ok "exactly one model commit made" || bad "commits made: $(git -C "$P" rev-list --count "$HEAD2"..HEAD)"
+printf 'flag edit\n' >> "$P/mprcontents/a.mxunit"
+HEAD3="$(git -C "$P" rev-parse HEAD)"; NSNAP="$(ls "$P/.mpr-snapshots" | grep -c .)"
+OUT="$(run "$P" --commit-first --bogus mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 2 ] && ok "a script name starting with -- is refused (rc 2)" || bad "misplaced flag: rc $RC"
+has "  and named" "$OUT" "'--bogus'"
+[ "$(git -C "$P" rev-parse HEAD)" = "$HEAD3" ] && ok "  before commit-first committed anything" || bad "commit-first committed before the refusal"
+[ "$(ls "$P/.mpr-snapshots" | grep -c .)" = "$NSNAP" ] && ok "  and before any snapshot" || bad "a snapshot was taken before the refusal"
+hasnt "  and nothing executed" "$OUT" "fake mxcli exec"
+( cd "$P" && git checkout -q -- mprcontents )
+
+echo "-- two-tree checkout (.mpr under app/): lock and --commit-first (#304 review; CLAUDE.md field-proof rule 2)"
+T="$WORK/twotree"; mkproj "$T"
+( cd "$T" && mkdir app && git mv Fixture.mpr app/ && git mv mprcontents app/ \
+  && git -c user.email=t@t -c user.name=t commit -qm two-tree ) >/dev/null 2>&1
+cat > "$T/bin/snapshot-mpr.sh" <<'SNAP2'
+#!/usr/bin/env bash
+set -e
+cd "$(dirname "$0")/.."
+sleep "${SNAP_SLEEP:-0}"
+D=".mpr-snapshots/$(date +%Y%m%d-%H%M%S)-$$"
+mkdir -p "$D"; cp app/Fixture.mpr "$D/"; cp -r app/mprcontents "$D/"
+echo "Snapshot saved: $D"
+SNAP2
+chmod +x "$T/bin/snapshot-mpr.sh"
+TLOCK="$T/.mpr-snapshots/.exec.lock"
+[ -f "$T/app/Fixture.mpr" ] && [ ! -e "$T/Fixture.mpr" ] && ok "[setup] model only under app/" || bad "[setup] two-tree layout not built"
+H2="$(bg_hold "$T")"; BG_PIDS="$BG_PIDS $H2"
+if wait_lock "$TLOCK"; then
+  ok "the lock lives at the project root (.mpr-snapshots/.exec.lock), not under app/"
+  OUT="$(run "$T" mdlsource/test.mdl)"; RC=$?
+  [ "$RC" -ne 0 ] && has "a second exec is refused on a two-tree checkout" "$OUT" "PID $H2" || bad "two-tree: second exec ran concurrently"
+else
+  bad "two-tree: background exec never took the lock at $TLOCK"
+fi
+kill -KILL "$H2" 2>/dev/null; wait "$H2" 2>/dev/null
+OUT="$(run "$T" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && has "two-tree: the SIGKILLed holder's lock is taken over" "$OUT" "taking it over" || bad "two-tree stale lock blocked (rc $RC)"
+printf 'edited\n' >> "$T/app/mprcontents/a.mxunit"; printf 'new\n' > "$T/app/mprcontents/b.mxunit"
+printf 'unrelated staged\n' > "$T/staged.txt"; ( cd "$T" && git add staged.txt )
+OUT="$(run "$T" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -ne 0 ] && has "two-tree: a dirty app/ model is refused by default" "$OUT" "app/mprcontents" || bad "two-tree: dirty model under app/ not refused"
+TH="$(git -C "$T" rev-parse HEAD)"
+OUT="$(run "$T" --commit-first mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "two-tree: --commit-first committed and executed" || bad "two-tree --commit-first failed (rc $RC): $(printf '%s' "$OUT" | tail -4)"
+FILES="$(git -C "$T" diff --name-only "$TH" HEAD | sort | tr '\n' ' ')"
+[ "$FILES" = "app/mprcontents/a.mxunit app/mprcontents/b.mxunit " ] && ok "two-tree: commit holds exactly app/'s model paths" || bad "two-tree commit holds: $FILES"
+git -C "$T" diff --cached --name-only | grep -qx staged.txt && ok "two-tree: unrelated staged file still staged" || bad "two-tree: staged.txt lost its staged state"
+[ -e "$TLOCK" ] && bad "two-tree: lock left behind" || ok "two-tree: lock removed after the run"
+
 echo "-- watch-compat over real MDL"
 AG="$TOOLKIT/skills/agents-examples"; GAL="$TOOLKIT/examples/stylegallery/mdlsource/gallery"
 PFM="$TOOLKIT/tests/wave2/fixtures/page-fidelity-mocks"
@@ -201,6 +304,31 @@ printf "alter page Shop.Order_Overview { set Url = 'orders'; }\n" > "$WORK/url.m
 expect "$WORK/url.mdl" "restart needed" "page URL" "alter page { set Url = ... } (bug-log shape)"
 printf -- "-- create microflow Shop.ACT_X in a comment\nalter page Shop.P { set Caption = 'create microflow X; grant' on t1 }\n" > "$WORK/noise.mdl"
 expect "$WORK/noise.mdl" "watch can apply this" "" "comments and string literals never count"
+# Only ui-loop.md's watch-safe list may say "watch can apply this" (#304 review). Statements on
+# neither column are `unknown`. Real MDL where the repo has it: a shipped repro script, the
+# workflow example, a bug-log transcript, a captured DESCRIBE NAVIGATION.
+UNK="unknown — restart if behaviour looks stale"
+expect "$TOOLKIT/fixtures/import-mapping-range-repro/flip.mdl" "restart needed" "microflow" \
+  "associations + import mapping + microflow (flip.mdl) → the microflow still wins"
+grep -m1 -E '^create association RenA\.Item_Owner from RenA\.Item to RenA\.Owner;' \
+  "$TOOLKIT/bug-logs/pending-github-issues/rename-module-leaves-xpath.md" > "$WORK/assoc.mdl"
+[ -s "$WORK/assoc.mdl" ] && expect "$WORK/assoc.mdl" "$UNK" "create association" "create association (pending issue, verbatim)" \
+                         || bad "golden 'create association' line not found"
+awk '/^CREATE ENUMERATION /{p=1} p{print} p&&/^\);/{exit}' "$TOOLKIT/skills/build/workflow-example.mdl" > "$WORK/enum.mdl"
+[ -s "$WORK/enum.mdl" ] && expect "$WORK/enum.mdl" "$UNK" "CREATE ENUMERATION" "create enumeration (workflow-example.mdl)" \
+                        || bad "golden CREATE ENUMERATION block not found"
+awk '/^create java action Test\.JA_WithTypeParam/{p=1} p{print} p&&/^\$\$;/{exit}' \
+  "$TOOLKIT/bug-logs/pending-github-issues/bug87-describe-java-action-type-param-name.md" > "$WORK/ja.mdl"
+[ -s "$WORK/ja.mdl" ] && expect "$WORK/ja.mdl" "$UNK" "create java action" "create java action with a \$\$ body (bug87, verbatim)" \
+                      || bad "golden create java action block not found"
+expect "$TOOLKIT/tests/wave2/fixtures/design-audit-nav/describe-navigation-responsive.txt" "$UNK" "navigation" \
+  "create or replace navigation (captured DESCRIBE NAVIGATION output)"
+# No shipped file holds these two; written from the statement grammar in mxcli's generated
+# project CLAUDE.md (ALTER ENTITY ... MODIFY, CREATE CONSTANT) — no capture exists to take them from.
+printf 'alter entity Shop.Order modify attribute Note: String(500);\n' > "$WORK/modattr.mdl"
+expect "$WORK/modattr.mdl" "$UNK" "modify attribute" "alter entity ... modify attribute (no ADD) is not watch-safe"
+printf "create constant Shop.ApiBase type String default 'https://example.invalid';\n" > "$WORK/const.mdl"
+expect "$WORK/const.mdl" "$UNK" "create constant" "create constant"
 
 echo "-- watch-compat in a real run"
 cp "$GAL/05-demo-data.mdl" "$P/mdlsource/demo.mdl"

From cd67a7c33c391cb69e1c8bed24305e2641adcf6f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:59:35 +0000
Subject: [PATCH 23/68] chore(trim): correct the measured word counts in the
 CHANGELOG line

Measured with LC_ALL=C on the branch after master (#313) was merged in:
79,997 -> 76,259 (-3,738); the old line used pre-#313 figures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bad77127..507ad9ed 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
+- chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo

From 234e06deed54320bb2521530facebb5325168470 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 14:59:56 +0000
Subject: [PATCH 24/68] process: second review round on the merge-review rule

Testing section gets the reviewer fixture exception it was cited for; the
PENDING verdict goes to a PR comment (squash bodies are immutable); the trim
trigger is within 2,000 words of the budget after the PR, not 95%.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CLAUDE.md | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index a06a50c0..fcd3abbe 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -188,7 +188,8 @@ never count: the builder grades its own work, and CI proves only the tests the b
    get the same review. "Small", "only skill text" and "CI is green" are how the exceptions start.
    The one exception is guard rule 7's: a fix whose only purpose is to unblock master (a broken CI
    check, a leak guard that blocks every commit) may merge first, with its review within 24 hours
-   and a `Review: PENDING (unblock)` line that the follow-up review replaces.
+   and a `Review: PENDING (unblock)` line; the follow-up verdict is recorded as a comment on the
+   merged PR (and a follow-up fix PR if it finds anything), since a squash commit cannot be edited.
 
 **Why (real incident, 2026-10-13).** Nine PRs merged in one day on the builders' own reports and
 green CI, each carrying its builder's "all checks pass". When the maintainer asked whether value
@@ -216,9 +217,9 @@ that does the work.
 4. **At the cap, a feature PR never squeezes other text to fit.** Room comes from a separate trim
    PR that only moves movable text; its reviewer compares removed against moved line by line, and
    any protected line that disappeared is a HOLD.
-5. **Trim before the cap, not at it:** when the baseline passes 95% of the budget, the next PR that
-   adds baseline words is preceded by a trim PR. A trim PR does not lower the ratchet by itself;
-   lowering it is a separate one-line change once the trimmed total has held for a release.
+5. **Trim before the cap, not at it:** when a PR would take the baseline (measured after the PR)
+   within 2,000 words of the budget, a trim PR lands first. A trim PR does not lower the ratchet by
+   itself; lowering it is a separate one-line change once the trimmed total has held for a release.
 
 **Why (2026-10-13).** One feature PR pushed the baseline to 80,466 words against the 80,000 budget
 while six other open PRs each added words; to fit, it merged two sentences in a testing skill and
@@ -341,6 +342,11 @@ to. Wide blast radius is a reason to pick the right *scoped* check, not to run e
 `bin/lib/skill-routing.tsv` and its re-render (README.md, ROUTING.md, every agent template, and
 `gate-check.sh`'s stage map at once) that check is `bin/render-routing.sh --check`.
 
+**One standing exception: the independent reviewer of a PR** (see "Merging a PR") may run the
+fixtures the PR adds or that target its changed files, without asking, in a detached worktree of
+the PR branch. That isolation is what avoids the shared-tree problem above; the reviewer still
+never runs the full suites.
+
 **Asking is also required for a single fixture** — name it, say what it will tell us, and wait.
 
 Where a fixture's assertions are greps over a file you changed, prefer verifying by inspection:

From 50e56e4a32489bd4e986f1bd04f2d3db190a8c2d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:00:51 +0000
Subject: [PATCH 25/68] fix: follow-ups to #290 and #292 (subject-set wording,
 re-run contradictions, baseline cost)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An independent review of the merged #290 and #292 found four defects.

- testing-shape.md §3: the UI-only lane said "no regression journeys of
  other modules", but a snippet or layout change reaches pages in other
  modules (the subject-set table already said "a page that embeds the
  snippet"). Both tables now say: the journeys of every page the change
  reaches, embedders of a changed snippet/layout included, in any module.
- module-review.md: the Prove row said "re-run after any change" and the
  "nothing grandfathers" line implied a fresh re-run, contradicting
  "reviewers never re-run". Both now say the implementer re-runs the
  subject set once and the reviewer verifies that artifact (testing-shape §3).
- testing-shape.md is a baseline file: the #274 cost anecdote was told in
  §2 and again in a §3 box. Kept once, as one line in §3; §2 points there;
  the full-suite paragraph defers to the event table it repeated. 6,888 ->
  6,702 words. Rules, denominators and one failure example per rule stay.
- agent-roles.md's Dispatching section moves to skills/dispatching.md
  (981 words, adds a harness note: forks, resumes, notices and per-call
  model naming are Claude Code concepts; elsewhere the equivalent is a
  fresh session per task). dispatching.md is the lead's baseline at
  P-6; agent-roles.md goes back to its pre-#292 setup row (lead, P,4,5).
  A stub heading in agent-roles.md keeps old "-> Dispatching" pointers
  resolving; the runbook §1c pointer now names dispatching.md.

render-routing --check (on top of #315): baseline 76,259 -> 76,191 words.
Lead load per stage: 1: 29,275 -> 27,216; 2, 3, 6: 31,079 -> 29,020;
P: 27,367 -> 27,452; 4: 31,079 -> 31,164; 5: 29,171 -> 29,256 (setup file
plus the dispatch file at those three stages); 0 and 7: +17 (the extra
runbook routing row).

Depends on #315. Refs #274 #288

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                 |  1 +
 README.md                    |  3 +-
 ROUTING.md                   |  3 +-
 bin/gate-check.sh            | 14 +++----
 bin/lib/skill-routing.tsv    |  3 +-
 skills/agent-roles.md        | 70 ++---------------------------------
 skills/conversion-runbook.md |  6 +--
 skills/dispatching.md        | 72 ++++++++++++++++++++++++++++++++++++
 skills/module-review.md      |  5 ++-
 skills/testing-shape.md      | 40 +++++++-------------
 10 files changed, 109 insertions(+), 108 deletions(-)
 create mode 100644 skills/dispatching.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bad77127..e93eeb0e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(testing-shape, module-review, dispatching): **follow-ups to #290 and #292 — subject set reaches embedders, reviewers never re-run, dispatch guidance is its own small baseline file.** A UI-only change now re-runs the journeys of every page it reaches (pages embedding a changed snippet or layout, in any module), not "no other module's journeys"; `module-review.md`'s Prove row and "nothing grandfathers" line no longer say "re-run after any change" (implementer re-runs the subject set once, reviewer verifies the artifact, per `testing-shape.md` §3); the #274 cost anecdote appears once in `testing-shape.md` instead of three times (−186 words). `agent-roles.md`'s Dispatching section moved to `skills/dispatching.md` (981 words, with a note that forks/resumes/per-call models are Claude Code concepts — elsewhere, one fresh session per task); the lead loads that at P–6 and `agent-roles.md` returns to its pre-#292 setup row (P,4,5). Lead load at stages 1/2/3/6: −2,059 words each; baseline 76,259 → 76,191 ([#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274), [#288](https://github.com/MendixMau/mxcli-project-toolkit/issues/288)) — MendixMau
 - chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/README.md b/README.md
index 50f41d55..c6b91195 100644
--- a/README.md
+++ b/README.md
@@ -764,7 +764,8 @@ Then filter by Role(s). A helper dispatched with a role stub (ba, architect, mdl
 | Putting a question TO the user — any gate, any stage: ask in chat not in a file, two named options plus your recommendation, one batch per gate then end the turn | `skills/interview-protocol.md` | P,0,1,2,3,4,5,6,7 | lead, ba, architect |
 | The user gives feedback or asks for a change mid-project — "change X", "it also needs Y", a remark on a screenshot or the running app, a stakeholder's ask relayed in chat: log a CR row in PROJECT.md ## Change log BEFORE any edit, size it, then edit the highest artifact it alters (BRD, decision, architecture, wireframe), never the MDL first | `skills/change-intake.md` | 2,3,4,5,6,7 | lead, ba |
 | Any stage transition — the 2+1 format every CAC uses, and the one-register rule (answers land in PROJECT.md, never in a separate state file). The seven CACs themselves are routed per stage in the situational table | `skills/checkpoints/checkpoint-template.md` | 0,1,2,3,4,6,7 | lead, ba, architect |
-| Starting a subagent, sending it a fix round, or reading an agent-stop notice; or setting up the project's subagents — read its Dispatching section per dispatch, the rest once at setup | `skills/agent-roles.md` | P,1,2,3,4,5,6 | lead |
+| Setting up or completing a project's dev-process subagents — once, at project start, not "on demand" | `skills/agent-roles.md` | P,4,5 | lead |
+| Starting a subagent, sending it a fix round, or reading an agent-stop notice — name the model, fresh not fork, fresh fixer not resume, coalesce notices | `skills/dispatching.md` | P,1,2,3,4,5,6 | lead |
 | Deciding whether to extract at all, before any BRD gets generated | `skills/source-triage.md` | 0 | ba |
 | Taking in a new source — before generating anything from it. Grades what the source can support; nothing else in this toolkit reads a source | `bin/source-sufficiency.sh` | 0,1 | ba |
 | Closing Stage 1, or adding files to a source folder — every inventoried file must name the artifact that consumed it (text AND embedded diagrams), or carry a waiver; blocks Stages 1–2 until it does | `bin/source-ledger.sh` | 0,1,2 | ba |
diff --git a/ROUTING.md b/ROUTING.md
index 2c55707c..afc1345b 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -47,7 +47,8 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | CAC-4, after rearchitect sign-off and before any design artifact — branding and UI direction. Opens with a brainstorm | `skills/checkpoints/checkpoint-design.md` | architect | 3 | ondemand |
 | CAC-5, after design sign-off and before the build plan — build order and slice boundaries. Opens with a brainstorm | `skills/checkpoints/checkpoint-build.md` | architect,mdl | 4 | ondemand |
 | CAC-6, after Stage 6 passes and before any cutover step — migration mode only, and a hard gate: every answer lands CONFIRMED, no ASSUMED defaults | `skills/checkpoints/checkpoint-cutover.md` | gate,test | 6,7 | ondemand |
-| Starting a subagent, sending it a fix round, or reading an agent-stop notice; or setting up the project's subagents — read its Dispatching section per dispatch, the rest once at setup | `skills/agent-roles.md` | lead | P,1,2,3,4,5,6 | baseline |
+| Setting up or completing a project's dev-process subagents — once, at project start, not "on demand" | `skills/agent-roles.md` | lead | P,4,5 | baseline |
+| Starting a subagent, sending it a fix round, or reading an agent-stop notice — name the model, fresh not fork, fresh fixer not resume, coalesce notices | `skills/dispatching.md` | lead | P,1,2,3,4,5,6 | baseline |
 | Stage 0 sign-off when the inventory is at or under 1 module / 8 screens / 25 use cases, or the user says the app is small — declare the tier, then apply its per-stage caps and the three artifact waivers | `skills/small-project-tier.md` | ba,architect | 0,1,2,3,4 | ondemand |
 | Deciding who answers a question — before putting any batch to the user. gap/conflict/choice/user-only is what keeps a gate batch at four questions instead of 127 | `bin/question-kinds.sh` | ba | 1,2,3 | baseline |
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` | ba | P | ondemand |
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index d24a021c..84594597 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -1765,14 +1765,14 @@ stage_protocol_paths() {
   # every stage as "(unmapped)" — noisy by design, but only after someone hits it.
   case "$1" in
 # <!-- ROUTING:BEGIN stage-map -->
-    P)  echo "skills/interview-protocol.md skills/grill-mode.md skills/agent-roles.md skills/bootstrap-project.md skills/cloud-dev-environment.md skills/existing-app-change.md skills/app-analysis.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/platform-link.md" ;;
+    P)  echo "skills/interview-protocol.md skills/grill-mode.md skills/agent-roles.md skills/dispatching.md skills/bootstrap-project.md skills/cloud-dev-environment.md skills/existing-app-change.md skills/app-analysis.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/platform-link.md" ;;
     0)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-scope.md skills/source-triage.md skills/image-transcription.md skills/small-project-tier.md skills/existing-app-change.md skills/app-analysis.md skills/layering-review.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/assess-migration.md skills/migration-pipeline.md skills/migrate-general.md skills/migrate-outsystems.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/qa-loop-goal-pattern.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/gate-check-file-locations.md" ;;
-    1)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-extraction.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/migration-pipeline.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/kb-generation.md skills/corpus-extraction-integrity.md" ;;
-    2)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
-    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/agent-roles.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
-    4)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/small-project-tier.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/learned-constants-and-secrets.md" ;;
-    5|build-ready) echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/microflow-preflight.md skills/mendix-best-practices-index.md skills/ui-preflight-pages.md skills/design-spacing.md skills/learned-stylegallery.md skills/ui-loop.md skills/module-review.md skills/testing-shape.md skills/microflow-loop-antipatterns.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/learned-file-upload-widget.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
-    6)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/agent-roles.md skills/mendix-best-practices-index.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/app-analysis.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/share-demo-package.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
+    1)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-extraction.md skills/dispatching.md skills/image-transcription.md skills/small-project-tier.md skills/migration-pipeline.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/kb-generation.md skills/corpus-extraction-integrity.md" ;;
+    2)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/dispatching.md skills/image-transcription.md skills/small-project-tier.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
+    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/dispatching.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
+    4)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/dispatching.md skills/small-project-tier.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/learned-constants-and-secrets.md" ;;
+    5|build-ready) echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/agent-roles.md skills/dispatching.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/microflow-preflight.md skills/mendix-best-practices-index.md skills/ui-preflight-pages.md skills/design-spacing.md skills/learned-stylegallery.md skills/ui-loop.md skills/module-review.md skills/testing-shape.md skills/microflow-loop-antipatterns.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/learned-file-upload-widget.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
+    6)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/dispatching.md skills/mendix-best-practices-index.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/app-analysis.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/share-demo-package.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
     7)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/close-the-loop.md skills/share-demo-package.md skills/handoff-to-studio-pro.md skills/platform-link.md skills/teamserver-alignment.md skills/deploy-to-sandbox.md" ;;
     *)  echo "" ;;
 # <!-- ROUTING:END -->
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index 200b80e4..66ab9dc1 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -83,7 +83,8 @@ checkpoint-architecture	skills/checkpoints/checkpoint-architecture.md	CAC-3, aft
 checkpoint-design	skills/checkpoints/checkpoint-design.md	CAC-4, after rearchitect sign-off and before any design artifact — branding and UI direction. Opens with a brainstorm	architect	3	ondemand	spine
 checkpoint-build	skills/checkpoints/checkpoint-build.md	CAC-5, after design sign-off and before the build plan — build order and slice boundaries. Opens with a brainstorm	architect,mdl	4	ondemand	spine
 checkpoint-cutover	skills/checkpoints/checkpoint-cutover.md	CAC-6, after Stage 6 passes and before any cutover step — migration mode only, and a hard gate: every answer lands CONFIRMED, no ASSUMED defaults	gate,test	6,7	ondemand	spine
-agent-roles	skills/agent-roles.md	Starting a subagent, sending it a fix round, or reading an agent-stop notice; or setting up the project's subagents — read its Dispatching section per dispatch, the rest once at setup	lead	P,1,2,3,4,5,6	baseline	spine
+agent-roles	skills/agent-roles.md	Setting up or completing a project's dev-process subagents — once, at project start, not "on demand"	lead	P,4,5	baseline	spine
+dispatching	skills/dispatching.md	Starting a subagent, sending it a fix round, or reading an agent-stop notice — name the model, fresh not fork, fresh fixer not resume, coalesce notices	lead	P,1,2,3,4,5,6	baseline	spine
 source-triage	skills/source-triage.md	Deciding whether to extract at all, before any BRD gets generated	ba	0	baseline	source
 source-sufficiency	bin/source-sufficiency.sh	Taking in a new source — before generating anything from it. Grades what the source can support; nothing else in this toolkit reads a source	ba	0,1	baseline	source
 source-ledger	bin/source-ledger.sh	Closing Stage 1, or adding files to a source folder — every inventoried file must name the artifact that consumed it (text AND embedded diagrams), or carry a waiver; blocks Stages 1–2 until it does	ba	0,1,2	baseline	source
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index ba9c2e2a..c8ed0eb5 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -26,75 +26,13 @@
 
 ---
 
-**When to dispatch, in what batch, on which tier:** `conversion-runbook.md` §1c is the single source. **How to dispatch** — the four harness defaults to override on every call — is the next section. The rest of this file is the setup.
+**When to dispatch, in what batch, on which tier:** `conversion-runbook.md` §1c is the single source. **How to dispatch** — the four harness defaults to override on every call — is `dispatching.md`. This file is the setup.
 
 The `model:` line of every completed agent is pinned to the shipped stub at `agents/<name>-agent.md` (never inherited) — see `conversion-runbook.md` §1c for the tiers.
 
-## Dispatching — override four defaults on every call
-
-**Trigger:** you are the lead and are about to start a subagent, send one a fix round, or are
-reading an agent-stop notice. Read this section, not the whole file.
-
-Every default below is what the harness does when the call says nothing. In a 20-task,
-89-subagent UX-fix run (2026-10-12, 663.6M tokens, #288) none was overridden, and each one
-shows up in the bill:
-
-| Harness default | What it cost in that run | Override |
-|---|---|---|
-| The subagent inherits the lead's model | 15 of the 21 subagents on the most capable model got it by inheritance alone: read-only lint planners, a severity judge, a root-cause investigator, a PR drafter. 48.1M tokens, 7.2% of everything | 1 |
-| A scan is started as a fork | 6 forks started at 178–210k tokens of inherited context: 37.5M, 7.7% of subagent tokens. Three read-only scan forks made 2–7 tool calls each | 2 |
-| A fix round resumes the implementer | 15 resumes cost 46.6M (9.5%), 3.1M each, because a resumed agent re-reads its 120–215k context on every turn. The narrow re-reviews in the same run cost 0.2–1.2M each | 3 |
-| Every notice gets a turn | 130 task notices to the lead: 96 of the turns after them made no tool call, 19.9M. 20 notices reached subagents that had already reported | 4 |
-
-1. **Name the model on every call.** A stub carries `model:` in its frontmatter
-   (`sync-project.sh --pin-models` repairs drift in a completed one); an ad-hoc call carries
-   nothing and silently runs at the lead's price. Pick the tier from §1c's tier table and write
-   it on the call. Read-only planning, judging, root-cause reading and drafting a PR or report
-   are **mid**: their output is checked by the lead or a gate. Transcriptions and `SHOW` dumps
-   followed by a check are **cheap**. Only §1c's strong rows get the most capable model.
-2. **Scans start fresh, with a written brief — never as a fork.** A fork carries everything the
-   lead has read; a scan needs a question, the paths to read and the file to write. The brief
-   says: the question, the files or globs, the output file and its shape, the model, and "you are
-   a dispatched helper: skip the session-start ritual". If you cannot write the brief without
-   the conversation, a fact the scan needs lives only in chat — write it into `PROJECT.md`
-   first, then dispatch.
-3. **A fix round goes to a fresh, narrow fixer — not the resumed implementer.** Its brief is the
-   review file (each finding with file and line), the commit range (`git diff <base>..<head>`),
-   the module brief, and the gate to re-run. *What is lost:* the implementer's discarded
-   attempts and any reason it never wrote down. *How the brief covers it:* the review file
-   carries the evidence, the diff carries the work, and the implementer's returned report must
-   list every choice the brief did not dictate — require that line in every implementer brief.
-   Resume only when a finding needs the implementer's unwritten reasoning, and say why in the
-   dispatch. A fresh fixer has not been measured head-to-head against a resume yet; the first
-   run that does both records the numbers in `process/`.
-4. **Coalesce notices per lane; a notice that needs nothing gets no turn of reply.** Dispatch a
-   lane's independent units in one message as parallel foreground calls, so N results arrive in
-   one turn instead of N notices. With background agents, a notice whose result the next step
-   does not need yet gets no reply; read the lane's files when its last unit lands. Never send a
-   message to an agent that has already reported — that restarts it at its full context.
-
-**App restarts: the implementer restarts its own app, through one script only.** Write this into
-every implementer brief: "When `exec.sh` prints `restart needed`, run `./bin/app-restart.sh`
-yourself and carry on; never stop or start an app any other way (no kill by name, no `pkill`, no
-second `run --local`), and never touch another lane's app." The helper stops only the pid that
-`run --local` recorded for that project and refuses otherwise (`ui-loop.md` § "What watch picks
-up"). The old rule, that only the lead restarts apps, came from a broad kill in one lane that took
-down another lane's app; the helper cannot do that, and the rule cost 24 implementer
-restart-resumes (41.6M tokens, 8.5% of subagent tokens) in the 2026-10-12 run (#289). If the
-helper refuses (exit 3) or the app does not come back (exit 1), the implementer reports
-`BLOCKED NEEDS_RESTART` with its output, as before.
-
-**Prefix you do not control.** Every subagent turn also carries the harness's skill listing,
-tool and MCP notes and the instruction chain — 47–48k tokens in that run before the brief was
-read, about 40% of subagent volume. Each installed skill and plugin adds to it on every turn of
-every subagent: disable the ones a project does not use. The toolkit keeps its own share short
-(`CLAUDE.local.md`'s session-start ritual is main-session only and does not repeat what
-`gate-check.sh` prints).
-
-**Done when**, for each dispatch batch: N of N calls name a model; 0 scans started as forks;
-every fix round names its review file and commit range; 0 messages sent to agents that already
-reported. After a run, `bin/context-audit.sh --project <dir>` section 1 gives the subagent start
-size (median, p90, max): a p90 near the lead's own context means a fork slipped through.
+## Dispatching
+
+Moved to `dispatching.md` (2026-10-13).
 
 ## Why split into six roles
 
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 852f3ff2..5f440a83 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -32,7 +32,8 @@ Then filter by Role(s). A helper dispatched with a role stub (ba, architect, mdl
 | Putting a question TO the user — any gate, any stage: ask in chat not in a file, two named options plus your recommendation, one batch per gate then end the turn | `skills/interview-protocol.md` | P,0,1,2,3,4,5,6,7 | lead, ba, architect |
 | The user gives feedback or asks for a change mid-project — "change X", "it also needs Y", a remark on a screenshot or the running app, a stakeholder's ask relayed in chat: log a CR row in PROJECT.md ## Change log BEFORE any edit, size it, then edit the highest artifact it alters (BRD, decision, architecture, wireframe), never the MDL first | `skills/change-intake.md` | 2,3,4,5,6,7 | lead, ba |
 | Any stage transition — the 2+1 format every CAC uses, and the one-register rule (answers land in PROJECT.md, never in a separate state file). The seven CACs themselves are routed per stage in the situational table | `skills/checkpoints/checkpoint-template.md` | 0,1,2,3,4,6,7 | lead, ba, architect |
-| Starting a subagent, sending it a fix round, or reading an agent-stop notice; or setting up the project's subagents — read its Dispatching section per dispatch, the rest once at setup | `skills/agent-roles.md` | P,1,2,3,4,5,6 | lead |
+| Setting up or completing a project's dev-process subagents — once, at project start, not "on demand" | `skills/agent-roles.md` | P,4,5 | lead |
+| Starting a subagent, sending it a fix round, or reading an agent-stop notice — name the model, fresh not fork, fresh fixer not resume, coalesce notices | `skills/dispatching.md` | P,1,2,3,4,5,6 | lead |
 | Deciding whether to extract at all, before any BRD gets generated | `skills/source-triage.md` | 0 | ba |
 | Taking in a new source — before generating anything from it. Grades what the source can support; nothing else in this toolkit reads a source | `bin/source-sufficiency.sh` | 0,1 | ba |
 | Closing Stage 1, or adding files to a source folder — every inventoried file must name the artifact that consumed it (text AND embedded diagrams), or carry a waiver; blocks Stages 1–2 until it does | `bin/source-ledger.sh` | 0,1,2 | ba |
@@ -353,8 +354,7 @@ reader approves the *transition* on — checklist for the work, block for the ha
 **Why (2026-09-14):** with no rule for *when* to hand work over, the main session did nearly all
 of Stages P–4 itself at its own model's price (`process/baseline-incident-history.md` §R10). Owner is accountability; this table is
 the runtime rule. It is the single source; `agent-roles.md` (setup) defers here. *How* to dispatch —
-model named on every call, fresh agent not fork, fix rounds, notices — is `agent-roles.md` →
-"Dispatching".
+model named on every call, fresh agent not fork, fix rounds, notices — is `dispatching.md`.
 
 **The main session keeps, always:** every question to the user (§1); every gate verdict and
 its `--closeout` block; every `mxcli exec` / MCP write (`agent-roles.md`'s one rule); the
diff --git a/skills/dispatching.md b/skills/dispatching.md
new file mode 100644
index 00000000..221bdb77
--- /dev/null
+++ b/skills/dispatching.md
@@ -0,0 +1,72 @@
+# Dispatching — override four harness defaults on every call
+**Applies to:** any mxcli project where the lead (main session) starts subagents.
+**Purpose:** *How* to word a dispatch. *When* to dispatch and on which tier is
+`conversion-runbook.md` §1c; setting agents up is `agent-roles.md`.
+
+**Trigger:** you are about to start a subagent, send one a fix round, or are reading an
+agent-stop notice.
+
+**Harness note.** Forks, resumes, task notices and per-call model naming are Claude Code concepts.
+On other harnesses (Copilot, Cursor, Windsurf) the equivalent of every override below is **a fresh
+session per task**, opened with a written brief, on the model you chose for it.
+
+Every default below is what the harness does when the call says nothing. In a 20-task,
+89-subagent UX-fix run (2026-10-12, 663.6M tokens, #288) none was overridden, and each one
+shows up in the bill:
+
+| Harness default | What it cost in that run | Override |
+|---|---|---|
+| The subagent inherits the lead's model | 15 of the 21 subagents on the most capable model got it by inheritance alone: read-only lint planners, a severity judge, a root-cause investigator, a PR drafter. 48.1M tokens, 7.2% of everything | 1 |
+| A scan is started as a fork | 6 forks started at 178–210k tokens of inherited context: 37.5M, 7.7% of subagent tokens. Three read-only scan forks made 2–7 tool calls each | 2 |
+| A fix round resumes the implementer | 15 resumes cost 46.6M (9.5%), 3.1M each, because a resumed agent re-reads its 120–215k context on every turn. The narrow re-reviews in the same run cost 0.2–1.2M each | 3 |
+| Every notice gets a turn | 130 task notices to the lead: 96 of the turns after them made no tool call, 19.9M. 20 notices reached subagents that had already reported | 4 |
+
+1. **Name the model on every call.** A stub carries `model:` in its frontmatter
+   (`sync-project.sh --pin-models` repairs drift in a completed one); an ad-hoc call carries
+   nothing and silently runs at the lead's price. Pick the tier from §1c's tier table and write
+   it on the call. Read-only planning, judging, root-cause reading and drafting a PR or report
+   are **mid**: their output is checked by the lead or a gate. Transcriptions and `SHOW` dumps
+   followed by a check are **cheap**. Only §1c's strong rows get the most capable model.
+2. **Scans start fresh, with a written brief — never as a fork.** A fork carries everything the
+   lead has read; a scan needs a question, the paths to read and the file to write. The brief
+   says: the question, the files or globs, the output file and its shape, the model, and "you are
+   a dispatched helper: skip the session-start ritual". If you cannot write the brief without
+   the conversation, a fact the scan needs lives only in chat — write it into `PROJECT.md`
+   first, then dispatch.
+3. **A fix round goes to a fresh, narrow fixer — not the resumed implementer.** Its brief is the
+   review file (each finding with file and line), the commit range (`git diff <base>..<head>`),
+   the module brief, and the gate to re-run. *What is lost:* the implementer's discarded
+   attempts and any reason it never wrote down. *How the brief covers it:* the review file
+   carries the evidence, the diff carries the work, and the implementer's returned report must
+   list every choice the brief did not dictate — require that line in every implementer brief.
+   Resume only when a finding needs the implementer's unwritten reasoning, and say why in the
+   dispatch. A fresh fixer has not been measured head-to-head against a resume yet; the first
+   run that does both records the numbers in `process/`.
+4. **Coalesce notices per lane; a notice that needs nothing gets no turn of reply.** Dispatch a
+   lane's independent units in one message as parallel foreground calls, so N results arrive in
+   one turn instead of N notices. With background agents, a notice whose result the next step
+   does not need yet gets no reply; read the lane's files when its last unit lands. Never send a
+   message to an agent that has already reported — that restarts it at its full context.
+
+**App restarts: the implementer restarts its own app, through one script only.** Write this into
+every implementer brief: "When `exec.sh` prints `restart needed`, run `./bin/app-restart.sh`
+yourself and carry on; never stop or start an app any other way (no kill by name, no `pkill`, no
+second `run --local`), and never touch another lane's app." The helper stops only the pid that
+`run --local` recorded for that project and refuses otherwise (`ui-loop.md` § "What watch picks
+up"). The old rule, that only the lead restarts apps, came from a broad kill in one lane that took
+down another lane's app; the helper cannot do that, and the rule cost 24 implementer
+restart-resumes (41.6M tokens, 8.5% of subagent tokens) in the 2026-10-12 run (#289). If the
+helper refuses (exit 3) or the app does not come back (exit 1), the implementer reports
+`BLOCKED NEEDS_RESTART` with its output, as before.
+
+**Prefix you do not control.** Every subagent turn also carries the harness's skill listing,
+tool and MCP notes and the instruction chain — 47–48k tokens in that run before the brief was
+read, about 40% of subagent volume. Each installed skill and plugin adds to it on every turn of
+every subagent: disable the ones a project does not use. The toolkit keeps its own share short
+(`CLAUDE.local.md`'s session-start ritual is main-session only and does not repeat what
+`gate-check.sh` prints).
+
+**Done when**, for each dispatch batch: N of N calls name a model; 0 scans started as forks;
+every fix round names its review file and commit range; 0 messages sent to agents that already
+reported. After a run, `bin/context-audit.sh --project <dir>` section 1 gives the subagent start
+size (median, p90, max): a p90 near the lead's own context means a fork slipped through.
diff --git a/skills/module-review.md b/skills/module-review.md
index d1a45f18..e68c3518 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -409,12 +409,13 @@ Researched 2026-08-13 against DORA, Google's diff-scoped mutation testing, 2026
 gate practice (Tricorder's 90% precision floor; CodeRabbit/Tenki staged trust) and SRE error-budget
 policy. Two structural points: most published gates are **rate-over-a-window** judgements, so
 clearing the table once is not "this loop is reliable"; and **nothing grandfathers** — agent output
-is non-deterministic run to run, so a prior pass is not evidence for a re-run of changed work.
+is non-deterministic run to run, so a prior pass is not evidence for changed work — the change's
+subject set is re-run, once, by the implementer (`testing-shape.md` §3).
 
 | Gate | Acceptable | Not acceptable |
 |---|---|---|
 | Build (2) | 0 mxbuild errors, 0 unaddressed lint findings above the project's bar. A **newly authored** lint rule runs advisory-only for its first pass | any error; "warnings are fine" on a rule the project enabled; a day-one rule blocking with no false-positive check |
-| Prove (3) | every declared scenario passes with a landing-guard-verified pass; every write has a Data assertion or a documented reason it does not apply; re-run after any change | green UI with no landing guard; trusting a stale pass on since-changed code |
+| Prove (3) | every declared scenario passes with a landing-guard-verified pass; every write has a Data assertion or a documented reason it does not apply; after any change the implementer re-runs its subject set once and the reviewer verifies that artifact (`testing-shape.md` §3) | green UI with no landing guard; trusting a stale pass on since-changed code; a reviewer re-running what the implementer already ran and recorded |
 | Monkey (3) | zero unhandled crashes — a legitimate flat bar, crash-on-input being unambiguous. Track findings-per-module as a trend | skipped because happy-path was green; a crash dismissed as "edge case"; a rising trend read as N unrelated one-offs |
 | **Look (4)** | **every page in 4a's set reviewed, each with a written answer to 4c's questions and a 4d visual verdict naming its yardstick (wireframe / design system / unaided rubric); every degradation named, substituted and still carrying a verdict; every verdict's evidence a screenshot, not a CSS declaration; the report stamped `VALID AT` a commit and carrying a `PROOF-OF-LOOK:` citation per page, each pointing at a real capture file on disk** | **sampling the pages a journey happened to visit; "looked fine"; a clean `design-audit.js` reported as "the UI is reviewed"; a missing wireframe or uninstalled instrument treated as a reason to skip a page rather than to change yardstick; a layout claim proven by `getComputedStyle` instead of pixels; citing a report the module has been built past** |
 | Confirm (5) | an independent human looked at the running app; the denominator is in the headline | the agent self-certifying; citing an earlier control run as if it still applies |
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index d1c77406..7e28ec3a 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -94,9 +94,8 @@ written by `bin/init-project.sh`, appended to older projects by `bin/sync-projec
 
 - **Unit flips to yes per module** only when the module has calculation, mapping, or date/money
   logic; calls a Java action or a REST service; or a bug was fixed in that flow (the unit test pins
-  the fix). Otherwise Unit stays **no**. Before this default existed nothing set it, so agents read
-  "optional" as "yes" — and in a 20-task UX-fix run (toolkit issue #274) **143 minutes** of
-  microflow tests found stale expected strings and credential problems, not a single logic bug.
+  the fix). Otherwise Unit stays **no**. With no default set, agents read "optional" as "yes"
+  (what that cost: §3).
 - **Trace may be added** by a module that **calls out** to something external, even when the
   project default is off. That is where swallowed failures live, and it is the only place Trace
   reliably earns its setup cost.
@@ -131,19 +130,16 @@ definition of done (`iterative-build-loop.md`). Without this anchor someone decl
 
 **After the base set: re-run what the change touched — once — and nothing else.**
 
-> **The routing question, before any test run after the base set:** *does this run prove something
-> the existing artifact does not?* If the journey report, screenshot or diff already in hand proves
-> it, the run is waste. If you cannot name what the run would show that the artifact does not, do
-> not run it.
+> **Before any test run after the base set, ask:** *does this run prove something the artifact in
+> hand (journey report, screenshot, diff) does not?* If you cannot name what it would show, do not run it.
 
-**The subject set.** A re-run is scoped to the tests whose *subject* the change touched, read off
-what the exec'd script(s) changed — the script is the change list; `bin/exec.sh` also tags each run
-`ui-only` or `logic` and prints the lane below:
+**The subject set.** A re-run covers the tests whose *subject* the exec'd script(s) changed — the
+script is the change list; `bin/exec.sh` tags each run `ui-only` or `logic` and prints its lane:
 
 | Changed in this exec | Its subject set — re-run these, only these |
 |---|---|
 | A microflow | the tests that call it, plus the tests of its callers (`SHOW CALLERS OF <Mod.Flow>`) |
-| A page or snippet | the journeys whose steps visit that page (or a page that embeds the snippet) |
+| A page, snippet or layout | the journeys of every page the change reaches: the page itself, and every page that embeds a changed snippet or uses a changed layout, in any module |
 | An entity, association, enum or access rule | the tests and journeys of the module that owns it |
 
 Anything outside that set was not at risk from this change and is not re-run.
@@ -152,7 +148,7 @@ Anything outside that set was not at risk from this change and is not re-run.
 
 | Change class | What re-runs | What does not |
 |---|---|---|
-| **UI-only** — `ALTER PAGE`/`ALTER SNIPPET`, styling, captions, visibility, layout; **no** microflow, entity, association, enum, security or navigation change (`exec.sh` tag `ui-only`) | The implementer's own journey for that page, **once**, plus a **LOOK** (screenshot, actually opened — `module-review.md` stage 4) | No `.test.mdl`. No regression journeys of other modules. No full `mxcli test`. |
+| **UI-only** — `ALTER PAGE`/`ALTER SNIPPET`, styling, captions, visibility, layout; **no** microflow, entity, association, enum, security or navigation change (`exec.sh` tag `ui-only`) | The journeys of every page the change reaches (embedders of a changed snippet/layout included), **once**, plus a **LOOK** (screenshot, actually opened — `module-review.md` stage 4) | No `.test.mdl`. No journeys of pages the change does not reach. No full `mxcli test`. |
 | **Logic** — anything else (`exec.sh` tag `logic`; a mixed script is logic) | The subject set above: the changed microflows' tests and their callers' tests, the changed pages' journeys | Tests whose subject this change did not touch. |
 
 **Who re-runs:** the implementer, once per gate. **Reviewers verify artifacts** — the diff, the
@@ -160,12 +156,9 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**When the full suite runs:** full `mxcli test` (and the module's whole journey set) runs **at
-module close**, as part of `module-review.md`'s PROVE stage; the **project-wide** suite runs at
-project close / cutover; and either runs **whenever the user explicitly asks for it** in that
-message. Those are the only triggers — **never at batch close**, never after an individual fix,
-and never because the change "felt wide". The e2e instruments themselves (journeys, Playwright,
-DB assertions, LOOK) are unchanged by this rule; only their trigger is.
+**The full suite runs on the last three rows below only** — **never at batch close**, never after
+an individual fix, never because the change "felt wide". The e2e instruments are unchanged; only
+their trigger is.
 
 | Event | What happens |
 |---|---|
@@ -176,15 +169,8 @@ DB assertions, LOOK) are unchanged by this rule; only their trigger is.
 | Project close / cutover | The project-wide suite, once. |
 | The user asks for a full run | Run it, that message is the trigger. |
 
-> **What the unscoped rule produced (toolkit issue #274, a 20-task UX-fix retro).** This table
-> used to say "a fix to an existing script → re-run the suite as regression", with no scope. Read
-> literally, every caption change re-ran everything. Measured: each UI-only change was re-proven
-> **5–10×** — the implementer's journey, then 4–5 regression journeys of other modules, then the
-> reviewer re-running the same journeys, then a full `mxcli test` (~6 min) at every batch close.
-> **143 minutes of microflow tests** in that run found stale expected strings and credential
-> problems — not one logic bug — because the changes under test contained no logic. The fix is
-> not "test less", it is "test the subject": a caption change has no microflow subject, so it owes
-> one journey and one look.
+> **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
+> change 5–10× and spent **143 minutes** of microflow tests finding stale strings, not one logic bug.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.
 That is what makes this affordable on a module under active development.

From e4a5f3ebb4dda3931395e891f704f8bad06db211 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:01:13 +0000
Subject: [PATCH 26/68] fix(changelog): drop the pre-correction #315 line the
 merge duplicated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa73eb44..5edba06b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,6 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - fix(testing-shape, module-review, dispatching): **follow-ups to #290 and #292 — subject set reaches embedders, reviewers never re-run, dispatch guidance is its own small baseline file.** A UI-only change now re-runs the journeys of every page it reaches (pages embedding a changed snippet or layout, in any module), not "no other module's journeys"; `module-review.md`'s Prove row and "nothing grandfathers" line no longer say "re-run after any change" (implementer re-runs the subject set once, reviewer verifies the artifact, per `testing-shape.md` §3); the #274 cost anecdote appears once in `testing-shape.md` instead of three times (−186 words). `agent-roles.md`'s Dispatching section moved to `skills/dispatching.md` (981 words, with a note that forks/resumes/per-call models are Claude Code concepts — elsewhere, one fresh session per task); the lead loads that at P–6 and `agent-roles.md` returns to its pre-#292 setup row (P,4,5). Lead load at stages 1/2/3/6: −2,059 words each; baseline 76,259 → 76,191 ([#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274), [#288](https://github.com/MendixMau/mxcli-project-toolkit/issues/288)) — MendixMau
-- chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst

From 51fdb3ffab25ed25ee9272c572058890fd158bac Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:01:47 +0000
Subject: [PATCH 27/68] =?UTF-8?q?interaction-model:=20review=20fixes=20?=
 =?UTF-8?q?=E2=80=94=20ba=20routed,=20one=20Page=20parameter=20format,=20g?=
 =?UTF-8?q?ate=20clause?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Routing row now lead,ba,architect (ba runs the Stage-3 interviews); re-rendered.
- Page parameter written as Module.Entity or "none — <reason>" in both the
  skill's table and design-artifacts.md Step 3, since a later gate parses it.
- Full paths design/ vs skills/interaction-model.md where ambiguous.
- Runbook Stage-3 Gate row names the two-objects-two-roles walk.
- Step 4 walk is a paper walk unless wireframes draw two records.
- Trimmed "Why this exists"; changed the min-width example value.

Refs #291

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                 |  2 +-
 ROUTING.md                   |  2 +-
 agents/ba-agent.md           |  1 +
 bin/lib/skill-routing.tsv    |  2 +-
 skills/conversion-runbook.md |  2 +-
 skills/design-artifacts.md   | 13 +++++++------
 skills/interaction-model.md  | 31 +++++++++++++++----------------
 7 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebbe7655..7eb5f90f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- skill(interaction-model, design-artifacts, runbook): **Stage 3 writes `design/interaction-model.md` before the first wireframe — a home per role, an inbox per user task, and per page how it is reached, its page parameter and its data view source; every wireframe opens with a `wf-contract` block (`Page parameter:`, `Reached from:`, `Drawn as role:`)** ([#291](https://github.com/MendixMau/mxcli-project-toolkit/issues/291), part 1 of 3). Three apps built with the toolkit passed every gate (Stage 3/4 PASS, page fidelity 81-89% on the affected pages, lint 0 errors, e2e 69/69) while one of them rooted 8 pages on a parameterless "current record" retrieve, gave all 6 roles one home page and put 3 process stages in a 6-item menu; the wireframes were drawn as one role with one record, so every downstream check inherited the defect. Routed on demand, Stage 3, lead + architect; the gate facts and the model-side check are follow-ups. — MendixMau
+- skill(interaction-model, design-artifacts, runbook): **Stage 3 writes `design/interaction-model.md` before the first wireframe — a home per role, an inbox per user task, and per page how it is reached, its page parameter and its data view source; every wireframe opens with a `wf-contract` block (`Page parameter:`, `Reached from:`, `Drawn as role:`)** ([#291](https://github.com/MendixMau/mxcli-project-toolkit/issues/291), part 1 of 3). Three apps built with the toolkit passed every gate (Stage 3/4 PASS, page fidelity 81-89% on the affected pages, lint 0 errors, e2e 69/69) while one of them rooted 8 pages on a parameterless "current record" retrieve, gave all 6 roles one home page and put 3 process stages in a 6-item menu; the wireframes were drawn as one role with one record, so every downstream check inherited the defect. Routed on demand, Stage 3, lead + ba + architect; the gate facts and the model-side check are follow-ups. — MendixMau
 - chore(context): **baseline word budget freed — 79,735 → 75,963 words (−3,772) without dropping a rule.** The always-on tier sat 265 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/ROUTING.md b/ROUTING.md
index 99f22259..d31a88fe 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -126,7 +126,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | After every wireframe edit: assembles design/wireframes/*.html into design/prototype.html, one hash-routed page a stakeholder can click through instead of twenty separate files. Generated, never edited (design-artifacts.md Step 3) | `project-bin/assemble-prototype.js` | architect,review | 3 | ondemand |
 | Before wireframes pass to the build loop, and with --brd before a BRD is signed off: dead #/route links, orphan screens, controls with no data-bind and no data-cut, BRD routes no screen has, screens no use case walks (design-artifacts.md Step 3c, brd-validation.md check 8) | `project-bin/check-prototype-links.js` | architect,review | 3 | ondemand |
 | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable | `skills/design-artifacts.md` | architect | 3 | ondemand |
-| Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter | `skills/interaction-model.md` | lead,architect | 3 | ondemand |
+| Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter | `skills/interaction-model.md` | lead,ba,architect | 3 | ondemand |
 | Before a wireframe or a design commits to a WIDGET, when a requirement shows a widget to one role and not another, and when a page script hits a parse error that looks like a syntax mistake: the short list of things MDL cannot write at all, and the four-minute probe that answers it at Stage 3 instead of at build time | `skills/learned-mdl-cannot-express.md` | architect,mdl | 3,5 | ondemand |
 | A style change that appears to have done nothing, a focus ring that paints on every page landing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget | `skills/learned-css-that-never-applied.md` | mdl,review,gate | 5,6 | baseline |
 
diff --git a/agents/ba-agent.md b/agents/ba-agent.md
index 92ef81ee..2ab92d9a 100644
--- a/agents/ba-agent.md
+++ b/agents/ba-agent.md
@@ -85,6 +85,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/kb-generation.md` | Extracting Excel/Word/PDF specs into a knowledge base |
 | `skills/brd-generation.md` | Writing or enriching a BRD JSON |
 | `skills/brd-validation.md` | Validating BRDs against the code and document KB |
+| `skills/interaction-model.md` | Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME |
 | `skills/company-brain.md` | Setting up or wiring a COMPANY BRAIN |
 | `skills/close-the-loop.md` | Cutover and retrospective |
 | `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index 56ec085f..0fe6a991 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -143,7 +143,7 @@ brd-validation	skills/brd-validation.md	Validating BRDs against the code and doc
 architecture-blueprint	skills/architecture-blueprint.md	Diagramming target architecture — module defs, wiring, fit-gap, marketplace, security, NFRs, integrations	architect	3	ondemand	architecture
 modularize-domain	skills/modularize-domain.md	Deciding module boundaries before "create module"	architect	3	ondemand	architecture
 design-artifacts	skills/design-artifacts.md	Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable	architect	3	ondemand	design
-interaction-model	skills/interaction-model.md	Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter	lead,architect	3	ondemand	design
+interaction-model	skills/interaction-model.md	Stage 3, after the role model is CONFIRMED and BEFORE THE FIRST WIREFRAME — and any time a page shows ONE object, a menu item or home page is added, or a data source retrieves the current/first record: role homes, inboxes, and per page how it is reached and which object it takes as parameter	lead,ba,architect	3	ondemand	design
 brd-to-build-plan	skills/brd-to-build-plan.md	Turning BRDs plus architecture into a numbered, dependency-ordered build plan	architect	3,4	ondemand	requirements
 coverage-ledger	skills/coverage-ledger.md	Building the Stage 4 coverage ledger — every requirement either claimed by a build-plan row or catalogued with a reason, never invisible	architect,gate	4	ondemand	requirements
 coverage-check	bin/coverage-check.sh	Checking a coverage ledger against its BRD — every scalar leaf CLAIMED, LEDGERED, UNCLAIMED, PHANTOM or DOUBLE-CLAIMED, so coverage is measured rather than remembered	architect,gate	4	ondemand	requirements
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 45bb7214..5d2f2571 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -631,7 +631,7 @@ The biggest gap before this runbook existed. Module boundaries, wiring diagrams
 | **User defines** | ① One Mendix app or several (if flagged at Stage 0). ② **Module boundaries** (agent proposes with `modularize-domain.md` criteria). ③ **Buy vs build vs stub, per fit-gap item** — the confirming step `brd-to-build-plan.md` assumed already happened. ④ **Target security / role model** — not just whether auth existed in the source, but what the target should be. ⑤ **Data volumes, concurrency, NFRs** — these decide indexing, pagination, datagrid-vs-paged-gallery, loop batch sizes. ⑥ **Integration contracts** — real or stub, endpoint, credentials, owner, test environment. ⑦ **Branding inputs** — logo, palette, type, spacing, per `design-artifacts.md`; with no brand, the design direction (Step 0b question D1: ideation-library directions or Atlas defaults). |
 | **Agent produces** | `.mx-brd.json`, `architecture/` (module defs, layer diagram, wiring diagram, `fit-gap.md`, `blueprint.html` checkpoint render — plus a workflow diagram and/or agent-wiring diagram in `blueprint.md`/`blueprint.html` when CAC-3's Q3 flags real scope for either, plus cross-persona journey diagrams + journey list — `architecture-blueprint.md` Step 3d — whenever the BRDs carry more than one persona; single-persona skip recorded as a one-line note, never silent), `design/` per `design-artifacts.md`'s full output list: `design/interaction-model.md` (first) + `ds.css` + `design-system.html` + **`wireframes/*.html`, one annotated wireframe per screen** — the design system without the wireframes is half the deliverable and fails the gate. |
 | **Surface** | `module-design.html` · `architecture/blueprint.html` (generated render of `blueprint.md` — architecture-blueprint.md Step 7, never hand-edited) · `design-system.html` + `wireframes/*.html` |
-| **Gate ✋** | Boundaries approved. Marketplace calls made. Role model, volumes, integrations and branding **each asked and answered**: `CONFIRMED`, or explicitly delegated by the user ("you decide" → `ASSUMED` with risk). Never `ASSUMED` without the question having reached the user. Close-out block pasted before the ✋ decision is asked (§1b rule 7) — this stage has no closing checkpoint, so the gate is where the Stage-4 open (its approach, skills and optional artifacts) is shown. **No architecture/design artifact is produced before its checkpoint ran.** |
+| **Gate ✋** | Boundaries approved. Marketplace calls made. Interaction model walked with two objects, two roles. Role model, volumes, integrations and branding **each asked and answered**: `CONFIRMED`, or explicitly delegated by the user ("you decide" → `ASSUMED` with risk). Never `ASSUMED` without the question having reached the user. Close-out block pasted before the ✋ decision is asked (§1b rule 7) — this stage has no closing checkpoint, so the gate is where the Stage-4 open (its approach, skills and optional artifacts) is shown. **No architecture/design artifact is produced before its checkpoint ran.** |
 | **Owner** | `architect-agent` (interviews run by `ba-agent`) |
 
 ### Stage 4 — Build Plan ✋
diff --git a/skills/design-artifacts.md b/skills/design-artifacts.md
index 51b1d76d..0b6d4888 100644
--- a/skills/design-artifacts.md
+++ b/skills/design-artifacts.md
@@ -229,7 +229,7 @@ table against `design/wireframes/*.html` and reports `MANUAL <built> wireframes
 ## Step 2b: Interaction Model — before the first wireframe
 
 With the Screen Inventory written and the role model CONFIRMED, write `design/interaction-model.md`
-per `interaction-model.md`: a home per role, an inbox per BRD user task, and one row per inventoried
+per `skills/interaction-model.md`: a home per role, an inbox per BRD user task, and one row per inventoried
 screen naming how it is reached, its page parameter and its data view source. Do it before drawing:
 wireframes drawn as one role looking at one record hide a page that shows "the first open record"
 instead of the clicked one, and every later check compares the build with the wireframe.
@@ -238,18 +238,19 @@ instead of the clicked one, and every later check compares the build with the wi
 
 ## Step 3: Build Wireframes FROM the Design System
 
-Each wireframe is assembled from Step 1's components — never restyled from scratch. One HTML per screen, or a single annotated showcase. Every wireframe opens with a **page contract** copied from its `interaction-model.md` row:
+Each wireframe is assembled from Step 1's components — never restyled from scratch. One HTML per screen, or a single annotated showcase. Every wireframe opens with a **page contract** copied from its row in `design/interaction-model.md`:
 
 ```html
 <div class="wf-contract">
-  <p>Page parameter: Sales.Order</p>          <!-- or: none — list page / none — singleton -->
+  <p>Page parameter: Sales.Order</p>          <!-- Module.Entity, or: none — list page | none — singleton | none — home -->
   <p>Reached from: row of Order_Overview; row of Review_Inbox</p>
   <p>Drawn as role: Reviewer</p>
 </div>
 ```
 
-`Page parameter: none` is a statement, not a blank: it says the page is a list, a home or a
-singleton. The `wf-` prefix makes the block annotation, so `page-fidelity.js` does not score it as
+The value is the qualified entity (`Module.Entity`) or `none — <reason>`, in exactly that form
+(a later gate parses the line). `none` is a statement, not a blank: it says the page is a list, a
+home or a singleton. The `wf-` prefix makes the block annotation, so `page-fidelity.js` does not score it as
 page content and `assemble-prototype.js` hides it behind **Show bindings**. Draw the screen as the
 role named there, with that role's menu.
 
@@ -419,7 +420,7 @@ not evidence that the design system is correct — it is evidence that it is not
 design/
   brand.md                     ← brand decisions + deliberate inversions + Atlas variable mapping
   target-ui.md                 ← UX pattern inventory from client mockup → Atlas implications
-  interaction-model.md         ← role homes, inboxes, one row per screen: how reached, page parameter, data view source (interaction-model.md)
+  interaction-model.md         ← role homes, inboxes, one row per screen: how reached, page parameter, data view source (skills/interaction-model.md)
   ds.css                       ← token + component CSS (linked by showcase + all wireframes)
   design-system.html           ← annotated showcase (links ds.css; not the token source)
   wireframes/
diff --git a/skills/interaction-model.md b/skills/interaction-model.md
index 06aa3655..ee697d56 100644
--- a/skills/interaction-model.md
+++ b/skills/interaction-model.md
@@ -24,16 +24,12 @@ Screen Inventory (`design-artifacts.md` Step 2).
 
 ## Why this exists
 
-Every check downstream of Stage 3 compares the build with the wireframe. When the wireframe is
-drawn as one role looking at one record, a page that shows "the first open record" instead of
-the one the user clicked passes everything. Field evidence, three apps built with this toolkit
-(2026-10): one app rooted **8 pages** on a parameterless "current record" retrieve, gave **all 6
-roles one home page**, and put **3 process stages among 6 menu items**. Gate-check Stage 3 and 4
-passed, page fidelity scored 81–89% on the affected pages, lint reported 0 errors and the e2e
-suite went **69/69** — every journey seeded one open record, so "the first one" was always the
-right one. A navigation review of a second app then found 16 defects of the same kinds. The
-fix landed after a week of scripts had come to depend on the parameterless pages. A page
-parameter added later breaks every `show page` that calls the page without one.
+Every check after Stage 3 compares the build with the wireframe. A wireframe drawn as one role
+looking at one record hides a page that shows "the first open record" instead of the clicked one.
+In one app built with this toolkit (2026-10), 8 pages did exactly that, all 6 roles shared one
+home, and 3 of 6 menu items were process stages — while Stage 3/4 gates, page fidelity, lint and
+a 69/69 e2e run (one seeded record) all passed. Adding the parameter later breaks every
+`show page` already calling the page without one, so it is decided here.
 
 ---
 
@@ -62,18 +58,21 @@ One row per screen in the Screen Inventory, no exceptions:
 
 | Page | How reached | Page parameter / context object | Data view source | Nav entry | Role(s) |
 |---|---|---|---|---|---|
-| `Order_Overview` | menu; home for Manager | none (list page) | grid: database `Sales.Order` | Orders | Manager |
-| `Order_Detail` | row of `Order_Overview`; row of `Review_Inbox` | `Order` | page parameter | — | Manager, Reviewer |
-| `Order_Review` | stage tile on `Order_Detail` | `Order` | page parameter | — | Reviewer |
+| `Order_Overview` | menu; home for Manager | none — list page | grid: database `Sales.Order` | Orders | Manager |
+| `Order_Detail` | row of `Order_Overview`; row of `Review_Inbox` | `Sales.Order` | page parameter | — | Manager, Reviewer |
+| `Order_Review` | stage tile on `Order_Detail` | `Sales.Order` | page parameter | — | Reviewer |
 | `AppSettings_Edit` | menu | none — singleton | microflow `DS_AppSettings_Get` (one row by design) | Settings | Admin |
 
+Write the parameter column as `Module.Entity` or `none — <reason>` (list page, home, singleton),
+exactly as the wireframe's `Page parameter:` line carries it.
+
 Rules the table must satisfy:
 
 1. **A page about one object takes that object as a page parameter**, and its root data view's
    source is that parameter. A named singleton (settings, "my profile") is the one exception;
    say so in the row.
 2. **"How reached" names every caller**, and every caller passes the object. A menu item cannot
-   pass a page parameter, so a page whose Nav entry is filled in has `none` in the parameter
+   pass a page parameter, so a page whose Nav entry is filled in has `none — …` in the parameter
    column.
 3. **Menu items are object lists, inboxes or tools — never a process stage.** One navigation per
    concept: a stepper on the hub *or* the menu, not both.
@@ -95,7 +94,7 @@ Each was measured in a built app; each passed every gate. Generic names below.
 | `show page` without its argument | stepper tile action `show page Sales.Order_Review;` on a snippet that has `$Order` in hand | The stepper on order B opens the step for order A |
 | Home pages not matching the design | `home page Sales.Order_Overview for` all six roles, while the design said reviewers land on their inbox | The reviewer has no place to start; their work is reached through a stage in the top bar |
 | Process stages in the menu | top bar: Orders, **Reviews**, **Approvals**, Reports | Each stage page is forced to be parameterless (rule 2), which brings back failure 1 |
-| Grid min-width | `.order-grid table { min-width: 1100px; }` added to fix squashed columns | Horizontal scrollbar at 1440 px on a grid that would have fitted; nothing else flags it |
+| Grid min-width | `.order-grid table { min-width: 1280px; }` added to fix squashed columns | Horizontal scrollbar at 1440 px on a grid that would have fitted; nothing else flags it |
 | Read-only drawn but not specified | wireframe row `Read-only: yes` with no rendering | Built as grey disabled inputs; say "renders as text" (data view `ReadOnlyStyle: Text`) |
 | Save reopens its own page | inline cell `OnChange` → `close page; show page Plan_Edit(Plan = $Plan);` | Every edit jumps the user back to the top; a save must not close and reopen its own page |
 
@@ -104,7 +103,7 @@ Each was measured in a built app; each passed every gate. Generic names below.
 ## Step 4: Walk it with two objects and two roles
 
 Before the Stage-3 ✋, walk the prototype (`design/prototype.html`) with **2+ open objects and 2+
-roles**: as each role, start at its home, find the work for the **second** object, and complete
+roles** — a paper walk over the per-page table unless the wireframes actually draw two records: as each role, start at its home, find the work for the **second** object, and complete
 one step. Write the route taken under each role in `design/interaction-model.md`. A route that
 goes through "the first one" or through a menu stage is a defect in the table, fixed here.
 

From 58fda4d73612f43ce7970ad380d98b054e6ca88e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:02:35 +0000
Subject: [PATCH 28/68] test-stack-up: runtime command-line ownership proof,
 own runtime is not a port thief, tracked stale-process sweep (#160, #278,
 refs #262)

- #160: a scanned Mendix port whose listener runs runtimelauncher.jar on this
  project's deployment dir (<root>/deployment or <root>/app/deployment) is
  APP_OWNERSHIP=verified, APP_SOURCE=runtime; freshness stays unknown. Linux
  /proc, macOS ps, Git Bash PowerShell; unreadable stays unverified.
- port_holder / holder_text / in-tree walk moved into _common.sh (additive) and
  sourced by both test-stack-up.sh and app-restart.sh; an older _common.sh stops
  with exit 2 and the sync remedy.
- #262 follow-up to #313: a port held by this project's own process (live
  recorded pid or descendant, or a runtime on this deployment dir, incl. Studio
  Pro running this project) is NOT READY, exit 1, not INSTRUMENT BLOCKED.
- #278: --track <pid> [label] records a background test process; every run
  lists tracked ones older than MXTK_STALE_HOURS; --reap stops them (pid record
  only, start-time checked). test-result-audit.md names the two outside causes
  of INVALID.

Fixtures: test-stack-up-local.sh T8-T14 (16 assertions fail on master),
test-app-restart.sh old-_common.sh guard case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                       |   3 +
 project-bin/_common.sh             | 125 ++++++++++++++++
 project-bin/app-restart.sh         |  62 ++------
 project-bin/test-stack-up.sh       | 226 ++++++++++++++++++++++-------
 skills/test-result-audit.md        |   1 +
 tests/wave2/test-app-restart.sh    |  11 ++
 tests/wave2/test-stack-up-local.sh | 139 +++++++++++++++++-
 7 files changed, 459 insertions(+), 108 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..4e89ae4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(test-stack-up): **an app with no run --local handshake is `verified` when its listener runs `runtimelauncher.jar` on this project's own deployment dir** ([#160](https://github.com/MendixMau/mxcli-project-toolkit/issues/160)). Studio Pro's Run Locally, or a run --local without the handshake, was published `APP_OWNERSHIP=unverified`, so every journey run in a requirements-driven build needed `APP_PORT` asserted by hand, though the runtime's command line named the project's deployment dir all along. Both layouts (`<root>/deployment`, `<root>/app/deployment`); /proc on Linux, `ps` on macOS, PowerShell on Git Bash; unreadable stays unverified. The port/process helpers app-restart.sh and test-stack-up.sh each carried now live once in `_common.sh` (additive; an older `_common.sh` stops with the sync remedy, exit 2) — MendixMau
+- fix(test-stack-up): **this project's own booting runtime on its port reads NOT READY (exit 1), no longer "INSTRUMENT BLOCKED" (exit 4)** (refs [#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262), follow-up to #313). A runtime binds its ports before it serves a page, and the #262 port check named it as a thief; the same happened with `--no-docker` while Studio Pro booted this project. Ours = the live recorded pid or its descendant, or a command line on this project's deployment dir; any other holder still blocks — independent review of #313
+- new(test-stack-up, test-result-audit): **`--track <pid>` records a background test process this project started; every run lists the recorded ones older than `MXTK_STALE_HOURS` (4) and `--reap` stops them — by pid record only, a reused pid (start time changed) is never signalled** ([#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278)). Hung journey-runner shells from earlier retries filled a trial licence's session cap and made a later run INVALID; test-result-audit.md now names the two outside causes of INVALID (account lockout, licence session cap) — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 3a58af7a..1a1414c3 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -787,3 +787,128 @@ mxtk_sha256() {
   else openssl dgst -sha256 | sed 's/^.*= //'
   fi
 }
+
+# ---------------------------------------------------------------------------
+# Process identity — who holds a port, whose process it is. Shared by test-stack-up.sh and
+# app-restart.sh (moved here from both, #160; they had carried identical copies since #262).
+# All read-only: nothing below stops, signals or starts a process.
+# ---------------------------------------------------------------------------
+
+# mxtk_port_holder <port> — who LISTENs on it: prints "<pid>|<process name>" and returns 0, or
+# returns 1 when the port is free. "?|an unidentified process" when something accepts connections
+# but no tool here can name it (lsof without root cannot see another user's sockets).
+# Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
+mxtk_port_holder() {
+  local p="$1" out pid="" name=""
+  case "$(mxtk_platform)" in
+    windows)
+      pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
+      [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
+    *)
+      if command -v lsof >/dev/null 2>&1; then
+        out="$(lsof -nP -iTCP:"$p" -sTCP:LISTEN -Fpc 2>/dev/null)"
+        pid="$(printf '%s\n' "$out" | sed -n 's/^p//p' | head -1)"
+        name="$(printf '%s\n' "$out" | sed -n 's/^c//p' | head -1)"
+      fi
+      if [ -z "$pid" ] && command -v ss >/dev/null 2>&1; then
+        out="$(ss -ltnpH "sport = :$p" 2>/dev/null | head -1)"
+        pid="$(printf '%s' "$out" | sed -n 's/.*pid=\([0-9][0-9]*\).*/\1/p')"
+        name="$(printf '%s' "$out" | sed -n 's/.*users:(("\([^"]*\)".*/\1/p')"
+      fi ;;
+  esac
+  if [ -n "$pid" ]; then printf '%s|%s\n' "$pid" "${name:-unknown}"; return 0; fi
+  if (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then printf '?|an unidentified process\n'; return 0; fi
+  return 1
+}
+
+# mxtk_holder_text "<pid>|<name>" — "studiopro pid 4711" plus its parent where ps can show one,
+# because a runtime Studio Pro started shows up as plain "java"; the parent names the owner.
+mxtk_holder_text() {
+  local pid="${1%%|*}" name="${1#*|}" pp pn
+  [ "$pid" = "?" ] && { printf '%s (pid unknown — no lsof/ss/netstat could name it)\n' "$name"; return; }
+  printf '%s pid %s' "$name" "$pid"
+  if [ "$(mxtk_platform)" != windows ]; then
+    pp="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"
+    pn="$(ps -o comm= -p "${pp:-0}" 2>/dev/null | sed 's#.*/##')"
+    [ -n "$pp" ] && [ "$pp" != 1 ] && [ -n "$pn" ] && printf ' (parent: %s pid %s)' "$pn" "$pp"
+  fi
+  printf '\n'
+}
+
+# mxtk_pid_in_tree <pid> <root pid> — 0 when <pid> is <root pid> or a descendant of it (walked up
+# by parent pid, at most 10 levels). Git Bash's ps shows no parent of a Windows pid: returns 1 there
+# unless the two pids are equal, so a caller must treat "not in tree" on Windows as "unknown".
+mxtk_pid_in_tree() {
+  local p="$1" root="$2" i=0
+  [ -n "$p" ] && [ -n "$root" ] || return 1
+  while [ -n "$p" ] && [ "$p" != 0 ] && [ "$p" != 1 ] && [ "$i" -lt 10 ]; do
+    [ "$p" = "$root" ] && return 0
+    p="$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')"; i=$((i + 1))
+  done
+  return 1
+}
+
+# mxtk_pid_args <pid> — the process's command line. Linux: argv one per line from /proc (exact, a
+# space inside an argument survives). macOS: `ps -o args=`, ONE line (arguments joined by spaces).
+# Windows (Git Bash): Win32_Process.CommandLine via PowerShell, one line — Git Bash's ps cannot
+# show a Windows process's arguments. Returns 1 when nothing could be read.
+mxtk_pid_args() {
+  local pid="$1" out=""
+  case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+  case "$(mxtk_platform)" in
+    linux)
+      if [ -r "/proc/$pid/cmdline" ]; then out="$(tr '\0' '\n' < "/proc/$pid/cmdline" 2>/dev/null)"
+      else out="$(ps -o args= -p "$pid" 2>/dev/null)"; fi ;;
+    macos) out="$(ps -o args= -p "$pid" 2>/dev/null)" ;;
+    windows)
+      command -v powershell.exe >/dev/null 2>&1 \
+        && out="$(powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=$pid').CommandLine" 2>/dev/null | tr -d '\r')" ;;
+  esac
+  [ -n "$out" ] || return 1
+  printf '%s\n' "$out"
+}
+
+# mxtk_pid_runs_deployment <pid> <deployment dir>... — 0 when <pid> is a Mendix runtime started on
+# one of the named deployment directories: its command line runs runtimelauncher.jar and the
+# argument after the jar resolves to one of them. That is how both `mxcli run --local` and Studio
+# Pro's Run Locally start the runtime (field capture, run --local, Linux, 2026-09-25:
+# `java … -jar …/runtimelauncher.jar <project>/app/deployment`). A deployment directory belongs to
+# exactly one project checkout, so this is an ownership claim, not a "looks like Mendix" guess.
+# Linux compares exact argv after resolving symlinks (and a relative argument against the process's
+# cwd); macOS and Windows have only the joined line, so the directory is matched as text in both
+# its logical and physical spellings (Windows: drive form, case-insensitive). Unreadable → 1.
+mxtk_pid_runs_deployment() {
+  local pid="$1" args line next="" arg="" cwd d cand want
+  shift
+  args="$(mxtk_pid_args "$pid")" || return 1
+  case "$args" in *runtimelauncher.jar*) ;; *) return 1 ;; esac
+  if [ "$(mxtk_platform)" = linux ] && [ -r "/proc/$pid/cmdline" ]; then
+    while IFS= read -r line; do
+      [ -n "$next" ] && { arg="$line"; break; }
+      case "$line" in *runtimelauncher.jar) next=1 ;; esac
+    done <<EOF_ARGS
+$args
+EOF_ARGS
+    [ -n "$arg" ] || return 1
+    case "$arg" in /*) ;; *) cwd="$(readlink "/proc/$pid/cwd" 2>/dev/null)" || return 1; arg="$cwd/$arg" ;; esac
+    arg="$(cd "$arg" 2>/dev/null && pwd -P)" || return 1
+    for d in "$@"; do
+      want="$(cd "$d" 2>/dev/null && pwd -P)" || continue
+      [ "$arg" = "$want" ] && return 0
+    done
+    return 1
+  fi
+  # One joined line: match "runtimelauncher.jar <dir>" followed by the end, a slash or a space.
+  line="$(printf '%s' "$args" | head -1 | tr -d '"')"
+  [ "$(mxtk_platform)" = windows ] && line="$(printf '%s' "$line" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
+  for d in "$@"; do
+    for cand in "${d%/}" "$(cd "$d" 2>/dev/null && pwd -P)"; do
+      [ -n "$cand" ] || continue
+      [ "$(mxtk_platform)" = windows ] && cand="$(native_path "$cand" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
+      case "$line" in
+        *"runtimelauncher.jar $cand"|*"runtimelauncher.jar $cand/"|*"runtimelauncher.jar $cand "*|*"runtimelauncher.jar $cand/ "*) return 0 ;;
+      esac
+    done
+  done
+  return 1
+}
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index b18ffe19..c7c70f8b 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -129,48 +129,14 @@ mask() {  # print argv joined, with the value after any password/secret/token/ke
     "s/(-[-A-Za-z_]*([Pp][Aa][Ss][Ss]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Tt][Oo][Kk][Ee][Nn]|[Kk][Ee][Yy])[-A-Za-z_]*)(=| +)[^ ']+/\1\3****/g"
 }
 
-# port_holder <port> — who LISTENs on it: prints "<pid>|<process name>" and returns 0, or returns 1
-# when the port is free. "?|an unidentified process" when something accepts connections but no
-# tool here can name it (lsof without root cannot see another user's sockets). Never kills anything.
-# Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
-port_holder() {
-  local p="$1" out pid="" name=""
-  case "$(mxtk_platform)" in
-    windows)
-      pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
-      [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
-    *)
-      if command -v lsof >/dev/null 2>&1; then
-        out="$(lsof -nP -iTCP:"$p" -sTCP:LISTEN -Fpc 2>/dev/null)"
-        pid="$(printf '%s\n' "$out" | sed -n 's/^p//p' | head -1)"
-        name="$(printf '%s\n' "$out" | sed -n 's/^c//p' | head -1)"
-      fi
-      if [ -z "$pid" ] && command -v ss >/dev/null 2>&1; then
-        out="$(ss -ltnpH "sport = :$p" 2>/dev/null | head -1)"
-        pid="$(printf '%s' "$out" | sed -n 's/.*pid=\([0-9][0-9]*\).*/\1/p')"
-        name="$(printf '%s' "$out" | sed -n 's/.*users:(("\([^"]*\)".*/\1/p')"
-      fi ;;
-  esac
-  if [ -n "$pid" ]; then printf '%s|%s\n' "$pid" "${name:-unknown}"; return 0; fi
-  if (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then printf '?|an unidentified process\n'; return 0; fi
-  return 1
-}
-# holder_text "<pid>|<name>" — "studiopro pid 4711" plus its parent where ps can show one, because a
-# runtime Studio Pro started shows up as plain "java"; the parent is what names the owner.
-holder_text() {
-  local pid="${1%%|*}" name="${1#*|}" pp pn
-  [ "$pid" = "?" ] && { printf '%s (pid unknown — no lsof/ss/netstat could name it)\n' "$name"; return; }
-  printf '%s pid %s' "$name" "$pid"
-  if [ "$(mxtk_platform)" != windows ]; then
-    pp="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"
-    pn="$(ps -o comm= -p "${pp:-0}" 2>/dev/null | sed 's#.*/##')"
-    [ -n "$pp" ] && [ "$pp" != 1 ] && [ -n "$pn" ] && printf ' (parent: %s pid %s)' "$pn" "$pp"
-  fi
-  printf '\n'
-}
+# Port and process helpers (mxtk_port_holder, mxtk_holder_text, mxtk_pid_in_tree) live in
+# _common.sh, shared with test-stack-up.sh. A project whose bin/_common.sh predates them stops here
+# with the remedy, instead of dying mid-restart on "command not found".
+command -v mxtk_port_holder >/dev/null 2>&1 || {
+  echo "app-restart: bin/_common.sh is older than this script (no mxtk_port_holder) — run the toolkit's bin/sync-project.sh" >&2; exit 2; }
 # blocked <port> "<pid>|<name>" <when> — exit 4, the holder named, nothing of it touched.
 blocked() {
-  echo "✗ app-restart: instrument blocked — port :$1 is held by $(holder_text "$2"), not this project's run --local." >&2
+  echo "✗ app-restart: instrument blocked — port :$1 is held by $(mxtk_holder_text "$2"), not this project's run --local." >&2
   echo "  $3. This script never stops a process it did not record, so it is not touching that one." >&2
   echo "  Starting now would collide: mxcli reports 'Authentication failed' against the other runtime's admin API." >&2
   echo "  → Stop that process yourself (Studio Pro: stop its run), or start on free ports:" >&2
@@ -179,15 +145,7 @@ blocked() {
   exit 4
 }
 # in_our_tree <pid> — the recorded pid itself, or a descendant of it (the runtime mxcli started).
-in_our_tree() {
-  local p="$1" i=0
-  [ "$ALIVE" = 1 ] || return 1
-  while [ -n "$p" ] && [ "$p" != 0 ] && [ "$p" != 1 ] && [ "$i" -lt 10 ]; do
-    [ "$p" = "$PID" ] && return 0
-    p="$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')"; i=$((i + 1))
-  done
-  return 1
-}
+in_our_tree() { [ "$ALIVE" = 1 ] && mxtk_pid_in_tree "$1" "$PID"; }
 
 # ── 1. The record ───────────────────────────────────────────────────────────
 [ -n "$HS" ] || refuse "no run --local record for this project (.mxcli/run-local.json beside $(basename "$MPR"))." \
@@ -254,7 +212,7 @@ echo "  ports: app :$PORT, admin :$ADMIN_PORT"
 # pids), it is left to the post-stop check below, which is exact: after our tree is gone, whatever
 # still holds the port is not ours.
 for _p in "$PORT" "$ADMIN_PORT"; do
-  _h="$(port_holder "$_p")" || continue
+  _h="$(mxtk_port_holder "$_p")" || continue
   if [ "$ALIVE" = 1 ]; then
     case "${_h%%|*}" in '?') continue ;; esac
     [ "$(mxtk_platform)" = windows ] && continue
@@ -282,12 +240,12 @@ fi
 _busy=""
 for _i in $(seq 1 30); do
   _busy=""
-  for _p in "$PORT" "$ADMIN_PORT"; do port_holder "$_p" >/dev/null && { _busy="$_p"; break; }; done
+  for _p in "$PORT" "$ADMIN_PORT"; do mxtk_port_holder "$_p" >/dev/null && { _busy="$_p"; break; }; done
   [ -z "$_busy" ] && ! port_answers "$PORT" && break
   sleep 1
 done
 if [ -n "$_busy" ]; then
-  blocked "$_busy" "$(port_holder "$_busy" || echo '?|an unidentified process')" "The recorded app was stopped; nothing was started"
+  blocked "$_busy" "$(mxtk_port_holder "$_busy" || echo '?|an unidentified process')" "The recorded app was stopped; nothing was started"
 elif port_answers "$PORT"; then
   blocked "$PORT" "?|an unidentified process" "The recorded app was stopped; nothing was started"
 fi
diff --git a/project-bin/test-stack-up.sh b/project-bin/test-stack-up.sh
index 17af56ad..dfc0e141 100755
--- a/project-bin/test-stack-up.sh
+++ b/project-bin/test-stack-up.sh
@@ -28,6 +28,8 @@
 #   bin/test-stack-up.sh             # report, then bring up what is missing (may run a Docker build)
 #   bin/test-stack-up.sh --no-docker # bring up auxiliaries only; never build. "SP is already running it".
 #   bin/test-stack-up.sh --restart   # skip the hot reload; rebuild and restart the container (old path)
+#   bin/test-stack-up.sh --track <pid> [label]  # record a background test process THIS project started
+#   bin/test-stack-up.sh --reap      # stop recorded processes older than MXTK_STALE_HOURS; nothing else
 #
 # WARM LOOP. After a model change the old loop was: exec.sh gate (mxbuild) -> `docker run` (mx check +
 # mxbuild again) -> container restart -> boot wait. Now: the app's model is recorded in
@@ -70,6 +72,34 @@
 # RUN_LOCAL_ADMIN_PORT (stack.conf), else mxcli's defaults 8080 / app port + 10 — and exits 4
 # naming the holder (lsof / ss; netstat on Windows) instead of advising a start that cannot work.
 #
+# RUNTIME PROOF WITHOUT A HANDSHAKE (#160, field run 2026-09-25, requirements-driven build). An app
+# with no run-local.json — Studio Pro's Run Locally, or a run --local older than the handshake — was
+# found by scan and published APP_OWNERSHIP=unverified, so every journey run needed APP_PORT
+# asserted by hand. The proof was there all along: the runtime's command line runs
+# `runtimelauncher.jar <project>/app/deployment`, and a deployment directory belongs to one checkout.
+# So a scanned Mendix port whose listener (lsof / ss / netstat) runs runtimelauncher.jar on THIS
+# project's deployment dir (<root>/deployment, <root>/app/deployment, or beside the real .mpr) is
+# `verified` with APP_SOURCE=runtime. Freshness stays `unknown` — this script did not build it.
+# Command line: /proc on Linux, `ps -o args=` on macOS, PowerShell CIM on Git Bash (_common.sh's
+# mxtk_pid_runs_deployment). Unreadable → `unverified`, exactly as before.
+#
+# OWN PROCESS ON THE PORT IS NOT A THIEF (follow-up to #262). The port check above must not name
+# this project's own runtime: while it boots it binds its ports before it serves a page, and the
+# check said "INSTRUMENT BLOCKED" (exit 4) about it. A holder is ours — reported NOT READY, exit 1
+# — when it is the live recorded run --local pid or a descendant of it, or when its command line
+# runs this project's deployment dir (that includes Studio Pro running THIS project). Anything else
+# still blocks.
+#
+# STALE TEST PROCESSES (#278, field run 2026-10-12). A night of retries left journey-runner and
+# monitor shells running for hours; a later run then hit the trial licence's session cap and was
+# INVALID. Every run of this script lists the recorded processes older than MXTK_STALE_HOURS
+# (default 4) and prints the one command that stops them; --reap does it. It acts ONLY on
+# .claude/loop/bg-pids.tsv — lines `<pid> TAB <epoch> TAB <ps lstart> TAB <label>` written by
+# `--track <pid> [label]` for a process this project started — never on a process found by name
+# or pattern, so another project's runner is out of reach by construction. A pid whose start time
+# no longer matches its line was reused by an unrelated process and is dropped, never signalled.
+# Not on Git Bash: its ps cannot show a Windows process's start time, so nothing is reaped there.
+#
 # PROJECT CONFIGURATION — no project name, port or service path is hardcoded here. Put anything
 # project-specific in <project>/.claude/loop/stack.conf, which this script sources if present:
 #
@@ -80,6 +110,7 @@
 #   MOCK_DIR="source/mock-api"                           # dir containing server.js
 #   MOCK_START="node server.js"                          # command run inside MOCK_DIR
 #   BOOT_TIMEOUT=240
+#   MXTK_STALE_HOURS=4                                   # age at which a tracked process is stale
 #
 # With no MOCK_HEALTH_URL the mock rung is reported as "not configured" and does not gate — most
 # projects have no mock, and a rung that fails for everyone gets switched off, taking the real
@@ -119,10 +150,17 @@ case "${1:-}" in
   --check)     MODE="check" ;;
   --no-docker) MODE="nodocker" ;;
   --restart)   MODE="restart" ;;
+  --reap)      MODE="reap" ;;
+  --track)     MODE="track" ;;
   "")          ;;
-  *) echo "usage: $0 [--check|--no-docker|--restart]" >&2; exit 2 ;;
+  *) echo "usage: $0 [--check|--no-docker|--restart|--reap|--track <pid> [label]]" >&2; exit 2 ;;
 esac
 
+# Helpers moved to _common.sh (#160). A project whose bin/_common.sh predates them stops here with
+# the remedy instead of dying mid-run on "command not found".
+command -v mxtk_pid_runs_deployment >/dev/null 2>&1 || {
+  echo "test-stack-up: bin/_common.sh is older than this script (no mxtk_pid_runs_deployment) — run the toolkit's bin/sync-project.sh" >&2; exit 2; }
+
 ok()   { printf '  \033[32m✓\033[0m %s\n' "$1"; }
 bad()  { printf '  \033[31m✗\033[0m %s\n' "$1"; }
 warn() { printf '  \033[33m!\033[0m %s\n' "$1"; }
@@ -217,16 +255,22 @@ find_app_port() {
     warn "our container publishes :$owned but it is not serving Mendix yet" >&2
     echo "$owned|verified|docker"; return 1
   fi
-  # 2. No container of ours is running (SP-hosted run, or docker unavailable). Fall back to the
-  #    scan — but say so, because a hit here is UNVERIFIED ownership: it proves a Mendix answered,
-  #    not that it is ours.
+  # 2. No container of ours is running (SP-hosted run, or docker unavailable). Scan — and first
+  #    look for a port whose listener runs THIS project's deployment dir (see RUNTIME PROOF).
+  local hits="" h
   for p in $APP_PORTS; do
-    if mendix_at "$p"; then
-      warn "no container owned by $ROOT/.docker is running; :$p matched by scan — ownership UNVERIFIED" >&2
-      warn "  → recorded as APP_OWNERSHIP=unverified in stack.env. A test harness should REFUSE an" >&2
-      warn "    unverified port unless ALLOW_UNVERIFIED_APP=1, because :$p may be another project." >&2
-      echo "$p|unverified|scan"; return 0
-    fi
+    mendix_at "$p" || continue
+    hits="$hits $p"
+    h="$(mxtk_port_holder "$p")" || continue
+    [ "${h%%|*}" = "?" ] && continue
+    if mxtk_pid_runs_deployment "${h%%|*}" $DEPLOY_DIRS; then echo "$p|verified|runtime"; return 0; fi
+  done
+  # 3. Otherwise a hit is UNVERIFIED ownership: it proves a Mendix answered, not that it is ours.
+  for p in $hits; do
+    warn "no container owned by $ROOT/.docker is running; :$p matched by scan — ownership UNVERIFIED" >&2
+    warn "  → recorded as APP_OWNERSHIP=unverified in stack.env. A test harness should REFUSE an" >&2
+    warn "    unverified port unless ALLOW_UNVERIFIED_APP=1, because :$p may be another project." >&2
+    echo "$p|unverified|scan"; return 0
   done
   echo "|none|none"; return 1
 }
@@ -242,6 +286,9 @@ if [ -L "$MPR" ]; then
   case "$_t" in /*) ;; *) _t="$MPR_DIR/$_t" ;; esac
   MODEL_DIR="$(cd "$(dirname "$_t")" 2>/dev/null && pwd -P)" || MODEL_DIR="$MPR_DIR"
 fi
+# Where this project's runtime is deployed, on either layout. Paths with spaces are not split-safe
+# here; mxtk_pid_runs_deployment then simply finds no match (unverified, as before).
+DEPLOY_DIRS="$ROOT/deployment $ROOT/app/deployment $MPR_DIR/deployment $MODEL_DIR/deployment"
 LOCAL_HS="$MPR_DIR/.mxcli/run-local.json"
 pick_local_hs() {
   local d
@@ -260,45 +307,6 @@ pid_alive() {
     *)       kill -0 "$1" 2>/dev/null ;;
   esac
 }
-# port_holder <port> — who LISTENs on it: prints "<pid>|<process name>" and returns 0, or returns 1
-# when the port is free. "?|an unidentified process" when something accepts connections but no
-# tool here can name it (lsof without root cannot see another user's sockets). Never kills anything.
-# Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
-port_holder() {
-  local p="$1" out pid="" name=""
-  case "$(mxtk_platform)" in
-    windows)
-      pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
-      [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
-    *)
-      if command -v lsof >/dev/null 2>&1; then
-        out="$(lsof -nP -iTCP:"$p" -sTCP:LISTEN -Fpc 2>/dev/null)"
-        pid="$(printf '%s\n' "$out" | sed -n 's/^p//p' | head -1)"
-        name="$(printf '%s\n' "$out" | sed -n 's/^c//p' | head -1)"
-      fi
-      if [ -z "$pid" ] && command -v ss >/dev/null 2>&1; then
-        out="$(ss -ltnpH "sport = :$p" 2>/dev/null | head -1)"
-        pid="$(printf '%s' "$out" | sed -n 's/.*pid=\([0-9][0-9]*\).*/\1/p')"
-        name="$(printf '%s' "$out" | sed -n 's/.*users:(("\([^"]*\)".*/\1/p')"
-      fi ;;
-  esac
-  if [ -n "$pid" ]; then printf '%s|%s\n' "$pid" "${name:-unknown}"; return 0; fi
-  if (exec 3<>"/dev/tcp/127.0.0.1/$p") 2>/dev/null; then printf '?|an unidentified process\n'; return 0; fi
-  return 1
-}
-# holder_text "<pid>|<name>" — "studiopro pid 4711" plus its parent where ps can show one, because a
-# runtime Studio Pro started shows up as plain "java"; the parent is what names the owner.
-holder_text() {
-  local pid="${1%%|*}" name="${1#*|}" pp pn
-  [ "$pid" = "?" ] && { printf '%s (pid unknown — no lsof/ss/netstat could name it)\n' "$name"; return; }
-  printf '%s pid %s' "$name" "$pid"
-  if [ "$(mxtk_platform)" != windows ]; then
-    pp="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"
-    pn="$(ps -o comm= -p "${pp:-0}" 2>/dev/null | sed 's#.*/##')"
-    [ -n "$pp" ] && [ "$pp" != 1 ] && [ -n "$pn" ] && printf ' (parent: %s pid %s)' "$pn" "$pp"
-  fi
-  printf '\n'
-}
 # The ports a `mxcli run --local` of this project will want: "<app> <admin>".
 run_local_ports() {
   local a="" m=""
@@ -307,12 +315,37 @@ run_local_ports() {
   m="${RUN_LOCAL_ADMIN_PORT:-${m:-$((a + 10))}}"
   echo "$a $m"
 }
+# own_holder "<pid>|<name>" — is this port holder this project's own process? Yes when it is the
+# live recorded run --local pid or under it (the runtime mxcli started), or when its command line
+# runs this project's deployment dir (a newer run --local still booting, Studio Pro running THIS
+# project). With a live record and a holder that cannot be placed — unnamed, or Windows where Git
+# Bash shows no parent pids — it is presumed ours: blocking our own boot is the worse error, and a
+# real stranger is named on the next run once the record is gone.
+own_holder() {
+  local hp="${1%%|*}" lp=""
+  pick_local_hs && lp="$(hs_field pid)" && pid_alive "$lp" || lp=""
+  [ "$hp" != "?" ] && mxtk_pid_runs_deployment "$hp" $DEPLOY_DIRS && return 0
+  # A runtime whose command line names ANOTHER deployment dir is foreign, whatever else is true.
+  [ "$hp" != "?" ] && case "$(mxtk_pid_args "$hp" 2>/dev/null)" in *runtimelauncher.jar*) return 1 ;; esac
+  [ -n "$lp" ] || return 1
+  [ "$hp" = "?" ] && return 0
+  [ "$(mxtk_platform)" = windows ] && return 0
+  mxtk_pid_in_tree "$hp" "$lp"
+}
 # Exit 4 if a run --local of this project could not bind its ports. Never stops the holder.
+# Returns 3 (and sets OWN_HOLDING) when a port is held by this project's own process — it is
+# booting or not serving a page yet: NOT READY, never blocked.
+OWN_HOLDING=""
 check_run_local_ports() {
   local p h kind=app
+  OWN_HOLDING=""
   for p in $(run_local_ports); do
-    if h="$(port_holder "$p")"; then
-      bad "INSTRUMENT BLOCKED — :$p (the run --local $kind port) is held by $(holder_text "$h")"
+    if h="$(mxtk_port_holder "$p")"; then
+      if own_holder "$h"; then
+        [ -n "$OWN_HOLDING" ] || OWN_HOLDING=":$p (the run --local $kind port) — $(mxtk_holder_text "$h")"
+        kind=admin; continue
+      fi
+      bad "INSTRUMENT BLOCKED — :$p (the run --local $kind port) is held by $(mxtk_holder_text "$h")"
       echo "  Not touching it. \`mxcli run --local\` here would collide: it reports 'Authentication failed'"
       echo "  against the other runtime's admin API, and a journey would test that runtime instead."
       echo "  → Stop that process yourself (Studio Pro: stop its run), or start on free ports:"
@@ -322,6 +355,12 @@ check_run_local_ports() {
     fi
     kind=admin
   done
+  if [ -n "$OWN_HOLDING" ]; then
+    warn "this project's own runtime holds $OWN_HOLDING"
+    warn "  → it is booting, or up without serving a page yet. Not blocked: wait, then re-run --check."
+    return 3
+  fi
+  return 0
 }
 local_loop_port() {
   local pid port
@@ -384,6 +423,8 @@ record_served() {
 # Echoes fresh | stale | unknown.
 served_state() {
   local want have
+  # Proven by its command line, not built by this script: no record of what model it booted.
+  [ "${APP_SOURCE:-}" = "runtime" ] && { echo unknown; return; }
   # run --local: mxcli rebuilt nothing for us to record; the handshake's mtime is the boot.
   if [ "${APP_SOURCE:-}" = "run-local" ]; then
     pick_local_hs || true
@@ -411,7 +452,84 @@ prove_app() {
   mendix_at "$APP_PORT"
 }
 
+# --- Tracked background test processes (#278) — see STALE TEST PROCESSES above -----------------
+BG_PIDS="${BG_PIDS:-$ROOT/.claude/loop/bg-pids.tsv}"
+STALE_HOURS="${MXTK_STALE_HOURS:-4}"
+case "$STALE_HOURS" in ''|*[!0-9]*) echo "MXTK_STALE_HOURS takes whole hours" >&2; exit 2 ;; esac
+pid_lstart() { ps -o lstart= -p "$1" 2>/dev/null | sed 's/  */ /g; s/^ //; s/ $//'; }
+# bg_scan — prints "<state>|<pid>|<age h>|<label>" per record line: live | stale | gone (dead, or the
+# pid now belongs to a process that started at another time).
+bg_scan() {
+  local pid ep ls lab now
+  [ -f "$BG_PIDS" ] || return 0
+  now="$(date +%s)"
+  while IFS='	' read -r pid ep ls lab; do
+    case "$pid" in ''|*[!0-9]*) continue ;; esac
+    case "$ep" in ''|*[!0-9]*) ep="$now" ;; esac
+    if ! kill -0 "$pid" 2>/dev/null || [ "$(pid_lstart "$pid")" != "$ls" ]; then
+      echo "gone|$pid|0|$lab"
+    elif [ $(( (now - ep) / 3600 )) -ge "$STALE_HOURS" ]; then
+      echo "stale|$pid|$(( (now - ep) / 3600 ))|$lab"
+    else echo "live|$pid|$(( (now - ep) / 3600 ))|$lab"; fi
+  done < "$BG_PIDS"
+}
+# bg_prune — keep only the lines whose process still runs with its recorded start time.
+bg_prune() {
+  local keep pid
+  [ -f "$BG_PIDS" ] || return 0
+  keep="$(bg_scan | awk -F'|' '$1 != "gone" { print $2 }')"
+  : > "$BG_PIDS.tmp" || return 0
+  while IFS= read -r line; do
+    pid="${line%%	*}"
+    case " $(echo $keep) " in *" $pid "*) printf '%s\n' "$line" >> "$BG_PIDS.tmp" ;; esac
+  done < "$BG_PIDS"
+  mv "$BG_PIDS.tmp" "$BG_PIDS"
+}
+if [ "$MODE" = "track" ]; then
+  T_PID="${2:-}"; T_LABEL="${3:-process}"
+  case "$T_PID" in ''|*[!0-9]*) echo "usage: $0 --track <pid> [label]" >&2; exit 2 ;; esac
+  [ "$(mxtk_platform)" = windows ] && { echo "test-stack-up: --track is not supported on Git Bash (no process start time to check a reused pid against); nothing recorded"; exit 0; }
+  T_LS="$(pid_lstart "$T_PID")"
+  [ -n "$T_LS" ] || { echo "test-stack-up: pid $T_PID is not running — nothing recorded" >&2; exit 1; }
+  mkdir -p "$(dirname "$BG_PIDS")" || exit 2
+  printf '%s\t%s\t%s\t%s\n' "$T_PID" "$(date +%s)" "$T_LS" "$(printf '%s' "$T_LABEL" | tr '\t\n' '  ')" >> "$BG_PIDS"
+  echo "tracked pid $T_PID ($T_LABEL) in ${BG_PIDS#$ROOT/}"
+  exit 0
+fi
+# bg_report — list the stale ones and the command that stops them. Read-only.
+bg_report() {
+  local st pid age lab n=0
+  while IFS='|' read -r st pid age lab; do
+    [ "$st" = stale ] || continue
+    [ $n -eq 0 ] && warn "test processes THIS project started are still running after ${STALE_HOURS}h+ (${BG_PIDS#$ROOT/}):"
+    warn "  pid $pid — $lab — ${age}h"; n=$((n + 1))
+  done <<EOF_BG
+$(bg_scan)
+EOF_BG
+  [ $n -gt 0 ] && warn "  → hung runs hold login sessions (licence session cap → INVALID runs). Stop them: $0 --reap"
+  return 0
+}
+if [ "$MODE" = "reap" ]; then
+  [ "$(mxtk_platform)" = windows ] && { echo "test-stack-up: --reap is not supported on Git Bash; stop the processes yourself"; exit 0; }
+  REAPED=0
+  while IFS='|' read -r st pid age lab; do
+    [ "$st" = stale ] || continue
+    KIDS="$(pgrep -P "$pid" 2>/dev/null | tr '\n' ' ' || true)"   # portability-ok: pgrep -P (by parent pid of a recorded pid); Windows returned above
+    kill -TERM "$pid" $KIDS 2>/dev/null || true
+    for _ in 1 2 3 4 5; do kill -0 "$pid" 2>/dev/null || break; sleep 1; done
+    for k in "$pid" $KIDS; do kill -0 "$k" 2>/dev/null && kill -KILL "$k" 2>/dev/null; done
+    ok "stopped pid $pid — $lab — ${age}h old${KIDS:+ (and its children $KIDS)}"; REAPED=$((REAPED + 1))
+  done <<EOF_BG
+$(bg_scan)
+EOF_BG
+  bg_prune
+  echo "reaped $REAPED stale tracked process(es); live and untracked processes untouched"
+  exit 0
+fi
+
 echo "── Test stack: $PROJ ──────────────────────────────────"
+bg_report
+[ "$MODE" != "check" ] && bg_prune
 
 # --- Studio Pro: report only, never act -------------------------------------
 # Matched on the process list rather than with pgrep: pgrep is macOS/BSD-and-Linux only, and the
@@ -439,6 +557,8 @@ IFS='|' read -r APP_PORT APP_OWNERSHIP APP_SOURCE <<<"$APP_FIND"
 if [ $APP_FOUND -eq 0 ]; then
   if [ "$APP_SOURCE" = "run-local" ]; then
     ok "App serving on :$APP_PORT (ownership verified — this project's mxcli run --local)"
+  elif [ "$APP_SOURCE" = "runtime" ]; then
+    ok "App serving on :$APP_PORT (ownership verified — its runtime runs this project's deployment dir)"
   elif [ "$APP_OWNERSHIP" = "verified" ]; then
     ok "App serving on :$APP_PORT (ownership verified — our container)"
   else
@@ -606,7 +726,7 @@ fi
 # --- Bring up the app -------------------------------------------------------
 if [ $APP_FOUND -ne 0 ]; then
   if [ "$MODE" = "nodocker" ]; then
-    check_run_local_ports
+    check_run_local_ports || { bad "App not serving yet — this project's own runtime holds its port. Re-run --check when it answers."; exit 1; }
     bad "App down and --no-docker given. Click Run Locally in Studio Pro (or, with no Studio Pro, ./mxcli run --local --watch), then re-run --check."
     exit 1
   fi
@@ -624,7 +744,7 @@ if [ $APP_FOUND -ne 0 ]; then
     [ -n "$_DK" ] || { wait "$_dk_pid"; _DK=$?; }
   fi
   if [ "$_DK" != 0 ]; then
-    check_run_local_ports
+    check_run_local_ports || { bad "App not serving yet — this project's own runtime holds its port. Re-run --check when it answers."; exit 1; }
     bad "App down and no Docker/Podman reachable, so this script cannot build the app container."
     echo "  Normal in a cloud container, and fine on a desktop without one. Run the app without it:"
     echo "    Studio Pro: Run Locally.  No Studio Pro:"
diff --git a/skills/test-result-audit.md b/skills/test-result-audit.md
index 710bf568..1505ed4f 100644
--- a/skills/test-result-audit.md
+++ b/skills/test-result-audit.md
@@ -163,6 +163,7 @@ exactly these three:
   happened to exist. A stitched total is reported as stitched, with the run ids, never as the
   verdict.
 A report that does not give one of these numbers fails that question; say which.
+An INVALID run has two causes outside the app (#278, field run 2026-10-12): a demo account locked out by failed logins from a runner started with its password variable unset, and the trial licence's session cap filled by hung runner shells from earlier retries (`bin/test-stack-up.sh` lists the ones this project tracked; `--reap` stops them). Name which, re-run after the lockout window or the reap, and never count either as FAIL.
 
 ### 3. Produce a written critique — not a rubber stamp
 
diff --git a/tests/wave2/test-app-restart.sh b/tests/wave2/test-app-restart.sh
index 75920d7c..62819f90 100755
--- a/tests/wave2/test-app-restart.sh
+++ b/tests/wave2/test-app-restart.sh
@@ -22,6 +22,8 @@
 # #262: a stranger on the admin port while our app runs → exit 4 before anything is stopped, the
 # stranger named by pid and alive; our app dead and a stranger on the app port → exit 4, nothing
 # started. (The stranger is a bare TCP listener, as a runtime's admin port is to curl.)
+# #160: the port/tree helpers moved to _common.sh; an older _common.sh stops with exit 2 + the
+# sync remedy (this is the case where it would otherwise die on "command not found").
 # Needs node and curl; skips (exit 0, says so) without them.
 set -uo pipefail
 
@@ -205,6 +207,15 @@ OUT="$(restart "$P" --dry-run --cmd './mxcli run --local --db-password hunter2 -
 hasnt "a password value never reaches the screen" "$OUT" "hunter2"
 alive "$DECOY" && ok "decoy survived the whole run" || bad "decoy killed"
 
+echo "-- #160: a bin/_common.sh older than the moved helpers → exit 2 naming sync, nothing stopped"
+O="$WORK/oldcommon"; mkapp "$O" "$PORT"
+sed '/^# Process identity — who holds a port/,$d' "$TOOLKIT/project-bin/_common.sh" > "$O/bin/_common.sh"
+grep -q mxtk_port_holder "$O/bin/_common.sh" && bad "[setup] could not strip the helpers" || ok "[setup] _common.sh without the shared helpers"
+OUT="$(restart "$O" --dry-run)"; RC=$?
+[ "$RC" -eq 2 ] && ok "exit 2" || bad "exit $RC: $(printf '%s' "$OUT" | tail -2)"
+has "names the remedy" "$OUT" "sync-project.sh"
+hasnt "no command-not-found mid-run" "$OUT" "command not found"
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-stack-up-local.sh b/tests/wave2/test-stack-up-local.sh
index cd7521a7..9e27c37c 100755
--- a/tests/wave2/test-stack-up-local.sh
+++ b/tests/wave2/test-stack-up-local.sh
@@ -11,14 +11,20 @@
 # rewrites only pid/appPort/adminPass. The "app" is a python http.server serving a login page with
 # a Mendix marker; the "mxcli" is `sleep` with its argv[0] set, so `ps` shows the command line the
 # script reads --watch from. docker/podman are stubbed out so no real container can answer.
-# Not fixtured: the Windows tasklist branch of pid_alive and the netstat branch of port_holder (CI
-# is Linux).
+# Not fixtured: the Windows tasklist branch of pid_alive, the netstat branch of mxtk_port_holder and
+# the PowerShell / `ps -o args=` branches of mxtk_pid_args (CI is Linux; Linux reads /proc).
+# T8-T10 (#160): no handshake, ownership proven by the listener's command line running
+# runtimelauncher.jar on this project's deployment dir (both layouts); a foreign one stays unverified.
+# T11-T13 (#262 follow-up): this project's own booting runtime on its port is NOT READY (exit 1),
+# never INSTRUMENT BLOCKED. T14 (#278): --track / --reap act on the project's own pid record only.
 # T7 (#262): a port the run --local loop needs is held by a process that is not this project's
 # loop (here the fake app itself, behind a dead handshake — Studio Pro's runtime in the field) →
 # exit 4, "INSTRUMENT BLOCKED", the holder named with its pid, and it is still alive afterwards.
 #
 # usage: test-stack-up-local.sh /path/to/test-stack-up.sh
-set -uo pipefail
+# No pipefail: every assertion is `printf "$OUT" | grep -q …`, and grep -q exits on the first match —
+# with pipefail the printf's SIGPIPE on a long $OUT then failed a passing assertion (seen on T2).
+set -u
 
 SRC="${1:?usage: test-stack-up-local.sh /path/to/test-stack-up.sh}"
 case "$SRC" in /*) ;; *) SRC="$PWD/$SRC" ;; esac
@@ -168,6 +174,133 @@ P="$(mkproj t7c root)"; handshake "$P" "$DEAD_PID"; sed -i.bak "s/^  \"appPort\"
 OUT="$(run "$P")"; RC=$?
 [ "$RC" -eq 1 ] && ! printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && ok "free run --local ports: plain NOT READY, exit 1" || bad "free ports rc=$RC, want 1" "$OUT"
 
+# --- #160 and the #262 follow-up: the runtime's own command line ----------------------------
+# srv.py <mx|boot> <www> <portfile> [args the script ignores] — a listener whose command line can
+# carry `-jar …/runtimelauncher.jar <deployment dir>`, as the Mendix runtime's does (field capture,
+# run --local on Linux, 2026-09-25: `java … -jar …/runtimelauncher.jar <project>/app/deployment`).
+# mx serves the Mendix-marked login page; boot answers 503 (bound, not serving yet — a booting runtime).
+cat > "$WORK/srv.py" <<'PY'
+import functools, http.server, sys
+mode, www, pf = sys.argv[1:4]
+class Boot(http.server.BaseHTTPRequestHandler):
+    def do_GET(self): self.send_response(503); self.end_headers()
+    def log_message(self, *a): pass
+H = functools.partial(http.server.SimpleHTTPRequestHandler, directory=www) if mode == "mx" else Boot
+s = http.server.ThreadingHTTPServer(("127.0.0.1", 0), H)
+open(pf, "w").write(str(s.server_address[1]))
+s.serve_forever()
+PY
+# srv <port var> <pid var> <mx|boot> [extra argv…]
+SRVN=0
+srv() {
+  local pv="$1" iv="$2" mode="$3" pf; shift 3; SRVN=$((SRVN + 1)); pf="$WORK/srv$SRVN.port"
+  "$PY" -I "$WORK/srv.py" "$mode" "$WORK/www" "$pf" "$@" >/dev/null 2>&1 &
+  PIDS="$PIDS $!"; printf -v "$iv" '%s' "$!"
+  for _ in $(seq 1 50); do [ -s "$pf" ] && break; sleep 0.1; done
+  printf -v "$pv" '%s' "$(cat "$pf" 2>/dev/null)"
+}
+JAR=/opt/mendix/runtime/launcher/runtimelauncher.jar
+if [ "$CAN_NAME" != 1 ]; then
+  echo "  [skip] T8-T13: neither lsof nor ss — no listener pid, so no command line to read"
+else
+echo "== T8 (#160): no handshake; :X runs runtimelauncher.jar on THIS project's deployment dir -> verified =="
+P="$(mkproj t8 root)"; mkdir -p "$P/deployment"
+srv R8 R8PID mx -jar "$JAR" "$P/deployment"
+# Another Mendix answers FIRST in the scan list — the old scan published it as ours-unverified.
+printf 'APP_PORTS="%s %s"\n' "$APP" "$R8" >> "$P/.claude/loop/stack.conf"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 0 ] && ok "--check exits 0" || bad "--check rc=$RC" "$OUT"
+[ "$(envv "$P" APP_PORT)" = "$R8" ] && [ "$(envv "$P" APP_OWNERSHIP)" = verified ] && [ "$(envv "$P" APP_SOURCE)" = runtime ] \
+  && ok "stack.env: APP_PORT=$R8 verified runtime (the foreign Mendix on :$APP skipped)" || bad "stack.env wrong" "$(cat "$P/.claude/loop/stack.env" 2>&1)"
+printf '%s' "$OUT" | grep -q "runs this project's deployment dir" && ok "says why it is verified" || bad "no runtime verdict" "$OUT"
+printf '%s' "$OUT" | grep -q "App freshness unknown" && ok "freshness unknown (this script did not build it)" || bad "freshness claimed" "$OUT"
+
+echo "== T9 (#160): two-tree — runtimelauncher.jar on <root>/app/deployment -> verified =="
+P="$(mkproj t9 app)"; mkdir -p "$P/app/deployment"
+srv R9 R9PID mx -jar "$JAR" "$P/app/deployment/"
+printf 'APP_PORTS="%s"\n' "$R9" >> "$P/.claude/loop/stack.conf"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 0 ] && [ "$(envv "$P" APP_OWNERSHIP)" = verified ] && [ "$(envv "$P" APP_SOURCE)" = runtime ] \
+  && ok "app/deployment recognised (trailing slash too)" || bad "two-tree runtime not verified (rc=$RC)" "$OUT"
+
+echo "== T10 (#160): runtimelauncher.jar on ANOTHER checkout's deployment dir -> unverified, as before =="
+P="$(mkproj t10 root)"; mkdir -p "$P/deployment" "$WORK/other/deployment"
+srv R10 R10PID mx -jar "$JAR" "$WORK/other/deployment"
+printf 'APP_PORTS="%s"\n' "$R10" >> "$P/.claude/loop/stack.conf"
+OUT="$(run "$P")"; RC=$?
+[ "$(envv "$P" APP_OWNERSHIP)" = unverified ] && [ "$(envv "$P" APP_SOURCE)" = scan ] \
+  && ok "another project's runtime stays unverified" || bad "foreign runtime verified" "$(cat "$P/.claude/loop/stack.env" 2>&1)"
+
+echo "== T11 (#262 follow-up): live record, its own child bound to the app port, booting -> NOT READY, exit 1 =="
+P="$(mkproj t11 root)"
+( "$PY" -I "$WORK/srv.py" boot "$WORK/www" "$WORK/t11.port" & wait ) >/dev/null 2>&1 &
+LOOP11=$!; PIDS="$PIDS $LOOP11"
+for _ in $(seq 1 50); do [ -s "$WORK/t11.port" ] && break; sleep 0.1; done
+B11="$(cat "$WORK/t11.port")"; PIDS="$PIDS $(pgrep -P "$LOOP11" | tr '\n' ' ')"   # portability-ok: fixture teardown list, by parent pid
+handshake "$P" "$LOOP11"
+sed -i.bak "s/^  \"appPort\": [0-9]*/  \"appPort\": $B11/; s/^  \"adminPort\": [0-9]*/  \"adminPort\": 1/" "$P/.mxcli/run-local.json"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 1 ] && ok "--check exits 1 (was 4)" || bad "--check rc=$RC, want 1" "$OUT"
+printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && bad "own booting runtime called a thief" "$OUT" || ok "not INSTRUMENT BLOCKED"
+printf '%s' "$OUT" | grep -q "this project's own runtime holds :$B11" && ok "names its own runtime on :$B11" || bad "own holder not named" "$OUT"
+
+echo "== T11b: live record, but ANOTHER checkout's runtime holds the app port -> still blocked, exit 4 =="
+P="$(mkproj t11b root)"
+srv F11 F11PID boot -jar "$JAR" "$WORK/other/deployment"
+handshake "$P" "$LOOP11"
+sed -i.bak "s/^  \"appPort\": [0-9]*/  \"appPort\": $F11/; s/^  \"adminPort\": [0-9]*/  \"adminPort\": 1/" "$P/.mxcli/run-local.json"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 4 ] && printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED — :$F11" && ok "foreign runtime still blocks (exit 4)" || bad "rc=$RC, want 4" "$OUT"
+
+echo "== T12 (#262 follow-up): dead record, a booting runtime on THIS deployment dir holds the port -> exit 1 =="
+P="$(mkproj t12 root)"; mkdir -p "$P/deployment"
+srv B12 B12PID boot -jar "$JAR" "$P/deployment"
+handshake "$P" "$DEAD_PID"
+sed -i.bak "s/^  \"appPort\": [0-9]*/  \"appPort\": $B12/; s/^  \"adminPort\": [0-9]*/  \"adminPort\": 1/" "$P/.mxcli/run-local.json"
+OUT="$(run "$P")"; RC=$?
+[ "$RC" -eq 1 ] && ! printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && ok "exit 1, not blocked" || bad "rc=$RC, want 1 and not blocked" "$OUT"
+
+echo "== T13 (#262 follow-up): --no-docker, no record, Studio Pro booting THIS project on the port -> exit 1 =="
+P="$(mkproj t13 root)"; mkdir -p "$P/deployment"
+srv B13 B13PID boot -jar "$JAR" "$P/deployment"
+printf 'RUN_LOCAL_APP_PORT=%s\nRUN_LOCAL_ADMIN_PORT=1\n' "$B13" >> "$P/.claude/loop/stack.conf"
+OUT="$(cd "$P" && bash bin/test-stack-up.sh --no-docker 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "own runtime holds its port" && ok "exit 1, says its own runtime is booting" || bad "rc=$RC, want 1" "$OUT"
+kill -0 "$B13PID" 2>/dev/null && ok "own runtime untouched" || bad "own runtime killed"
+fi
+
+echo "== T14 (#278): tracked test processes — only this project's own record, only stale ones =="
+P="$(mkproj t14 root)"
+( sleep 600 & wait ) & OLDRUN=$!; PIDS="$PIDS $OLDRUN"
+sleep 0.2; OLDKID="$(pgrep -P "$OLDRUN" | head -1)"; PIDS="$PIDS $OLDKID"   # portability-ok: fixture, by parent pid
+sleep 600 & YOUNG=$!; PIDS="$PIDS $YOUNG"
+sleep 600 & REUSED=$!; PIDS="$PIDS $REUSED"
+bash -c "exec -a 'node journey-runner.js' sleep 600" & DECOY14=$!; PIDS="$PIDS $DECOY14"
+( cd "$P" && bash bin/test-stack-up.sh --track "$OLDRUN" journey-runner ) >/dev/null 2>&1 && ok "--track records a live pid" || bad "--track failed"
+( cd "$P" && bash bin/test-stack-up.sh --track "$YOUNG" monitor ) >/dev/null 2>&1
+( cd "$P" && bash bin/test-stack-up.sh --track "$DEAD_PID" gone ) >/dev/null 2>&1 && bad "--track accepted a dead pid" || ok "--track refuses a dead pid"
+BG="$P/.claude/loop/bg-pids.tsv"
+# Age the first line; a REUSED pid: recorded start time differs from the running process's.
+sed -i.bak "s/^$OLDRUN	[0-9]*	/$OLDRUN	1000000000	/" "$BG"
+printf '%s\t1000000000\tThu Jan 1 00:00:00 1970\treused\n%s\t1000000000\tx\tdead\n' "$REUSED" "$DEAD_PID" >> "$BG"
+OUT="$(run "$P")"
+printf '%s' "$OUT" | grep -q "pid $OLDRUN — journey-runner" && ok "--check lists the stale own process" || bad "stale process not listed" "$OUT"
+printf '%s' "$OUT" | grep -qE "pid ($YOUNG|$REUSED|$DECOY14) " && bad "listed a young/reused/untracked pid" "$OUT" || ok "young, reused and untracked pids not listed"
+printf '%s' "$OUT" | grep -q -- "--reap" && ok "names the --reap command" || bad "no remedy named" "$OUT"
+[ "$(wc -l < "$BG" | tr -d ' ')" = 4 ] && ok "--check left the record unchanged" || bad "--check wrote the record"
+OUT="$(cd "$P" && bash bin/test-stack-up.sh --reap 2>&1)"; RC=$?
+sleep 0.5
+[ "$RC" -eq 0 ] && ok "--reap exits 0" || bad "--reap rc=$RC" "$OUT"
+kill -0 "$OLDRUN" 2>/dev/null && bad "stale tracked pid survived --reap" || ok "stale tracked pid stopped"
+# The child is reparented once its parent dies; until init reaps it, kill -0 sees a zombie.
+kid_alive() { kill -0 "$1" 2>/dev/null || return 1; [ "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" != Z ]; }
+[ -n "$OLDKID" ] || bad "[setup] the tracked process had no child"
+kid_alive "$OLDKID" && bad "its child survived" || ok "  and its child"
+kill -0 "$YOUNG" 2>/dev/null && ok "young tracked pid untouched" || bad "young pid killed"
+kill -0 "$REUSED" 2>/dev/null && ok "reused pid (start time mismatch) untouched" || bad "reused pid killed"
+kill -0 "$DECOY14" 2>/dev/null && ok "untracked look-alike untouched" || bad "untracked process killed"
+[ "$(cut -f1 "$BG" | tr '\n' ' ')" = "$YOUNG " ] && ok "record pruned to the live entry" || bad "record not pruned" "$(cat "$BG")"
+
 echo
 echo "stack-up-local: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]

From 456fe738f1875f87ec271a8e3bba8bf8ea055a7c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:02:51 +0000
Subject: [PATCH 29/68] Revert FIRST-SEEN (5432345): unsafe as built, redesign
 in a separate PR

Review put #308 on hold over it: the legacy fallback compares .star mtimes, which checkout,
sync and the #264 remedy all refresh, so real rises (bundled SEC004-SEC009 included) passed
rc 0; and even with star_rules a first-seen rule stayed rc 0 at any count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                             |   1 -
 project-bin/exec.sh                      |  10 +--
 project-bin/lint-gate.sh                 |  56 ++----------
 tests/wave2/test-lint-gate-first-seen.sh | 103 -----------------------
 4 files changed, 7 insertions(+), 163 deletions(-)
 delete mode 100755 tests/wave2/test-lint-gate-first-seen.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9509a509..7c0a17a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,6 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(lint-gate): **a Starlark rule installed after the baseline is reported as FIRST-SEEN, not as a rise** ([#305](https://github.com/MendixMau/mxcli-project-toolkit/pull/305) review). A rule sync installs has no baseline count, so its first hit compared against 0: every exec logged `LINT ROSE` and exited 1 until someone re-baselined, and the Lint Batch 3 rules fire on ordinary text (TBD, XXX, v1.2, "12 Oct 2026"). Now a `.star` rule (`RULE_ID = "..."` in `.claude/lint-rules/`) that the baseline did not know prints `FIRST-SEEN <rule> N finding(s) — new rule, first seen: review and re-baseline with --reason`, exits 0 (verdict `PASS-FIRST-SEEN`, exec.sh row `FIRST-SEEN: <rule> (N)`), and is an ordinary ratcheted rule after the next `--update-baseline --reason`. `--update-baseline` now records `star_rules`; for an older baseline the `.star` file being newer than it decides. Built-in rules and `.star` rules known at baseline with zero findings still rise. Fixture `tests/wave2/test-lint-gate-first-seen.sh`: 17/17 here, 8 fail on master's lint-gate. — MendixMau (review of #305)
 - fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the printed remedy always clears it, `bin/lib/install-lint-rules.sh` now restores a rule whose receipt row exists and whose header is gone even when its stock hash is not in `STOCK-HASHES.txt` (an mxcli upgrade, then init; it was reported LOCALLY MODIFIED and never written), prunes receipt rows for rules no longer shipped, and honours a new `.claude/lint-rules-disabled.txt` opt-out that lint-gate also reads (`lint-rules/README.md` told projects to delete txt002, which would now read as a re-seed). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 38/38 here, 21 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 09043ac9..a84446de 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -753,15 +753,7 @@ run_lint_gate() {
   LINT_RC=0
   bash "$PROJECT_ROOT/bin/lint-gate.sh" >"$_lo" 2>&1 || LINT_RC=$?
   case "$LINT_RC" in
-    0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline"
-       # A rule installed after the baseline is FIRST-SEEN, not a rise (#305 review): say it on
-       # the row, so the count is reviewed and re-baselined rather than found later.
-       _new=$(grep -E '^ +FIRST-SEEN [A-Z][A-Z0-9-]*[0-9]+ ' "$_lo" | awk '{printf "%s%s (%s)", (n++?", ":""), $2, $4}')
-       if [ -n "$_new" ]; then
-         LINT_DETAIL="lint unchanged vs baseline; FIRST-SEEN: $_new — review, re-baseline with --reason"
-         echo "  ⚠ lint: new rule(s) first seen, not counted as a rise: $_new"
-         echo "    Review the findings, then: bin/lint-gate.sh --update-baseline --reason \"<why>\""
-       fi ;;
+    0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline" ;;
     1) # Rule ids are matched as [A-Z][A-Z0-9-]*[0-9]+, not [A-Z]+[0-9]+: mxcli's built-in
        # rules include hyphenated ids (MDL-FLOW01), and the old pattern dropped them from every
        # row — three field apps logged 475 ROSE rows and not one named MDL-FLOW01 (2026-10-12).
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index f761fe0e..eca387c1 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -18,8 +18,7 @@
 #       --approved-in-chat              # ALSO required when a security-tier rule rises
 #   bin/lint-gate.sh --full             # ignore the vendor exclusion (rarely useful)
 #
-# Exit codes: 0 clean, unchanged, or only FIRST-SEEN rules (a .star rule installed after the
-#             baseline: reported, not a rise — #305 review) · 1 a rule increased, or BLIND (a rule inspected nothing,
+# Exit codes: 0 clean or unchanged · 1 a rule increased, or BLIND (a rule inspected nothing,
 #             or the toolkit rules reverted to stock — see below) · 2 could not run (or a
 #             refused update)
 #
@@ -131,7 +130,7 @@ while [ $# -gt 0 ]; do
               REASON="$2"; shift ;;
     --reason=*) REASON="${1#--reason=}" ;;
     --approved-in-chat) APPROVED=1 ;;
-    -h|--help) sed -n '2,63p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,62p' "$0"; exit 0 ;;
     *) echo "lint-gate: unknown argument '$1'" >&2; exit 2 ;;
   esac
   shift
@@ -309,28 +308,6 @@ except (ValueError, IndexError):
     sys.exit(2)
 
 viol = data.get("violations") or []
-
-# FIRST-SEEN (#305 review). A rule sync-project.sh installs AFTER the baseline was taken has no
-# baseline count, so it compared against 0 and its first hit was a "rise": every exec logged
-# LINT ROSE and exited 1 until someone re-baselined (Lint Batch 3's TXT001/TXT002 fire on TBD,
-# XXX, v1.2, "12 Oct 2026"). A rule absent from the baseline counts is FIRST-SEEN, not a rise,
-# when it is a Starlark rule in .claude/lint-rules/ (`RULE_ID = "..."`) that the baseline did not
-# know: listed in neither its counts nor its `star_rules` (written by --update-baseline from now
-# on); for an older baseline without `star_rules`, its .star file is newer than the baseline.
-# Built-in mxcli rules are never first-seen: a baseline omits a rule with zero findings, so
-# "absent" there means "was clean" and a hit is a real rise.
-import re, glob
-def star_rules():
-    out = {}
-    rdir = os.path.join(os.path.dirname(base_path), "lint-rules")
-    for f in glob.glob(os.path.join(rdir, "*.star")):
-        try:
-            m = re.search(r'^RULE_ID\s*=\s*"([^"]+)"', open(f, encoding="utf-8", errors="replace").read(), re.M)
-        except OSError:
-            continue
-        if m:
-            out[m.group(1)] = os.path.getmtime(f)
-    return out
 counts = collections.Counter(v["ruleId"] for v in viol)
 sev    = {v["ruleId"]: v["severity"] for v in viol}
 
@@ -420,7 +397,6 @@ if update:
             sys.exit(2)
     json.dump({"counts": dict(sorted(counts.items())),
                "total": len(viol),
-               "star_rules": sorted(star_rules()),
                "note": "Per-rule finding counts on OUR modules. Gate fails when any rises."},
               open(base_path, "w"), indent=2)
     open(base_path, "a").write("\n")
@@ -436,22 +412,11 @@ if not os.path.exists(base_path):
     write_last("ERROR-NO-BASELINE", viol, counts)
     sys.exit(2)
 
-base_doc = json.load(open(base_path))
-base = base_doc.get("counts", {})
-known = base_doc.get("star_rules")
-stars = star_rules()
-base_mtime = os.path.getmtime(base_path)
-def first_seen(r):
-    if r in base or r not in stars:
-        return False
-    if known is not None:
-        return r not in known
-    return stars[r] > base_mtime
-rose, fell, new = [], [], []
+base = json.load(open(base_path)).get("counts", {})
+rose, fell = [], []
 for r in sorted(set(counts) | set(base)):
     now, was = counts.get(r, 0), base.get(r, 0)
-    if now > was and first_seen(r): new.append((r, now))
-    elif now > was: rose.append((r, was, now))
+    if now > was: rose.append((r, was, now))
     elif now < was: fell.append((r, was, now))
 
 print("==> %d findings on our modules (baseline %d)" % (len(viol), sum(base.values())))
@@ -488,20 +453,11 @@ if collapsed:
     write_last("FAIL-COLLAPSE", viol, counts)
     sys.exit(1)
 
-if new:
-    print("\n!! NEW RULE(S), FIRST SEEN — not in the baseline, so not counted as a rise:")
-    for r, now in new:
-        print("   FIRST-SEEN %-8s %-8s %d finding(s) — new rule, first seen: review and re-baseline with --reason"
-              % (r, sev.get(r, "?"), now))
-        for v in [x for x in viol if x["ruleId"] == r][:3]:
-            print("        %s | %s" % (v.get("module") or "(project)", v["message"][:120]))
-    print("   Review them, then: bin/lint-gate.sh --update-baseline --reason \"<why these are accepted>\"")
-
 if not rose:
     print("\nPASS — nothing got worse.")
     if fell:
         print("       %d rule(s) improved. Run --update-baseline to lock the gain in." % len(fell))
-    write_last("PASS-BLIND" if blind else ("PASS-FIRST-SEEN" if new else "PASS"), viol, counts)
+    write_last("PASS-BLIND" if blind else "PASS", viol, counts)
     sys.exit(1 if blind else 0)
 
 print("\nFAIL — %d rule(s) got worse:\n" % len(rose))
diff --git a/tests/wave2/test-lint-gate-first-seen.sh b/tests/wave2/test-lint-gate-first-seen.sh
deleted file mode 100755
index 1142841e..00000000
--- a/tests/wave2/test-lint-gate-first-seen.sh
+++ /dev/null
@@ -1,103 +0,0 @@
-#!/usr/bin/env bash
-# Fixture for project-bin/lint-gate.sh FIRST-SEEN handling and exec.sh's row for it.
-#
-# Usage: bash test-lint-gate-first-seen.sh [path-to-lint-gate.sh]
-#
-# Review of #305 (Lint Batch 3), 2026-10-13: a rule sync-project.sh installs after the baseline
-# has no baseline count, so lint-gate compared it against 0 and its first hit was a "rise" —
-# every exec logged LINT ROSE and exited 1 until someone re-baselined, and TXT001/TXT002 fire on
-# ordinary text (TBD, XXX, v1.2, "12 Oct 2026"). Now such a rule is FIRST-SEEN: reported, rc 0.
-#
-# Rules under test are the toolkit's real .star files (their `RULE_ID = "..."` line is what
-# lint-gate reads). Lint output goes through LINT_JSON, using the key set of a real
-# `mxcli lint --format json` capture (same builder as test-lint-gate-accept.sh). No mxcli/.mpr.
-set -uo pipefail
-TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-GATE="${1:-$TK/project-bin/lint-gate.sh}"
-EXEC="$TK/project-bin/exec.sh"
-. "$TK/bin/lib/portable.sh"
-require_py
-WORK="$(mktemp -d "${TMPDIR:-/tmp}/lint-first-seen.XXXXXX")"
-trap 'rm -rf "$WORK"' EXIT
-PASS=0; FAIL=0
-ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
-bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
-
-P="$WORK/proj"; mkdir -p "$P/bin" "$P/.claude/lint-rules"
-cp "$GATE" "$P/bin/lint-gate.sh"; [ -f "$TK/project-bin/_common.sh" ] && cp "$TK/project-bin/_common.sh" "$P/bin/"
-printf 'mpr' > "$P/App.mpr"; printf '#!/bin/sh\nexit 0\n' > "$P/mxcli"; chmod +x "$P/mxcli" "$P/bin/lint-gate.sh"
-R="$P/.claude/lint-rules"
-cp "$TK/lint-rules/conv010_act_microflow_content.star" "$TK/lint-rules/ux001_confirm_before_destructive.star" "$R/"
-
-v() { i=0; while [ "$i" -lt "$3" ]; do
-  printf '{"ruleId":"%s","severity":"%s","message":"finding %s","module":"Orders","document":"Doc%s","documentType":"microflow","documentId":"id-%s-%s","suggestion":"s"},' \
-    "$1" "$2" "$i" "$i" "$1" "$i"; i=$((i+1)); done; }
-mk() { printf '{"violations":[%s{"ruleId":"MPR001","severity":"warning","message":"m","module":"Orders","document":"E","documentType":"entity","documentId":"x","suggestion":"s"}],"summary":{}}' "$1" > "$WORK/lint.json"; }
-gate() { (cd "$P" && LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh "$@"); }
-fn="$WORK/run_lint_gate.sh"; sed -n '/^run_lint_gate() {/,/^}/p' "$EXEC" > "$fn"
-exec_detail() { (cd "$P" && PROJECT_ROOT="$P" LINT_JSON="$WORK/lint.json" bash -c ". '$fn'; LINT_RC=0; run_lint_gate >/dev/null; echo \"\$LINT_RC|\$LINT_DETAIL\""); }
-verdict() { "$PY" -c 'import json,sys;print(json.load(open(sys.argv[1]))["verdict"])' "$P/.claude/loop/lint-last.json"; }
-
-echo "F0 baseline before the new rule is installed (UX001 installed, zero findings)"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)"
-out=$(gate --update-baseline 2>&1); rc=$?
-[ "$rc" -eq 0 ] && ok "baseline written" || bad "rc=$rc" "$out"
-"$PY" -c 'import json,sys;d=json.load(open(sys.argv[1]));sys.exit(0 if d.get("star_rules")==["CONV010","UX001"] else 1)' "$P/.claude/lint-baseline.json" \
-  && ok "baseline records star_rules [CONV010, UX001]" || bad "star_rules wrong" "$(cat "$P/.claude/lint-baseline.json")"
-
-echo "F1 sync installs TXT001; its findings are FIRST-SEEN, rc 0"
-cp "$TK/lint-rules/txt001_build_words_in_user_text.star" "$R/"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 5)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 0 ] && ok "rc 0" || bad "first-seen rule treated as a failure (rc $rc)" "$out"
-case "$out" in *"FIRST-SEEN TXT001"*"5 finding(s) — new rule, first seen: review and re-baseline with --reason"*) ok "first-seen line names TXT001 and its count" ;; *) bad "no first-seen line" "$out" ;; esac
-case "$out" in *"FAIL —"*) bad "reported as a rise" "$out" ;; *) ok "not reported as a rise" ;; esac
-[ "$(verdict)" = PASS-FIRST-SEEN ] && ok "lint-last verdict PASS-FIRST-SEEN" || bad "verdict $(verdict)"
-d=$(exec_detail)
-case "$d" in "0|lint unchanged vs baseline; FIRST-SEEN: TXT001 (5)"*) ok "exec row: ${d#*|}" ;; *) bad "exec row does not carry FIRST-SEEN" "$d" ;; esac
-
-echo "F2 an existing rule rising next to it is still a rise"
-mk "$(v CONV010 warning 6)$(v CONV009 info 2)$(v TXT001 info 5)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 1 ] && ok "rc 1" || bad "rc=$rc" "$out"
-case "$out" in *"CONV010  warning  4 -> 6"*) ok "CONV010 4 -> 6 reported" ;; *) bad "rise missing" "$out" ;; esac
-case "$(printf '%s\n' "$out" | sed -n '/^FAIL/,$p')" in *TXT001*) bad "TXT001 listed among the rises" "$out" ;; *) ok "TXT001 not listed as a rise" ;; esac
-
-echo "F3 a built-in rule absent from the baseline (was clean) is a rise, not first-seen"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v MDL001 info 1)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 1 ] && case "$out" in *"MDL001"*"0 -> 1"*) true ;; *) false ;; esac && ok "MDL001 0 -> 1 is a rise" || bad "built-in hit not a rise (rc $rc)" "$out"
-
-echo "F4 a .star rule known at baseline with zero findings is a rise when it fires"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v UX001 warning 1)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 1 ] && case "$out" in *"UX001"*"0 -> 1"*) true ;; *) false ;; esac && ok "UX001 0 -> 1 is a rise" || bad "known clean rule not ratcheted (rc $rc)" "$out"
-
-echo "F5 re-baselining a first-seen rule needs --reason; afterwards it is a normal rule"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 5)"
-out=$(gate --update-baseline 2>&1); rc=$?
-[ "$rc" -eq 2 ] && ok "refused without --reason" || bad "accepted without a reason (rc $rc)" "$out"
-out=$(gate --update-baseline --reason "TXT001 reviewed: 5 placeholder labels, fixed in slice 4" 2>&1); rc=$?
-[ "$rc" -eq 0 ] && ok "accepted with --reason" || bad "rc=$rc" "$out"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 7)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 1 ] && case "$out" in *"TXT001"*"5 -> 7"*) true ;; *) false ;; esac && ok "TXT001 5 -> 7 is now a rise" || bad "baselined rule not ratcheted (rc $rc)" "$out"
-
-echo "F6 a baseline written before star_rules existed: file mtime decides"
-"$PY" - "$P/.claude/lint-baseline.json" <<'PY'
-import json,sys
-d=json.load(open(sys.argv[1])); d.pop("star_rules",None); d["counts"].pop("TXT001",None)
-json.dump(d,open(sys.argv[1],"w"))
-PY
-"$PY" -c 'import os,sys,time;t=time.time();os.utime(sys.argv[1],(t-3600,t-3600));os.utime(sys.argv[2],(t-60,t-60));os.utime(sys.argv[3],(t-7200,t-7200))' \
-  "$P/.claude/lint-baseline.json" "$R/txt001_build_words_in_user_text.star" "$R/ux001_confirm_before_destructive.star"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v TXT001 info 3)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 0 ] && case "$out" in *"FIRST-SEEN TXT001"*) true ;; *) false ;; esac && ok "star newer than baseline -> first-seen" || bad "legacy newer star not first-seen (rc $rc)" "$out"
-mk "$(v CONV010 warning 4)$(v CONV009 info 2)$(v UX001 warning 1)"
-out=$(gate 2>&1); rc=$?
-[ "$rc" -eq 1 ] && ok "star older than baseline -> rise" || bad "legacy older star not ratcheted (rc $rc)" "$out"
-
-echo ""
-echo "PASS=$PASS FAIL=$FAIL"
-[ "$FAIL" -eq 0 ]

From 333d4353a2be21afb34d016ea197a239eb2bcf95 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:03:05 +0000
Subject: [PATCH 30/68] Guard against a leftover mxcli test injection; verify
 app-restart's pid; serialise test-scratch takeovers; lint-a-copy recipe

#244 (BUG-157): test-scratch.sh and app-restart.sh read AfterStartupMicroflow from the
settings unit's bytes (no mxcli) and refuse to start while it is MxTest.RegisterEndpoint
or MxTest.TestRunner, printing the git / alter-settings / Studio Pro repair with HEAD's
value. app-restart lets a live --test-endpoint app through and re-checks after the stop
(new exit 5). Golden: a settings unit captured from mxcli's own test model, re-encoded
byte-faithfully per case. Second field case credited to AlvinnYeo (PR #309 inbox note).

Review of #304: app-restart verifies the recorded pid is itself an mxcli run before
stopping (a reused pid with --cmd was killed); test-scratch's stale-lock takeover is
serialised by an O_EXCL .takeover marker and re-read, restored with ln, not mv -f.

#240 (BUG-158): skills/lint-that-actually-runs.md gains the copy-the-rules-first recipe
and the rule-count comparison before any diff.

Refs #244 #240

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   4 +
 bug-logs/mxcli-bugs.md                        |  72 +++++++++++
 project-bin/app-restart.sh                    | 119 +++++++++++++++++-
 project-bin/test-scratch.sh                   | 105 +++++++++++++++-
 skills/lint-that-actually-runs.md             |  46 +++++++
 .../mxtest-guard/set-after-startup.js         |  34 +++++
 .../mxtest-guard/settings-unit.mxunit         | Bin 0 -> 2684 bytes
 tests/wave2/test-app-restart.sh               |  64 +++++++++-
 tests/wave2/test-test-scratch.sh              |  68 ++++++++++
 9 files changed, 503 insertions(+), 9 deletions(-)
 create mode 100644 tests/wave2/fixtures/mxtest-guard/set-after-startup.js
 create mode 100644 tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..f514aba5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,10 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(test-scratch, app-restart): **both refuse to start on a model whose after-startup is still an mxcli test injection (`MxTest.RegisterEndpoint` / `MxTest.TestRunner`), and print the repair** ([#244](https://github.com/MendixMau/mxcli-project-toolkit/issues/244), BUG-157). A `mxcli test` or `run --test-endpoint` stopped by a signal skips its restore, and the next injection chains `RegisterEndpoint` to itself: StackOverflowError, app down. It happened twice in one day on one machine, and again on a second project. The setting is read from the settings unit's bytes, so no mxcli is needed. The fixture uses a settings unit captured from mxcli's own test model. `test-scratch.sh` exits 3 before copying. `app-restart.sh` exits 3 before stopping, except for a live `--test-endpoint` app, which holds the injection legitimately; if stopping that app leaves the setting behind, it exits 5 (new): stopped, not started. Projects pick this up on sync; a clean model sees no change. — MendixMau, second case AlvinnYeo
+- fix(app-restart): **the recorded pid is verified to still be an `mxcli run` before anything is stopped** (review of #304). With `--cmd` / `MXTK_APP_START_CMD`, the identity check read the override, not the process. A record left by a SIGKILL whose pid the OS had reused sent TERM/KILL to that unrelated process and its children. The pid's own command line (`/proc`, `ps`; on Windows the image name `mxcli.exe`) must now name mxcli and `run`. Otherwise the app counts as not running and the process is not touched. — MendixMau
+- fix(test-scratch): **taking over a stale lock is serialised, so two runs can no longer both hold it** (review of #304). The takeover holds an O_EXCL `<lock>.takeover` marker (cleared after 30s), re-reads the lock, and removes it only if it still holds the line judged stale. A changed lock is put back with `ln`, never `mv -f`. A deterministic replay of the race fails on the old code. — MendixMau
+- learn(lint-that-actually-runs): **lint a copy of the model only after copying `.claude/lint-rules` (and `lint-config.yaml`) beside it, and compare rule counts before diffing** ([#240](https://github.com/MendixMau/mxcli-project-toolkit/issues/240), BUG-158). A snapshot in `/tmp` gave 51 findings from 8 rules, against 721 from 29 for the project: no notice, exit 0. mxcli's source also shows `lint-config.yaml` is read only from beside the `.mpr`, so an in-repo snapshot loses it as well. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md
index 5bdcbc70..6e80b6e0 100644
--- a/bug-logs/mxcli-bugs.md
+++ b/bug-logs/mxcli-bugs.md
@@ -6851,3 +6851,75 @@ passes `mxcli check`, and `mx check` then fails with CE1613.
 
 **Workaround:** never treat `describe` output as a source to replay without an `mx check`; qualify
 the caption parameter (as BUG-23 / BUG-142 describe) before re-executing.
+
+## BUG-157: `mxcli test` / `run --test-endpoint` stopped by a signal leave AfterStartupMicroflow on `MxTest.RegisterEndpoint`; the next injection chains it to itself (StackOverflowError, the app never starts)
+
+**Severity:** High. An app goes down with no model change by the user, and the cause (a settings unit) is not where anyone looks.
+**mxcli version:** v0.25.0 (field). Same code in v0.26.0 source (`cmd/mxcli/testrunner`, `12ce281`). **Mendix version:** 11.15.0 and 11.14.0 Beta
+**Discovered:** 2026-10, three apps built side by side (#244): two hits in one day, one app down. A second field case on another project, 2026-10-13, reported by AlvinnYeo (open PR #309, inbox note)
+**Reproducible:** yes. Probe from the second report: start `mxcli run --local --test-endpoint` on a scratch copy, `kill -TERM` it, then `describe settings`. After-startup is still `MxTest.RegisterEndpoint` on v0.25.0.
+**Not filed upstream** (draft prepared, issue #244)
+
+**How it happens.** `mxcli test` and `run --test-endpoint` read the current after-startup
+microflow, generate `MxTest.RegisterEndpoint` (plain `mxcli test`: `MxTest.TestRunner`) that calls
+it after registering the endpoint, and point after-startup at the generated flow. Only a clean exit
+runs the restore (`ALTER SETTINGS RUNTIME (AfterStartupMicroflow: '<original>')`). A run stopped by
+a signal (an agent's background-task stop, a kill) skips it. The setting stays on the injected flow
+in the on-disk model, where every other mxcli process sees it. The next injection then reads
+`MxTest.RegisterEndpoint` as "the original" and generates a flow that calls itself:
+
+```
+ERROR - Core: An exception occurred while running the after-startup-action.
+com.mendix.modules.microflowengine.MicroflowException: java.lang.StackOverflowError
+    at MxTest.RegisterEndpoint (SubMicroflow : 'RegisterEndpoint')
+    at MxTest.RegisterEndpoint (SubMicroflow : 'RegisterEndpoint')
+ERROR - M2EE: Starting Mendix Runtime failed.
+```
+
+A partial clean-up makes it worse. If the `MxTest` module is removed but the setting is not, the
+after-startup names a flow that does not exist: CE1613 at build, which `exec.sh`'s delta gate then
+carries as a "pre-existing" error on every later script.
+
+**Toolkit guard (#244).** `project-bin/test-scratch.sh` and `project-bin/app-restart.sh` read the
+setting from the model bytes before starting. The setting is the BSON string `AfterStartupMicroflow`
+in the project-settings unit (`mprcontents/4e/70/4e70063d-….mxunit`, or inside a v1 `.mpr`). This
+needs no mxcli. When the value is `MxTest.RegisterEndpoint` or `MxTest.TestRunner`, both scripts
+refuse and print the repair. `app-restart.sh` lets a live `--test-endpoint` app through, because it
+holds the injection legitimately, and checks again after the stop.
+
+**Repair** (any one of):
+- `git checkout -- mprcontents/4e/70/<settings unit>`, then `git status`: the run may also have left an `MxTest` module.
+- Through `./bin/exec.sh` (an `ALTER SETTINGS`, so say so in chat; it is the statement mxcli's own cleanup runs, and it was field-proven on v0.25.0):
+  `mdl 1;` `alter settings runtime (AfterStartupMicroflow: 'MyModule.ASU_Startup');` (`''` for none).
+- Studio Pro: App Settings → Runtime → After startup.
+
+**Avoid it:** stop `run --test-endpoint` with Ctrl+C in its own terminal. Never kill it or stop it
+as a background task. Afterwards `git status` on the model must show the Settings unit unchanged.
+
+## BUG-158: `mxcli lint` on a copy of the model outside the repository silently drops the project's Starlark rules (8 of 29 rules ran, no notice, exit 0)
+
+**Severity:** Medium. The result is wrong, not refused: a before/after diff over it is off by hundreds.
+**mxcli version:** v0.25.0 (field). Discovery code unchanged in v0.26.0 source (`mdl/linter/lintrules_discovery.go`, `12ce281`)
+**Discovered:** 2026-10, attributing a lint ratchet rise to one script by linting the pre-exec snapshot copied to `/tmp` (#240)
+**Reproducible:** yes. Copy the `.mpr` + `mprcontents/` to a folder outside the repository and lint it.
+**Not filed upstream** (draft prepared, issue #240)
+
+`mxcli lint -p /tmp/pre/App.mpr --format json` gave **51 findings across 8 rules**. The same model
+in the project folder gave **721 across 29**. The 21 missing rules are the Starlark rules in
+`.claude/lint-rules/`. Discovery walks up from the `.mpr`'s folder and stops at a `.git`, so a
+copy outside the repository finds none. Only the built-in rules ran (MPR\*, CONV013, SEC003,
+MDL-FLOW01), with no notice and exit 0. The "no `.claude/lint-rules/` directory was found" line
+exists in the source, but it prints only when `--rules` names an unknown id.
+
+Two related findings from reading the v0.26.0 source (not field-run):
+- `lint-config.yaml` is read only from beside the `.mpr` (`FindConfigFile`), never from above it.
+  A snapshot inside the repository finds the rules by walking up but loses the config's module
+  excludes and rule overrides.
+- With no `.git` above it, the walk continues to `/`. A stray `~/.claude/lint-rules` would then
+  supply rules to the copy.
+
+**Workaround (worked in the field):** `cp -R .claude/lint-rules <copy>/.claude/` (plus
+`.claude/lint-config.yaml`) before linting. The copy then gave 721 findings across 29 rules,
+matching the project. Recipe and the rule-set comparison to run before any diff:
+`skills/lint-that-actually-runs.md` → "Linting a copy of the model". `lint-gate.sh`'s collapse
+guard catches this inside the gate. Nothing catches it when lint is run directly.
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index b18ffe19..c9529a51 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -7,9 +7,12 @@
 #   ./bin/app-restart.sh --timeout <s>    readiness bound (default 240, MXTK_RESTART_TIMEOUT)
 #
 # Exit: 0 up and serving · 1 restarted but not proven up (timeout, no bundle) · 2 usage ·
-#       3 refused — nothing was stopped (no record, record belongs elsewhere, start command unknown) ·
+#       3 refused — nothing was stopped (no record, record belongs elsewhere, start command unknown,
+#         the model's after-startup left on an mxcli test injection — #244) ·
 #       4 instrument blocked — the app or admin port is held by a process this script did not record
 #         (named, with its pid; never stopped). A run summary records it as blocked, not as FAIL.
+#       5 stopped, not started — stopping a `run --test-endpoint` app left its after-startup on
+#         MxTest.RegisterEndpoint, and a start would recurse (#244; the repair is printed).
 #
 # WHY (#289 item 1, field run 2026-10-12). A 20-task UX-fix run over three apps, one lane per app:
 # implementers were told never to start or stop apps, because a broad kill in one lane had once
@@ -52,6 +55,12 @@
 # the admin port (record's adminPort, else app port + 10) must be free or held by the recorded
 # process tree; otherwise it exits 4 naming the holder (lsof / ss / netstat) and kills nothing.
 #
+# LEFTOVER TEST INJECTION (#244, BUG-157): `mxcli test` / `run --test-endpoint` stopped by a signal
+# leave the after-startup on MxTest.RegisterEndpoint, and the next start recurses (StackOverflowError)
+# or fails at CE1613. It is read from the model bytes (no mxcli) before anything is stopped — refused,
+# exit 3, unless the recorded app is a live --test-endpoint run, which holds it legitimately — and
+# again after the stop, before the start (exit 5). The repair is printed; this script never writes it.
+#
 # Never touches Studio Pro, the model, Docker, or another port. Docker stack: bin/test-stack-up.sh
 # --restart (scoped to this project's container). Bash 3.2 / Git Bash / macOS / Linux.
 set -uo pipefail
@@ -179,6 +188,65 @@ blocked() {
   exit 4
 }
 # in_our_tree <pid> — the recorded pid itself, or a descendant of it (the runtime mxcli started).
+# ── After-startup left on an mxcli test injection (#244, BUG-157) ───────────
+# `mxcli test` and `mxcli run --test-endpoint` point the model's after-startup microflow at
+# MxTest.RegisterEndpoint (MxTest.TestRunner for a plain test run) and chain the original; only a
+# clean exit puts it back. A run stopped by a signal leaves it, and the next injection then chains
+# RegisterEndpoint to itself: StackOverflowError in the after-startup, the runtime never starts.
+# Read straight from the model bytes — no mxcli, no running app: the setting is the BSON string
+# element "AfterStartupMicroflow" of the project-settings unit (mprcontents/**/*.mxunit; inside the
+# .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own test models).
+mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+  { if [ "$1" = - ]; then od -An -v -tx1; else od -An -v -tx1 "$1"; fi; } 2>/dev/null | awk '
+    BEGIN { for (i = 0; i < 256; i++) hv[sprintf("%02x", i)] = i
+            for (i = 32; i < 127; i++) { c = sprintf("%c", i); ch[sprintf("%02x", i)] = c; hx[c] = sprintf("%02x", i) }
+            s = "AfterStartupMicroflow"; T = length(s) + 2; t[1] = "02"; t[T] = "00"
+            for (i = 1; i <= length(s); i++) t[i + 1] = hx[substr(s, i, 1)]
+            k = 0; st = 0; found = 0 }
+    { for (f = 1; f <= NF; f++) { b = $f
+        if (st == 0) { if (b == t[k + 1]) k++; else k = (b == t[1]) ? 1 : 0
+                       if (k == T) { st = 1; L = 0; m = 1; n = 0; v = "" } }
+        else if (st == 1) { L += hv[b] * m; m *= 256
+                            if (++n == 4) { if (L < 1 || L > 1024) { st = 0; k = 0 } else if (L == 1) { found = 1; exit } else { st = 2; n = 0 } } }
+        else { if (++n < L) v = v ((b in ch) ? ch[b] : "?"); else { found = 1; exit } } } }
+    END { if (!found) exit 1; print v }'
+}
+MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+mxtest_left() {  # $1 = model dir, $2 = .mpr. 0 = after-startup is an mxcli test injection (sets MXTEST_*)
+  local unit val
+  MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+  if [ -d "$1/mprcontents" ]; then
+    unit="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null | head -1)"
+  else unit="$2"; fi
+  [ -n "$unit" ] && [ -f "$unit" ] || return 1
+  val="$(mxtest_after_startup "$unit")" || return 1
+  case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) return 1 ;; esac
+  MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
+  case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
+    MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
+  *) MXTEST_HEAD="?" ;; esac
+  return 0
+}
+mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stderr.
+  local was="$MXTEST_HEAD" rel="${MXTEST_UNIT#"$PROJECT_ROOT"/}"
+  echo "✗ $1: this model's after-startup microflow is $MXTEST_LEFT — left behind by an mxcli test or" >&2
+  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)." >&2
+  echo "  Starting on it recurses (the next injection chains $MXTEST_LEFT to itself: StackOverflowError)," >&2
+  echo "  or fails the build with CE1613 if the MxTest module is already gone. Either way the app never starts." >&2
+  echo "  set in: $rel" >&2
+  case "$was" in '?') was="<your own after-startup microflow, or '' for none>"
+                      echo "  HEAD: not readable (no git, or the unit is untracked)" >&2 ;;
+                 '')  echo "  HEAD: no after-startup microflow" >&2 ;;
+                 *)   echo "  HEAD: $was" >&2 ;; esac
+  echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
+  echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  echo "  → Otherwise restore it, then retry:" >&2
+  echo "      git checkout -- '$rel'      (then git status: the run may have left an MxTest module too)" >&2
+  echo "    or through ./bin/exec.sh (an ALTER SETTINGS — say so in chat; it is what mxcli's own cleanup runs):" >&2
+  echo "      mdl 1;" >&2
+  echo "      alter settings runtime (AfterStartupMicroflow: '$was');" >&2
+  echo "    or Studio Pro: App Settings → Runtime → After startup." >&2
+}
 in_our_tree() {
   local p="$1" i=0
   [ "$ALIVE" = 1 ] || return 1
@@ -207,7 +275,31 @@ if [ "$HS_REAL" != "$MPR_REAL" ] && [ "$HS_REAL" != "$MPR_TARGET" ] \
     "record:  $HS_PROJECT" "this:    $MPR_TARGET" \
     "A copied project carries the original's record; stopping its pid would stop someone else's app."
 fi
-ALIVE=0; pid_alive "$PID" && ALIVE=1
+# The recorded pid must still BE an mxcli run (#304 review). A SIGKILLed mxcli leaves its record
+# behind, and the OS hands its pid to an unrelated process; `kill -0` cannot tell the difference,
+# and the start-command check below cannot either when --cmd / MXTK_APP_START_CMD supplies the
+# command — so without this a stale record plus a reused pid sent TERM/KILL to that process and
+# its children. Checked on the pid itself, whichever way the start command is learned: its
+# command line (/proc/<pid>/cmdline, else `ps -o args=`) names mxcli and `run`; on Windows the
+# image name is mxcli.exe. Anything else is treated as not running: never stopped, and if it
+# holds one of the ports the port check below names it and stops.
+pid_is_mxcli_run() {
+  local a=""
+  if [ "$(mxtk_platform)" = windows ]; then
+    a="$(tasklist //FI "PID eq $1" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)"
+    case "$(printf '%s' "$a" | tr '[:upper:]' '[:lower:]')" in mxcli.exe|mxcli) return 0 ;; esac
+    return 1
+  fi
+  if [ -r "/proc/$1/cmdline" ]; then a="$(tr '\0' ' ' < "/proc/$1/cmdline" 2>/dev/null)"
+  else a="$(ps -o args= -p "$1" 2>/dev/null)"; fi
+  case " $a " in *mxcli*" run "*) return 0 ;; esac
+  return 1
+}
+ALIVE=0
+if pid_alive "$PID"; then
+  if pid_is_mxcli_run "$PID"; then ALIVE=1
+  else echo "  ! recorded pid $PID is alive but is not an mxcli run (the pid was reused after the app died) — treating the app as not running; that process is not touched"; fi
+fi
 ADMIN_PORT="$(hs_num adminPort "$HS")"; [ -n "$ADMIN_PORT" ] || ADMIN_PORT=$((PORT + 10))
 
 # ── 2. How it was started ───────────────────────────────────────────────────
@@ -241,6 +333,19 @@ case " ${ARGV[*]} " in
        "This script restarts only that; it will not start anything else." ;;
 esac
 
+
+# ── 2a. The model must not carry a leftover mxcli test injection (#244) ─────
+# A live `run --test-endpoint` legitimately holds the injection while it runs; its stop is supposed
+# to restore it, which 3b re-checks before anything starts. In every other case the start would
+# recurse in the after-startup, so refuse before stopping anything.
+LIVE_ENDPOINT=0
+if [ "$ALIVE" = 1 ]; then case " ${ARGV[*]} " in *" --test-endpoint "*|*" --test-endpoint="*) LIVE_ENDPOINT=1 ;; esac; fi
+if mxtest_left "$MODEL_DIR" "$MPR_TARGET" && [ "$LIVE_ENDPOINT" = 0 ]; then
+  mxtest_refusal "app-restart"
+  echo "  Nothing was stopped." >&2
+  exit 3
+fi
+
 echo "→ app-restart: $(basename "$MPR") on :$PORT"
 if [ "$ALIVE" = 1 ]; then echo "  stop:  pid $PID (from $HS) and its own child processes"
 else echo "  stop:  nothing — recorded pid $PID is not running"; fi
@@ -292,6 +397,16 @@ elif port_answers "$PORT"; then
   blocked "$PORT" "?|an unidentified process" "The recorded app was stopped; nothing was started"
 fi
 
+
+# ── 3b. Did the stop leave the test injection behind? (#244) ───────────────
+# A `run --test-endpoint` stopped by a signal can skip its restore; starting it again would chain
+# MxTest.RegisterEndpoint to itself. The app is down now — say so plainly, and start nothing.
+if mxtest_left "$MODEL_DIR" "$MPR_TARGET"; then
+  mxtest_refusal "app-restart"
+  echo "  The recorded app was stopped; nothing was started (exit 5)." >&2
+  exit 5
+fi
+
 # ── 4. Start it the same way, detached, and remember how ────────────────────
 LOG="${LOGDIR:-${TMPDIR:-/tmp}}/$(basename "$MPR" .mpr)-run-local.log"
 rm -f "$HS" 2>/dev/null || true   # a SIGKILLed mxcli leaves its record behind; the new one must be new
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index b45d134a..dc3055a6 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -23,6 +23,9 @@
 #      holder has it and taking over a dead one;
 #   4. runs `mxcli test <args> -p <scratch>.mpr` in the scratch dir, then releases both and deletes
 #      the copy (--keep leaves it, and says where).
+# Refused (exit 3, nothing copied) when the live model's after-startup is still an mxcli test injection
+# (MxTest.RegisterEndpoint / MxTest.TestRunner, left by a run stopped by a signal — #244, BUG-157):
+# the copy would carry it and the test runtime would recurse in its after-startup. The repair is printed.
 # --attach is refused: it hot-applies into the live app and runs against its database, which is
 # the opposite of a scratch run. Never touches the live model, the live app, or Studio Pro.
 # Bash 3.2 / Git Bash / macOS / Linux; no flock (absent on macOS and Git Bash).
@@ -57,6 +60,74 @@ elif [ -x "$MODEL_DIR/mxcli" ]; then MXCLI="$MODEL_DIR/mxcli"
 elif command -v mxcli >/dev/null 2>&1; then MXCLI="$(command -v mxcli)"
 else echo "✗ test-scratch: no mxcli (project root or PATH)." >&2; exit 3; fi
 
+# ── After-startup left on an mxcli test injection (#244, BUG-157) ───────────
+# `mxcli test` and `mxcli run --test-endpoint` point the model's after-startup microflow at
+# MxTest.RegisterEndpoint (MxTest.TestRunner for a plain test run) and chain the original; only a
+# clean exit puts it back. A run stopped by a signal leaves it, and the next injection then chains
+# RegisterEndpoint to itself: StackOverflowError in the after-startup, the runtime never starts.
+# Read straight from the model bytes — no mxcli, no running app: the setting is the BSON string
+# element "AfterStartupMicroflow" of the project-settings unit (mprcontents/**/*.mxunit; inside the
+# .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own test models).
+mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+  { if [ "$1" = - ]; then od -An -v -tx1; else od -An -v -tx1 "$1"; fi; } 2>/dev/null | awk '
+    BEGIN { for (i = 0; i < 256; i++) hv[sprintf("%02x", i)] = i
+            for (i = 32; i < 127; i++) { c = sprintf("%c", i); ch[sprintf("%02x", i)] = c; hx[c] = sprintf("%02x", i) }
+            s = "AfterStartupMicroflow"; T = length(s) + 2; t[1] = "02"; t[T] = "00"
+            for (i = 1; i <= length(s); i++) t[i + 1] = hx[substr(s, i, 1)]
+            k = 0; st = 0; found = 0 }
+    { for (f = 1; f <= NF; f++) { b = $f
+        if (st == 0) { if (b == t[k + 1]) k++; else k = (b == t[1]) ? 1 : 0
+                       if (k == T) { st = 1; L = 0; m = 1; n = 0; v = "" } }
+        else if (st == 1) { L += hv[b] * m; m *= 256
+                            if (++n == 4) { if (L < 1 || L > 1024) { st = 0; k = 0 } else if (L == 1) { found = 1; exit } else { st = 2; n = 0 } } }
+        else { if (++n < L) v = v ((b in ch) ? ch[b] : "?"); else { found = 1; exit } } } }
+    END { if (!found) exit 1; print v }'
+}
+MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+mxtest_left() {  # $1 = model dir, $2 = .mpr. 0 = after-startup is an mxcli test injection (sets MXTEST_*)
+  local unit val
+  MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+  if [ -d "$1/mprcontents" ]; then
+    unit="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null | head -1)"
+  else unit="$2"; fi
+  [ -n "$unit" ] && [ -f "$unit" ] || return 1
+  val="$(mxtest_after_startup "$unit")" || return 1
+  case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) return 1 ;; esac
+  MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
+  case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
+    MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
+  *) MXTEST_HEAD="?" ;; esac
+  return 0
+}
+mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stderr.
+  local was="$MXTEST_HEAD" rel="${MXTEST_UNIT#"$PROJECT_ROOT"/}"
+  echo "✗ $1: this model's after-startup microflow is $MXTEST_LEFT — left behind by an mxcli test or" >&2
+  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)." >&2
+  echo "  Starting on it recurses (the next injection chains $MXTEST_LEFT to itself: StackOverflowError)," >&2
+  echo "  or fails the build with CE1613 if the MxTest module is already gone. Either way the app never starts." >&2
+  echo "  set in: $rel" >&2
+  case "$was" in '?') was="<your own after-startup microflow, or '' for none>"
+                      echo "  HEAD: not readable (no git, or the unit is untracked)" >&2 ;;
+                 '')  echo "  HEAD: no after-startup microflow" >&2 ;;
+                 *)   echo "  HEAD: $was" >&2 ;; esac
+  echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
+  echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  echo "  → Otherwise restore it, then retry:" >&2
+  echo "      git checkout -- '$rel'      (then git status: the run may have left an MxTest module too)" >&2
+  echo "    or through ./bin/exec.sh (an ALTER SETTINGS — say so in chat; it is what mxcli's own cleanup runs):" >&2
+  echo "      mdl 1;" >&2
+  echo "      alter settings runtime (AfterStartupMicroflow: '$was');" >&2
+  echo "    or Studio Pro: App Settings → Runtime → After startup." >&2
+}
+
+# A model whose after-startup is an mxcli test injection must not be copied and tested: the copy
+# carries it, and mxcli test then chains the injection to itself (#244 observation 1).
+if mxtest_left "$MODEL_DIR" "$MODEL_DIR/$MPR_NAME"; then
+  mxtest_refusal "test-scratch"
+  echo "  Nothing was copied or run." >&2
+  exit 3
+fi
+
 # Same liveness rule as exec.sh's lock: alive, not a zombie, and (where ps can say) one of ours.
 holder_live() {
   [ -n "${1:-}" ] || return 1
@@ -67,9 +138,32 @@ holder_live() {
   case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
   return 1
 }
+# Taking over a stale lock is itself serialised (#304 review): two runs that both read the same
+# dead holder must not both remove "the stale lock" — the second would remove the lock the first
+# had just taken, and both would run. So a takeover first wins "$f.takeover" (noclobber: O_EXCL;
+# one older than 30s is a takeover that died midway and is cleared), re-reads the lock, and
+# removes it only if it still holds the stale line it judged. It moves the lock aside before
+# checking; a lock that changed in between is put back with `ln`, which refuses to overwrite,
+# never `mv -f`, which would clobber a lock taken meanwhile.
+take_over() {  # $1 = lock file, $2 = the stale line. 0 = handled (retry the take), 1 = another takeover runs
+  local f="$1" held="$2" t="$1.takeover" ts
+  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$t" ) 2>/dev/null; then
+    ts="$(cut -d' ' -f2 "$t" 2>/dev/null | head -1)"
+    case "$ts" in ''|*[!0-9]*) ;; *) [ $(( $(date +%s) - ts )) -gt 30 ] && rm -f "$t" ;; esac
+    return 1
+  fi
+  if [ "$(head -1 "$f" 2>/dev/null || true)" = "$held" ] && mv "$f" "$f.stale.$$" 2>/dev/null; then
+    if [ "$(head -1 "$f.stale.$$" 2>/dev/null || true)" != "$held" ]; then
+      ln "$f.stale.$$" "$f" 2>/dev/null || true   # not the line we judged: put it back, never over a newer one
+    fi
+    rm -f "$f.stale.$$"
+  fi
+  rm -f "$t"
+  return 0
+}
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
   local f="$1" held hpid i
-  for i in 1 2 3 4 5; do
+  for i in 1 2 3 4 5 6 7 8; do
     if ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "test-scratch.sh" > "$f" ) 2>/dev/null; then return 0; fi
     held="$(head -1 "$f" 2>/dev/null || true)"
     if [ -z "$held" ] && [ "$i" -lt 3 ]; then sleep 1; continue; fi
@@ -78,10 +172,13 @@ take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken,
       echo "✗ test-scratch: $2 is held by PID $hpid ($(printf '%s' "$held" | cut -d' ' -f3-)) — wait for it to finish." >&2
       return 1
     fi
-    echo "  (stale lock on $2 from PID ${hpid:-?}, not running — taking it over)"
-    mv -f "$f" "$f.stale.$$" 2>/dev/null && rm -f "$f.stale.$$"
+    if take_over "$f" "$held"; then
+      echo "  (stale lock on $2 from PID ${hpid:-?}, not running — taking it over)"
+    else
+      sleep 1   # another run is taking the same stale lock over; see who won
+    fi
   done
-  echo "✗ test-scratch: could not take the lock on $2 after 5 attempts." >&2; return 1
+  echo "✗ test-scratch: could not take the lock on $2 after 8 attempts." >&2; return 1
 }
 release() { local f="$1" own; own="$(head -1 "$f" 2>/dev/null || true)"; [ "${own%% *}" = "$$" ] && rm -f "$f"; return 0; }
 
diff --git a/skills/lint-that-actually-runs.md b/skills/lint-that-actually-runs.md
index 64b1b179..ba4d5b6a 100644
--- a/skills/lint-that-actually-runs.md
+++ b/skills/lint-that-actually-runs.md
@@ -153,6 +153,52 @@ Both were found by testing the gate, not by reading it:
    rules improved."* If the catalog is empty or the rules fail to load, every count drops to zero
    and the gate celebrates. Guard: a broad drop is a malfunction until proven otherwise.
 
+## Linting a copy of the model: copy the rules in first
+
+`mxcli lint` looks for the Starlark rules in `.claude/lint-rules/` from the `.mpr`'s folder
+upward, and stops at the repository root. A copy of the model **outside the repository** (a
+pre-exec snapshot copied to `/tmp` to attribute a ratchet rise, a scratch copy for a
+before/after diff) therefore lints with the built-in rules only. Nothing says so and the exit
+code is 0.
+
+Field run, v0.25.0, 2026-10 (BUG-158, #240). The same model gave:
+
+| Where the `.mpr` sat | Findings | Rules that ran |
+|---|---|---|
+| project folder | 721 | 29 |
+| copy in `/tmp`, no rules beside it | 51 | 8 (MPR\*, CONV013, SEC003, MDL-FLOW01) |
+
+A before/after diff over those two outputs reports 670 "new" findings that are not new.
+
+**Recipe.** Copy the rules and the lint config beside the copy, then lint it:
+
+```sh
+COPY=/tmp/pre                        # the folder that holds the copied App.mpr
+mkdir -p "$COPY/.claude" && cp -R .claude/lint-rules "$COPY/.claude/"
+[ -f .claude/lint-config.yaml ] && cp .claude/lint-config.yaml "$COPY/.claude/"
+./mxcli lint -p "$COPY/App.mpr" --format json > pre.json
+```
+
+**Before you diff two lint outputs, compare their rule sets.** Both runs must report the same
+number of distinct `ruleId`s (or the copy's set must be a subset you can explain), counted over
+the two files. If the copy shows only the built-in rules above, it did not load the project rules
+and the diff is meaningless. "51 findings" from a copy is not a result until its rule count
+matches.
+
+- A copy **inside** the repository (`.mpr-snapshots/<stamp>/`, left where `exec.sh` puts it)
+  finds the rules by walking up. It does **not** find `lint-config.yaml`: in mxcli's source
+  (v0.26.0) that file is read only from beside the `.mpr`, never above it. Its module excludes
+  and rule overrides then do not apply, so copy both files every time.
+- A copy outside any repository is searched all the way up to `/`. In the v0.26.0 source the
+  walk stops only at a `.git`, so a stray `~/.claude/lint-rules` or `/tmp/.claude/lint-rules`
+  would supply its rules to the copy. Copying the project's rules in puts the nearest match
+  beside the `.mpr`, which wins.
+- There is no `--rules-dir` option on v0.25.0. Check `mxcli lint --help` on your binary before
+  you rely on one.
+- `project-bin/lint-gate.sh` guards against the collapse inside the gate (see "A collapse looks
+  like a triumph" above). Running lint directly has no such guard, and this recipe stands in for
+  it.
+
 ## What does NOT generalise — do not build this
 
 **A vendor-module exclusion list.** `mxcli lint` **already skips Marketplace-sourced modules and
diff --git a/tests/wave2/fixtures/mxtest-guard/set-after-startup.js b/tests/wave2/fixtures/mxtest-guard/set-after-startup.js
new file mode 100644
index 00000000..83182623
--- /dev/null
+++ b/tests/wave2/fixtures/mxtest-guard/set-after-startup.js
@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// set-after-startup.js — fixture helper: re-encode a captured Mendix settings unit (BSON) with
+// AfterStartupMicroflow = <value>, every enclosing length rewritten. Re-encoding with the original
+// value ('') reproduces the capture byte for byte (checked by test-mxtest-guard.sh).
+const fs = require('fs');
+const [inp, out, value] = process.argv.slice(2);
+const buf = fs.readFileSync(inp);
+function cstr(b, o) { const e = b.indexOf(0, o); return [b.toString('utf8', o, e), e + 1]; }
+function size(t, b, o) {
+  switch (t) {
+    case 0x01: case 0x09: case 0x11: case 0x12: return 8;
+    case 0x02: case 0x0d: case 0x0e: return 4 + b.readInt32LE(o);
+    case 0x03: case 0x04: return b.readInt32LE(o);
+    case 0x05: return 5 + b.readInt32LE(o);
+    case 0x07: return 12; case 0x08: return 1; case 0x0a: case 0x06: case 0x7f: case 0xff: return 0;
+    case 0x10: return 4; case 0x13: return 16;
+    default: throw new Error('unknown BSON type 0x' + t.toString(16) + ' at ' + o);
+  }
+}
+function enc(b, o) {  // re-encode document at o, rewriting the target
+  const len = b.readInt32LE(o), end = o + len - 1; let p = o + 4; const parts = [];
+  while (p < end) {
+    const t = b[p]; const [k, vo] = cstr(b, p + 1); const n = size(t, b, vo);
+    let val = b.subarray(vo, vo + n);
+    if (t === 0x03 || t === 0x04) val = enc(b, vo);
+    else if (t === 0x02 && k === 'AfterStartupMicroflow') {
+      const s = Buffer.from(value + '\0', 'utf8'); const l = Buffer.alloc(4); l.writeInt32LE(s.length); val = Buffer.concat([l, s]);
+    }
+    parts.push(b.subarray(p, vo), val); p = vo + n;
+  }
+  const body = Buffer.concat(parts); const h = Buffer.alloc(4); h.writeInt32LE(body.length + 5);
+  return Buffer.concat([h, body, Buffer.from([0])]);
+}
+fs.writeFileSync(out, enc(buf, 0));
diff --git a/tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit b/tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit
new file mode 100644
index 0000000000000000000000000000000000000000..6984c6120b3fcb840f3f796292b852808f9429d3
GIT binary patch
literal 2684
zcmZuzU2IfE6rSGQ(v=t_jR{~tO;}Jdv4x6Mg6RGfTIhDy-fb&jVy1V`?hc)M=W=Im
zw_8CY;X#lnK}}2_P$LqfMllLcKB@7+V0hp~A51jS5Px1Yn)uK}&)lE=Y1oIocg~zS
zzu)=h9$!sJZ+a|G))M?Zw#uFO$z0t3!TGuQp}{X+HPYp#3uFUsnV=MNYBF8&#8I$R
zye7%k+W^{HJ4g)FPHZQedO9tC{{8XyXm!`&w~NE;&b{{EACcvIP<Nm3Y?+>c*{QJ=
zwoBAgBsJpDSq=qed7{ciV-l!Ur?ZSR)yz1QHzkv#C(@dLhN(P^GYfS(&xA+f^SCp^
zDm761!2ypdCY;u(N$FB+F6%oL4($`6dLTuEge1##u%RF-K8K=LLCxDSdQ3Qh4`NJt
zyyQWZEd&K{Q6Qn{DrU1qsN^^UN0B5d9s-H=*+C}py<PcxKkD1~`-7Fz#jlp%sD88I
zW>la1Q7Nu(ddyK!3q!wEp-5tg6tMVhqu(XJy*@DX$<t>mH~u_zv9Z0Q=q;l;;Z#}8
z56#9>lI#*o@;5d!$`o7sOIK?jKfQc4^ZwP$yL|<D^zxRkBQKjeLpQ;j2d~R0F*2^p
znH98RQV4|wB<t`{T`70>zyKE(<#i#|?%~1V!GRzosi>o-Dfh94oyAY)e5r)p3cqvD
z$WujUse}n?14*HS3RJ1j6>061sFV%iRS4#Vos16z*zZHhs656iv+WHXX`q^lRk7D`
zcc5Z|<$H+E4pX@A1^z=1BMZu-2j*=AI0mJ_Lj-Hr{iB$BNqB0)w`UPx=k$DNd4Vn*
zp!0MTsB0pgLMi?mt)%i%QmLW~PNrfrN83S&>ve3Fkkxuw298KpUX%2Pjp=Z?6uCs>
ziHFJ7E<C{tOPi-B_n4Qb2G=~XRO*R3t(z8?K8^DMJYHdstC*dsaFBhsHNsKxG91TQ
zSEhj7U@iv}q{O+zV)SP%uj#5Bwm)dJPT0soRd`_5eN_<+XN9%?JXp-8+(gubZ4S;v
zWhpZo4hsiz7+vH&q!ryjQwfjOqG6SaS>wW*3r619$2_U>v{|gq0L%sGi3@FvQd!UN
zn!r}qZK83K&FP?tfo<Zdo~wg3w<1bIcd<Z^3U3;lt~p4P$Bym9m=s7q=v3D)Fg8kg
zbqZ<3wCbQKr!q2+6w;N52J?ur2Byk6)RR01o?=x!QqT^p7nMo}$DSf7EOm@m<Xm7i
z=O8q3CMANAIZCrAsuZ6bk7C;q3e2WdV56Rb1%(H*$dxruhg+s{4#|upc9I|Q(I%e8
zn$7F?`ad6eb7}9%^;?<`L_pbyN-;FjXiz7FHHbwdnX&X*|Ig$6M3v47E^t7)XF5cC
zMoM9^fI*@r2BpIjzU|<=hFT^Z^TDxTAHr>%IS|aXHkXA(hOFcxH<8r1Xy7~YM5|@f
z)MNVU2~vE7Y{n67r}*Wk+upj-eCf!CW4m8DQ$JIRQoO4(#c}G?d_-0&!8oFLBY@*7
zJOa)$Qzl8qa!IbBuuZs^aMgBw>HN~ahWppSk8k$gHh$*na^(6BR4QYOWI8rOQUL~Y
z!p7lJc<)I}#aQ9g2)PrH0s1DU$Qft|)dEV@VvV_5Y^@aIp~Nmi@zD<T)Z}M{Ll=6d
zUN3WY?Rolg6l&Mq(1F@kp^_cK?$(pU@CvY9H!eK4Y}{#{&o{3v{@SQTKDJ^YvAy(+
z@aFW#gS^$niPRBX2pZ0skvRv>q#fStXeGHH(eAdw(BC&CS#)BX!Cc1h3^w)E?~Nd~
z@ea^93n%CyEhYV}V@?gR*y&GCYVb=ux}uCHofFTV-Np~U*!#np6aVz=jZ)N9-AeHQ
z_443y(X?@@Vkt?EELhwRSv8uVAVmB^8zd+2e7jdyE}i~u&rILUJIm{K-nVCTC~|Ul
lr;|KGvS71**Vr0aoSI6}i773>PijoIl=ToHqPq6c>i<8_5c>cC

literal 0
HcmV?d00001

diff --git a/tests/wave2/test-app-restart.sh b/tests/wave2/test-app-restart.sh
index 75920d7c..c99ee3dd 100755
--- a/tests/wave2/test-app-restart.sh
+++ b/tests/wave2/test-app-restart.sh
@@ -22,6 +22,12 @@
 # #262: a stranger on the admin port while our app runs → exit 4 before anything is stopped, the
 # stranger named by pid and alive; our app dead and a stranger on the app port → exit 4, nothing
 # started. (The stranger is a bare TCP listener, as a runtime's admin port is to curl.)
+# #304 review: a stale record whose pid was reused by an unrelated process, restarted with --cmd →
+# that process survives (the pid is checked to be an mxcli run itself). #244: the settings unit is
+# the CAPTURED one (fixtures/mxtest-guard, from mxcli's own test model), re-encoded with the
+# after-startup under test: a plain app + leftover injection → exit 3, app untouched; a live
+# --test-endpoint app whose stop does not restore → exit 5, nothing started; one whose stop restores
+# → restarted.
 # Needs node and curl; skips (exit 0, says so) without them.
 set -uo pipefail
 
@@ -84,13 +90,15 @@ http.createServer((req, res) => {
   fs.mkdirSync(path.dirname(hs), { recursive: true });
   setTimeout(() => fs.writeFileSync(hs, g), 300);   // written when "ready", as mxcli does
 });
-const stop = () => { try { fs.unlinkSync(hs); } catch (e) {} try { child.kill('SIGTERM'); } catch (e) {} process.exit(0); };
+// .restore_on_stop (two lines: source, target) stands in for run --test-endpoint's clean-exit restore.
+const stop = () => { try { const r = fs.readFileSync(path.join(dir, '.restore_on_stop'), 'utf8').trim().split('\n'); fs.copyFileSync(r[0], r[1]); } catch (e) {}
+  try { fs.unlinkSync(hs); } catch (e) {} try { child.kill('SIGTERM'); } catch (e) {} process.exit(0); };
 process.on('SIGTERM', stop); process.on('SIGINT', stop);
 JS
   chmod +x "$P/mxcli" "$P/bin/app-restart.sh"
 }
-start_app() {  # $1 = project dir; waits for the record
-  ( cd "$1" && FAKE_GOLDEN="$GOLDEN" setsid nohup ./mxcli run --local --watch -p Fixture.mpr >"$1/first.log" 2>&1 </dev/null & )
+start_app() {  # $1 = project dir, $2 = extra run flags (optional); waits for the record
+  ( cd "$1" && FAKE_GOLDEN="$GOLDEN" setsid nohup ./mxcli run --local --watch ${2:-} -p Fixture.mpr >"$1/first.log" 2>&1 </dev/null & )
   local i; for i in $(seq 1 50); do [ -f "$1/.mxcli/run-local.json" ] && return 0; sleep 0.2; done; return 1
 }
 hs_pid() { sed -n 's/^  "pid": *\([0-9]*\).*/\1/p' "$1/.mxcli/run-local.json" 2>/dev/null; }
@@ -157,6 +165,56 @@ has "says there was nothing to stop" "$OUT" "nothing — recorded pid $D is not
 has "uses the remembered command" "$OUT" "remembered from the last restart"
 KILL_LIST="$KILL_LIST $(hs_pid "$P") $(cat "$P/.fakechild" 2>/dev/null)"
 
+echo "-- #304 review: a stale record whose pid now belongs to another process → that process is never stopped"
+# A SIGKILLed mxcli leaves its record; the OS reuses the pid. With --cmd the start command no longer
+# comes from the pid, so only a check on the pid itself can tell. The old code sent it TERM.
+R="$WORK/reused"; RPORT=$(( PORT + 200 )); mkapp "$R" "$RPORT"
+sleep 300 & REUSED=$!; KILL_LIST="$KILL_LIST $REUSED"
+mkdir -p "$R/.mxcli"
+sed -e "s|^  \"project\": \"[^\"]*\"|  \"project\": $(printf '%s' "$R/Fixture.mpr" | sed 's/[&|]/\\&/g; s/.*/"&"/')|" \
+    -e "s/^  \"pid\": [0-9]*/  \"pid\": $REUSED/" -e "s/^  \"appPort\": [0-9]*/  \"appPort\": $RPORT/" \
+    -e "s/^  \"adminPort\": [0-9]*/  \"adminPort\": $(( RPORT + 10 ))/" "$GOLDEN" > "$R/.mxcli/run-local.json"
+OUT="$(restart "$R" --timeout 30 --cmd './mxcli run --local --watch -p Fixture.mpr')"; RC=$?
+alive "$REUSED" && ok "the process holding the reused pid is untouched" || bad "the reused pid $REUSED was killed"
+has "says the pid is not an mxcli run" "$OUT" "is not an mxcli run"
+[ "$RC" -eq 0 ] && ok "the app is started (exit 0)" || bad "exit $RC: $(printf '%s' "$OUT" | tail -3)"
+KILL_LIST="$KILL_LIST $(hs_pid "$R") $(cat "$R/.fakechild" 2>/dev/null)"
+
+echo "-- #244: an after-startup left on an mxcli test injection"
+GU="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit"
+SETAS="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/set-after-startup.js"
+UNIT="$P/mprcontents/4e/70/4e70063d-53e1-477a-ab92-6b763330c293.mxunit"; mkdir -p "$(dirname "$UNIT")"
+cp "$GU" "$UNIT"; cp "$GU" "$P/.clean.mxunit"
+CUR="$(hs_pid "$P")"
+node "$SETAS" "$GU" "$UNIT" "MxTest.RegisterEndpoint"
+OUT="$(restart "$P" --timeout 10)"; RC=$?
+[ "$RC" -eq 3 ] && ok "plain run --local app + leftover injection → refused (exit 3)" || bad "exit $RC: $(printf '%s' "$OUT" | tail -3)"
+has "names the leftover" "$OUT" "after-startup microflow is MxTest.RegisterEndpoint"
+has "prints the MDL repair" "$OUT" "alter settings runtime (AfterStartupMicroflow:"
+has "says nothing was stopped" "$OUT" "Nothing was stopped"
+alive "$CUR" && ok "the app was left running" || bad "the app was stopped"
+cp "$GU" "$UNIT"
+
+echo "-- #244: a live --test-endpoint app holds the injection legitimately; a stop that does not restore it → exit 5"
+OUT="$(restart "$P" --timeout 30 --cmd './mxcli run --local --watch --test-endpoint -p Fixture.mpr')"; RC=$?
+[ "$RC" -eq 0 ] && ok "[setup] app restarted with --test-endpoint" || bad "[setup] exit $RC: $(printf '%s' "$OUT" | tail -3)"
+CUR="$(hs_pid "$P")"; KILL_LIST="$KILL_LIST $CUR $(cat "$P/.fakechild" 2>/dev/null)"
+node "$SETAS" "$GU" "$UNIT" "MxTest.RegisterEndpoint"     # what run --test-endpoint writes while it runs
+OUT="$(restart "$P" --timeout 10)"; RC=$?
+[ "$RC" -eq 5 ] && ok "exit 5" || bad "exit $RC: $(printf '%s' "$OUT" | tail -3)"
+has "says it stopped and started nothing" "$OUT" "The recorded app was stopped; nothing was started"
+hasnt "starts nothing" "$OUT" "started (log:"
+alive "$CUR" && bad "the app was not stopped" || ok "the --test-endpoint app was stopped"
+echo "-- #244: repaired and started by hand (the stop removed the record); a stop that restores restarts normally"
+cp "$GU" "$UNIT"
+start_app "$P" --test-endpoint && ok "[setup] --test-endpoint app started again" || bad "[setup] app never became ready"
+KILL_LIST="$KILL_LIST $(hs_pid "$P") $(cat "$P/.fakechild" 2>/dev/null)"
+node "$SETAS" "$GU" "$UNIT" "MxTest.RegisterEndpoint"; printf '%s\n%s\n' "$P/.clean.mxunit" "$UNIT" > "$P/.restore_on_stop"
+OUT="$(restart "$P" --timeout 30)"; RC=$?
+[ "$RC" -eq 0 ] && ok "a stop that restores → restarted (exit 0)" || bad "exit $RC: $(printf '%s' "$OUT" | tail -3)"
+rm -f "$P/.restore_on_stop"; cp "$GU" "$UNIT"
+KILL_LIST="$KILL_LIST $(hs_pid "$P") $(cat "$P/.fakechild" 2>/dev/null)"
+
 # A process this script did not start, listening on $1 — the Studio Pro runtime of #262.
 stranger() {
   node -e "require('net').createServer(()=>{}).listen($1,'127.0.0.1')" & STR=$!; KILL_LIST="$KILL_LIST $STR"
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 9fcfac76..ecb26de0 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -91,6 +91,74 @@ OUT="$(run g -- tests/a.test.mdl --attach)"; RC=$?
 OUT="$(run h -- tests/a.test.mdl -p Other.mpr)"; RC=$?
 [ "$RC" -eq 2 ] && ok "-p refused" || bad "-p exit $RC"
 
+
+echo "-- #304 review: a stale-lock takeover never removes a lock another run took meanwhile"
+# Deterministic replay of the race: the functions are lifted from the subject, and holder_live
+# is wrapped so that, while this run judges the dead holder, a second run completes its own
+# takeover and writes a live lock. The old code then `mv -f`'d that live lock away and took
+# the lock too — two holders. Taking over must re-read and leave a changed lock alone.
+H="$WORK/harness.sh"; L="$WORK/race.lock"
+awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$SUBJECT" > "$H"
+grep -q '^take_lock() {' "$H" && ok "[setup] lifted holder_live..take_lock from the subject" || bad "[setup] could not lift take_lock"
+sleep 300 & LIVE=$!; BG="$BG $LIVE"
+OUT="$( L="$L" LIVE="$LIVE" bash -c '
+  . "$1"
+  eval "orig_$(declare -f holder_live)"
+  holder_live() {   # the dead holder is being judged: another run finishes ITS takeover now
+    [ "$1" = 999999 ] && printf "%s %s %s\n" "$LIVE" "$(date +%s)" "test-scratch.sh" > "$L"
+    [ "$1" = "$LIVE" ]
+  }
+  printf "999999 1 test-scratch.sh\n" > "$L"
+  take_lock "$L" "race lock"; echo "rc=$?"
+' _ "$H" 2>&1 )"
+has "the second taker is refused (the live lock survives)" "$OUT" "rc=1"
+[ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = "$LIVE" ] && ok "the lock still names the live holder" || bad "the live holder's lock was replaced: $(cat "$L" 2>/dev/null)"
+[ -e "$L.takeover" ] && bad "takeover marker left behind" || ok "takeover marker cleared"
+echo "-- a takeover marker older than 30s (a takeover that died midway) is cleared"
+printf '999999 1 test-scratch.sh\n' > "$L"; printf '999998 1\n' > "$L.takeover"
+OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
+has "taken after clearing the dead marker" "$OUT" "rc=0"
+[ "$(cut -d' ' -f1 "$L" 2>/dev/null)" != 999999 ] && ok "the stale line is gone" || bad "stale line still there"
+kill -KILL "$LIVE" 2>/dev/null; wait "$LIVE" 2>/dev/null
+
+echo "-- #244: an after-startup left on an mxcli test injection is refused before anything is copied"
+if command -v node >/dev/null 2>&1; then
+  GU="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit"
+  SETAS="$TOOLKIT/tests/wave2/fixtures/mxtest-guard/set-after-startup.js"
+  UNIT="$P/mprcontents/4e/70/4e70063d-53e1-477a-ab92-6b763330c293.mxunit"; mkdir -p "$(dirname "$UNIT")"
+  node "$SETAS" "$GU" "$WORK/rt.mxunit" "" && cmp -s "$GU" "$WORK/rt.mxunit" \
+    && ok "[setup] re-encoding the captured unit reproduces it byte for byte" || bad "[setup] the BSON re-encoder is not faithful"
+  cp "$GU" "$UNIT"
+  OUT="$(run i -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 0 ] && ok "captured settings unit (no after-startup) → runs" || bad "clean captured unit refused (exit $RC): $(printf '%s' "$OUT" | tail -3)"
+  ( cd "$P" && git init -q && git add mprcontents && git -c user.email=t@t -c user.name=t commit -qm base ) >/dev/null 2>&1
+  node "$SETAS" "$GU" "$UNIT" "Orders.ASU_Startup"
+  ( cd "$P" && git -c user.email=t@t -c user.name=t commit -qam own ) >/dev/null 2>&1
+  OUT="$(run j -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 0 ] && ok "a project's own after-startup → runs" || bad "own after-startup refused (exit $RC)"
+  node "$SETAS" "$GU" "$UNIT" "MxTest.RegisterEndpoint"
+  rm -rf "$WORK/tmp"/Fixture-test.*
+  OUT="$(run k -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 3 ] && ok "MxTest.RegisterEndpoint → refused (exit 3)" || bad "exit $RC: $(printf '%s' "$OUT" | tail -3)"
+  has "names the leftover" "$OUT" "after-startup microflow is MxTest.RegisterEndpoint"
+  has "names what HEAD has" "$OUT" "HEAD: Orders.ASU_Startup"
+  has "prints the git repair" "$OUT" "git checkout -- 'mprcontents/4e/70/4e70063d-53e1-477a-ab92-6b763330c293.mxunit'"
+  has "prints the MDL repair with HEAD's value" "$OUT" "alter settings runtime (AfterStartupMicroflow: 'Orders.ASU_Startup');"
+  [ -f "$WORK/rec.k" ] && bad "mxcli ran on the injected model" || ok "mxcli not run"
+  ls "$WORK/tmp" | grep -q 'Fixture-test' && bad "a copy was made" || ok "nothing copied"
+  node "$SETAS" "$GU" "$UNIT" "MxTest.TestRunner"
+  OUT="$(run l -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 3 ] && ok "MxTest.TestRunner → refused (exit 3)" || bad "TestRunner exit $RC"
+  cp "$GU" "$UNIT"
+  echo "-- #244 on a v1 model (settings inside the .mpr itself)"
+  V="$WORK/v1"; mkdir -p "$V/bin"; cp "$P/bin/"*.sh "$V/bin/"; cp "$P/mxcli" "$V/"
+  { printf 'SQLite format 3\0'; node "$SETAS" "$GU" /dev/stdout "MxTest.RegisterEndpoint"; printf '\0\0trailing'; } > "$V/Fixture.mpr"
+  OUT="$( cd "$V" && REC="$WORK/rec.m" ./bin/test-scratch.sh -- x.test.mdl 2>&1 )"; RC=$?
+  [ "$RC" -eq 3 ] && has "v1 .mpr → refused, git repair degrades to a placeholder" "$OUT" "HEAD: not readable" || bad "v1 exit $RC: $(printf '%s' "$OUT" | tail -3)"
+else
+  echo "  [skip] node missing — the injected settings units are built from the capture with node"
+fi
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

From 59e7c1624a22543f7f656dc0bc55f8afe0e2d2ab Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:03:12 +0000
Subject: [PATCH 31/68] Address review on #307: no-call models sweep, per-BRD
 reuse, stack exit 4

1. graph-sweep.sh / app-facts.sh: the first cut required a 'call' edge and
   refused a model with no microflow-to-microflow calls (reached only from
   pages/buttons), which master swept. Now FAULT only on an empty or
   kind-less refs table, report per-kind counts, and graph-sweep warns when
   none of its orphan-read kinds is present. The per-kind query is fixed
   (aggregate in GROUP BY). Fixture renamed test-catalog-edge-guard.sh,
   adds the action-only and kind-less cases (16 checks).
2. review-module.sh reads every report of the run: --reuse-conformance
   <report-date.tsv> also reads its report-<date>-<BRD>.tsv siblings, and
   its own run slices every report newer than the run start, so a per-BRD
   module no longer FAULTs verify-module's rung 13 or drops BRDs.
   verify-module.sh documents the contract. test-review-conformance-per-brd.sh.
3. conformance-check.sh: per-BRD reports via while-read, so a BRD id with
   a space stays one BRD (fixture case 9).
4. CHANGELOG: missing LEDGER_FILE now FAULTs; per-BRD baseline rows are
   re-keyed <BRD>:<pointer>, so run once after upgrade and re-check.
5. #313 follow-up: verify-module.sh grades test-stack-up exit 4 (port held
   by another process) as FAULT on the stack rung only, not FINDING.
   test-verify-stack-blocked.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   5 +-
 project-bin/app-facts.sh                      |  18 +--
 project-bin/conformance-check.sh              |   6 +-
 project-bin/graph-sweep.sh                    |  33 +++--
 project-bin/review-module.sh                  |  34 +++++-
 project-bin/verify-module.sh                  |  13 +-
 ...ll-edges.sh => test-catalog-edge-guard.sh} |  90 +++++++++-----
 .../wave2/test-conformance-per-brd-ledger.sh  |  16 ++-
 .../wave2/test-review-conformance-per-brd.sh  | 114 ++++++++++++++++++
 tests/wave2/test-verify-stack-blocked.sh      |  65 ++++++++++
 10 files changed, 328 insertions(+), 66 deletions(-)
 rename tests/wave2/{test-catalog-call-edges.sh => test-catalog-edge-guard.sh} (65%)
 create mode 100755 tests/wave2/test-review-conformance-per-brd.sh
 create mode 100755 tests/wave2/test-verify-stack-blocked.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f9873f0..61aa3bb2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(graph-sweep, app-facts): **the catalog guard checks for `call` edges, not the `build_mode` label; mxcli v0.24+ labels a complete catalog `source` and both scripts refused every one** ([#259](https://github.com/MendixMau/mxcli-project-toolkit/issues/259)). Field report: four module reviews recorded the sweep as "Instrument FAULT" on a fresh catalog with 5,368 refs rows. Now an empty refs table or zero `RefKind='call'` edges FAULTs, naming the mode and per-kind edge counts; `manifest.json` records the real mode. `tests/wave2/test-catalog-call-edges.sh` (12 checks, both layouts) fails 10 of 12 on master's scripts, including the verbatim FAULT line. Synthetic catalogs; a field run on a v0.24 project is still owed. — AlvinnYeo
-- fix(conformance-check, coverage-ledger): **per-BRD ledgers (`<Module>/coverage-ledger/<BRD>.md`) are all measured, one report per BRD, and an index file is named as one instead of "0 measurable rows"** ([#260](https://github.com/MendixMau/mxcli-project-toolkit/issues/260)). Field report: every module with an index ended in `FAULT: 0 measurable rows extracted from 1 ledger(s).`, while `LEDGER_FILE` on one per-BRD file measured 128 rows. Baseline pointers carry the BRD id, `LEDGER_FILE` (file or directory) is in the usage text, and a missing one FAULTs instead of falling back. `tests/wave2/test-conformance-per-brd-ledger.sh` (17 checks, both layouts) fails all 17 on master's script. A field run on a per-BRD project is still owed. — AlvinnYeo
+- fix(graph-sweep, app-facts): **the catalog guard checks the refs table, not the `build_mode` label; mxcli v0.24+ labels a complete catalog `source` and both scripts refused every one** ([#259](https://github.com/MendixMau/mxcli-project-toolkit/issues/259)). Field report: four module reviews recorded the sweep as "Instrument FAULT" on a fresh catalog with 5,368 refs rows. Now only an empty or kind-less refs table FAULTs, naming the mode and the per-kind edge counts; a model with no microflow-to-microflow calls (reached only from pages and buttons) still sweeps, and graph-sweep warns when no orphan-read kind is present. `manifest.json` records the real mode. `tests/wave2/test-catalog-edge-guard.sh` (16 checks, both layouts) fails 14 on master's scripts, including the verbatim FAULT line. Synthetic catalogs; a field run on a v0.24 project is still owed. — AlvinnYeo
+- fix(conformance-check, review-module, verify-module, coverage-ledger): **per-BRD ledgers (`<Module>/coverage-ledger/<BRD>.md`) are all measured, one report per BRD, review/verify read every report of the run, and an index file is named as one instead of "0 measurable rows"** ([#260](https://github.com/MendixMau/mxcli-project-toolkit/issues/260)). Field report: every module with an index ended in `FAULT: 0 measurable rows extracted from 1 ledger(s).`, while `LEDGER_FILE` on one per-BRD file measured 128 rows. `LEDGER_FILE` (file or directory) is in the usage text. **Upgrade notes:** (a) a `LEDGER_FILE` that does not exist now FAULTs instead of silently falling back to another ledger, and `verify-module.sh` reads `LEDGER_FILE` and passes it on to conformance through the environment, so a stale export now FAULTs the conformance rung; (b) baseline pointers of per-BRD rows are re-keyed `<BRD>:<pointer>`, so a project that had both a filled index and a per-BRD directory sees its old rows go unmatched and the new ones re-seeded as "newly baselined" on the first run after upgrade, with no regressions reported: run conformance once, then re-check. Fixtures: `test-conformance-per-brd-ledger.sh` (19, both layouts), `test-review-conformance-per-brd.sh` (4, both layouts), all failing on master. A field run on a per-BRD project is still owed. — AlvinnYeo
+- fix(verify-module): **a stack rung exit 4 from `test-stack-up.sh` (port held by another process) is an instrument FAULT, not a FINDING** — follow-up to [#313](https://github.com/MendixMau/mxcli-project-toolkit/pull/313), whose header says to record it as blocked, not as a test failure; review of #313 found verify-module grading it as findings. Scoped to the stack rung (exit 4 is NOT APPLICABLE from conformance-check). `tests/wave2/test-verify-stack-blocked.sh` (6) fails 2 on master. — AlvinnYeo (port-holder report), review of #313
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/app-facts.sh b/project-bin/app-facts.sh
index 96a2c2cf..534d3263 100755
--- a/project-bin/app-facts.sh
+++ b/project-bin/app-facts.sh
@@ -249,8 +249,10 @@ BUILD_MODE="$(q "SELECT Value FROM catalog_meta WHERE Key='build_mode';")"
 # The build_mode LABEL is not checked (fixed 2026-10-13, field report 2026-10-11): mxcli v0.24.0
 # labels a complete catalog 'source', and the old `!= full` test refused it on every run. What
 # this script needs is checked instead, below: the tables by name, non-empty refs/activities,
-# and at least one 'call' edge (the call graph in step 2 reads RefKind='call'). The label is
-# recorded in manifest.json as found, so a reader can still see it.
+# and at least one refs row that carries a RefKind (the dependency facts group by it). The label
+# is recorded in manifest.json as found, so a reader can still see it. Zero 'call' edges is NOT a
+# fault: an early module reached only from pages and buttons has none, and its call graph is
+# legitimately empty — requiring them (the first cut of this fix) refused such apps.
 MISSING=""
 for t in modules_data entities_data microflows_data activities_data pages_data scheduled_events_data refs catalog_meta projects; do
   [ "$(q "SELECT count(*) FROM sqlite_master WHERE name='$t';")" = "1" ] || MISSING="$MISSING $t"
@@ -268,14 +270,14 @@ if [ "${N_MODULES:-0}" -eq 0 ] || [ "${N_REFS:-0}" -eq 0 ] || [ "${N_ACTS:-0}" -
   echo "FAULT: catalog is vacuous (modules=$N_MODULES refs=$N_REFS activities=$N_ACTS, build_mode '${BUILD_MODE:-unset}'). An empty graph is not a clean app." >&2
   exit 2
 fi
-N_CALLS=$(q "SELECT count(*) FROM refs WHERE RefKind='call';")
-if [ "${N_CALLS:-0}" -eq 0 ]; then
-  KINDS="$(q "SELECT RefKind || '=' || count(*) FROM refs GROUP BY RefKind ORDER BY count(*) DESC LIMIT 8;" | paste -sd' ' -)"
-  echo "FAULT: catalog has 0 'call' edges (build_mode '${BUILD_MODE:-unset}', $N_REFS refs: ${KINDS:-none})." >&2
-  echo "       The call graph and dead-asset facts read 'call' edges. Refusing to write facts without them." >&2
+KINDS="$(q "SELECT k || '=' || n FROM (SELECT COALESCE(NULLIF(RefKind,''),'(none)') k, count(*) n FROM refs GROUP BY k ORDER BY n DESC LIMIT 8);" | paste -sd' ' -)"
+N_KINDED=$(q "SELECT count(*) FROM refs WHERE COALESCE(RefKind,'') <> '';")
+if [ "${N_KINDED:-0}" -eq 0 ]; then
+  echo "FAULT: catalog refs carry no RefKind (build_mode '${BUILD_MODE:-unset}', $N_REFS refs by kind: ${KINDS:-none})." >&2
+  echo "       The dependency and call-graph facts are read by kind. Refusing to write facts without one." >&2
   exit 2
 fi
-log "catalog ok: build_mode=${BUILD_MODE:-unset} modules=$N_MODULES refs=$N_REFS (call=$N_CALLS) activities=$N_ACTS (${T1}s)"
+log "catalog ok: build_mode=${BUILD_MODE:-unset} modules=$N_MODULES refs=$N_REFS (${KINDS:-none}) activities=$N_ACTS (${T1}s)"
 
 # ---------------------------------------------------------------------------------------------
 # Step 2 — inventory + dependencies, straight from the catalog through the REAL module column.
diff --git a/project-bin/conformance-check.sh b/project-bin/conformance-check.sh
index 57b88a56..b76031cb 100755
--- a/project-bin/conformance-check.sh
+++ b/project-bin/conformance-check.sh
@@ -428,13 +428,15 @@ STAMP="$(date +%Y-%m-%d)"
 # One report per BRD for per-BRD ledgers (report-<date>-<BRD>.tsv), so measuring several BRDs
 # does not leave only the last one on disk; rows from every other shape keep report-<date>.tsv.
 REPORTS=""
-for b in $(printf '%s\n' "$RESULTS" | awk -F'\t' 'NF{print $7}' | sort -u); do
+# while-read, not `for b in $(…)`: a BRD file name with a space must stay one BRD.
+while IFS= read -r b; do
+  [ -n "$b" ] || continue
   if [ "$b" = "-" ]; then REPORT="$OUTDIR/report-$STAMP.tsv"; else REPORT="$OUTDIR/report-$STAMP-$b.tsv"; fi
   { printf 'module\tpointer\tstored\tobserved\tverdict\tcommand\n'
     printf '%s\n' "$RESULTS" | awk -F'\t' -v b="$b" 'BEGIN{OFS="\t"} $7==b {print $1,$2,$3,$4,$5,$6}'
   } > "$REPORT"
   REPORTS+="$REPORT"$'\n'
-done
+done <<< "$(printf '%s\n' "$RESULTS" | awk -F'\t' 'NF{print $7}' | sort -u)"
 
 count() { printf '%s\n' "$RESULTS" | awk -F'\t' -v v="$1" '$5==v' | grep -c . || true; }
 OK=$(count OK); STALE=$(count STALE); UNDER=$(count UNDERSTATED); UNK=$(count UNKNOWN-STATUS)
diff --git a/project-bin/graph-sweep.sh b/project-bin/graph-sweep.sh
index 313df442..35e4647e 100755
--- a/project-bin/graph-sweep.sh
+++ b/project-bin/graph-sweep.sh
@@ -26,7 +26,7 @@
 # is an intent question, answered against the module brief, not here.
 #
 # Usage: bin/graph-sweep.sh [--module <Name>] [--min-elements N] [--tsv]
-# Exit:  0 swept · 2 instrument fault (stale catalog, empty graph, no 'call' edges, missing db)
+# Exit:  0 swept · 2 instrument fault (stale catalog, empty or untyped graph, missing db)
 
 set -uo pipefail
 
@@ -119,26 +119,32 @@ fi
 # rows. So the sweep FAULTed on every run on that mxcli, on a fresh, complete catalog:
 #   FAULT: catalog build_mode is 'source'; reference edges require 'full'.
 # The label was a proxy for "the reference edges are there". Test that directly instead: the
-# orphan finding reads RefKind 'call' (with action/menu_item/show_page/datasource), and a
-# catalog built without edges (the old 'fast' mode) has none. Zero 'call' edges is the
-# signature of a catalog that cannot answer the question, whatever its label says.
-# Assumption, stated: a real model with microflows has at least one microflow-to-microflow
-# call. A model with literally none would FAULT here; the message says what was counted.
+# wiring finding reads every refs row, grouped by module, and the orphan finding reads the
+# inbound kinds in $READ_KINDS (shared with the ORPHANS query below). A catalog built without
+# edges (the old 'fast' mode) has an empty refs table; one whose rows carry no RefKind cannot
+# answer the orphan question either. Those two FAULT, naming the mode and the per-kind counts.
+#
+# Requiring 'call' specifically (the first cut of this fix) was a regression: an early greenfield
+# module reached only from buttons and pages has action/show_page edges and no microflow-to-
+# microflow call at all, and master swept it fine. So any kinded edge is enough to run; a catalog
+# with none of the orphan-read kinds still sweeps, with a warning that its orphan list is moot.
+READ_KINDS="'call','action','menu_item','show_page','datasource'"
 REFS=$(q "SELECT COUNT(*) FROM refs;")
 OBJS=$(q "SELECT COUNT(*) FROM objects;")
+KINDS="$(q "SELECT k || '=' || n FROM (SELECT COALESCE(NULLIF(RefKind,''),'(none)') k, count(*) n FROM refs GROUP BY k ORDER BY n DESC LIMIT 8);" | paste -sd' ' -)"
 if [ "${REFS:-0}" -eq 0 ] || [ "${OBJS:-0}" -eq 0 ]; then
   echo "FAULT: graph is empty (refs=$REFS objects=$OBJS, build_mode '${BUILD_MODE:-unset}'). Refusing to report a clean sweep." >&2
   echo "       Rebuild: ./mxcli -p $MPR -c 'REFRESH CATALOG FULL'" >&2
   exit 2
 fi
-CALLS=$(q "SELECT COUNT(*) FROM refs WHERE RefKind='call';")
-if [ "${CALLS:-0}" -eq 0 ]; then
-  KINDS="$(q "SELECT RefKind || '=' || COUNT(*) FROM refs GROUP BY RefKind ORDER BY COUNT(*) DESC LIMIT 8;" | paste -sd' ' -)"
-  echo "FAULT: catalog has 0 'call' edges (build_mode '${BUILD_MODE:-unset}', $REFS refs: ${KINDS:-none})." >&2
-  echo "       The orphan finding reads 'call' edges; without them every microflow looks orphaned." >&2
+KINDED=$(q "SELECT COUNT(*) FROM refs WHERE COALESCE(RefKind,'') <> '';")
+if [ "${KINDED:-0}" -eq 0 ]; then
+  echo "FAULT: catalog refs carry no RefKind (build_mode '${BUILD_MODE:-unset}', $REFS refs by kind: ${KINDS:-none})." >&2
+  echo "       The orphan finding is read by kind. Refusing to report a sweep from untyped edges." >&2
   echo "       Rebuild: ./mxcli -p $MPR -c 'REFRESH CATALOG FULL'" >&2
   exit 2
 fi
+READ_EDGES=$(q "SELECT COUNT(*) FROM refs WHERE RefKind IN ($READ_KINDS);")
 
 WIRING_FILTER=""
 ORPHAN_FILTER=""
@@ -194,7 +200,7 @@ WHERE m.ModuleName NOT IN (
   AND NOT EXISTS (
         SELECT 1 FROM refs r
         WHERE r.TargetName = m.QualifiedName
-          AND r.RefKind IN ('call','action','menu_item','show_page','datasource'))
+          AND r.RefKind IN ($READ_KINDS))
   $ORPHAN_FILTER
 ORDER BY m.ModuleName, m.Name;
 ")"
@@ -210,7 +216,7 @@ fi
 N_UNWIRED=$(printf '%s\n' "$WIRING" | awk -F'|' 'NF && $3==0' | grep -c . || true)
 N_ORPH=$(printf '%s\n' "$ORPHANS" | grep -c . || true)
 
-echo "graph-sweep · catalog $CAT_MTIME (build_mode ${BUILD_MODE:-unset}) · $OBJS objects · $REFS typed edges ($CALLS call)"
+echo "graph-sweep · catalog $CAT_MTIME (build_mode ${BUILD_MODE:-unset}) · $OBJS objects · $REFS typed edges (${KINDS:-none})"
 echo
 echo "  module wiring (>= $MIN_ELEMENTS elements)"
 printf '    %-24s %8s %9s %10s\n' MODULE ELEMENTS INBOUND OUTBOUND
@@ -218,6 +224,7 @@ printf '%s\n' "$WIRING" | awk -F'|' 'NF {printf "    %-24s %8s %9s %10s%s\n", $1
 
 echo
 echo "  orphaned microflows (no call / action / nav inbound, entry-point prefixes excluded): $N_ORPH"
+[ "${READ_EDGES:-0}" -eq 0 ] && echo "    WARNING: the catalog has no call/action/menu_item/show_page/datasource edges, so every microflow reads as orphaned here; check the edge kinds above."
 if [ "$N_ORPH" -gt 0 ]; then
   printf '%s\n' "$ORPHANS" | awk -F'|' 'NF {printf "    %-56s %s activities\n", $1, $2}' | head -40
   [ "$N_ORPH" -gt 40 ] && echo "    ... and $((N_ORPH-40)) more"
diff --git a/project-bin/review-module.sh b/project-bin/review-module.sh
index 87a6ade1..af0259b1 100755
--- a/project-bin/review-module.sh
+++ b/project-bin/review-module.sh
@@ -302,6 +302,16 @@ if [ "$MODULE_KNOWN" -eq 0 ]; then
 fi
 
 # ── 1. Conformance: the ledger's claimed status vs the live model ───────────
+# A module whose ledger is split one-per-BRD gets one conformance report PER BRD
+# (report-<date>-<BRD>.tsv, conformance-check.sh since 2026-10-13), not one report-<date>.tsv.
+# Reading a single file here took one BRD's rows (newest-by-mtime) or, on --reuse, none at all
+# — a per-BRD module would FAULT rung 13 of verify-module with "does not exist". So both paths
+# below read every report of the run and slice them together.
+# conf_slice OUT FILE... — header once, then this module's rows from every file.
+conf_slice() {
+  local out="$1"; shift
+  awk -F'\t' -v m="$MODULE" 'NR==1 {print; next} FNR==1 {next} $1==m' "$@" > "$out"
+}
 # The ledger is a claim. This measures it. A module with no ledger has made no claims to
 # measure, which is a FAULT and emphatically not a pass — "no ledger" is exactly the hole
 # that let projects ship with no coverage-ledger.md at all and read as silence.
@@ -315,15 +325,22 @@ if [ ! -f "$LEDGER" ]; then
 elif [ -n "$REUSE_CONF" ]; then
   printf '\n\033[1m── conformance (reusing the caller'"'"'s run)\033[0m\n'
   case "$REUSE_CONF" in /*) RC_PATH="$REUSE_CONF" ;; *) RC_PATH="$ROOT/$REUSE_CONF" ;; esac
-  if [ ! -f "$RC_PATH" ]; then
+  # The reused path names the run's base report (report-<date>.tsv); its per-BRD siblings
+  # (report-<date>-<BRD>.tsv) belong to the same run and are read with it.
+  # Counted, not read back as ${#RC_FILES[@]}: bash 3.2 (stock macOS) aborts on an empty
+  # array expansion under `set -u`.
+  RC_FILES=(); RC_N=0
+  [ -f "$RC_PATH" ] && { RC_FILES[$RC_N]="$RC_PATH"; RC_N=$((RC_N+1)); }
+  for f in "${RC_PATH%.tsv}"-*.tsv; do [ -f "$f" ] && { RC_FILES[$RC_N]="$f"; RC_N=$((RC_N+1)); }; done
+  if [ "$RC_N" -eq 0 ]; then
     c_warn "  ! INSTRUMENT FAULT"; echo " — $REUSE_CONF does not exist"
     echo "      The caller said it had already measured conformance and it had not."
     printf 'conformance (reused)\tFAULT\t2\t-\t(%s missing)\n' "$REUSE_CONF" >> "$SUMMARY"
     note_instrument conformance fault 2 "" "" "reuse requested but $REUSE_CONF does not exist"
     FAULTED=$((FAULTED+1))
   else
-    awk -F'\t' -v m="$MODULE" 'NR==1 || $1==m' "$RC_PATH" > "$OUTDIR/conformance.tsv"
-    RC_ROWS=$(awk -F'\t' -v m="$MODULE" '$1==m' "$RC_PATH" | grep -c . || true)
+    conf_slice "$OUTDIR/conformance.tsv" "${RC_FILES[@]}"
+    RC_ROWS=$(awk -F'\t' -v m="$MODULE" 'FNR>1 && $1==m' "${RC_FILES[@]}" | grep -c . || true)
     if [ "${RC_ROWS:-0}" -eq 0 ]; then
       rm -f "$OUTDIR/conformance.tsv"
       c_warn "  ! INSTRUMENT FAULT"; echo " — $REUSE_CONF carries no rows for $MODULE"
@@ -333,7 +350,7 @@ elif [ -n "$REUSE_CONF" ]; then
         "reused report carries no rows for $MODULE — refusing to report a clean run over zero measurements"
       FAULTED=$((FAULTED+1))
     else
-      c_ok "  ✓ reused"; echo "  ($RC_ROWS rows from ${REUSE_CONF})"
+      c_ok "  ✓ reused"; echo "  ($RC_ROWS rows from $RC_N report(s): ${REUSE_CONF%.tsv}[-<BRD>].tsv)"
       printf 'conformance (reused)\tPASS\t0\t-\t%s\n' "$REUSE_CONF" >> "$SUMMARY"
       note_instrument conformance pass 0 "" "$REUSE_CONF" ""
     fi
@@ -359,13 +376,18 @@ else
     echo "      conformance did not complete — NOT slicing an older report in as its result."
   else
     CONF_TSV="$(ls -t "$ROOT"/docs/conformance/report-*.tsv 2>/dev/null | head -1)"
+    CONF_NEW=(); CONF_N=0
+    for f in "$ROOT"/docs/conformance/report-*.tsv; do
+      [ -f "$f" ] && [ "$f" -nt "$OUTDIR/.started" ] && { CONF_NEW[$CONF_N]="$f"; CONF_N=$((CONF_N+1)); }
+    done
     if [ -z "$CONF_TSV" ]; then
       echo "      no docs/conformance/report-*.tsv to slice; the report will carry a fault row."
-    elif [ ! "$CONF_TSV" -nt "$OUTDIR/.started" ]; then
+    elif [ "$CONF_N" -eq 0 ]; then
       echo "      newest conformance report predates this run — NOT slicing it in."
       echo "      (${CONF_TSV#$ROOT/} is older than $STAMP; it measured a different run.)"
     else
-      awk -F'\t' -v m="$MODULE" 'NR==1 || $1==m' "$CONF_TSV" > "$OUTDIR/conformance.tsv"
+      # Every report this run wrote: one, or one per BRD for a per-BRD ledger.
+      conf_slice "$OUTDIR/conformance.tsv" "${CONF_NEW[@]}"
     fi
   fi
 fi
diff --git a/project-bin/verify-module.sh b/project-bin/verify-module.sh
index c5dde886..ded6eb61 100755
--- a/project-bin/verify-module.sh
+++ b/project-bin/verify-module.sh
@@ -215,8 +215,15 @@ _report_result() {
   # into coherence-cadence.sh and build-plan-status.sh. Observed on a real field run:
   # `mode=static-only pages=0 fault=2` reported as PASS. Fault is checked FIRST because "did not
   # run" must never be readable as "ran and was clean".
+  #
+  # `stack:4` is test-stack-up.sh's "instrument blocked": the port `mxcli run --local` needs is
+  # held by another process. Its own header says to record that as blocked, not as a test
+  # failure — the app was never measured, so it is a FAULT, not a FINDING. Scoped to the stack
+  # rung's kind on purpose: exit 4 means something else elsewhere (conformance-check.sh: NOT
+  # APPLICABLE), so it is not a global remap.
   case "$kind:$rc" in
     *:2)      verdict=FAULT ;;
+    stack:4)  verdict=FAULT ;;
     info:*)   verdict=INFO ;;
     *:0)      verdict=PASS ;;
     *)        verdict=FINDING ;;
@@ -235,6 +242,7 @@ _report_result() {
 # run <name> <logfile> <kind> <timeout_s> -- <cmd...>
 #   kind=gate   exit 1 => finding, exit 2 => instrument fault
 #   kind=info   never fails the pass; recorded for the trend line
+#   kind=stack  as gate, plus exit 4 (test-stack-up: port held by another process) => fault
 # Blocks until the instrument finishes.
 run() {
   local name="$1" log="$2" kind="$3" tmo="$4"; shift 5   # the literal --
@@ -376,7 +384,7 @@ echo "══ verify-module: $MODULE ══  $STAMP"
 # so the runtime instruments below cannot be pointed at a guessed one.
 STACK_OK=0
 if [ -x "$(_tool test-stack-up.sh)" ]; then
-  run "stack (test-stack-up --check)" "$OUTDIR/00-stack.log" gate 60 -- \
+  run "stack (test-stack-up --check)" "$OUTDIR/00-stack.log" stack 60 -- \
     "$(_tool test-stack-up.sh)" --check
   grep -q "^stack (test-stack-up --check)	PASS" "$SUMMARY" && STACK_OK=1
   # "app up with a caveat" is not "app down", and reporting it as one sends the reader
@@ -510,6 +518,9 @@ run_join_all
 # a second time in the same pass buys nothing. The path is passed unconditionally: if rung 1 faulted
 # the file is absent, review says so and FAULTS, which is the truth — nothing was measured — and it
 # costs seconds instead of minutes.
+# The path names the run's BASE report; a per-BRD ledger writes report-<date>-<BRD>.tsv instead
+# (and no base file), and review-module.sh reads every report-<date>*.tsv sibling with it — so
+# the reuse finds a per-BRD module's rows rather than FAULTing on "does not exist" (2026-10-13).
 if [ -x "$(_tool review-module.sh)" ]; then
   run "review (model vs decided — report.json)" "$OUTDIR/13-review.log" info 600 -- \
     "$(_tool review-module.sh)" "$MODULE" --json-only \
diff --git a/tests/wave2/test-catalog-call-edges.sh b/tests/wave2/test-catalog-edge-guard.sh
similarity index 65%
rename from tests/wave2/test-catalog-call-edges.sh
rename to tests/wave2/test-catalog-edge-guard.sh
index b6a11835..06589ea8 100755
--- a/tests/wave2/test-catalog-call-edges.sh
+++ b/tests/wave2/test-catalog-edge-guard.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Usage: bash test-catalog-call-edges.sh [path-to-graph-sweep.sh]
+# Usage: bash test-catalog-edge-guard.sh [path-to-graph-sweep.sh]
 #
 # Fixture for the catalog guard in project-bin/graph-sweep.sh and project-bin/app-facts.sh
 # (app-facts.sh is taken from beside the subject).
@@ -9,14 +9,19 @@
 # writes 'source' even after `REFRESH CATALOG FULL`, on a catalog holding 5,368 typed refs rows,
 # so every sweep on that mxcli ended in (verbatim from the report — the golden input):
 #   FAULT: catalog build_mode is 'source'; reference edges require 'full'.
-# The fix tests what the scripts read instead of the label: a non-empty refs table with at
-# least one RefKind='call' edge.
+# The fix tests what the scripts read instead of the label: a non-empty refs table whose rows
+# carry a RefKind. It FAULTs only on an empty or kind-less refs table.
+#
+# The first cut of the fix required a 'call' edge, which refused a model with no
+# microflow-to-microflow calls at all (an early module reached only from pages and buttons) —
+# a regression against master, caught in review. Case 2 guards it.
 #
 # Cases, each on BOTH layouts (single-tree, and two-tree with the .mpr and catalog under app/):
-#   1. build_mode 'source' + call edges  -> sweep runs, orphan finding still correct
-#   2. build_mode 'full'   + zero call edges -> FAULT naming the mode and the per-kind counts
-#   3. build_mode 'fast'   + empty refs  -> FAULT (graph is empty), as before
-#   4. app-facts: 'source' + calls passes the guard; zero calls FAULTs naming mode and counts
+#   1. build_mode 'source' + call edges   -> sweep runs, orphan finding still correct
+#   2. build_mode 'full'   + action edges only, zero calls -> sweep runs (as on master)
+#   3. build_mode 'full'   + kind-less refs -> FAULT naming the mode and the per-kind counts
+#   4. build_mode 'fast'   + empty refs    -> FAULT, as before
+#   5. app-facts: 'source' + calls and action-only both pass the guard; kind-less FAULTs
 #
 # The catalog databases are SYNTHETIC: no real catalog.db is captured in this repo, and the
 # report quotes only the FAULT line and the counts. Tables and columns are exactly the ones the
@@ -45,9 +50,9 @@ bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/catalog-calls.XXXXXX")"
 trap 'rm -rf "$WORK"' EXIT
 
-# mkdb <db> <build_mode> <with-calls:1|0> <with-refs:1|0>
+# mkdb <db> <build_mode> <refs shape: calls|actions|kindless|empty>
 mkdb() {
-  local db="$1" mode="$2" calls="$3" refs="$4"
+  local db="$1" mode="$2" shape="$3"
   mkdir -p "$(dirname "$db")"; rm -f "$db"
   {
     echo "CREATE TABLE catalog_meta (key TEXT, value TEXT);"
@@ -68,11 +73,15 @@ mkdb() {
       echo "INSERT INTO objects VALUES ('$m','${m%%.*}','MICROFLOW');"
       echo "INSERT INTO microflows_data VALUES ('$m','${m%%.*}','${m#*.}',3,'MICROFLOW');"
     done
-    if [ "$refs" = 1 ]; then
-      echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','action','Orders');"
-      echo "INSERT INTO refs VALUES ('MICROFLOW','Billing.ACT_Send','Orders.ACT_Save','action','Billing');"
-      [ "$calls" = 1 ] && echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total','call','Orders');"
-    fi
+    case "$shape" in
+      calls|actions)
+        echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','action','Orders');"
+        echo "INSERT INTO refs VALUES ('MICROFLOW','Billing.ACT_Send','Orders.ACT_Save','action','Billing');"
+        [ "$shape" = calls ] && echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total','call','Orders');" ;;
+      kindless)
+        echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','','Orders');"
+        echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total',NULL,'Orders');" ;;
+    esac
   } | sqlite3 "$db"
 }
 
@@ -94,7 +103,7 @@ for layout in single two; do
   echo "== graph-sweep · $layout-tree layout"
 
   # --- 1. 'source' with call edges: the field case --------------------------------------------
-  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" source 1 1
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" source calls
   rc="$(sweep "$P")"
   if grep -q "FAULT: catalog build_mode is 'source'; reference edges require 'full'." "$WORK/out"; then
     bad "[$layout] build_mode 'source' refused by label (issue #259 golden FAULT line)" "rc=$rc $(out)"
@@ -109,18 +118,27 @@ for layout in single two; do
     bad "[$layout] orphan finding wrong on a 'source' catalog" "$(out)"
   fi
 
-  # --- 2. 'full' label but zero call edges: the label is not evidence --------------------------
-  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full 0 1
+  # --- 2. no microflow-to-microflow calls at all: still sweeps (the review-caught regression) ----
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full actions
   rc="$(sweep "$P")"
-  if [ "$rc" = 2 ] && grep -q "0 'call' edges" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out" \
-     && grep -q "action=2" "$WORK/out"; then
-    ok "[$layout] zero call edges FAULTs, naming the mode and per-kind counts (action=2)"
+  if [ "$rc" = 0 ] && grep -q "graph-sweep ·.*action=2" "$WORK/out" && grep -q "Orders.SUB_Total" "$WORK/out"; then
+    ok "[$layout] action-only catalog (zero calls) is swept, as on master"
   else
-    bad "[$layout] a catalog with no call edges was not refused by what it holds" "rc=$rc $(out)"
+    bad "[$layout] a model with no calls was refused" "rc=$rc $(out)"
   fi
 
-  # --- 3. empty refs still FAULTs ---------------------------------------------------------------
-  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" fast 0 0
+  # --- 3. refs present but kind-less: the label is not evidence ---------------------------------
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full kindless
+  rc="$(sweep "$P")"
+  if [ "$rc" = 2 ] && grep -q "carry no RefKind" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out" \
+     && grep -q "(none)=2" "$WORK/out"; then
+    ok "[$layout] kind-less refs FAULT, naming the mode and per-kind counts ((none)=2)"
+  else
+    bad "[$layout] a catalog with untyped edges was not refused by what it holds" "rc=$rc $(out)"
+  fi
+
+  # --- 4. empty refs still FAULTs ---------------------------------------------------------------
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" fast empty
   rc="$(sweep "$P")"
   if [ "$rc" = 2 ] && grep -q "^FAULT:" "$WORK/out"; then
     ok "[$layout] empty refs still FAULTs (never a clean sweep)"
@@ -128,13 +146,14 @@ for layout in single two; do
     bad "[$layout] empty refs not refused" "rc=$rc $(out)"
   fi
 
-  # --- 4. app-facts: same guard, through a stub mxcli that drops a prepared catalog -------------
+  # --- 5. app-facts: same guard, through a stub mxcli that drops a prepared catalog -------------
   if [ -f "$AF" ]; then
-    for variant in source-calls full-nocalls; do
-      P="$(proj $layout)"; M="$(mdir "$P")"
+    for variant in source-calls full-actions full-kindless; do
+      P="$(proj $layout)"
       case "$variant" in
-        source-calls) mkdb "$WORK/prep.db" source 1 1 ;;
-        full-nocalls) mkdb "$WORK/prep.db" full 0 1 ;;
+        source-calls)  mkdb "$WORK/prep.db" source calls ;;
+        full-actions)  mkdb "$WORK/prep.db" full actions ;;
+        full-kindless) mkdb "$WORK/prep.db" full kindless ;;
       esac
       cat > "$WORK/mxcli-stub" <<EOF
 #!/usr/bin/env bash
@@ -152,11 +171,18 @@ EOF
           else
             bad "[$layout] app-facts refused a 'source' catalog with call edges" "rc=$rc $(out)"
           fi ;;
-        full-nocalls)
-          if [ "$rc" = 2 ] && grep -q "0 'call' edges" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out"; then
-            ok "[$layout] app-facts FAULTs on zero call edges, naming the mode"
+        full-actions)
+          if grep -q "catalog ok: build_mode=full" "$WORK/out"; then
+            ok "[$layout] app-facts accepts an action-only catalog (zero calls)"
+          else
+            bad "[$layout] app-facts refused a model with no calls" "rc=$rc $(out)"
+          fi ;;
+        full-kindless)
+          if [ "$rc" = 2 ] && grep -q "carry no RefKind" "$WORK/out" && grep -q "build_mode 'full'" "$WORK/out" \
+             && grep -q "(none)=2" "$WORK/out"; then
+            ok "[$layout] app-facts FAULTs on kind-less refs, naming the mode and counts"
           else
-            bad "[$layout] app-facts wrote facts from a catalog with no call edges" "rc=$rc $(out)"
+            bad "[$layout] app-facts wrote facts from untyped refs" "rc=$rc $(out)"
           fi ;;
       esac
     done
diff --git a/tests/wave2/test-conformance-per-brd-ledger.sh b/tests/wave2/test-conformance-per-brd-ledger.sh
index 766577cb..a18ac7d6 100755
--- a/tests/wave2/test-conformance-per-brd-ledger.sh
+++ b/tests/wave2/test-conformance-per-brd-ledger.sh
@@ -20,6 +20,7 @@
 #   6. a module whose index links to another module's per-BRD file: the link is named
 #   7. LEDGER_FILE that does not exist FAULTs instead of falling back
 #   8. --help documents LEDGER_FILE
+#   9. a BRD file name with a space stays one BRD (one report, not two)
 #
 # The ledgers and the mxcli stub are SYNTHETIC, as in test-conformance-baseline-scope.sh: the
 # field-proof rule's captured-golden-input clause governs parsers of tool output, and nothing
@@ -74,6 +75,9 @@ if grep -qx "$name" "$d/PRESENT"; then echo "-- $name"; echo "create $name;"; ex
 echo "Error: $name not found"; exit 1
 EOF
   chmod +x "$P/mxcli"
+  mkdir -p "$P/architecture/modules/Shipping/coverage-ledger"
+  ledger_rows "$P/architecture/modules/Shipping/coverage-ledger/F003 shipping.md" Shipping Parcel ACT_Parcel_Send
+  printf 'Shipping.Parcel\nShipping.ACT_Parcel_Send\n' >> "$P/PRESENT"
   ledger_rows "$O/coverage-ledger/F001-orders.md" Orders Order ACT_Order_Save
   ledger_rows "$O/coverage-ledger/F002-invoicing.md" Orders Invoice ACT_Invoice_Send
   cat > "$O/coverage-ledger.md" <<'EOF'
@@ -126,8 +130,8 @@ for layout in single two; do
 
   # --- 4. unscoped run: the index is not a third ledger -----------------------------------------
   rc="$(run)"
-  if [ "$rc" = 0 ] && grep -q "measured 4 " "$WORK/out" && ! grep -q "Orders/coverage-ledger.md" "$WORK/out"; then
-    ok "[$layout] unscoped run measures the 4 per-BRD rows; Orders' index is not read"
+  if [ "$rc" = 0 ] && grep -q "measured 6 " "$WORK/out" && ! grep -q "Orders/coverage-ledger.md" "$WORK/out"; then
+    ok "[$layout] unscoped run measures the 6 per-BRD rows (3 BRDs); Orders' index is not read"
   else
     bad "[$layout] unscoped run wrong on per-BRD layout" "rc=$rc $(out)"
   fi
@@ -146,6 +150,14 @@ for layout in single two; do
     && ok "[$layout] Billing's index names the ledger its rows are in" \
     || bad "[$layout] cross-module index not explained" "rc=$rc $(out)"
 
+  # --- 9. a BRD id with a space is one BRD --------------------------------------------------------
+  rm -f "$P"/docs/conformance/report-*.tsv
+  rc="$(run --module Shipping)"
+  n=$(ls "$P"/docs/conformance/ | grep -c '^report-')
+  [ "$rc" = 0 ] && [ "$n" = 1 ] && ls "$P"/docs/conformance/report-*-"F003 shipping.tsv" >/dev/null 2>&1 \
+    && ok "[$layout] 'F003 shipping.md' writes one report, report-<date>-F003 shipping.tsv" \
+    || bad "[$layout] a BRD id with a space was split" "rc=$rc $(ls "$P/docs/conformance" | tr '\n' '|')"
+
   # --- 7. a LEDGER_FILE that does not exist FAULTs ----------------------------------------------
   rc="$( ( cd "$P" && PROJECT_ROOT="$P" LEDGER_FILE=architecture/nope.md bash "$SUT" --quiet --module Orders ) \
            > "$WORK/out" 2>&1; echo $? )"
diff --git a/tests/wave2/test-review-conformance-per-brd.sh b/tests/wave2/test-review-conformance-per-brd.sh
new file mode 100755
index 00000000..9ccf5780
--- /dev/null
+++ b/tests/wave2/test-review-conformance-per-brd.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Usage: bash test-review-conformance-per-brd.sh [path-to-review-module.sh]
+#
+# Fixture for project-bin/review-module.sh's conformance rung on a per-BRD ledger.
+#
+# The defect (review of the #260 fix, 2026-10-13): conformance-check.sh writes one report per
+# BRD (docs/conformance/report-<date>-<BRD>.tsv) for a per-BRD ledger, and no report-<date>.tsv.
+# review-module.sh read exactly one file on both of its paths:
+#   - --reuse-conformance docs/conformance/report-<date>.tsv (what verify-module.sh passes):
+#     the file does not exist, so rung 13 of verify-module FAULTed "does not exist";
+#   - its own run: `ls -t report-*.tsv | head -1`, i.e. one BRD's rows, the others dropped.
+# Both now read every report of the run and slice this module's rows out of all of them.
+#
+# Cases, each on BOTH layouts (single-tree, and two-tree with the .mpr under app/):
+#   1. --reuse-conformance <base>: both per-BRD siblings are read (2 Orders rows, not a FAULT)
+#   2. its own run (stub conformance-check.sh in <project>/bin, which _tool prefers): rows from
+#      both per-BRD reports reach conformance.tsv
+#
+# The reports and the mxcli / conformance-check stubs are SYNTHETIC: the report columns are the
+# six conformance-check.sh writes, and the assertions are about which files are read. Later
+# rungs (graph sweep, coverage) fault harmlessly on the empty fixture project; only the
+# conformance slice is asserted.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/review-module.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+SUT="$(cd "$(dirname "$SUT")" && pwd)/$(basename "$SUT")"
+[ -f "$(dirname "$SUT")/_common.sh" ] || { echo "FAIL — _common.sh not beside $SUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/review-perbrd.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+D="$(date +%Y-%m-%d)"
+
+report() {  # report <file> <brd>
+  { printf 'module\tpointer\tstored\tobserved\tverdict\tcommand\n'
+    printf 'Orders\t%s:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW Orders.X\n' "$2"
+    printf 'Billing\t%s:`/microflows/1`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW Billing.Y\n' "$2"
+  } > "$1"
+}
+
+setup() {  # setup <single|two> -> sets P
+  P="$WORK/$1"; rm -rf "$P"
+  mkdir -p "$P/architecture/modules/Orders/coverage-ledger" "$P/docs/conformance" "$P/bin"
+  if [ "$1" = two ]; then mkdir -p "$P/app"; : > "$P/app/Shop.mpr"; else : > "$P/Shop.mpr"; fi
+  printf '# Orders — index\n- [F001](coverage-ledger/F001.md)\n' > "$P/architecture/modules/Orders/coverage-ledger.md"
+  : > "$P/architecture/modules/Orders/coverage-ledger/F001.md"
+  cat > "$P/mxcli" <<'EOF'
+#!/usr/bin/env bash
+case "$*" in *"SHOW MODULES"*) echo "| Orders |"; exit 0 ;; esac
+echo "Error: not available in this fixture"; exit 1
+EOF
+  chmod +x "$P/mxcli"
+  # Module-exists probe: the catalog answers instantly; without it review-module falls back to
+  # `mxcli SHOW MODULES` under a 60 s watchdog it waits out in full.
+  if command -v sqlite3 >/dev/null 2>&1; then
+    mkdir -p "$P/.mxcli"
+    printf "CREATE TABLE objects (QualifiedName TEXT, ModuleName TEXT);\nINSERT INTO objects VALUES ('Orders.X','Orders');\n" \
+      | sqlite3 "$P/.mxcli/catalog.db"
+  fi
+}
+run() { ( cd "$P" && PROJECT_ROOT="$P" MXTK_ROOT="" bash "$SUT" Orders --json-only --out "$P/out/report.json" "$@" ) \
+          > "$WORK/out" 2>&1; echo $?; }
+slice() { awk -F'\t' 'NR>1 && $1=="Orders"' "$P/.claude/loop/review/Orders/conformance.tsv" 2>/dev/null | grep -c . ; }
+out() { sed $'s/\033\[[0-9;]*m//g' "$WORK/out" | tr '\n' ' ' | cut -c1-400; }
+
+for layout in single two; do
+  echo "== $layout-tree layout"
+
+  # --- 1. reuse: verify-module passes the base name; the per-BRD siblings are the run ---------
+  setup "$layout"
+  report "$P/docs/conformance/report-$D-F001.tsv" F001
+  report "$P/docs/conformance/report-$D-F002.tsv" F002
+  run --reuse-conformance "docs/conformance/report-$D.tsv" >/dev/null
+  if grep -q "does not exist" "$WORK/out"; then
+    bad "[$layout] reuse FAULTed on a per-BRD run (base report-<date>.tsv absent)" "$(out)"
+  elif [ "$(slice)" = 2 ] && grep -q "2 rows from 2 report(s)" "$WORK/out"; then
+    ok "[$layout] reuse reads both per-BRD reports (2 Orders rows, Billing's filtered out)"
+  else
+    bad "[$layout] reuse did not slice both per-BRD reports" "slice=$(slice) $(out)"
+  fi
+
+  # --- 2. own run: every report this run wrote, not just the newest ---------------------------
+  setup "$layout"
+  cat > "$P/bin/conformance-check.sh" <<EOF
+#!/usr/bin/env bash
+mkdir -p docs/conformance
+$(declare -f report)
+report "docs/conformance/report-$D-F001.tsv" F001
+sleep 1
+report "docs/conformance/report-$D-F002.tsv" F002
+echo "conformance-check stub"; exit 0
+EOF
+  chmod +x "$P/bin/conformance-check.sh"
+  run >/dev/null
+  if [ "$(slice)" = 2 ]; then
+    ok "[$layout] own run slices rows from both per-BRD reports (2 Orders rows)"
+  else
+    bad "[$layout] own run read only the newest per-BRD report" "slice=$(slice) $(out)"
+  fi
+done
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-verify-stack-blocked.sh b/tests/wave2/test-verify-stack-blocked.sh
new file mode 100755
index 00000000..61f092e4
--- /dev/null
+++ b/tests/wave2/test-verify-stack-blocked.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Usage: bash test-verify-stack-blocked.sh [path-to-verify-module.sh]
+#
+# Fixture for project-bin/verify-module.sh's verdict for the stack rung.
+#
+# The defect (review of #313, 2026-10-13): test-stack-up.sh exits 4 for "instrument blocked —
+# the port `mxcli run --local` needs is held by another process", and its header says to
+# record that as blocked, not as a test failure. verify-module's verdict table mapped every
+# non-0, non-2 gate exit to FINDING, so a held port read as "the module has findings". It is
+# now a FAULT (the instrument did not measure), scoped to the stack rung: exit 4 means NOT
+# APPLICABLE from conformance-check.sh, so it is deliberately not a global remap.
+#
+# The verdict function is extracted from the subject and called directly — a full verify-module
+# run needs a live app. The exit codes are the ones test-stack-up.sh's own header documents.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/verify-module.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/verify-stack.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+FN="$(awk '/^_report_result\(\) \{/{on=1} on{print} on && /^\}/{exit}' "$SUT")"
+[ -n "$FN" ] || { echo "FAIL — no _report_result() in $SUT"; exit 1; }
+
+# verdict <kind> <rc> -> the verdict column _report_result writes to the summary
+verdict() {
+  ( ROOT="$WORK"; SUMMARY="$WORK/summary.tsv"; FINDINGS=0; FAULTED=0
+    c_ok() { :; }; c_bad() { :; }; c_warn() { :; }
+    : > "$SUMMARY"; echo "log" > "$WORK/x.log"
+    eval "$FN"
+    _report_result "rung" "$WORK/x.log" "$1" 60 "$2" 1 >/dev/null 2>&1
+    cut -f2 "$SUMMARY" )
+}
+
+v="$(verdict stack 4)"
+[ "$v" = FAULT ] && ok "stack rung exit 4 (port held) is FAULT, not FINDING" \
+  || bad "stack rung exit 4 graded as a test result" "$v"
+v="$(verdict stack 1)"
+[ "$v" = FINDING ] && ok "stack rung exit 1 (not up) is still FINDING" || bad "stack exit 1 changed" "$v"
+v="$(verdict stack 0)"
+[ "$v" = PASS ] && ok "stack rung exit 0 is PASS" || bad "stack exit 0 changed" "$v"
+v="$(verdict stack 2)"
+[ "$v" = FAULT ] && ok "stack rung exit 2 is FAULT" || bad "stack exit 2 changed" "$v"
+v="$(verdict gate 4)"
+[ "$v" = FINDING ] && ok "exit 4 from a non-stack gate rung is not remapped (scoped fix)" \
+  || bad "exit 4 remapped globally" "$v"
+
+grep -qE 'run "stack \(test-stack-up --check\)" "[^"]*" stack ' "$SUT" \
+  && ok "the stack rung is run with kind 'stack'" \
+  || bad "the stack rung does not use kind 'stack', so exit 4 still reads as FINDING"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From 0ca1dbdd01bc3c84ce7ca1daee77e36fd8223e6e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:03:27 +0000
Subject: [PATCH 32/68] process: third review round on the merge-review rule
 (verbatim fixes)

CHANGELOG states the 2,000-word trim trigger; the fixture-asking sentence names
the reviewer exception; reviewers re-measure the word count; "unreviewed" inbox
files means content not vetted, and their PRs still get the merge review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md | 2 +-
 CLAUDE.md    | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index db32f123..884efa3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 ## Unreleased
 
 - process(merging): **every PR gets an independent review before it merges — a merge go is not a review.** A reviewer that did not write the PR returns MERGE / MERGE-AFTER-FIX / HOLD on value, regression risk after sync, correctness and context cost; builder self-reports and green CI no longer count. Nine PRs merged on 2026-10-13 without one. — MendixMau
-- process(context): **the baseline word budget is made room for by moving text, never by deleting rules.** Rules, STOP rows, denominators and failure examples are protected; stories and examples move behind pointers in a separate, independently reviewed trim PR; trim starts at 95% of the cap. — MendixMau
+- process(context): **the baseline word budget is made room for by moving text, never by deleting rules.** Rules, STOP rows, denominators and failure examples are protected; stories and examples move behind pointers in a separate, independently reviewed trim PR; a trim PR lands first when a PR would take the baseline within 2,000 words of the cap. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/CLAUDE.md b/CLAUDE.md
index fcd3abbe..9fdce3ff 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -177,7 +177,8 @@ never count: the builder grades its own work, and CI proves only the tests the b
    `sync-project.sh` (new FAIL / BLIND / refusals, exit codes, output another tool parses, gate
    verdicts that flip), across both layouts and macOS / Git Bash? *Correctness*: real bugs, tests
    that do not test what they claim, hand-written golden input where a capture was required.
-   *Context cost*: words added to always-loaded skill files.
+   *Context cost*: words added to always-loaded skill files — re-measured by the reviewer, not taken
+   from the PR body.
 3. **Verdict.** `MERGE`, `MERGE-AFTER-FIX` (exact fixes listed; the fixes are pushed and
    re-reviewed before merge) or `HOLD` (goes back to the maintainer with the reason). Only `MERGE`
    merges.
@@ -237,7 +238,7 @@ and tag every few days — the release cycle is defined at the top of `CHANGELOG
 
 Contributions arrive through three lanes (`CONTRIBUTING.md`): the `contrib/inbox/` drop
 (no quality bar — triage promotes into `skills/`/`bug-logs/`/`bin/` and deletes the inbox file
-in the same commit; inbox files are unreviewed and nothing may cite them),
+in the same commit; inbox files are unreviewed — their content is not vetted for promotion — and nothing may cite them; a PR that adds one still gets the merge review below),
 `bin/harvest-learnings.sh <project-root>` (drafts inbox files from a project's bug logs,
 register promotion tables, and locally-patched installed scripts — run it at project wrap-up),
 and direct PRs held to the full field-proof bar. CI (`.github/workflows/checks.yml`) runs
@@ -347,7 +348,7 @@ fixtures the PR adds or that target its changed files, without asking, in a deta
 the PR branch. That isolation is what avoids the shared-tree problem above; the reviewer still
 never runs the full suites.
 
-**Asking is also required for a single fixture** — name it, say what it will tell us, and wait.
+**Outside that reviewer exception, asking is also required for a single fixture** — name it, say what it will tell us, and wait.
 
 Where a fixture's assertions are greps over a file you changed, prefer verifying by inspection:
 read the fixture, replicate its greps against the changed file, and report that. Same signal, no

From e3e6c278faff91fce73e50e9dac27a8549c3eb18 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:04:31 +0000
Subject: [PATCH 33/68] Lint Batch 4 review: SEC014 unset is a sync warning,
 not PASS-BLIND on every exec

- SEC014 with no external_roles reports nothing on exec; bin/sync-project.sh warns on every
  sync via new bin/lib/sec014-notice.sh (exact config lines, "none" only on the user's answer
  recorded in PROJECT.md, re-baseline right after configuring). Fixture
  tests/wave2/test-sec014-notice.sh (13 cases).
- Remaining SEC014 _rule messages (list, blank, unknown role, not FULL) fit lint-gate's
  160-char print and name the place to fix it.
- CONV009's "all flows at 0 objects" self-check needs activities_for() to find a real object
  in a zero-count flow, so an early greenfield model is not reported blind (+fixture).
- README / TXT002 header: turning a toolkit rule off is `rules: <ID>: enabled: false` in
  lint-config.yaml (verified on mxcli 0.26.0), never deleting the file; ISO dates are a
  toolkit opinion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   2 +-
 bin/lib/sec014-notice.sh                      |  39 ++
 bin/sync-project.sh                           |   9 +
 lint-rules/README.md                          |  39 +-
 lint-rules/conv009_max_microflow_objects.star |  27 +-
 lint-rules/sec014_external_role_write.star    |  36 +-
 .../txt002_non_iso_date_in_user_text.star     |   6 +-
 process/lint-backlog.md                       |   4 +-
 .../fixtures/conv009-h-all-zero.json          |  42 ++
 .../fixtures/conv009-m-zero-but-objects.json  |  98 ++++
 tests/lint-rules/fixtures/sec014-m-empty.json | 456 ++++++++++++++++++
 tests/lint-rules/test-batch4-rules.sh         |  14 +-
 tests/wave2/test-sec014-notice.sh             |  89 ++++
 13 files changed, 827 insertions(+), 34 deletions(-)
 create mode 100644 bin/lib/sec014-notice.sh
 create mode 100644 tests/lint-rules/fixtures/conv009-m-zero-but-objects.json
 create mode 100644 tests/lint-rules/fixtures/sec014-m-empty.json
 create mode 100644 tests/wave2/test-sec014-notice.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2405b1eb..08e2294a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is unset or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 26 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. A project that syncs gets SEC014 PASS-BLIND until it sets `external_roles` — MendixMau
+- feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is blank or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. Each message is under 160 characters and names the place to fix it, because lint-gate prints only that much. An **absent** option is not a `_rule` finding, so it does not block every exec (the #229 pattern). Instead `bin/sync-project.sh` warns on every sync through new `bin/lib/sec014-notice.sh` until the option is set (fixture `tests/wave2/test-sec014-notice.sh`, 13 cases). `"none"` switches a security rule off, so it is set only on the user's answer in chat and recorded in `PROJECT.md`. Right after configuring, re-baseline with `lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, because the 0 → N jump would otherwise be blamed on the next script. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 32 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. CONV009's "every flow reports 0 objects" self-check now needs `activities_for()` to find a real object in a zero-count flow, so an early greenfield model with empty microflows is not reported blind. `lint-rules/README.md` and the TXT002 header now give the supported way to turn a toolkit rule off. ISO dates in particular are a toolkit opinion, so a project with a non-ISO display standard sets `rules: TXT002: enabled: false` in `lint-config.yaml` and records that in `PROJECT.md`. It must not delete the file, which sync would re-install. On mxcli 0.26.0, a rule with 1 finding gave 0 once disabled. — MendixMau
 - feat(lint): **Lint Batch 3 — TXT001 build-process words in user-visible text, TXT002 non-ISO dates in user-visible text, UI001 Data grid 2 / Atlas input layout traps.** From the 2026-10-12 UX-fix retros ([#280](https://github.com/MendixMau/mxcli-project-toolkit/issues/280), [#282](https://github.com/MendixMau/mxcli-project-toolkit/issues/282), [#276](https://github.com/MendixMau/mxcli-project-toolkit/issues/276)): leaked words reached 3 of 3 apps and non-ISO dates 2 of 3, each past a one-off glossary grep; a list view in a grid column and a width on an Atlas input each cost fix rounds. Warning severity, `_rule` finding on a missing field, an empty `strings()` under a FULL-catalog rule, or vocabulary that matches nothing; 23 cases in `tests/lint-rules/test-batch3-rules.sh` (harness gained a `strings()` mock). Field run (mxcli 0.26.0, 21-module Mendix 11.12 model): 0/0/0 over 478 user-visible strings and 271 widgets, with loosened positive controls returning 27/50/17 through the same accessors. TXT002 cannot see format strings inside expressions — that half is a blocked row. `process/lint-backlog.md` Batch 5 lists all 17 candidates from the three issues (rows 32–48) — MendixMau
 - new(process): **feedback typed mid-build gets a change log in `PROJECT.md`, written before any edit, and the BRD/decision/architecture/wireframe is edited before the MDL.** Across 12 mid-build changes on real projects, 12 went straight into MDL and 0 updated a BRD, build plan or wireframe; the drift-sync `UNSYNCED` marker was never written once, and its absence is invisible, so every gate passed on silence. At the other extreme, one already-settled entity change cost ~270k tokens through two helper agents, and one screenshot-driven fix took 4 rounds because it regressed twice. New `skills/change-intake.md` (baseline, lead+ba, Stages 2–7; routing trigger "the user gives feedback or asks for a change mid-project"): one `## Change log` row per ask (`CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by`), six classes, each mapped to its entry artifact (a decision is superseded by a new row, never edited; a built page's visual change is recorded as a before/after screenshot pair instead of wireframe upkeep; impl/bug need only a regression journey). Ceremony is proportional: a small change the user typed gets a one-line receipt and no question, a medium one gets one batched question at the next module gate, a large one or one that contradicts a CONFIRMED decision is asked and stopped on, and stakeholder asks wait for the user. Statuses run open → refined → agreed → applied → proven, or rejected. `bin/lib/change-log.sh` holds the one template and the parser: `init-project.sh` writes the section, `sync-project.sh` appends it once to older projects, and `gate-check.sh` prints a **warn-only** `Change log:` line plus a dashboard row (rows not yet applied, N of M; applied/proven rows with no Closed-by; unrecognised statuses). It becomes blocking only after two projects' counts match a hand count. `project-bin/exec.sh --cr CR-NN` tags the BUILD-LOG detail cell (metrics-ledger columns unchanged). Ownership contradiction fixed: the lead marks; ba-agent flushes BRDs and briefs; architect-agent flushes wireframes and `architecture/` (runbook §3b, `iterative-build-loop.md`, `agent-roles.md`, both stubs, `close-the-loop.md`). Inbox TD-04's change-loop half is promoted here, and its row is narrowed to the two unpromoted items. Fixture `tests/wave2/test-change-log.sh` (39 cases, PROJECT.md built by the real init) — MendixMau
 - feat(exec): **per-project exec lock with stale takeover, opt-in `--commit-first`, a post-exec "restart needed / watch can apply this" verdict, a scoped `bin/app-restart.sh`, and `bin/test-scratch.sh` for `mxcli test` on a locked copy** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287) items 3-4, [#284](https://github.com/MendixMau/mxcli-project-toolkit/issues/284), [#275](https://github.com/MendixMau/mxcli-project-toolkit/issues/275), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289) items 1-2, [#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285), [#278](https://github.com/MendixMau/mxcli-project-toolkit/issues/278) recipe half). In a 20-task UX-fix field run over three apps (2026-10-12), 57 of 148 `exec.sh` runs applied nothing (26 refused on uncommitted model changes, 15 gate failures, 16 mxbuild exit 1), a machine-wide `pgrep "mxcli exec"` guard blocked an exec because another project was writing, watch mode silently missed recreated microflows, grants, attributes, pages, page URLs and theme SCSS/JS (~26 restarts), and 24 implementer restart-resumes cost 41.6M tokens because only the lead could restart apps. `exec.sh` now locks per project (atomic, `<pid> <epoch> <script>`, a dead or reused pid is taken over with a note; another project never blocks), `--commit-first` commits only the `.mpr` + `mprcontents/` (refused while Studio Pro holds the model; the refusal names the flag), and every applied script ends with the watch verdict (`--watch-compat` alone). `app-restart.sh` stops only the pid `run --local` recorded for THIS project, restarts it with the same command and returns when the port serves a Mendix page and its JS bundle; no record, or a record from another project, refuses. `ui-loop.md` gains the covers / does-not-cover table and the stale-runtime symptom list (incl. the `IO_PathNotFound deployment/web/pages` rebuild crash); `agent-roles.md` lets implementers run that one helper. Fixtures: `test-exec-lock-watch.sh` (45), `test-app-restart.sh` (30), `test-test-scratch.sh` (20) — MendixMau
diff --git a/bin/lib/sec014-notice.sh b/bin/lib/sec014-notice.sh
new file mode 100644
index 00000000..5fc6fa96
--- /dev/null
+++ b/bin/lib/sec014-notice.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# sec014-notice.sh — the one place a project hears that SEC014 is not configured yet.
+#
+# SEC014 (lint-rules/sec014_external_role_write.star) cannot tell an external role (partner,
+# customer, portal) from an internal one; the project has to name them in
+# .claude/lint-config.yaml (`rules: SEC014: options: external_roles: "A, B"`). Until it does,
+# the rule reports nothing on exec — a `_rule` blindness finding there would make lint-gate
+# exit PASS-BLIND on every exec of every synced project until someone edits a config file,
+# which is the #229 pattern (an unconfigured CONV020 logged 20 LINT BLIND rows in two apps).
+# The not-yet-decided state is said HERE instead, once per sync, as a sync warning, until the
+# option is set. A misconfigured value (a list, an unknown role) is still a `_rule` finding.
+#
+# Producer of the input: bin/sync-project.sh and bin/init-project.sh install the rule via
+# mxtk_install_lint_rules; lint-config.yaml is written by `mxcli init`.
+#
+# Usage: . bin/lib/sec014-notice.sh; mxtk_sec014_notice <project_dir>
+#   prints the notice lines and returns 0 when one is owed; prints nothing and returns 1 when
+#   the rule is not installed or external_roles is set (any value, "none" included).
+# Keep bash-3.2 compatible.
+
+mxtk_sec014_notice() {
+  _p="${1:?project dir}"
+  [ -f "$_p/.claude/lint-rules/sec014_external_role_write.star" ] || return 1
+  if [ -f "$_p/.claude/lint-config.yaml" ] &&
+     grep -Eq '^[[:space:]]*external_roles[[:space:]]*:' "$_p/.claude/lint-config.yaml"; then
+    return 1
+  fi
+  echo "SEC014 (external role can write state / audit / owner members) is installed but checks nothing:"
+  echo "no external_roles in .claude/lint-config.yaml. Ask the user which user roles are external"
+  echo "(partner, customer, portal), then add:"
+  echo "    rules:"
+  echo "      SEC014:"
+  echo "        options:"
+  echo "          external_roles: \"RoleA, RoleB\"   # one text, not a YAML list"
+  echo "\"none\" switches this security rule off: only on the user's answer in chat, recorded in"
+  echo "PROJECT.md — never to silence this notice. The first configured run raises SEC014 0 -> N, so"
+  echo "re-baseline right after: bin/lint-gate.sh --update-baseline --reason \"SEC014 configured\" --approved-in-chat"
+  return 0
+}
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index d0101698..339849e8 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1444,6 +1444,15 @@ fi
 if [ "$WIRED" -eq 1 ]; then
   mxtk_install_lint_rules "$(cd "$SCRIPT_DIR/.." && pwd)" "$PROJECT_DIR" "$DRY_RUN" "$UPGRADE_LINT"
   CHANGES=$((CHANGES + ${MXTK_LINT_CHANGES:-0}))
+  # SEC014 says "not configured" here, once per sync, never on exec (bin/lib/sec014-notice.sh).
+  . "$SCRIPT_DIR/lib/sec014-notice.sh"
+  if _sec014_msg=$(mxtk_sec014_notice "$PROJECT_DIR"); then
+    _old_ifs=$IFS; IFS='
+'
+    # shellcheck disable=SC2086
+    warn $_sec014_msg
+    IFS=$_old_ifs
+  fi
 fi
 
 # ── Script smoke — do the refreshed copies actually load on THIS machine? ────────────────
diff --git a/lint-rules/README.md b/lint-rules/README.md
index 3be6cb72..b1e438b0 100644
--- a/lint-rules/README.md
+++ b/lint-rules/README.md
@@ -19,9 +19,9 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 | `perf002_nested_data_widgets.star` | PERF002 — a data view / list view / data grid / gallery nested inside two or more other data widgets on the same page: re-queries per row at every level | `MAX_NESTING`, `DATA_WIDGET_CANDIDATES`, `EXCLUDE` (widget_type vocabulary: probe first) |
 | `perf004_npe_system_user_assoc.star` | PERF004 — an association between a non-persistable entity and System.User / System.Session (or an entity generalizing them), which pins session objects to the shared side | `NON_PERSISTABLE_CANDIDATES`, `SYSTEM_TARGETS` (entity_type vocabulary: probe first) |
 | `txt001_build_words_in_user_text.star` | TXT001 — user-visible text (titles, captions, templates, messages, menu items) holding build-process words: `Stage N`, `BR-10`, `F004`, TODO, a version tag, "(local, …)" | `PROJECT_WORDS` (sibling-app and project code names); `LEAK_PATTERNS` if "Stage N" is a real domain word |
-| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — delete it deliberately if the project's display standard is not ISO |
+| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no. ISO dates are a toolkit opinion, not a Mendix rule. A project whose display standard is not ISO turns it off in `.claude/lint-config.yaml` (`rules: TXT002: enabled: false`), never by deleting the file, which sync re-installs. See "Turning a toolkit rule off" below |
 | `ui001_widget_layout_traps.star` | UI001 — a list view inside a Data grid 2 column (its own "Load more" / "No items found" in every cell); an inline `width` on an Atlas input without `flex` (ignored) | `DATAGRID_TYPES`, `LISTVIEW_TYPES`, `INPUT_TYPES` (widget_type vocabulary: probe first) |
-| `sec014_external_role_write.star` | SEC014 — an external user role (partner, customer, portal) that can write every member, a state enumeration (`Status`, `State`, …), an audit attribute (`…At` / `…By`) or the association its own XPath uses for ownership: the client API lets it skip the approval microflow | **yes, required**, in `.claude/lint-config.yaml`: `rules: SEC014: options: external_roles: "Partner, Customer"` (one text, not a YAML list), or `"none"`. Unset is a `_rule` finding, so the gate reports PASS-BLIND until it is set |
+| `sec014_external_role_write.star` | SEC014 — an external user role (partner, customer, portal) that can write every member, a state enumeration (`Status`, `State`, …), an audit attribute (`…At` / `…By`) or the association its own XPath uses for ownership: the client API lets it skip the approval microflow | **yes, required**, in `.claude/lint-config.yaml`: `rules: SEC014: options: external_roles: "Partner, Customer"` (one text, not a YAML list), or `"none"`. Until it is set the rule reports nothing and `bin/sync-project.sh` warns on every sync; a list, a blank value or an unknown role is a `_rule` finding |
 
 `err001` and `loop001` first field count (2026-10-12, mxcli 0.26.0, 21-module Mendix 11.12 model,
 876 microflows): ERR001 8 (3 true, 5 debatable — flows that return an error payload instead of
@@ -67,12 +67,12 @@ write on all 7 attributes of a decision entity, one of them an audit attribute,
 association its own XPath scopes on; a true positive by the rule's definition, the same shape as
 #268. Positive control with every user role configured: 7 findings across 6 entities, and a SQL
 replay of the same logic over `.mxcli/catalog.db` gives the same 7 (0 on the second model, which
-has no external role; `"none"` there gives 0 and no `_rule`). Unset, a list, or a misspelt role
-each give exactly one `_rule` finding. Both files also load and give the same counts on mxcli
+has no external role; `"none"` there gives 0 and no `_rule`). A list or a misspelt role each give
+exactly one `_rule` finding; an absent option gives nothing on exec and a sync warning instead. Both files also load and give the same counts on mxcli
 0.17.0 and 0.24.0 (SEC014 avoids `associations()`, which does not exist before 0.25.0 and would
 make the file fail to load). Vocabulary landed in SEC014's header: `MEMBER_WRITE` rows carry
 qualified member and module-role names, attribute `data_type` for an enum is `Enumeration`.
-Unit cases: `tests/lint-rules/test-batch4-rules.sh` (26; the harness gained `get_option`,
+Unit cases: `tests/lint-rules/test-batch4-rules.sh` (32; the harness gained `get_option`,
 `permissions_for`, `attributes_for`, `user_roles`, `role_mappings` mocks).
 
 `data_change_microflows` and `entity_business_key` are **repaired copies of rules `mxcli init`
@@ -145,6 +145,35 @@ the template has not moved. The receipt lives outside `lint-rules/`, which is wh
 survive `mxcli init` — and surviving matters, because init wipes every in-file marker at once,
 which would otherwise make a genuine revert indistinguishable from a first install.
 
+**SEC014 needs two decisions from the user, not from an agent.** Until `external_roles` is
+set, SEC014 reports nothing on exec, and `bin/sync-project.sh` warns on every sync with the exact
+lines to add (`bin/lib/sec014-notice.sh`). It is not a `_rule` finding, because that would make
+lint-gate exit PASS-BLIND on every exec of every synced project until someone answered, which is
+the #229 pattern an unconfigured CONV020 caused. Which roles are external is the user's answer,
+asked in chat. `external_roles: "none"` switches off a security rule, so it is set only on the
+user's answer and recorded as a decision row in `PROJECT.md`. An agent never sets it to make the
+warning go away. The first run after configuring raises SEC014 from 0 to N at once, and lint-gate
+would blame that security-tier rise on whatever script ran next. So re-baseline in the same step:
+`bin/lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, after the
+user has seen the findings.
+
+**Turning a toolkit rule off** is a line in `.claude/lint-config.yaml`, never a deleted or
+edited file. Sync re-installs a deleted rule, and it reports an edited one as locally modified
+on every run. TXT002 is the usual case, because ISO dates are this toolkit's opinion rather than
+a Mendix rule:
+
+```yaml
+rules:
+  TXT002:
+    enabled: false   # display standard is not ISO: decided <date>, see PROJECT.md
+```
+
+mxcli skips a rule whose `enabled` is false. That applies to Starlark rules too, by `RULE_ID`
+(verified 2026-10-13 on mxcli 0.26.0: a toolkit rule with 1 finding gave 0 once disabled). Record
+the decision in `PROJECT.md`, as for SEC014's `"none"`. If you also want sync to stop installing
+the file, use the opt-out list in PR #308 (`.claude/lint-rules-disabled.txt`) once that PR is
+merged.
+
 **Tuning a toolkit rule never means editing it.** `conv009` and `sec014` read their settings
 with `get_option()` from `.claude/lint-config.yaml` (`rules: <RULE_ID>: options:`), so the file
 stays byte-identical to the toolkit's and keeps refreshing. mxcli passes an option to Starlark
diff --git a/lint-rules/conv009_max_microflow_objects.star b/lint-rules/conv009_max_microflow_objects.star
index 099cf5b5..2e924b9a 100644
--- a/lint-rules/conv009_max_microflow_objects.star
+++ b/lint-rules/conv009_max_microflow_objects.star
@@ -37,7 +37,9 @@
 #   - maxObjects / countLoopBodies set to something unusable (a list, text, 0): `_rule`
 #     finding, and the rule does not silently fall back to 15.
 #   - countLoopBodies on an mxcli without total_activity_count: `_rule` finding.
-#   - flows exist and every one reports 0 objects: activity_count is not populated.
+#   - every flow reports 0 objects, yet activities_for() finds a real object (not a start,
+#     end or merge) in one of them: activity_count is not populated. Zero everywhere with
+#     nothing behind it is an early greenfield model (empty microflows), not blindness.
 
 RULE_ID = "CONV009"
 RULE_NAME = "MaxMicroflowObjects"
@@ -46,8 +48,11 @@ CATEGORY = "quality"
 SEVERITY = "info"
 
 DEFAULT_MAX_OBJECTS = 15
-# Below this many flows, "every flow has 0 objects" is a plausible empty model.
-MIN_FLOWS_FOR_BLINDNESS = 3
+# activities_for() rows that activity_count never counts (probed 2026-10-13, mxcli 0.26.0:
+# every flow has one StartEvent, empty flows have only start and end).
+NOT_COUNTED = ("StartEvent", "EndEvent", "ExclusiveMerge")
+# How many zero-count flows to cross-check with activities_for() before calling it.
+PROBE_FLOWS = 20
 
 
 def _blind(msg, suggestion):
@@ -94,11 +99,9 @@ def check():
             "Upgrade mxcli, or drop countLoopBodies from .claude/lint-config.yaml.",
         )]
 
-    counted = 0
     nonzero = 0
     for mf in flows:
         n = mf.total_activity_count if nested else mf.activity_count
-        counted += 1
         if n > 0:
             nonzero += 1
         if n <= max_objects:
@@ -113,10 +116,14 @@ def check():
             suggestion="Extract logical sections into SUB_ {}s to keep each at or under {} objects".format(noun, max_objects),
         ))
 
-    if counted >= MIN_FLOWS_FOR_BLINDNESS and nonzero == 0:
-        violations.append(_blind(
-            "CONV009 saw {} flows and every one reports 0 objects: activity_count is not populated on this mxcli. This rule inspected NOTHING.".format(counted),
-            "Probe: sqlite3 .mxcli/catalog.db \"SELECT ActivityCount, COUNT(*) FROM microflows GROUP BY 1;\" — then upgrade mxcli or report it upstream.",
-        ))
+    if len(flows) > 0 and nonzero == 0:
+        for mf in flows[:PROBE_FLOWS]:
+            real = [a for a in activities_for(mf.qualified_name) if a.activity_type not in NOT_COUNTED]
+            if real:
+                violations.append(_blind(
+                    "CONV009 blind: all {} flows report 0 objects, but {} has {}: activity_count is not populated on this mxcli.".format(len(flows), mf.qualified_name, len(real)),
+                    "Probe: sqlite3 .mxcli/catalog.db \"SELECT ActivityCount, COUNT(*) FROM microflows GROUP BY 1;\" — then upgrade mxcli or report it upstream.",
+                ))
+                break
 
     return violations
diff --git a/lint-rules/sec014_external_role_write.star b/lint-rules/sec014_external_role_write.star
index 180427d1..6b07fec7 100644
--- a/lint-rules/sec014_external_role_write.star
+++ b/lint-rules/sec014_external_role_write.star
@@ -25,7 +25,8 @@
 #     SEC014:
 #       options:
 #         external_roles: "Partner, Customer"   # user role or module role names, comma-separated
-#         # external_roles: "none"               # this app has no external role: rule is off, on the record
+#         # external_roles: "none"               # rule off: ONLY on the user's answer, asked in chat
+#                                                # and recorded in PROJECT.md; never to silence a notice
 #         # state_names: "Status, State, Result, Stage, Phase"   # the default list
 #
 # The value is ONE TEXT, not a YAML list: mxcli passes only bool / int / float / text
@@ -37,8 +38,16 @@
 # listing the members. Skipped: System / Administration, non-persistable and external
 # entities.
 #
-# SELF-CHECKS (a rule that cannot see must say so, never report a clean pass):
-#   - external_roles unset, empty or a list: `_rule` finding. Set it, or set "none".
+# NOT CONFIGURED YET (option absent): the rule returns nothing, and bin/sync-project.sh
+# says so instead, once per sync, as a sync warning (bin/lib/sec014-notice.sh). A `_rule`
+# finding here would make lint-gate exit PASS-BLIND on every exec of every synced project until
+# someone answers a question — the #229 pattern. The silence is not a pass: the sync names it.
+# After configuring, SEC014 jumps 0 -> N in one run; re-baseline right then
+# (lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat), or the
+# rise is blamed on whatever script runs next.
+#
+# SELF-CHECKS (configured but unusable: the rule must say so, never report a clean pass):
+#   - external_roles empty, or a YAML list: `_rule` finding.
 #   - a configured name matches no user role and no module role: `_rule` finding (typo, or
 #     user_roles() / role_mappings() return nothing on this mxcli).
 #   - persistable entities exist and permissions_for() returns no row for any of them: the
@@ -65,6 +74,7 @@ DEFAULT_STATE_NAMES = "Status, State, Result, Stage, Phase"
 # "Nearby" and "Flat" do not match.
 AUDIT_PATTERN = "[a-z0-9_](At|By)$"
 OFF_VALUES = ("none", "-", "off")
+UNSET = "__mxtk_unset__"
 
 
 def _bare(name):
@@ -132,19 +142,23 @@ def _role_matches(perm_role, roles):
 
 
 def check():
-    raw = get_option("external_roles", "")
+    raw = get_option("external_roles", UNSET)
+    if raw == UNSET:
+        # Not decided yet: sync-project.sh reports it once per sync (see header).
+        return []
     if raw == None or type(raw) != "string":
+        # lint-gate prints message[:160] only, so the fix goes in the message.
         return [_blind(
-            "SEC014 option external_roles is {} ({}), not text. A YAML list reaches Starlark as None. This rule inspected NOTHING.".format(repr(raw), type(raw)),
-            "Write it as one text: `external_roles: \"Partner, Customer\"` under `rules: SEC014: options:` in .claude/lint-config.yaml.",
+            "SEC014 blind: external_roles is a list/non-text; write one text in .claude/lint-config.yaml rules: SEC014: options: external_roles: \"A, B\"",
+            "mxcli passes a YAML list to Starlark as None (got {}). Write the roles as one comma-separated text.".format(type(raw)),
         )]
     if raw.strip().lower() in OFF_VALUES:
         return []
     names = _split(raw)
     if not names:
         return [_blind(
-            "SEC014 has no external roles configured, so it cannot tell a partner / customer / portal role from an internal one. This rule inspected NOTHING.",
-            "Name them in .claude/lint-config.yaml: `rules: SEC014: options: external_roles: \"Partner, Customer\"`, or `external_roles: \"none\"` if this app has no external users.",
+            "SEC014 blind: external_roles empty. Ask the user; set .claude/lint-config.yaml rules: SEC014: options: external_roles (\"none\" only on their answer)",
+            "\"none\" turns this security rule off: only on the user's answer in chat, recorded in PROJECT.md, never to silence this finding.",
         )]
 
     raw_states = get_option("state_names", DEFAULT_STATE_NAMES)
@@ -156,8 +170,8 @@ def check():
     violations = []
     if unknown:
         violations.append(_blind(
-            "SEC014 external role(s) {} match no user role and no module role ({} roles seen). Those roles were NOT inspected.".format(
-                ", ".join(["'" + u + "'" for u in unknown]), role_count),
+            "SEC014 blind: no such role {} ({} seen); fix .claude/lint-config.yaml rules: SEC014: options: external_roles".format(
+                ", ".join(["'" + u + "'" for u in unknown])[:40], role_count),
             "Check the spelling against `SHOW USER ROLES` / `SHOW MODULE ROLES`; if roles exist and none is seen, user_roles() / role_mappings() return nothing on this mxcli.",
         ))
     if not resolved:
@@ -226,7 +240,7 @@ def check():
 
     if persistable > 0 and perm_rows == 0:
         violations.append(_blind(
-            "SEC014 saw {} persistable entities and permissions_for() returned no access rule for any of them: the catalog is not FULL. This rule inspected NOTHING.".format(persistable),
+            "SEC014 blind: {} persistable entities, no access rule rows: catalog not FULL. Run REFRESH CATALOG FULL, then lint again.".format(persistable),
             "Run `REFRESH CATALOG FULL` (permissions are only indexed in full mode), then lint again.",
         ))
 
diff --git a/lint-rules/txt002_non_iso_date_in_user_text.star b/lint-rules/txt002_non_iso_date_in_user_text.star
index ee56e8ba..7565d662 100644
--- a/lint-rules/txt002_non_iso_date_in_user_text.star
+++ b/lint-rules/txt002_non_iso_date_in_user_text.star
@@ -28,8 +28,10 @@
 # a DateTime attribute rendered with the locale's default format — that is a widget format
 # setting, not a string.
 #
-# If this project's display standard is deliberately not ISO, delete this rule rather than
-# loosening the patterns until it is quiet.
+# ISO dates are a toolkit opinion, not a Mendix rule. If this project's display standard is
+# deliberately not ISO, turn the rule off in .claude/lint-config.yaml
+# (`rules: TXT002: enabled: false`) and record the decision in PROJECT.md. Do not delete or
+# loosen this file: sync re-installs a deleted rule and reports an edited one on every run.
 #
 # REQUIRES mxcli >= 0.25.0 (the strings() builtin) and a FULL catalog. On an older binary
 # this file does not load at all — mxcli prints "rule file skipped" on stderr and no `_rule`
diff --git a/process/lint-backlog.md b/process/lint-backlog.md
index 47519d3a..78a8ec68 100644
--- a/process/lint-backlog.md
+++ b/process/lint-backlog.md
@@ -137,7 +137,7 @@ says a role is external. Lint Batch 4 shipped both rows; the field-run counts ar
 
 | # | Rule | Category | Evidence | Needs | Status |
 |---|---|---|---|---|---|
-| 49 | External role (configured) can write all members, a state enumeration (`Status`/`State`/`Result`/`Stage`/`Phase`), an audit `…At`/`…By` attribute, or the association its own XPath scopes ownership on (SEC014) | security | #268: a partner role held `create, read *, write *` on two self-owned entities with a state attribute; lint showed only CONV006 +4, re-baselined; a manual review found it five days later | `permissions_for()` `MEMBER_WRITE` rows, `attributes_for().data_type` (`Enumeration`), `user_roles()` / `role_mappings()`; `external_roles` option, text not list. Probed 2026-10-13 | drafted (Batch 4) |
+| 49 | External role (configured) can write all members, a state enumeration (`Status`/`State`/`Result`/`Stage`/`Phase`), an audit `…At`/`…By` attribute, or the association its own XPath scopes ownership on (SEC014) | security | #268: a partner role held `create, read *, write *` on two self-owned entities with a state attribute; lint showed only CONV006 +4, re-baselined; a manual review found it five days later | `permissions_for()` `MEMBER_WRITE` rows, `attributes_for().data_type` (`Enumeration`), `user_roles()` / `role_mappings()`; `external_roles` option, text not list; absent = sync warning, not a `_rule` finding. Probed 2026-10-13 | drafted (Batch 4) |
 | 50 | CONV009 threshold read from `lint-config.yaml` (`maxObjects`, `countLoopBodies`) instead of the stock hard-coded 15 | quality | #267: the generated config's own example does nothing; three apps at 36 / 30 / 5 findings, one app split flows only to satisfy the 15 | `get_option()`; `total_activity_count` (mxcli >= 0.25.0) for loop bodies. Default kept at 15: raising it for every project is a maintainer call | drafted (Batch 4) |
 
 ## Cheap extras (one afternoon each, when a batch has room)
@@ -172,7 +172,7 @@ a second backlog section. Forum only to weight by incident frequency.
 ## History
 
 - 2026-10-13 — Batch 6 added from #268 / #267 (rows 49–50). Lint Batch 4 shipped them as `SEC014`
-  and a toolkit-owned `CONV009` (status `drafted`, 26 unit cases). First field run, mxcli 0.26.0:
+  and a toolkit-owned `CONV009` (status `drafted`, 32 unit cases). First field run, mxcli 0.26.0:
   SEC014 1 finding with the one external role configured, positive control 7 that a SQL replay
   matches; CONV009 5 / 5 / 10 at 15 / 20 / 10, while stock CONV009 stayed at 5 with `maxObjects: 20`.
 - 2026-10-13 — Batch 5 added from #276 / #280 / #282 (rows 32–48). Lint Batch 3 shipped rows
diff --git a/tests/lint-rules/fixtures/conv009-h-all-zero.json b/tests/lint-rules/fixtures/conv009-h-all-zero.json
index 5dcad647..33c69e2a 100644
--- a/tests/lint-rules/fixtures/conv009-h-all-zero.json
+++ b/tests/lint-rules/fixtures/conv009-h-all-zero.json
@@ -1,4 +1,46 @@
 {
+ "activities": {
+  "Sales.A": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.A"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.A"
+   }
+  ],
+  "Sales.B": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.B"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.B"
+   }
+  ],
+  "Sales.C": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.C"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.C"
+   }
+  ],
+  "Sales.D": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.D"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.D"
+   }
+  ]
+ },
  "microflows": [
   {
    "activity_count": 0,
diff --git a/tests/lint-rules/fixtures/conv009-m-zero-but-objects.json b/tests/lint-rules/fixtures/conv009-m-zero-but-objects.json
new file mode 100644
index 00000000..a6447f3f
--- /dev/null
+++ b/tests/lint-rules/fixtures/conv009-m-zero-but-objects.json
@@ -0,0 +1,98 @@
+{
+ "activities": {
+  "Sales.A": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.A"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.A"
+   }
+  ],
+  "Sales.B": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.B"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.B"
+   }
+  ],
+  "Sales.C": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.C"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.C"
+   },
+   {
+    "activity_type": "ActionActivity",
+    "microflow_qualified_name": "Sales.C"
+   },
+   {
+    "activity_type": "ExclusiveSplit",
+    "microflow_qualified_name": "Sales.C"
+   },
+   {
+    "activity_type": "ExclusiveMerge",
+    "microflow_qualified_name": "Sales.C"
+   }
+  ],
+  "Sales.D": [
+   {
+    "activity_type": "StartEvent",
+    "microflow_qualified_name": "Sales.D"
+   },
+   {
+    "activity_type": "EndEvent",
+    "microflow_qualified_name": "Sales.D"
+   }
+  ]
+ },
+ "microflows": [
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "A",
+   "qualified_name": "Sales.A",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "B",
+   "qualified_name": "Sales.B",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "C",
+   "qualified_name": "Sales.C",
+   "total_activity_count": 0
+  },
+  {
+   "activity_count": 0,
+   "document_noun": "microflow",
+   "document_noun_title": "Microflow",
+   "microflow_type": "MICROFLOW",
+   "module_name": "Sales",
+   "name": "D",
+   "qualified_name": "Sales.D",
+   "total_activity_count": 0
+  }
+ ]
+}
diff --git a/tests/lint-rules/fixtures/sec014-m-empty.json b/tests/lint-rules/fixtures/sec014-m-empty.json
new file mode 100644
index 00000000..832fbf03
--- /dev/null
+++ b/tests/lint-rules/fixtures/sec014-m-empty.json
@@ -0,0 +1,456 @@
+{
+ "associations": [
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Partner",
+   "qualified_name": "Portal.Offer_Partner",
+   "to_entity": "Portal.Partner"
+  },
+  {
+   "from_entity": "Portal.Offer",
+   "module_name": "Portal",
+   "name": "Offer_Contact",
+   "qualified_name": "Portal.Offer_Contact",
+   "to_entity": "Portal.Contact"
+  }
+ ],
+ "attributes": {
+  "Portal.Contact": [
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Name"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Contact",
+    "module_name": "Portal",
+    "name": "Email"
+   }
+  ],
+  "Portal.Offer": [
+   {
+    "data_type": "Enumeration",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Status"
+   },
+   {
+    "data_type": "Decimal",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Amount"
+   },
+   {
+    "data_type": "DateTime",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "SubmittedAt"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "ApprovedBy"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Note"
+   },
+   {
+    "data_type": "String",
+    "entity_qualified_name": "Portal.Offer",
+    "module_name": "Portal",
+    "name": "Format"
+   }
+  ]
+ },
+ "entities": [
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Offer",
+   "qualified_name": "Portal.Offer"
+  },
+  {
+   "entity_type": "Persistent",
+   "module_name": "Portal",
+   "name": "Contact",
+   "qualified_name": "Portal.Contact"
+  }
+ ],
+ "options": {
+  "external_roles": "  "
+ },
+ "permissions": [
+  {
+   "access_type": "CREATE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": true,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "xpath_constraint": "[Portal.Offer_Partner/Portal.Partner/Portal.Partner_Account = '[%CurrentUser%]']"
+  },
+  {
+   "access_type": "READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Status",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Amount",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "SubmittedAt",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "ApprovedBy",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Note",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Format",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Partner",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_READ",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  },
+  {
+   "access_type": "MEMBER_WRITE",
+   "entity_name": "Portal.Offer",
+   "is_constrained": false,
+   "member_name": "Portal.Offer_Contact",
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "xpath_constraint": ""
+  }
+ ],
+ "role_mappings": [
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Partner",
+   "user_role_name": "Partner"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Buyer",
+   "user_role_name": "Buyer"
+  },
+  {
+   "module_name": "Portal",
+   "module_role_name": "Portal.Customer",
+   "user_role_name": "Customer"
+  }
+ ],
+ "user_roles": [
+  {
+   "module_roles": [
+    "Portal.Partner"
+   ],
+   "name": "Partner"
+  },
+  {
+   "module_roles": [
+    "Portal.Buyer"
+   ],
+   "name": "Buyer"
+  },
+  {
+   "module_roles": [
+    "Portal.Customer"
+   ],
+   "name": "Customer"
+  }
+ ]
+}
diff --git a/tests/lint-rules/test-batch4-rules.sh b/tests/lint-rules/test-batch4-rules.sh
index 4203d895..89f48fa8 100755
--- a/tests/lint-rules/test-batch4-rules.sh
+++ b/tests/lint-rules/test-batch4-rules.sh
@@ -73,11 +73,11 @@ PY
 
 echo "== SEC014 =="
 run "$R1" sec014-a-unset
-check "a external_roles unset -> 1 _rule finding, nothing inspected" 'len(v)==1 and v[0]["module"]=="_rule" and "no external roles configured" in v[0]["message"]'
+check "a external_roles absent -> 0 here; bin/sync-project.sh reports it instead (no PASS-BLIND on every exec)" 'len(v)==0'
 run "$R1" sec014-b-none
 check "b external_roles \"none\" -> 0 (the app has no external role, on the record)" 'len(v)==0'
 run "$R1" sec014-c-list
-check "c external_roles as a YAML list (reaches Starlark as None) -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "not text" in v[0]["message"]'
+check "c external_roles as a YAML list (reaches Starlark as None) -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "list/non-text" in v[0]["message"]'
 run "$R1" sec014-d-write-all
 check "d write * by the external role -> 1 finding (internal role with the same grant not flagged)" 'len(v)==1 and v[0]["document_name"]=="Portal.Offer" and "external role '"'"'Partner'"'"'" in v[0]["message"]'
 check "d message lists all members, state, both audit attrs, the ownership association" 'all(s in v[0]["message"] for s in ["all 6 attributes (write *)","state Status","audit ApprovedBy, SubmittedAt","ownership association Offer_Partner"])'
@@ -96,6 +96,12 @@ run "$R1" sec014-j-skipped
 check "j Administration, non-persistable and external entities skipped -> 0" 'len(v)==0'
 run "$R1" sec014-k-two-roles
 check "k two roles (';' and ',' separators, a duplicate) -> one finding per entity x role" 'sorted(x["message"].split("external role ")[1].split(" ")[0] for x in v)==["'"'"'Customer'"'"'","'"'"'Partner'"'"'"]'
+run "$R1" sec014-m-empty
+check "m external_roles set but blank -> 1 _rule finding naming \"none\" as the user's answer" 'len(v)==1 and v[0]["module"]=="_rule" and "\"none\" only on their answer" in v[0]["message"]'
+for f in sec014-c-list sec014-h-unknown-role sec014-i-not-full sec014-m-empty; do
+  run "$R1" "$f"
+  check "${f#sec014-} _rule message fits lint-gate's 160-char print and names the place to fix it" 'all(len(x["message"])<=160 for x in v) and ("lint-config.yaml" in v[0]["message"] or "REFRESH CATALOG FULL" in v[0]["message"])'
+done
 run "$R1" sec014-l-mapping-only
 check "l user_roles() empty, role_mappings() names the role -> still resolved, 1 finding" 'len(v)==1 and v[0]["module"]=="Portal"'
 
@@ -115,7 +121,9 @@ check "f maxObjects: 0 -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule
 run "$R2" conv009-g-loop-text
 check "g countLoopBodies: \"yes\" -> 1 _rule finding" 'len(v)==1 and v[0]["module"]=="_rule" and "countLoopBodies" in v[0]["message"]'
 run "$R2" conv009-h-all-zero
-check "h four flows all at 0 objects -> 1 _rule finding 'not populated'" 'len(v)==1 and v[0]["module"]=="_rule" and "not populated" in v[0]["message"]'
+check "h four empty flows (start/end only) -> 0: an early greenfield model is not blindness" 'len(v)==0'
+run "$R2" conv009-m-zero-but-objects
+check "m every flow 0 objects but activities_for() finds an action -> 1 _rule 'not populated'" 'len(v)==1 and v[0]["module"]=="_rule" and "not populated" in v[0]["message"] and "Sales.C has 2" in v[0]["message"]'
 run "$R2" conv009-i-empty
 check "i no flows -> 0 (an empty model is not blindness)" 'len(v)==0'
 run "$R2" conv009-j-nanoflow
diff --git a/tests/wave2/test-sec014-notice.sh b/tests/wave2/test-sec014-notice.sh
new file mode 100644
index 00000000..6bfc30e8
--- /dev/null
+++ b/tests/wave2/test-sec014-notice.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Fixture for bin/lib/sec014-notice.sh and its one caller, bin/sync-project.sh: an installed
+# SEC014 with no `external_roles` in .claude/lint-config.yaml is reported once per sync, as a
+# sync warning, instead of as a `_rule` blindness finding that would fail every exec (#229
+# pattern; review of PR #312).
+#
+# Usage: bash test-sec014-notice.sh [path-to-sync-project.sh]
+#
+# The lint-config.yaml bodies below start from the file `mxcli init` writes (v0.26.0, captured
+# 2026-10-13 into an empty directory): its `rules: {}` and the commented CONV009 example. A
+# commented `# external_roles:` must not count as configured.
+# Keep bash-3.2 compatible.
+
+set -uo pipefail
+SYNC="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/bin/sync-project.sh}"
+case "$SYNC" in /*) ;; *) SYNC="$PWD/$SYNC" ;; esac
+SUT="$(dirname "$SYNC")/lib/sec014-notice.sh"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+if [ ! -f "$SUT" ]; then
+  bad "bin/lib/sec014-notice.sh missing — nothing tells a project SEC014 is unconfigured"
+  echo "PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/sec014n.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+STOCK_CFG='# mxcli lint configuration.
+excludeModules:
+  - System
+
+# Per-rule overrides. Examples:
+#
+# rules:
+#   CONV009:            # max microflow objects
+#     severity: warning
+#     options:
+#       maxObjects: 20
+rules: {}
+'
+mkp() { # name, install-rule(0/1), config-text-or-NONE
+  d="$TMP/$1"; mkdir -p "$d/.claude/lint-rules"
+  [ "$2" = 1 ] && : > "$d/.claude/lint-rules/sec014_external_role_write.star"
+  [ "$3" != NONE ] && printf '%s' "$3" > "$d/.claude/lint-config.yaml"
+  echo "$d"
+}
+notice() { ( . "$SUT"; mxtk_sec014_notice "$1" ); }
+
+echo "== the notice =="
+p=$(mkp a 1 "$STOCK_CFG"); out=$(notice "$p"); rc=$?
+[ $rc -eq 0 ] && ok "a rule installed, stock config -> notice owed" || bad "a no notice (rc=$rc)"
+case "$out" in *"rules:"*"SEC014:"*"options:"*"external_roles:"*) ok "a notice shows the exact config path" ;; *) bad "a config path missing" "$out" ;; esac
+case "$out" in *'"none"'*"user's answer"*"PROJECT.md"*) ok "a \"none\" is named as a user decision recorded in PROJECT.md" ;; *) bad "a none-is-a-decision missing" "$out" ;; esac
+case "$out" in *"--update-baseline"*"--approved-in-chat"*) ok "a tells to re-baseline right after configuring" ;; *) bad "a re-baseline hint missing" "$out" ;; esac
+
+p=$(mkp b 1 NONE); notice "$p" >/dev/null && ok "b rule installed, no lint-config.yaml -> notice owed" || bad "b no notice without a config file"
+p=$(mkp c 1 "${STOCK_CFG}#   SEC014:
+#     options:
+#       external_roles: \"X\"
+"); notice "$p" >/dev/null && ok "c commented external_roles does not count" || bad "c commented line counted as configured"
+p=$(mkp d 1 'rules:
+  SEC014:
+    options:
+      external_roles: "Partner"
+'); out=$(notice "$p"); rc=$?
+[ $rc -eq 1 ] && [ -z "$out" ] && ok "d external_roles set -> silent" || bad "d notice despite configuration" "$out"
+p=$(mkp e 1 'rules:
+  SEC014:
+    options:
+      external_roles: "none"
+'); notice "$p" >/dev/null && bad "e \"none\" still nagged" || ok "e \"none\" (a recorded decision) -> silent"
+p=$(mkp f 0 "$STOCK_CFG"); notice "$p" >/dev/null && bad "f notice without the rule installed" || ok "f rule not installed -> silent"
+
+echo "== wired into sync-project.sh =="
+if grep -q 'lib/sec014-notice.sh' "$SYNC" && grep -q 'mxtk_sec014_notice "\$PROJECT_DIR"' "$SYNC"; then
+  ok "sync-project.sh sources the lib and calls it"
+else bad "sync-project.sh does not call mxtk_sec014_notice"; fi
+# The call sits inside the WIRED lint block, after the rules are installed.
+blk=$(awk '/mxtk_install_lint_rules "\$\(cd/{f=1} f{print} f&&/^fi$/{exit}' "$SYNC")
+case "$blk" in *mxtk_sec014_notice*) ok "the call runs after mxtk_install_lint_rules, in the same WIRED block" ;; *) bad "the call is not in the lint install block" ;; esac
+# Its output goes through warn(), so the sync counts it and does not end "all up to date".
+case "$blk" in *"warn \$_sec014_msg"*) ok "the notice is a sync warning (counted, not just printed)" ;; *) bad "the notice bypasses warn()" ;; esac
+bash -n "$SYNC" && ok "sync-project.sh parses" || bad "sync-project.sh does not parse"
+
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From c78212999f1f8589243ea5114e562243f4df3092 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:07:49 +0000
Subject: [PATCH 34/68] Promote 2026-09-29 inbox notes: exec.sh refusal rule,
 UI fix rounds, transcript usage, autocompact advisory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- skills/iterative-build-loop.md: every model write via exec.sh; on a guard refusal commit
  (--commit-first), wait (lock) or stop — never FORCE_EXEC on own initiative; MCP writes
  accepted as unrecorded and recorded by an "MCP:" commit; phase-close count (model commits =
  exec rows + MCP: commits); save-then-check; no batched-gate mode, do not imitate one (#69,
  #171, #173).
- skills/upstream-feedback.md: Studio Pro MCP server asks as a third destination, with the
  evidence rows from the field comparison (#173).
- skills/learned-page-patterns.md: UI fix rounds — SCSS first, apply directly, re-look only
  changed pages; N1–N4 pre-apply checks (#170).
- skills/measured-claims.md §7: read each message's LAST usage record; re-measured on Claude
  Code 2.1.296 transcripts (sub-agents up to 7x low on the first record; main loop exact) (#171).
- bin/init-project.sh: auto-compact advisory, writes nothing, never fails (#167); fixture
  tests/wave2/test-init-autocompact.sh (9 checks, 4 fail on master). Field run: scaffolded four
  scratch projects with no setting, env 1M, settings 250000 and settings 1000000.
- Routing triggers for three on-demand rows extended so the refusal, UI round and token-count
  cases reach the stubs; baseline unchanged at 79,997 words.
- contrib/inbox: mcp-build-observations deleted (fully promoted); ui-loop-efficiency,
  parallel-build-hygiene, subagent-context-cost trimmed to what stays open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  3 +
 README.md                                     |  6 +-
 ROUTING.md                                    |  6 +-
 agents/architect-agent.md                     |  2 +-
 agents/ba-agent.md                            |  2 +-
 agents/gate-agent.md                          |  4 +-
 agents/mdl-agent.md                           |  6 +-
 agents/review-agent.md                        |  2 +-
 agents/test-agent.md                          |  2 +-
 bin/init-project.sh                           | 44 +++++++++++
 bin/lib/skill-routing.tsv                     |  6 +-
 .../2026-09-29-mcp-build-observations.md      | 25 -------
 .../2026-09-29-parallel-build-hygiene.md      | 13 ++--
 .../inbox/2026-09-29-subagent-context-cost.md |  7 +-
 .../inbox/2026-09-29-ui-loop-efficiency.md    | 13 ++--
 skills/iterative-build-loop.md                | 58 +++++++++++++++
 skills/learned-page-patterns.md               | 37 ++++++++++
 skills/measured-claims.md                     | 30 ++++++++
 skills/upstream-feedback.md                   | 19 +++++
 tests/wave2/test-init-autocompact.sh          | 73 +++++++++++++++++++
 20 files changed, 301 insertions(+), 57 deletions(-)
 delete mode 100644 contrib/inbox/2026-09-29-mcp-build-observations.md
 create mode 100755 tests/wave2/test-init-autocompact.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..ad407609 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- learn(iterative-build-loop, upstream-feedback): **every model write goes through `exec.sh`; on a refusal the move is commit (`--commit-first`), wait (exec lock) or stop and report — never `FORCE_EXEC` on the agent's own initiative; MCP writes stay allowed and are accepted as unrecorded, recorded by an `MCP:` commit; the gate checks the saved file (save, then check); no batched-gate mode exists, so do not imitate one with overrides; Studio Pro MCP server asks get a third destination in `upstream-feedback.md` with their evidence rows** ([#69](https://github.com/MendixMau/mxcli-project-toolkit/issues/69), [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171), [#173](https://github.com/MendixMau/mxcli-project-toolkit/issues/173)). The phase-close check is a count: model commits = exec rows + `MCP:` commits. Field evidence: a 2026-09-29 two-build comparison (229 errors hidden by a stale disk copy; per-script apply 22–30 s growing to 55–65 s). Routing triggers for the build loop, page patterns and measured claims now name the refusal, the UI round and transcript token counts (stubs re-rendered; baseline unchanged at 79,997 words) — MendixMau
+- learn(learned-page-patterns, measured-claims): **UI fix rounds: SCSS first, apply directly through `exec.sh`, re-look only changed pages (N of N), and check four regressions before applying (N1 page-column on the layout root, N2 `.d-none` losing to a `display` class, N3 Data Grid 2 `autoFit` columns at 32 px, N4 focus ring); transcript usage is read from each message's LAST record** ([#170](https://github.com/MendixMau/mxcli-project-toolkit/issues/170), [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171)). The round took 1,507 calls against 515 for a comparable build; re-measured on Claude Code 2.1.296 transcripts, sub-agent output read from the first record was up to 7x low while the main loop's was exact — MendixMau
+- new(init-project): **the scaffold prints an auto-compact advisory: a warning when `CLAUDE_CODE_AUTO_COMPACT_WINDOW` or a settings `autoCompactWindow` is above 250k, otherwise a `/autocompact 250k` recommendation; it writes no setting and never fails the scaffold** ([#167](https://github.com/MendixMau/mxcli-project-toolkit/issues/167)). A lead session at a 1M window averaged 363–466k context per call. Fixture `tests/wave2/test-init-autocompact.sh` (9 checks; 4 fail on master) — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/README.md b/README.md
index 50f41d55..0c7bcc37 100644
--- a/README.md
+++ b/README.md
@@ -525,7 +525,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` |
-| Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` |
+| Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts — a claim not in the register may not be cited | `skills/measured-claims.md` |
 | Any review pass that runs more than once — module-review, coherence, monkey, wiring-sweep: findings accumulate across runs, a per-run report cannot show a trend | `skills/improvement-register.md` |
 
 **Source — reading a legacy system (migration entry mode)**
@@ -587,7 +587,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Task | Skill to load |
 |---|---|
 | Dispatching a build step to a helper — generate its one-file pack (the brief's Build steps row, mxcli brain brief, live DESCRIBEs, example, folder) and hand over the path instead of a reading list. Measured: 25-38% fewer tool calls and 30-41% less time, same quality; the token saving is not proven | `project-bin/context-pack.sh` |
-| Building a module with mxcli — verified, iterative, coverage-checklist gated | `skills/iterative-build-loop.md` |
+| Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` |
 | After marking a module done, or any time "how much is built vs proven" is asked — renders build-plan.html from done- prefixes and verify-module.sh/improvement-register.md, kept as two honestly separate views; --json writes architecture/build-plan.json parsed from build-plan.md's Phase headings (a plan with no Phase headings gets no file) | `project-bin/build-plan-status.sh` |
 | Turning a client-derived Mendix app into a clean, shareable demo with zero client fingerprint — branding, data, custom widgets | `skills/anonymize-client-app-for-demo.md` |
 | Handing a headless-built model to a person — opening it in Studio Pro, a free sandbox, or a colleague's machine: the model travels, the demo data and runtime config (keys, an agent's bound model) do not, and each needs its own re-establish step | `skills/handoff-to-studio-pro.md` |
@@ -610,7 +610,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 
 | Task | Skill to load |
 |---|---|
-| Building and auditing Mendix pages — widget patterns, datasource shapes | `skills/learned-page-patterns.md` |
+| Building and auditing Mendix pages, or starting a UI fix round across many pages — widget patterns, datasource shapes; for a round: SCSS first, four regressions to check | `skills/learned-page-patterns.md` |
 | Generating a whole page tree in one script — the structure patterns that survive it | `skills/oneshot-page-structure-patterns.md` |
 | Building or auditing a collapsible sidebar nav — Atlas Core's collapsed state needs icons assigned per menu item or it silently clips label text | `skills/learned-sidebar-collapse-icons.md` |
 | Building or altering any data grid — native DATAGRID vs pluggable DG2 decision rule, the ALTER PAGE INSERT corruption, sort-by and filter-binding traps | `skills/learned-dg2-patterns.md` |
diff --git a/ROUTING.md b/ROUTING.md
index 2c55707c..3e0b4548 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -55,7 +55,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` | ba,architect | P,0 | ondemand |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` | all | - | ondemand |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` | all | 7 | ondemand |
-| Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` | all | - | ondemand |
+| Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts — a claim not in the register may not be cited | `skills/measured-claims.md` | all | - | ondemand |
 | Any review pass that runs more than once — module-review, coherence, monkey, wiring-sweep: findings accumulate across runs, a per-run report cannot show a trend | `skills/improvement-register.md` | mdl,gate,test,review | 5,6 | ondemand |
 | The first command of every session, and any time someone asks "where are we" or "what next" — one screen: stage, done/overdue, the ONE next action, from the instruments, never from memory | `bin/status.sh` | all | P,0,1,2,3,4,5,6,7 | baseline |
 | Before obeying any learned-* STOP or workaround that costs a detour — probe the binary you actually have, then stamp the verdict back into the rule | `skills/retesting-learned-rules.md` | all | - | baseline |
@@ -136,7 +136,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Reviewing any module before calling it done — the ONE pass: build, gate, prove, LOOK (is it logical, does it look right, does it match our design, over every page not just the tested ones), confirm with the denominator stated | `skills/module-review.md` | mdl,review,test | 5,6 | baseline |
 | Before any mxcli exec / exec.sh / --mcp write — ask or run? the knob decides | `bin/exec-approval.sh` | mdl,gate | 5,6 | baseline |
 | Dispatching a build step to a helper — generate its one-file pack (the brief's Build steps row, mxcli brain brief, live DESCRIBEs, example, folder) and hand over the path instead of a reading list. Measured: 25-38% fewer tool calls and 30-41% less time, same quality; the token saving is not proven | `project-bin/context-pack.sh` | mdl | 5 | ondemand |
-| Building a module with mxcli — verified, iterative, coverage-checklist gated | `skills/iterative-build-loop.md` | mdl,gate | 5 | ondemand |
+| Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` | mdl,gate | 5 | ondemand |
 | After marking a module done, or any time "how much is built vs proven" is asked — renders build-plan.html from done- prefixes and verify-module.sh/improvement-register.md, kept as two honestly separate views; --json writes architecture/build-plan.json parsed from build-plan.md's Phase headings (a plan with no Phase headings gets no file) | `project-bin/build-plan-status.sh` | architect,gate,review | 4,5,6 | ondemand |
 | Turning a client-derived Mendix app into a clean, shareable demo with zero client fingerprint — branding, data, custom widgets | `skills/anonymize-client-app-for-demo.md` | mdl,review | 6 | ondemand |
 | Handing a headless-built model to a person — opening it in Studio Pro, a free sandbox, or a colleague's machine: the model travels, the demo data and runtime config (keys, an agent's bound model) do not, and each needs its own re-establish step | `skills/handoff-to-studio-pro.md` | test,review | 6,7 | ondemand |
@@ -164,7 +164,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 
 | Always relevant for | Load this | Agent(s) | Stage(s) | Tier |
 |---|---|---|---|---|
-| Building and auditing Mendix pages — widget patterns, datasource shapes | `skills/learned-page-patterns.md` | mdl | 5 | ondemand |
+| Building and auditing Mendix pages, or starting a UI fix round across many pages — widget patterns, datasource shapes; for a round: SCSS first, four regressions to check | `skills/learned-page-patterns.md` | mdl | 5 | ondemand |
 | Generating a whole page tree in one script — the structure patterns that survive it | `skills/oneshot-page-structure-patterns.md` | mdl | 5 | ondemand |
 | Building or auditing a collapsible sidebar nav — Atlas Core's collapsed state needs icons assigned per menu item or it silently clips label text | `skills/learned-sidebar-collapse-icons.md` | mdl | 5 | ondemand |
 | Building or altering any data grid — native DATAGRID vs pluggable DG2 decision rule, the ALTER PAGE INSERT corruption, sort-by and filter-binding traps | `skills/learned-dg2-patterns.md` | mdl | 5 | ondemand |
diff --git a/agents/architect-agent.md b/agents/architect-agent.md
index 5e6927a3..2ef72c7b 100644
--- a/agents/architect-agent.md
+++ b/agents/architect-agent.md
@@ -71,7 +71,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/mendix-agents.md` | Building a Mendix AI agent |
 | `skills/company-brain.md` | Setting up or wiring a COMPANY BRAIN |
 | `skills/close-the-loop.md` | Cutover and retrospective |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `project-bin/build-plan-status.sh` | After marking a module done, or any time "how much is built vs proven" is asked |
 | `skills/workflow-structure-rules.md` | Designing or reviewing a Workflow's SHAPE before or after the MDL |
diff --git a/agents/ba-agent.md b/agents/ba-agent.md
index 92ef81ee..4176190a 100644
--- a/agents/ba-agent.md
+++ b/agents/ba-agent.md
@@ -87,7 +87,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/brd-validation.md` | Validating BRDs against the code and document KB |
 | `skills/company-brain.md` | Setting up or wiring a COMPANY BRAIN |
 | `skills/close-the-loop.md` | Cutover and retrospective |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `skills/mendix-epics-api.md` | Working with the Mendix Epics board programmatically |
 | `skills/upstream-feedback.md` | About to open an issue, PR or discussion against mxcli or the toolkit |
diff --git a/agents/gate-agent.md b/agents/gate-agent.md
index 32fa7df8..505e5241 100644
--- a/agents/gate-agent.md
+++ b/agents/gate-agent.md
@@ -56,14 +56,14 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/coverage-ledger.md` | Building the Stage 4 coverage ledger |
 | `bin/coverage-check.sh` | Checking a coverage ledger against its BRD |
-| `skills/iterative-build-loop.md` | Building a module with mxcli |
+| `skills/iterative-build-loop.md` | Building a module with mxcli, or an exec.sh guard just refused a write |
 | `project-bin/conformance-check.sh` | Running the ledger rung alone |
 | `project-bin/graph-sweep.sh` | Running the wiring rung alone |
 | `project-bin/test-stack-up.sh` | Before any runtime test |
 | `skills/company-brain.md` | Setting up or wiring a COMPANY BRAIN |
 | `skills/close-the-loop.md` | Cutover and retrospective |
 | `skills/report-schema.md` | Writing or reading docs/report.json |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `project-bin/coherence-cadence.sh` | After every module's CONFIRM stage |
 | `project-bin/build-plan-status.sh` | After marking a module done, or any time "how much is built vs proven" is asked |
diff --git a/agents/mdl-agent.md b/agents/mdl-agent.md
index a4b47bc4..a9e28c34 100644
--- a/agents/mdl-agent.md
+++ b/agents/mdl-agent.md
@@ -71,17 +71,17 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `bug-logs/mxcli-bugs.md` | Reading a whole class of tool defects (a retest, a new mxcli release, an audit) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/microflow-loop-antipatterns.md` | Reading what loop bodies do (LOOP_TQ, deferred commit, nested loop, REST in loop, transaction control per item, scheduled-event reachability) from described MDL; the catalog holds top-level activities only and cannot see inside a loop |
-| `skills/iterative-build-loop.md` | Building a module with mxcli |
+| `skills/iterative-build-loop.md` | Building a module with mxcli, or an exec.sh guard just refused a write |
 | `skills/mdl-cookbook-microflows.md` | Writing MDL microflow scripts |
 | `skills/build/mdl/oneshot-mdl-method.md` | Writing a single MDL script that takes a project from nothing to a working vertical slice |
-| `skills/learned-page-patterns.md` | Building and auditing Mendix pages |
+| `skills/learned-page-patterns.md` | Building and auditing Mendix pages, or starting a UI fix round across many pages |
 | `skills/oneshot-page-structure-patterns.md` | Generating a whole page tree in one script |
 | `skills/mendix-agents.md` | Building a Mendix AI agent |
 | `skills/mendix-agent-ui.md` | Embedding a copilot chat panel |
 | `skills/mendix-agent-setup.md` | Standing up a project's GenAI agents in any environment |
 | `skills/company-brain.md` | Setting up or wiring a COMPANY BRAIN |
 | `skills/close-the-loop.md` | Cutover and retrospective |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `project-bin/coherence-cadence.sh` | After every module's CONFIRM stage |
 | `skills/mpr-corruption-and-sp-load-errors.md` | Studio Pro will not load the project, or the .mpr looks gutted |
diff --git a/agents/review-agent.md b/agents/review-agent.md
index b925be50..63a7beac 100644
--- a/agents/review-agent.md
+++ b/agents/review-agent.md
@@ -78,7 +78,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/close-the-loop.md` | Cutover and retrospective |
 | `skills/report-schema.md` | Writing or reading docs/report.json |
 | `skills/harness-architecture.md` | Installing, extending, debugging or porting the verification harness |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `skills/process-coherence-pass.md` | Checking whether the whole journey hangs together rather than each piece |
 | `project-bin/coherence-cadence.sh` | After every module's CONFIRM stage |
diff --git a/agents/test-agent.md b/agents/test-agent.md
index 83ad1670..0ff1dd2a 100644
--- a/agents/test-agent.md
+++ b/agents/test-agent.md
@@ -57,7 +57,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/close-the-loop.md` | Cutover and retrospective |
 | `skills/report-schema.md` | Writing or reading docs/report.json |
 | `skills/harness-architecture.md` | Installing, extending, debugging or porting the verification harness |
-| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence |
+| `skills/measured-claims.md` | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts |
 | `skills/agent-permission-friction.md` | Any refused, denied or blocked command |
 | `skills/e2e-evidence-report.md` | Turning an already-rigorous run into a narrated proof a stakeholder can trust without running anything |
 | `skills/record-demo-video.md` | Recording a narrated screen-capture demo of a running app for a human to watch |
diff --git a/bin/init-project.sh b/bin/init-project.sh
index 243ea49e..7f04a17a 100755
--- a/bin/init-project.sh
+++ b/bin/init-project.sh
@@ -724,6 +724,50 @@ echo "  - Optional, NOT installed by this script: the context-cost hooks. They a
 echo "    they fire in every repo on this machine — so installing them is your explicit choice."
 echo "    Read README.md \"Context cost\" first (the numbers are the point), then:"
 echo "      bin/install-claude-hooks.sh          # prints the tier table, installs nothing"
+
+# Auto-compact window advisory (#167). A WARNING, never a written setting: the value is user-global
+# or per-model, and an override the person did not choose is worse than one line of text. Field
+# evidence (contrib-promoted, 2026-09-29): a lead session left at a 1M auto-compact window averaged
+# 363-466k context per call against ~128k for a comparable build — the cost gap was context re-read
+# per call, not call count; re-estimated at a 250k window the build cost fell by about a fifth.
+# Reads only what Claude Code itself reads (CLAUDE_CODE_AUTO_COMPACT_WINDOW, then an
+# "autoCompactWindow" number in the user or project settings.json; names checked against the
+# 2.1.x CLI) and never fails the scaffold.
+mxtk_compact_tokens() {   # "250k" | "1M" | "250000" | "auto" -> integer tokens, or empty
+  local v n mult=1
+  v="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  case "$v" in
+    *k) n="${v%k}"; mult=1000 ;;
+    *m) n="${v%m}"; mult=1000000 ;;
+    *)  n="$v" ;;
+  esac
+  case "$n" in ''|*[!0-9]*) return 0 ;; esac   # "auto", "1.5M", garbage: unknown, say nothing about it
+  printf '%s' "$(( 10#$n * mult ))"
+}
+_ac_limit=250000; _ac_val=""; _ac_from=""
+if [ -n "${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-}" ]; then
+  _ac_val="$(mxtk_compact_tokens "$CLAUDE_CODE_AUTO_COMPACT_WINDOW")"
+  _ac_from="CLAUDE_CODE_AUTO_COMPACT_WINDOW=$CLAUDE_CODE_AUTO_COMPACT_WINDOW"
+else
+  for _ac_f in "$PROJECT_DIR/.claude/settings.local.json" "$PROJECT_DIR/.claude/settings.json" \
+               "${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/settings.json"; do
+    [ -f "$_ac_f" ] || continue
+    # Largest number found wins: a per-model block may list several, and the warning is for the worst.
+    _ac_n="$( (grep -oE '"autoCompactWindow"[[:space:]]*:[[:space:]]*[0-9]+' "$_ac_f" 2>/dev/null || true) \
+              | grep -oE '[0-9]+$' | sort -n | tail -1 || true)"
+    if [ -n "$_ac_n" ]; then _ac_val="$_ac_n"; _ac_from="autoCompactWindow=$_ac_n in $_ac_f"; break; fi
+  done
+fi
+if [ -n "$_ac_val" ] && [ "$_ac_val" -gt "$_ac_limit" ]; then
+  echo "  - WARNING: auto-compact window is above 250k ($_ac_from). A field build at a 1M window"
+  echo "    averaged 363-466k context per call — every token re-read on every call. Lower it with"
+  echo "    /autocompact 250k (or CLAUDE_CODE_AUTO_COMPACT_WINDOW=250k). Nothing was changed."
+elif [ -n "$_ac_val" ]; then
+  echo "  - Auto-compact window: $_ac_from (at or below 250k — ok)."
+else
+  echo "  - Auto-compact window: none set (\"auto\"), which on a 1M-context model compacts near 1M."
+  echo "    Recommended: /autocompact 250k — a field lead at 1M averaged 363-466k per call. Not set by this script."
+fi
 echo ""
 
 "$SCRIPT_DIR/gate-check.sh" "$PROJECT_DIR" || true
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index 200b80e4..dc144e7f 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -146,10 +146,10 @@ design-artifacts	skills/design-artifacts.md	Designing the brand and ONE ANNOTATE
 brd-to-build-plan	skills/brd-to-build-plan.md	Turning BRDs plus architecture into a numbered, dependency-ordered build plan	architect	3,4	ondemand	requirements
 coverage-ledger	skills/coverage-ledger.md	Building the Stage 4 coverage ledger — every requirement either claimed by a build-plan row or catalogued with a reason, never invisible	architect,gate	4	ondemand	requirements
 coverage-check	bin/coverage-check.sh	Checking a coverage ledger against its BRD — every scalar leaf CLAIMED, LEDGERED, UNCLAIMED, PHANTOM or DOUBLE-CLAIMED, so coverage is measured rather than remembered	architect,gate	4	ondemand	requirements
-iterative-build-loop	skills/iterative-build-loop.md	Building a module with mxcli — verified, iterative, coverage-checklist gated	mdl,gate	5	ondemand	build
+iterative-build-loop	skills/iterative-build-loop.md	Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC	mdl,gate	5	ondemand	build
 mdl-cookbook-microflows	skills/mdl-cookbook-microflows.md	Writing MDL microflow scripts — worked recipes	mdl	5	ondemand	build/mdl
 oneshot-mdl-method	skills/build/mdl/oneshot-mdl-method.md	Writing a single MDL script that takes a project from nothing to a working vertical slice — execution order, why it is deliberately non-idempotent, the instrument hierarchy, and the silent failures that pass every check	mdl	5	ondemand	build/mdl
-learned-page-patterns	skills/learned-page-patterns.md	Building and auditing Mendix pages — widget patterns, datasource shapes	mdl	5	ondemand	build/pages
+learned-page-patterns	skills/learned-page-patterns.md	Building and auditing Mendix pages, or starting a UI fix round across many pages — widget patterns, datasource shapes; for a round: SCSS first, four regressions to check	mdl	5	ondemand	build/pages
 oneshot-page-structure-patterns	skills/oneshot-page-structure-patterns.md	Generating a whole page tree in one script — the structure patterns that survive it	mdl	5	ondemand	build/pages
 mendix-agents	skills/mendix-agents.md	Building a Mendix AI agent — the agent is runtime data not a model document, so JSON import, tool microflows, knowledge base chunk loading and the runtime wiring all sit outside MDL, and mxbuild stays green when they are wrong	mdl,architect	5	ondemand	build/agents
 mendix-agent-ui	skills/mendix-agent-ui.md	Embedding a copilot chat panel — the frame is yours, ConversationalUI owns the conversation; wireframe to tokens to snippet to page placement	mdl	5	ondemand	build/agents
@@ -170,7 +170,7 @@ company-brain	skills/company-brain.md	Setting up or wiring a COMPANY BRAIN — t
 close-the-loop	skills/close-the-loop.md	Cutover and retrospective — promoting proven patterns back into the toolkit	all	7	ondemand	spine
 report-schema	skills/report-schema.md	Writing or reading docs/report.json — the append-only contract every instrument writes to and every renderer reads; open BEFORE building a new instrument or a second renderer	test,review,gate	5,6	ondemand	verify
 harness-architecture	skills/harness-architecture.md	Installing, extending, debugging or porting the verification harness — which part owns what, which parts run standalone, and what a missing part must report	test,review	5,6	ondemand	verify
-measured-claims	skills/measured-claims.md	Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited	all	-	ondemand	spine
+measured-claims	skills/measured-claims.md	Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts — a claim not in the register may not be cited	all	-	ondemand	spine
 tool-output-is-not-ground-truth	skills/tool-output-is-not-ground-truth.md	Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude	all	-	baseline	diagnose
 agent-permission-friction	skills/agent-permission-friction.md	Any refused, denied or blocked command — BEFORE rewriting a permission rule and before telling the user a tool is blocked. A rule matches the START of the command line, so an allowlisted tool prefixed with cd matches nothing	all	-	ondemand	diagnose
 process-coherence-pass	skills/process-coherence-pass.md	Checking whether the whole journey hangs together rather than each piece — finds correctly-built components nothing reaches, which per-element conformance and UI tests both miss	review	5,6	ondemand	verify
diff --git a/contrib/inbox/2026-09-29-mcp-build-observations.md b/contrib/inbox/2026-09-29-mcp-build-observations.md
deleted file mode 100644
index 2fa4a2c9..00000000
--- a/contrib/inbox/2026-09-29-mcp-build-observations.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# What a Studio Pro MCP build teaches (and needs) — for the toolkit and for the MCP owners
-
-**From:** a field comparison (mxcli + toolkit build vs a Studio Pro MCP build, same frozen spec)
-**Date:** 2026-09-29
-**Kind:** learning
-**Field evidence:** The MCP build's METRICS/RETRO-LOG/TIME-LOG and the comparison tool's own tool journal: 406 screen-driving calls (22% of build calls) clustered on screens the MCP cannot write; those rows ran 12–21 min each vs 2.6–3.5 min/row for domain and logic; the person did 9 manual steps.
-**Proposed target:** `skills/upstream-feedback.md` (route the MCP items), `skills/iterative-build-loop.md` (the two adoptable habits)
-
----
-
-Adoptable by the toolkit:
-- **Save-then-check**: the MCP build lost time to checks against a stale disk copy (229 errors
-  hidden until a real save). The toolkit's exec gate already checks the saved file — keep it
-  that way, and say so in the build loop.
-- **Visual check per page during the build**, not after the person complains (the The MCP build's UI
-  work started only after "the UI looks quite bad").
-
-For the MCP/comparison-tool owners (not toolkit work):
-- Write support for security, user roles, role home pages, snippets, scheduled events,
-  import/export mappings, published REST, pluggable-widget property schema.
-- Atomic writes with fixed batch order (a reverse-order batch miswired 16 associations).
-- Auto-flush/save before mx check; reload instead of full restart (23 restarts).
-- Flag a missing end-of-parallel-path element in consistency check.
-- Parallel drafting sub-agents with the lead as the single writer.
-- Testing: commit scripts and results, add unit tests, make timers and ERP failure testable.
diff --git a/contrib/inbox/2026-09-29-parallel-build-hygiene.md b/contrib/inbox/2026-09-29-parallel-build-hygiene.md
index 2bfc62c8..b800b6d4 100644
--- a/contrib/inbox/2026-09-29-parallel-build-hygiene.md
+++ b/contrib/inbox/2026-09-29-parallel-build-hygiene.md
@@ -10,9 +10,10 @@
 
 Parallel drafting is the toolkit build's speed advantage (2.6 vs 5.5 min/row; equal calls per
 row), so keep it and remove its friction:
-- **Lock/queue mxbuild** across agents (exec.sh lock file or scratch-clone check). [measured: 2 collisions]
-- **Batch the gate**: one mxbuild per 3–5 consecutive clean scripts; per-script only after a
-  failure. [hypothesis: 10–20 min wall time saved in slice 2]
-- **Usage measurement**: streamed transcript lines carry partial usage; the measure script must
-  take each message's final usage record — sub-agent output was undercounted in both builds,
-  which briefly produced a false "MCP build writes 2.4x more output" conclusion.
+- ~~Lock/queue mxbuild~~ — done: per-project exec lock in `project-bin/exec.sh` (#304).
+- ~~Usage measurement~~ — promoted 2026-10-14 to `skills/measured-claims.md` §7 (re-measured:
+  sub-agent transcripts carry partial output_tokens on early records, up to 7x low).
+- **Still open — batch the gate**: one mxbuild per 3–5 consecutive clean scripts; per-script
+  only after a failure. [hypothesis: 10–20 min wall time saved in slice 2]. Needs an `exec.sh`
+  mode (it has none today; `skills/iterative-build-loop.md` → "Gate cost as the model grows"
+  says not to imitate one with overrides).
diff --git a/contrib/inbox/2026-09-29-subagent-context-cost.md b/contrib/inbox/2026-09-29-subagent-context-cost.md
index ce993fcf..f616d5c0 100644
--- a/contrib/inbox/2026-09-29-subagent-context-cost.md
+++ b/contrib/inbox/2026-09-29-subagent-context-cost.md
@@ -40,7 +40,8 @@ Calls per row are the same. The whole cost gap is **context re-read per call**:
 
 Output tokens and effort level are not the driver: lead-to-lead output per call is equal
 (~630 vs ~610 tokens). The recorded sub-agent output is undercounted in both builds
-(streamed usage records; `measure-usage.py` should read each message's final usage record).
+(streamed usage records; each message's final usage record is the right one — promoted to
+`skills/measured-claims.md` §7).
 
 ## Proposed improvements (hypotheses until re-measured)
 
@@ -49,8 +50,8 @@ Output tokens and effort level are not the driver: lead-to-lead output per call
   Target: sub-agent mean context ≤ ~130k (the MCP build's level).
 - **Pass the slice, not the spec.** A build sub-agent gets its rows + the module's BRD, not
   the whole frozen spec.
-- **Autocompact default in what `init-project.sh` writes** (or a preflight warning when a
-  session runs with autocompact > 250k).
+- ~~Autocompact default~~ — done 2026-10-14 as an advisory: `bin/init-project.sh` warns when
+  the auto-compact window is above 250k and recommends `/autocompact 250k`; it writes nothing.
 - **Cap agent bundles / add autocompact for sub-agents** so a long-running drafter compacts
   instead of growing to 500k+.
 - **Measure it.** Add per-role mean-context-per-call to the time log so the next run shows
diff --git a/contrib/inbox/2026-09-29-ui-loop-efficiency.md b/contrib/inbox/2026-09-29-ui-loop-efficiency.md
index 6c347e34..3e9bb1f5 100644
--- a/contrib/inbox/2026-09-29-ui-loop-efficiency.md
+++ b/contrib/inbox/2026-09-29-ui-loop-efficiency.md
@@ -16,8 +16,11 @@ Regressions round 1 introduced (N1–N4 are lintable):
 N1 `page-column` class landing on the layout root (shell detached); N2 Atlas `.d-none` loses to
 `.pill`; N3 Data Grid 2 autoFit starving columns to 32 px; N4 dashed focus ring on the rail.
 
-Proposed (hypotheses):
-- UI agents apply directly, one mx check per batch — roughly halves calls.
-- Cross-cutting fixes first, as SCSS, once; then re-review only changed pages.
-- N1–N4 as a pre-apply lint in check-page-shell / learned-css-that-never-applied.
-- Autocompact/bundle cap for UI drafters (see 2026-09-29-subagent-context-cost.md).
+Promoted 2026-10-14: the round order (SCSS first, apply directly, re-look only changed pages)
+and the N1–N4 pre-apply checks are in `skills/learned-page-patterns.md` → "UI fix rounds";
+N4's fix was already in `learned-css-that-never-applied.md`.
+
+Still open (not promoted):
+- N1–N3 as a mechanical pre-apply check in `project-bin/check-page-shell.sh` (today a prose
+  checklist only); needs captured page MDL / SCSS showing each regression as golden input.
+- Bundle cap for UI drafters (see 2026-09-29-subagent-context-cost.md).
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 8e64563f..c2a2591f 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -316,6 +316,64 @@ rm -f "$MPR.lock"
 echo "✓ SP restarting — click Run Locally when it finishes loading."
 ```
 
+### Every model write goes through `bin/exec.sh` — and what to do when a guard refuses
+
+Every MDL script, and every one-off model patch (`--patch`), is applied with `./bin/exec.sh`.
+A raw `./mxcli exec` writes no BUILD-LOG row, takes no snapshot and runs no gate, so the change
+shows as "not recorded" to everything that reads the build log (status, done-drift, proof views).
+
+When a guard refuses, nothing in the model changed (the uncommitted-model and `--commit-first`
+refusals also write a `🚫 blocked` row; the Studio Pro and lock refusals only print). Your move
+is one of three — **commit, wait, or stop and report** — never an override:
+
+| Refusal | Do this |
+|---|---|
+| Uncommitted model changes | Re-run with `--commit-first` (commits the `.mpr` + `mprcontents/` only), or commit them yourself, then re-run |
+| Studio Pro holds the model (also refuses `--commit-first`) | Stop. Ask the person to save (Cmd+S) and close the project; never kill Studio Pro |
+| Another session holds this project's exec lock | Wait for that run to finish, then re-run. A dead holder is taken over automatically — never `rm` the lock |
+| The mxbuild gate cannot run, even after its own download | Stop and report; run `bin/doctor.sh`. `ALLOW_UNVERIFIED=1` only when the person says so |
+| Pre-exec check or a NEW mxbuild error | Fix the script. That is the gate working |
+
+**Never set `FORCE_EXEC=1` on your own initiative** — only when the person tells you to, naming
+the risk. The failure it causes: an agent hits the uncommitted-model guard mid-loop, sets
+`FORCE_EXEC=1` to keep going, the next script's gate fails, and the auto-restore silently drops
+every MCP change made since the last commit (problem 4 above). The guard is the only thing
+between those two events.
+
+**The MCP write path stays allowed** where `learned-mdl-preflight.md` prescribes it (its
+Step 0 write-mode choice), and it is **accepted as unrecorded**: no exec row, no exec gate. Its record
+is the commit you make before the next exec (the pre-exec sequence below), with a message that
+starts `MCP:` and names what changed.
+
+**Check before closing a phase:** every model-changing commit since the phase began is either
+covered by a BUILD-LOG row or is an `MCP:` commit. Count both: commits = exec rows + `MCP:`
+commits. A commit that is neither is a raw `mxcli exec` — re-run that script through exec.sh,
+or record why it cannot be.
+
+### The gate checks the saved file — save, then check
+
+`exec.sh`'s mxbuild gate reads the `.mpr` on disk, never an editor's in-memory model, so after
+any Studio Pro or MCP edit, **save first, then check**. The failure this prevents (field
+comparison, 2026-09-29): an MCP build ran `mx check` against a stale disk copy and 229 errors
+stayed hidden until a real save. Step 1 of the sequence below is that save; exec.sh's
+Studio-Pro-holds-the-model refusal exists for the same reason.
+
+### Gate cost as the model grows — what to batch, and what not to
+
+The per-script apply grows with the model (field run, 2026-09-29: 22–30 s per script in the
+first slice, 55–65 s in the second, almost all of it mxbuild). What the gate already saves:
+the pre-flight baseline mxbuild is skipped when the verification stamp says the model is
+unchanged since its last clean build, so a run of clean applies costs **one** mxbuild each, not
+two. Concurrent applies from parallel agents queue on the exec lock instead of colliding (two of
+eleven failed applies in that run were concurrent mxbuild collisions, from before the lock).
+
+`exec.sh` has **no** batched-gate mode. Do not imitate one with `SKIP_CHECK`, `SKIP_BASELINE`,
+`FORCE_EXEC` or raw `mxcli exec` runs between gates — each of those is an unrecorded or
+unverified write. If gate time dominates, reduce the number of applies at the granularity level
+(see "Iterative Granularity": layer scripts rather than per-page ones where partial recovery is
+unlikely, fewer stub-then-fill passes), keep parallel **drafting**, and let the exec lock
+serialise the applies.
+
 ### Pre-exec sequence when MCP work was done
 
 Before running exec.sh after any MCP session:
diff --git a/skills/learned-page-patterns.md b/skills/learned-page-patterns.md
index bfa188c5..cc9813a6 100644
--- a/skills/learned-page-patterns.md
+++ b/skills/learned-page-patterns.md
@@ -349,3 +349,40 @@ nothing). Making the input itself editable does nothing. Set `Editable: true` on
 between the page and the input. Lint MDL-WIDGET31 checks only native inputs, so it misses a
 pluggable one such as a Switch (BUG-149). (Mendix 11.13.0, mxcli v0.24.0, the same build,
 2026-09-26: fixed only when both the outer and the inner list view were editable.)
+
+## UI fix rounds — fix once in SCSS, apply directly, re-look only what changed
+
+A round of UI fixes across many pages (after a review, a design port, or "the UI looks bad") is
+where calls multiply and regressions sneak in. Field comparison, 2026-09-29: one UI round took
+1,507 calls against 515 for a comparable build in the same ~3 h. Seven drafting agents each ran
+check → exec → mx check → page-fidelity on a scratch copy for every script, and the lead then
+applied each script again: about 25 calls per applied fix. Round 1 also introduced four
+regressions, and about a fifth of the UI tokens went to round 2 repairing them.
+
+**Order of work for a round:**
+
+1. **Cross-cutting fixes first, once, as SCSS** — a token, a spacing rule, a class every page
+   shares. One theme change fixes N pages; N page scripts fix N pages and drift.
+2. **Then the page scripts.** A drafter that has run `mxcli check` and `page-fidelity.js` on its
+   script hands it over for applying with `./bin/exec.sh`. Do not pre-apply to a scratch copy
+   "to be sure": exec.sh's gate is that check, and its lock serialises parallel applies.
+3. **Re-look only the pages the round changed** — the list is the round's BUILD-LOG rows plus
+   the pages an SCSS change reaches. Done when every page on that list has a fresh look
+   (`ui-loop.md`), N of N.
+
+(Expected effect: roughly half the calls per round. That is a hypothesis from one run, not a
+measurement.)
+
+**Before applying, check the round's scripts and SCSS for these four regressions** — each one
+broke previously correct pages in that round, and every one is visible in the source before it is
+visible on screen:
+
+| # | Regression | What it looked like | Check before applying |
+|---|---|---|---|
+| N1 | The page-column class lands on the layout root, not the page body | the app shell (sidebar, top bar) detaches and squeezes into the page column | the page-column class sits on a container **inside** the page's content placeholder; no layout or layout-root selector carries it |
+| N2 | Atlas `.d-none` loses to a project class that sets `display` | an element meant to be hidden shows (seen: a `.pill` badge) | hide with Mendix conditional visibility, not a hiding class; if a class must hide, grep the theme for any rule on the same widget that sets `display` |
+| N3 | Data Grid 2 columns left on `autoFit` | columns starve to 32 px, text cut to an ellipsis | every text column has an explicit width (`autoFill` or `manual`); `autoFit` only for icon or button columns |
+| N4 | A `:focus-visible` ring on navigation | one tab looks selected on every page landing | `learned-css-that-never-applied.md` → "a focus ring that paints on every page landing" |
+
+Denominator: the round's scripts and SCSS files checked against all four rows, M of M, before the
+first apply.
diff --git a/skills/measured-claims.md b/skills/measured-claims.md
index ba530ff4..a478bcb5 100644
--- a/skills/measured-claims.md
+++ b/skills/measured-claims.md
@@ -235,6 +235,36 @@ mocked integration render empty" as a suspected instrument fault, not a finding.
 
 ---
 
+## 7. A transcript's first usage record for a message is not its usage — read the last
+
+**Verdict: CONFIRMED for sub-agent transcripts; not seen in a main-loop transcript.** Measured
+2026-10-13 on Claude Code 2.1.296 transcripts (`~/.claude/projects/<slug>/…`), grouping
+`assistant` records by `message.id` and comparing `usage.output_tokens` on the first and the last
+record of each message:
+
+| Transcript | Messages | Messages whose records disagree | Output, first record | Output, last record |
+|---|---:|---:|---:|---:|
+| main loop | 941 | **0** | 631,486 | 631,486 |
+| sub-agent a | 133 | 2 | 1,652 | 2,837 |
+| sub-agent b | 109 | 2 | 1,152 | 6,402 |
+| sub-agent c | 93 | 3 | 1,151 | **8,241** |
+| sub-agent d | 98 | 0 | 1,709 | 1,709 |
+
+The main loop is the control that did not move; the sub-agents moved by up to 7x. A streamed
+message is written as several records carrying one `message.id`, and in sub-agent transcripts
+the early ones carry a partial `output_tokens` (e.g. `[4, 2631]` — first record 4, final 2,631).
+
+**Rule: sum usage once per `message.id`, from that message's LAST record.** Deduplicating by id
+is right (summing every record double-counts); keeping the *first* record is the undercount.
+
+**Cost:** a field comparison of two builds (2026-09-29) briefly concluded "the other build writes
+2.4x more output" — an artefact of reading partial records in both builds' sub-agents. A
+measurement that compares per-role or sub-agent output is wrong in the direction of whichever
+side uses more sub-agents. Replicated on one machine only; the main-loop arm shows the effect is
+sub-agent-specific, not universal — re-measure on your harness version before citing a ratio.
+
+---
+
 ## Adding an entry
 
 An entry earns its place only if it carries all four parts: the claim, the verdict, the
diff --git a/skills/upstream-feedback.md b/skills/upstream-feedback.md
index 4d2aef7b..640c9edf 100644
--- a/skills/upstream-feedback.md
+++ b/skills/upstream-feedback.md
@@ -26,6 +26,25 @@ mxcli. No → toolkit. A finding that is really both ("`check` passed a construc
 `learned-detection-gaps.md` did not list it") is **two** submissions, one per repo, each citing the
 other's number once it exists.
 
+**A third owner, outside both repos: the Studio Pro MCP server.** A gap in what the MCP path can
+write or check (a model element it cannot create, a batch it applies out of order, a check that
+reads an unsaved model) is neither an mxcli defect nor a toolkit one — the test above answers
+"no" for mxcli and "yes, still wrong without the toolkit". Do not file it in either repo and do
+not paper over it with a toolkit rule; draft it locally (§4 shape, §5 scrub) for the person to
+pass to that server's owners, and note the draft's path in `PROJECT.md`. Failure it prevents: a
+2026-09-29 field comparison logged its MCP asks only in a toolkit inbox note, where no MCP owner
+would read them. The asks from that run, with what was measured:
+
+| Ask | Evidence from the run |
+|---|---|
+| Write support for security, user roles, role home pages, snippets, scheduled events, import/export mappings, published REST, pluggable-widget property schema | 406 screen-driving calls (22% of the build) on screens the MCP path could not write; those rows ran 12–21 min each vs 2.6–3.5 min for domain and logic; 9 manual steps by the person |
+| Atomic writes with a fixed batch order | a reverse-order batch miswired 16 associations |
+| Save before `mx check`; reload instead of full restart | 229 errors hidden until a real save; 23 restarts |
+| Flag a missing end-of-parallel-path element in the consistency check | observed in that run; no count recorded |
+
+Done when each ask is either in a local draft with its evidence row, or recorded as dropped with
+a reason — none left only in a chat or an inbox note.
+
 ## 2. Before anything else: is it already written down?
 
 > **A gap that reads as "the toolkit already said this and it was not followed" is not a toolkit
diff --git a/tests/wave2/test-init-autocompact.sh b/tests/wave2/test-init-autocompact.sh
new file mode 100755
index 00000000..958e0a79
--- /dev/null
+++ b/tests/wave2/test-init-autocompact.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+# test-init-autocompact.sh — init-project.sh must warn about a large auto-compact window (#167).
+#
+# Field finding (2026-09-29): a lead session left at a 1M auto-compact window averaged 363-466k
+# context per call; the cost gap to a comparable build was context re-read per call, not call
+# count. The fix is an advisory line, never a written setting. This fixture checks the four
+# states by execution: nothing set, env var 1M, settings.json 250000 (ok), settings.json 1000000.
+# Setting names (CLAUDE_CODE_AUTO_COMPACT_WINDOW, "autoCompactWindow", CLAUDE_CONFIG_DIR) were
+# read out of the Claude Code 2.1.x CLI binary, and the per-model settings shape below is the
+# shape a real ~/.claude/settings.json carried — not invented.
+#
+# Usage: bash test-init-autocompact.sh [path-to-init-project.sh]
+# Fails against master's init-project.sh (no auto-compact line at all).
+
+export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
+export MXTK_NO_GUIDE=1
+SUBJECT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../bin" && pwd)/init-project.sh}"
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/initac.XXXXXX") || exit 2
+trap 'rm -rf "$WORK" "$MXTK_LEAKGUARD_DENYFILE"' EXIT
+
+run() {   # $1 = case name, $2 = env value for CLAUDE_CODE_AUTO_COMPACT_WINDOW ("" = unset)
+  local c="$1" envv="$2"
+  mkdir -p "$WORK/home-$c/.claude" "$WORK/proj-$c"
+  if [ -n "$envv" ]; then
+    env CLAUDE_CODE_AUTO_COMPACT_WINDOW="$envv" CLAUDE_CONFIG_DIR="$WORK/home-$c/.claude" \
+      bash "$SUBJECT" "$WORK/proj-$c" </dev/null > "$WORK/out-$c" 2>&1
+  else
+    env -u CLAUDE_CODE_AUTO_COMPACT_WINDOW CLAUDE_CONFIG_DIR="$WORK/home-$c/.claude" \
+      bash "$SUBJECT" "$WORK/proj-$c" </dev/null > "$WORK/out-$c" 2>&1
+  fi
+  echo $?
+}
+
+echo "== subject: $SUBJECT"
+
+rc=$(run none "")
+[ "$rc" -eq 0 ] && ok "no setting: scaffold exits 0" || bad "no setting: scaffold exited $rc"
+grep -q 'Recommended: /autocompact 250k' "$WORK/out-none" \
+  && ok "no setting: recommends /autocompact 250k" || bad "no setting: no auto-compact recommendation"
+
+rc=$(run env1m "1M")
+[ "$rc" -eq 0 ] && ok "env 1M: scaffold still exits 0 (advice, not a gate)" || bad "env 1M: scaffold exited $rc"
+grep -q 'WARNING: auto-compact window is above 250k (CLAUDE_CODE_AUTO_COMPACT_WINDOW=1M)' "$WORK/out-env1m" \
+  && ok "env 1M: warns and names the source" || bad "env 1M: no warning naming the env var"
+
+mkdir -p "$WORK/home-ok/.claude"
+printf '{\n  "modelSettings": {\n    "some-model": {\n      "autoCompactWindow": 250000\n    }\n  }\n}\n' \
+  > "$WORK/home-ok/.claude/settings.json"
+run ok "" >/dev/null
+grep -q 'autoCompactWindow=250000 .*at or below 250k' "$WORK/out-ok" \
+  && ok "settings 250000: reported ok" || bad "settings 250000: not reported as ok"
+grep -q 'WARNING: auto-compact' "$WORK/out-ok" && bad "settings 250000: warned anyway" || ok "settings 250000: no warning"
+
+mkdir -p "$WORK/home-big/.claude"
+printf '{"autoCompactWindow":1000000}\n' > "$WORK/home-big/.claude/settings.json"
+run big "" >/dev/null
+grep -q 'WARNING: auto-compact window is above 250k (autoCompactWindow=1000000' "$WORK/out-big" \
+  && ok "settings 1000000: warns" || bad "settings 1000000: no warning"
+
+rc=$(run garbage "1.5M")
+[ "$rc" -eq 0 ] && ok "unparseable env value: scaffold exits 0" || bad "unparseable env value: scaffold exited $rc (must never fail on advice)"
+
+# Never writes a setting.
+if grep -rqs 'autoCompactWindow' "$WORK"/proj-*/.claude 2>/dev/null; then
+  bad "init wrote an autoCompactWindow setting into the project — it must only advise"
+else ok "nothing written: no autoCompactWindow in any scaffolded .claude/"; fi
+
+echo "== $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

From ba461e5906afaf45cdb7a33daa8d4e1f4f88fcde Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:07:51 +0000
Subject: [PATCH 35/68] report: honour aborted findings; setup kind in the
 schema; drop dead credentials branch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- report-normalize.js: a findings file with `aborted` (preflight refusal or
  a signal) yields a report with top-level `aborted`, every kept journey
  row flagged notAResult/abortedRun, and the journey-runner instrument a
  fault — an aborted run never reads as results. --selftest cases; and
  test-journey-preflight.sh runs the real runner's aborted file through
  the real normalizer (fails on master's normalizer).
- skills/report-schema.md: kind enum gains `setup`; `aborted` documented.
- config.js: drop the `credentials().source === 'template default'`
  branch no template emits; the Demo2025! placeholder rule stays.

Refs #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                          |  2 +-
 project-tests/e2e/config.js           |  3 +--
 project-tests/e2e/report-normalize.js | 23 +++++++++++++++++++++++
 skills/report-schema.md               |  6 +++++-
 tests/wave2/test-journey-preflight.sh | 15 +++++++++++++--
 5 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd92119d..1d9cf912 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the placeholder (`Demo2025!`, or a `credentials()` reporting `source: 'template default'`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and a `report-normalize.js --selftest` case. Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/config.js b/project-tests/e2e/config.js
index ee7c4d38..d0c72b1b 100644
--- a/project-tests/e2e/config.js
+++ b/project-tests/e2e/config.js
@@ -89,11 +89,10 @@ const CREDS = PROJ.credentials();
 // Only the last is refused by journey-runner's preflight. Refusing every non-env password
 // (as #302 first did) broke every project whose real password lives in project.config.js,
 // because nothing in the toolkit loads an env file before verify-module runs the journeys.
-// A credentials() that reports `source: 'template default'` is honoured as well.
 const TEMPLATE_PASSWORDS = ['Demo2025!'];   // project.config.template.js DEFAULT_PASS
 function passwordSource({ env = process.env, creds = CREDS } = {}) {
   if (env.TEST_PASS || env.APP_PASS) return 'env';
-  if (creds.source === 'template default' || TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
+  if (TEMPLATE_PASSWORDS.includes(creds.pass)) return 'template placeholder';
   return 'project.config.js';
 }
 
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index 4a1a9710..f6400ce4 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -549,6 +549,16 @@ function collectJourney(input, contracts, ctx) {
     note: 'PASS/FAIL/INVALID are distinct at the source; INVALID → fault',
     checksEmitted: checks.length,
   });
+  // An ABORTED run (journey-runner wrote `aborted: "preflight"` or `"signal SIGINT"`) is not
+  // a result: the suite stopped before or while walking. Its rows are kept so the reader sees
+  // why, but each is flagged notAResult and the instrument is a fault — never a green or a
+  // finding about the app.
+  if (d.aborted) {
+    for (const c of checks) { c.notAResult = true; c.abortedRun = String(d.aborted); }
+    Object.assign(instruments[instruments.length - 1], { verdict: 'fault', aborted: String(d.aborted),
+      reason: `${input.path} is an ABORTED run (${d.aborted}) — the suite stopped before or while walking; ` +
+              'its rows are kept and flagged notAResult, none of them is a result. Fix the cause and re-run.' });
+  }
   return { checks, instruments, walks: collectWalks(d, checks) };
 }
 
@@ -2272,6 +2282,9 @@ function normalize(inputs) {
 
   return {
     schemaVersion: SCHEMA_VERSION,
+    // The journey run was aborted (preflight refusal or a signal): its rows are kept and
+    // flagged notAResult, and nothing in this report is a journey result.
+    aborted: (jf && jf.aborted) ? String(jf.aborted) : null,
     project: {
       id: m.projectId || null,
       displayName: m.displayName || null,
@@ -2609,6 +2622,16 @@ function selftest() {
   t('a setup row is kind "setup", not "ui"',
     jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
 
+  // An aborted run (preflight / signal) is kept but is never a result.
+  const jAb = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
+    data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false, aborted: 'preflight',
+            results: [{ rung: 'setup', name: 'preflight: admin', verdict: 'INVALID', detail: 'x', requirement: '' }] } } });
+  t('an aborted run marks the report aborted', jAb.aborted, 'preflight');
+  t('and faults the journey-runner instrument', inst(jAb, 'journey-runner').verdict, 'fault');
+  t('and flags every kept row notAResult',
+    jAb.checks.filter(c => c.instrument === 'journey-runner').every(c => c.notAResult === true && c.abortedRun === 'preflight'), true);
+  t('a completed run is not aborted', jSetup.aborted, null);
+
   // ---- 3b. the control instrument is per-rung, and a copied real run is not one ----
   const ctlRow = (rung, verdict) => ({
     rung: 'control', verdict, detail: `d-${rung}`,
diff --git a/skills/report-schema.md b/skills/report-schema.md
index b564068e..3148b9fe 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -57,6 +57,9 @@ any real project. The **Deriving the values** section says where each one actual
 ```jsonc
 {
   "schemaVersion": "1.2",              // renderer refuses on major mismatch, warns on newer minor
+  "aborted": null,                     // "preflight" | "signal SIGINT" | … when journey-findings.json is an
+                                       // aborted run: its checks carry notAResult: true + abortedRun, and the
+                                       // journey-runner instrument is a fault. None of them is a result.
 
   "project": {
     "id": "acme-procurement",          // stable key; a fleet index groups on this
@@ -97,8 +100,9 @@ any real project. The **Deriving the values** section says where each one actual
     {
       "id": "journey/J-PR-01/step5/landing",     // stable, sortable, unique
       "instrument": "journey-runner",            // WHO measured
-      "kind": "ui",                              // ui | trace | data | outcome | control
+      "kind": "ui",                              // ui | trace | data | outcome | control | setup
                                                  // | build | lint | coverage | conformance | stack
+                                                 // setup = journey-runner preflight / precondition / APP-DOWN rows
       "module": "Procurement",                   // null for cross-cutting
       "journey": "J-PR-01",                      // null when not a journey check
       "stepIndex": 5,                            // ordinal position on the path
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index 20875d1a..ba8755b9 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -125,7 +125,6 @@ out('PS', [
   ps({ env: { APP_PASS: 'x' }, creds: { pass: 'Real-Proj-Pass' } }),
   ps({ env: {}, creds: { pass: 'Real-Proj-Pass' } }),
   ps({ env: {}, creds: { pass: 'Demo2025!' } }),
-  ps({ env: {}, creds: { pass: 'anything', source: 'template default' } }),
 ]);
 // the shipped template's DEFAULT_PASS is the placeholder this list names
 out('TPL_LISTED', (C.TEMPLATE_PASSWORDS || []).includes(E.TPL_PASS));
@@ -266,7 +265,7 @@ case "$(line CRED)" in *'"abort":2,"calls":0'*'SETUP  credentials: TEST_PASS is
 echo "== T2b': only the template placeholder is refused (#302 follow-up) =="
 [ "$(line CRED_PROJ)" = '{"abort":null,"calls":1,"cred":false}' ] && ok "password set in project.config.js → no refusal, probe runs" || bad "project-set password refused (breaks every project after sync)" "$(line CRED_PROJ)"
 case "$(line CRED_TPL)" in *'"abort":2'*'placeholder password'*DEFAULT_PASS*) ok "template placeholder → refused, names DEFAULT_PASS as the fix" ;; *) bad "placeholder not refused" "$(line CRED_TPL)" ;; esac
-[ "$(line PS)" = '["env","env","project.config.js","template placeholder","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; template value / 'template default' is the placeholder" || bad "passwordSource wrong" "$(line PS)"
+[ "$(line PS)" = '["env","env","project.config.js","template placeholder"]' ] && ok "passwordSource: env wins; project value is the project's; the template value is the placeholder" || bad "passwordSource wrong" "$(line PS)"
 [ -n "$TPL_PASS" ] && [ "$(line TPL_LISTED)" = true ] && ok "the shipped template's DEFAULT_PASS is the listed placeholder" || bad "template DEFAULT_PASS not in TEMPLATE_PASSWORDS (got '$TPL_PASS')" "$(line TPL_LISTED)"
 
 echo "== T2c: resetsData / --protect-state (#279) =="
@@ -357,6 +356,18 @@ FJ="$WORK/tests/e2e/artifacts/journey-findings.json"
 node -e 'const f=require(process.argv[1]); process.exit(f.aborted==="preflight" && f.results.length===1 && f.results[0].verdict==="INVALID" ? 0 : 1)' "$FJ" 2>/dev/null \
   && ok "findings slot overwritten with the aborted run (no stale file reads as this run)" || bad "findings file not written as aborted"
 grep -qF "$MARK" "$FJ" 2>/dev/null && bad "credential written to the findings file" || ok "credential not in the findings file"
+# The aborted findings file through the real normalizer: a report, marked aborted, no results.
+if [ -f "$E2E/report-normalize.js" ]; then
+  cp "$E2E/report-normalize.js" "$WORK/tests/e2e/"
+  ( cd "$WORK/tests/e2e" && APP_PORT=1 node report-normalize.js --out docs/report.json ) > "$WORK/rn.out" 2>&1
+  node -e 'const r=require(process.argv[1]); const j=r.checks.filter(c=>c.instrument==="journey-runner");
+    const i=r.instruments.find(x=>x.name==="journey-runner");
+    process.exit(r.aborted==="preflight" && j.length>0 && j.every(c=>c.notAResult===true) && i.verdict==="fault" ? 0 : 1)' "$WORK/docs/report.json" 2>/dev/null \
+    && ok "report-normalize marks the aborted run: report.aborted, rows flagged notAResult, instrument fault" \
+    || bad "aborted run normalised as results" "$(tail -3 "$WORK/rn.out"; node -e 'const r=require(process.argv[1]);console.log(r.aborted)' "$WORK/docs/report.json" 2>&1)"
+else
+  echo "  skip — report-normalize.js not beside $SUT"
+fi
 
 echo "== T10: real runner — missing env var, every journey affected → one SETUP line, no probe =="
 rm -f "$WORK/argv"

From df19a4ed3fc6dfe7878a1afa8e55b4801cda9e36 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:09:34 +0000
Subject: [PATCH 36/68] =?UTF-8?q?page-fidelity:=20review=20fixes=20?=
 =?UTF-8?q?=E2=80=94=20multi-line=20ALTER=20set,=20plural=20fold,=20re-sty?=
 =?UTF-8?q?led=20buttons,=20quieter=20layout=20hint?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- An ALTER `set (…) on w` segment ends at its `on`, `;`/`}` or the next ALTER
  operation, not at the first newline; the multi-line form dropped its caption.
- Whole-word matching folds trailing s/es on both sides ("Orders" = "Order").
- An ALTER that sets ButtonStyle replaces the button's style class.
- The "layout not in the input" hint prints only when a missed class looks like
  frame chrome (topbar/sidebar/rail/nav/menu/brand/region/layout/shell/...).
- CHANGELOG: 11 pre-existing pairs, 10 unchanged.
Fixture: alter-multiline-* (the review's counter-case) + inline probes; 68/68,
4 of the new assertions fail on the previous head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-bin/page-fidelity.js                  | 38 ++++++++++++++-----
 .../fixtures/page-fidelity-mocks/CAPTURE.md   | 11 ++++++
 .../alter-multiline-alter.mdl                 |  7 ++++
 .../alter-multiline-page.mdl                  | 19 ++++++++++
 .../page-fidelity-mocks/alter-multiline.html  | 13 +++++++
 tests/wave2/test-page-fidelity-mocks.sh       | 20 ++++++++++
 7 files changed, 100 insertions(+), 10 deletions(-)
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-alter.mdl
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-page.mdl
 create mode 100644 tests/wave2/fixtures/page-fidelity-mocks/alter-multiline.html

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8287fe08..ce5c43ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(page-fidelity): **text is matched against what the page shows, on whole words; ButtonStyle counts as `btn btn-<style>`; layout chrome comes from the layout** ([#158](https://github.com/MendixMau/mxcli-project-toolkit/issues/158), [#157](https://github.com/MendixMau/mxcli-project-toolkit/issues/157)). Headings, actions and content were a substring test over the whole page MDL with 60% of the >3-char words enough, so a wireframe H2 "Product overview" counted as present on a page named `Product_Overview`, "Deactivate product" on a button captioned "Deactivate", and an "Add" button passed with no words to test. Each wireframe string is now matched per literal against the page's own captions — headings against Title/Content/non-button Captions, actions against button Captions, content against every displayed literal — on whole words, all of them for a label under three words; bindings keep the identifier corpus. An `actionbutton` now declares `btn` + `btn-<ButtonStyle>` (`btn-default` when DESCRIBE omits it), per the measured DOM contract in `learned-stylegallery.md`. The page's layout, when its MDL is in the input (`describe layout`), or `--chrome a,b`, adds to the fixed chrome set; without either nothing changes. Scores move: on 13 real or fixture page/wireframe pairs in the repo, 11 unchanged, a stub page 66%→39% (a "Waiting for customer" heading credited from `dgWaiting` + `CustomerQuery`), and the two new probe pairs; a field run on a live project is still owed. — MendixMau
+- fix(page-fidelity): **text is matched against what the page shows, on whole words; ButtonStyle counts as `btn btn-<style>`; layout chrome comes from the layout** ([#158](https://github.com/MendixMau/mxcli-project-toolkit/issues/158), [#157](https://github.com/MendixMau/mxcli-project-toolkit/issues/157)). Headings, actions and content were a substring test over the whole page MDL with 60% of the >3-char words enough, so a wireframe H2 "Product overview" counted as present on a page named `Product_Overview`, "Deactivate product" on a button captioned "Deactivate", and an "Add" button passed with no words to test. Each wireframe string is now matched per literal against the page's own captions — headings against Title/Content/non-button Captions, actions against button Captions, content against every displayed literal — on whole words, all of them for a label under three words; bindings keep the identifier corpus. An `actionbutton` now declares `btn` + `btn-<ButtonStyle>` (`btn-default` when DESCRIBE omits it), per the measured DOM contract in `learned-stylegallery.md`. The page's layout, when its MDL is in the input (`describe layout`), or `--chrome a,b`, adds to the fixed chrome set; without either nothing changes. Whole-word matching folds plurals (`Orders` = `Order`) on both sides, and multi-line ALTER `set (…) on w` statements count, including a ButtonStyle that replaces the old one. Scores move: of the 11 page/wireframe pairs already in the repo, 10 are unchanged and a stub page drops 66%→39% (a "Waiting for customer" heading credited from `dgWaiting` + `CustomerQuery`); the new probe pairs fail on the old scorer; a field run on a live project is still owed. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/page-fidelity.js b/project-bin/page-fidelity.js
index 8f1fa863..804d202f 100755
--- a/project-bin/page-fidelity.js
+++ b/project-bin/page-fidelity.js
@@ -568,6 +568,14 @@ function mdlWidgets(mdl) {
   return { widgets: out, masked };
 }
 
+// One ALTER `set` statement, on the MASKED text (string contents blank): from `set` to its
+// `on <widget>`, or — page-level, no `on` — to the `;`/`}` or the next ALTER operation that ends
+// it. NOT to the end of the line: mxcli accepts the parenthesised form over several lines
+// (`set (\n  Caption = '…',\n  ButtonStyle = Success\n) on btnApprove`), and a segment that
+// stopped at the first newline dropped that caption.
+const ALTER_OP = '\\b(?:set|insert|drop|replace)\\b';
+const SET_STMT = new RegExp('\\bset\\b((?:(?!' + ALTER_OP + ')[^;{}])*?)(?:\\bon\\s+"?([A-Za-z_][A-Za-z0-9_]*)"?|(?=[;}]|' + ALTER_OP + '))', 'gi');
+
 function mdlTexts(mdl) {
   const { widgets, masked } = mdlWidgets(mdl);
   const t = { headings: [], actions: [], content: [] };
@@ -590,7 +598,7 @@ function mdlTexts(mdl) {
   }
   // ALTER … set (Caption = '…', …) on w   /   set Title = '…' (page-level, no `on`). mxcli
   // accepts `:` inside the parenthesised form too (`set (Content: '…') on brandText`).
-  for (const m of masked.matchAll(/\bset\b([^;{}]*?)(?:\bon\s+"?([A-Za-z_][A-Za-z0-9_]*)"?|(?=[;}\n]))/gi)) {
+  for (const m of masked.matchAll(SET_STMT)) {
     const seg = mdl.slice(m.index, m.index + m[0].length);
     const type = m[2] ? (kind[m[2]] || null) : null;
     for (const p of seg.matchAll(new RegExp('\\b(Title|Caption|Content|Label|Placeholder)\\s*[:=]\\s*' + LIT, 'gi')))
@@ -601,9 +609,14 @@ function mdlTexts(mdl) {
 
 // The words a wireframe string must show: the >3-char words, or — when it has none ("New",
 // "OK", "Add") — all of its words, so a short label is matched instead of passing vacuously.
-const keyWords = txt => { const w = words(txt); return w.length ? w : norm(txt).split(' ').filter(Boolean); };
+// Whole words, with a light SYMMETRIC plural fold (applied to both sides): "Open tasks" is the
+// caption "Open task", "Orders" the title "Order", "Boxes" the label "Box". The substring test
+// credited those for free; whole-word matching without the fold read them as missing.
+const stem = w => w.length > 3 && /(ss|x|z|ch|sh)es$/.test(w) ? w.slice(0, -2)
+  : w.length > 3 && /[^s]s$/.test(w) ? w.slice(0, -1) : w;
+const keyWords = txt => { const w = words(txt); return (w.length ? w : norm(txt).split(' ').filter(Boolean)).map(stem); };
 function makeHit(lits) {
-  const sets = lits.map(l => new Set(norm(l).split(' ').filter(Boolean)));
+  const sets = lits.map(l => new Set(norm(l).split(' ').filter(Boolean).map(stem)));
   return txt => {
     const w = keyWords(txt);
     if (!w.length) return true;
@@ -621,17 +634,23 @@ function makeHit(lits) {
 // the only way a page script styles a button. Link buttons are NOT mapped: their rendered
 // classes have not been measured.
 function buttonClasses(mdl) {
-  const out = new Set();
   const { widgets, masked } = mdlWidgets(mdl);
-  const kind = {};
+  const kind = {}, style = {};            // style: actionbutton name -> its CURRENT ButtonStyle
   for (const w of widgets) {
     kind[w.name] = w.type;
     if (w.type !== 'actionbutton') continue;
     const st = w.props.match(/\bButtonStyle\s*:\s*"?([A-Za-z]+)"?/i);
-    out.add('btn'); out.add('btn-' + (st ? st[1] : 'default').toLowerCase());
+    style[w.name] = (st ? st[1] : 'default').toLowerCase();
   }
-  for (const m of masked.matchAll(/\bset\b[^;{}]*?\bButtonStyle\s*[:=]\s*"?([A-Za-z]+)"?[^;{}]*?\bon\s+"?([A-Za-z_][A-Za-z0-9_]*)"?/gi))
-    if (!kind[m[2]] || kind[m[2]] === 'actionbutton') { out.add('btn'); out.add('btn-' + m[1].toLowerCase()); }
+  // An ALTER that sets ButtonStyle REPLACES the button's style (the old btn-<x> is gone from the
+  // DOM); on a button not declared in the input it can only add.
+  for (const m of masked.matchAll(SET_STMT)) {
+    if (!m[2] || (kind[m[2]] && kind[m[2]] !== 'actionbutton')) continue;
+    const st = m[1].match(/\bButtonStyle\s*[:=]\s*"?([A-Za-z]+)"?/i);
+    if (st) style[m[2]] = st[1].toLowerCase();
+  }
+  const out = new Set();
+  for (const k of Object.keys(style)) { out.add('btn'); out.add('btn-' + style[k]); }
   return out;
 }
 
@@ -772,7 +791,8 @@ if (bareImg && s.bd.miss.some(r => r.image))
     ' set them (ALTER PAGE … set ImageUrl = [Attr]) as another input');
 if (s.c.chrome.length) console.log('  chrome (layout-supplied, not scored): ' + s.c.chrome.join(' '));
 if (lay.found) console.log('  layout ' + lay.name + ' read from input: ' + lay.classes.size + ' class(es) treated as chrome');
-else if (lay.name && s.c.miss.length && !CHROME.length)
+// Only when a missed class LOOKS like frame chrome — a hint on every page with any miss is noise.
+else if (lay.name && !CHROME.length && s.c.miss.some(c => /(^|-)(topbar|sidebar|rail|nav|navbar|navigation|menu|menubar|brand|region|layout|shell|appbar|userchip|avatar)(-|$)/.test(c)))
   console.log('  layout ' + lay.name + ' is not in the input — if a missed class is one it renders, pass' +
     ' `describe layout ' + lay.name + '` output as another input, or name it with --chrome a,b');
 if (wf.mockUsed.length) console.log('  bound-data mocks (wireframe-local, text not scored): ' + wf.mockUsed.join(' '));
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
index 57115fa0..5888b5fb 100644
--- a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
+++ b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
@@ -139,3 +139,14 @@ frame, with the layout's `region-topbar` / `region-sidebar` / `region-content` c
 Master: `71% classes 0/2` (the layout's region classes scored as the page's). Fixed, with the
 layout in the input or named with `--chrome`: `100% classes 0/0`, both reported as chrome.
 Without either, the default chrome set is unchanged and the classes are still owed.
+
+## alter-multiline — review counter-case for the caption match (2026-10-13)
+
+**Synthetic**, all three files: the independent review's counter-case, kept as written apart
+from the marker comments and the `btn btn-success` classes on the Approve button. It pins three
+things the first cut of the caption match got wrong: an ALTER `set (…) on w` spread over
+several lines (the segment ended at the first newline and dropped `'Approve order'`); a
+plural wireframe heading (`Orders`) against a singular title (`'Order'`), which whole-word
+matching without a plural fold read as missing; and a ButtonStyle set by that ALTER. Misses
+that remain are real: `Save changes` vs the caption `'Save'`, an icon-only Edit button with an
+empty caption, and `Recent activity`, whose second word is a bound parameter.
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-alter.mdl b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-alter.mdl
new file mode 100644
index 00000000..f8a9569f
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-alter.mdl
@@ -0,0 +1,7 @@
+-- SYNTHETIC: the parenthesised ALTER set form spread over several lines.
+alter page Shop.Order_Overview {
+  set (
+    Caption = 'Approve order',
+    ButtonStyle = Success
+  ) on btnApprove
+}
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-page.mdl b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-page.mdl
new file mode 100644
index 00000000..c269135d
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline-page.mdl
@@ -0,0 +1,19 @@
+-- SYNTHETIC (review counter-case for #318): a page whose button captions differ from the
+-- wireframe's, a snippet heading, and a title in the singular. See CAPTURE.md.
+create page Shop.Order_Overview (
+  Title: 'Order',
+  Layout: Atlas_Core.Atlas_Default
+) {
+  snippetcall sc1 (Snippet: Shop.SNIPPET_CustomerHeader)
+  groupbox gbShip (Caption: 'Shipping') {
+    dynamictext t2 (Content: 'Recent {1}', ContentParams: [{1} = Activity])
+  }
+  dynamictext intro (Content: 'Here you can review every open order for this customer')
+  actionbutton btnSave (Caption: 'Save', Action: save_changes, ButtonStyle: Primary)
+  actionbutton btnCancel (Caption: 'Cancel', Action: cancel_changes)
+  actionbutton btnEdit (Caption: '', Icon: 'pencil', Action: show_page Shop.Order_NewEdit(Order: $currentObject))
+  actionbutton btnApprove (Caption: 'Approve', Action: microflow Shop.ACT_Order_Approve(Order: $currentObject))
+}
+create snippet Shop.SNIPPET_CustomerHeader {
+  dynamictext h (Content: 'Customer details', RenderMode: H2)
+}
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline.html b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline.html
new file mode 100644
index 00000000..766598a8
--- /dev/null
+++ b/tests/wave2/fixtures/page-fidelity-mocks/alter-multiline.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<!-- SYNTHETIC wireframe (review counter-case for #318), paired with alter-multiline-*.mdl. -->
+<html><body><main>
+<h1>Orders</h1>
+<h2>Customer details</h2>
+<h2>Shipping</h2>
+<h3>Recent activity</h3>
+<p>Here you can review every open order for this customer.</p>
+<button>Save changes</button>
+<button>Cancel</button>
+<button>Edit</button>
+<button class="btn btn-success">Approve order</button>
+</main></body></html>
diff --git a/tests/wave2/test-page-fidelity-mocks.sh b/tests/wave2/test-page-fidelity-mocks.sh
index 2dc22eca..abf768e7 100755
--- a/tests/wave2/test-page-fidelity-mocks.sh
+++ b/tests/wave2/test-page-fidelity-mocks.sh
@@ -227,6 +227,26 @@ OUT17=$(cd "$TMP" && printf '%s\n' "$PAGEONLY" | node "$SUT" --no-log --chrome r
 has   "--chrome names them instead"                                "$OUT17" "classes 0/0"
 has   "--chrome classes are reported as chrome too"                "$OUT17" "chrome (layout-supplied, not scored): region-sidebar region-content"
 
+echo "  -- a multi-line ALTER set, plurals, and a re-styled button (review of #318)"
+# alter-multiline-* is a SYNTHETIC counter-case (see CAPTURE.md). The first cut of the caption
+# match ended an ALTER `set` segment at the first newline and dropped 'Approve order'; and
+# whole-word matching read "Orders" against the title 'Order' as missing.
+AM="$FIX/alter-multiline"
+OUT18=$(cd "$TMP" && node "$SUT" --no-log "$AM.html" Order_Overview "$AM-page.mdl" "$AM-alter.mdl" 2>&1)
+echo "$OUT18" | sed 's/^/    | /'
+hasnt "a caption set by a multi-line ALTER is seen"         "$OUT18" "action:  Approve order"
+hasnt "a plural heading matches its singular title"         "$OUT18" "heading: Orders"
+has   "the multi-line ALTER's ButtonStyle is seen"          "$OUT18" "classes 2/2"
+has   "a different caption is still a miss"                 "$OUT18" "action:  Save changes"
+RESTYLE="$TMP/restyle.mdl"
+printf "create page M.R (Title: 'R', Layout: Atlas_Core.Atlas_Default) {\n  actionbutton bGo (Caption: 'Go', Action: close_page, ButtonStyle: Warning)\n}\nalter page M.R {\n  set ButtonStyle = Success on bGo;\n}\n" > "$RESTYLE"
+printf '<main><h1>R</h1><button class="btn btn-warning">Go</button></main>' > "$TMP/restyle.html"
+OUT19=$(cd "$TMP" && node "$SUT" --no-log "$TMP/restyle.html" R "$RESTYLE" 2>&1)
+has   "an ALTER that re-styles a button drops its old class" "$OUT19" "classes: btn-warning"
+hasnt "no layout hint when no missed class looks like chrome" "$OUT19" "is not in the input"
+hasnt "no layout hint for page classes (seg-tabs, dg-*)"     "$OUT6"  "is not in the input"
+has   "the hint names the layout when region-* is missed"   "$OUT16" "layout LayoutTest.App_Default is not in the input"
+
 echo
 printf 'test-page-fidelity-mocks: %d passed, %d failed\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ]

From afd74828e35e3741c4d9ec9315d392f7d594afc9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:10:59 +0000
Subject: [PATCH 37/68] status: delivery rounds in existing-app mode,
 manual-step template, no above-stage obligations in NEXT

#301: in existing-app-change mode status.sh prints a ROUND line read from a
PROJECT.md "## Rounds" table (last row = round in flight) and drops the
agent-slot and done- stall items from WATCH and NEXT. Pipeline modes print
byte-identical output.

#298: templates/manual-steps.md for edits mxcli cannot round-trip (path, why,
depends-on, exact clicks, Check, one Done line); a step done by patch still
goes through exec.sh --patch. status.sh prints "manual steps pending N of M"
when docs/manual-steps.md exists.

Review of #303: NEXT drops obligations whose from-stage is above the
project's current stage (final-look was sent to Stage 1-5 projects).

Fixture tests/wave2/test-status-existing-app.sh: 23/23; 13 fail on the old script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |   1 +
 bin/status.sh                           |  71 ++++++++-
 skills/existing-app-change.md           |  59 ++++++++
 templates/manual-steps.md               |  40 +++++
 tests/wave2/test-status-existing-app.sh | 190 ++++++++++++++++++++++++
 5 files changed, 359 insertions(+), 2 deletions(-)
 create mode 100644 templates/manual-steps.md
 create mode 100755 tests/wave2/test-status-existing-app.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..c5bd2ff9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- feat(status, existing-app-change): **existing-app-change mode reports the delivery round, not just the stage; agent-slot and done- noise is dropped in that mode only; a template for targeted manual Studio Pro steps, counted by `status.sh`** ([#301](https://github.com/MendixMau/mxcli-project-toolkit/issues/301), [#298](https://github.com/MendixMau/mxcli-project-toolkit/issues/298)). A field run delivered 11 backlog stories in 4 rounds on a 127-module app while `status.sh` still read "Stage 1 — Analysis", WATCH said "agent slots unfilled: 35 in 6 file(s)" and "done- stalled", and NEXT pointed at those. A `## Rounds` table in `PROJECT.md` (`| Round | Title | Stories | State |`, last row = round in flight) now gives a `ROUND   Round N: <title> — <state> · stories: … · D of N round(s) delivered` line in existing-app-change mode, and that mode drops the agent-slot and done- items from WATCH and NEXT. The same run needed six microflow edits mxcli could not round-trip (branches that rejoin early): new `templates/manual-steps.md` (document path, why mxcli cannot, depends-on, exact clicks with an anchor, a Check a person runs, one `- [ ] Done` line naming its evidence), and the rule that a step done by patch still goes through `exec.sh --patch`. `status.sh` prints `manual steps pending N of M` when `docs/manual-steps.md` exists. Also, from the review of #303: NEXT no longer names an obligation first owed at a later stage than the project is in (`final-look`, Stage 6, was sent to Stage 1–5 projects and hid gate-check's next-stage hint); the obligations-pending line still lists it. Apart from that NEXT fix, pipeline modes print byte-identical to before (fixture `tests/wave2/test-status-existing-app.sh`, 23 cases on real scaffolds; 13 fail on the old script) — jopterhorst
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/status.sh b/bin/status.sh
index fb1b9435..3a404150 100755
--- a/bin/status.sh
+++ b/bin/status.sh
@@ -109,6 +109,46 @@ fi
 PH_TOTAL="$(mxtk_placeholder_total "$PROJECT_DIR"/.claude/agents/*.md "$PROJECT_DIR/CLAUDE.local.md")"
 PH_FILES="$(mxtk_placeholders "$PROJECT_DIR"/.claude/agents/*.md "$PROJECT_DIR/CLAUDE.local.md" | grep -c .)"
 
+# --- existing-app-change: the delivery round, not the stage (#301) ----------------------------
+# A change stream on a live app is delivered as rounds of small stories, and the stage line stood
+# still at "Stage 1" through four delivered rounds (field, 2026-10-13). The round is the unit of
+# status in that mode: PROJECT.md "## Rounds" (skills/existing-app-change.md), one row per round,
+# columns found by header name. The LAST row is the round in flight. Nothing here is read, and
+# nothing printed, in the other entry modes.
+ROUND_LINE=""; EAC=0
+if [ "$ENTRY" = "existing-app-change" ]; then
+  EAC=1
+  ROUND_LINE="$(awk -F'|' '
+    function trim(s) { gsub(/^[ \t*`]+|[ \t*`]+$/, "", s); return s }
+    function cell(k) { return (k in col) ? trim($(col[k])) : "" }
+    /^## +Rounds/ { sec = 1; next }
+    sec && /^## / { sec = 0 }
+    !sec || !/^\|/ { next }
+    !hdr { for (i = 2; i < NF; i++) col[tolower(trim($i))] = i; hdr = 1; next }
+    /^\| *:?-/ { next }
+    { n++; r = cell("round"); t = cell("title"); s = cell("state"); st = cell("stories")
+      if (tolower(s) ~ /^delivered/) d++ }
+    END {
+      if (!n) { print "none recorded — add a row to PROJECT.md \"## Rounds\" when a round starts (skills/existing-app-change.md)"; exit }
+      printf "Round %s: %s — %s%s · %d of %d round(s) delivered\n", r, (t != "" ? t : "(no title)"), (s != "" ? s : "(no state)"), (st != "" ? " · stories: " st : ""), d, n
+    }' "$REG")"
+fi
+
+# --- targeted manual Studio Pro steps (#298) -------------------------------------------------
+# docs/manual-steps.md, from templates/manual-steps.md: one "- [ ] Done" line per step, ticked
+# when the step is done (by hand or by patch). Pending = unticked. Fenced blocks are skipped so
+# the template's worked example never counts. No file, no output — the screen is unchanged.
+MANUAL=""
+MS_FILE="$PROJECT_DIR/docs/manual-steps.md"
+if [ -f "$MS_FILE" ]; then
+  MANUAL="$(awk '
+    /^[ \t]*```/ { fence = !fence; next }
+    fence { next }
+    /^[ \t]*[-*] \[ \] *(\*\*)?Done/ { p++; t++ }
+    /^[ \t]*[-*] \[[xX]\] *(\*\*)?Done/ { t++ }
+    END { printf "manual steps pending %d of %d", p, t }' "$MS_FILE")"
+fi
+
 # --- doctor receipt -------------------------------------------------------------------------
 DR="$PROJECT_DIR/.claude/.doctor-receipt"
 if [ -f "$DR" ]; then
@@ -142,6 +182,23 @@ NEED_ATTN="$(printf '%s\n' "$GC" | awk '/^Needs attention/{f=1;next} /^Next up:|
 APPROVED_OVER="$(printf '%s\n' "$GC" | grep -m1 '^Approved over a failing gate:' | sed -E 's/^Approved over a failing gate: *//; s/ — .*$//')"
 N_ATTN="$(printf '%s\n' "$GC" | grep -oE '[0-9]+ need attention' | grep -oE '^[0-9]+' || echo 0)"
 OB_PENDING="$(printf '%s\n' "$GC" | grep -E '^Obligation ' | grep -E ' (PENDING|FAULT) ' | awk '{print $2": "$3}' | tr '\n' ',' | sed 's/,$//; s/,/, /g')"
+# NEXT only names obligations the project can discharge NOW. Each row in bin/lib/obligations.tsv
+# carries the stage it is first owed at (column 8); the gate-check line reports every one, so a
+# Stage 1 project was told "discharge: final-look" — the Stage 6 whole-app LOOK — and never saw
+# gate-check's "Next up:" hint behind it (review of #303). Above-stage obligations stay on the
+# screen's "obligations pending" line; they are only kept out of NEXT. A stage line we cannot read
+# keeps them all (louder, never quieter).
+CUR_STAGE="$(printf '%s\n' "$STAGE_LINE" | sed -nE 's/.*Stage ([0-9P]).*/\1/p' | head -1)"
+OB_NEXT="$OB_PENDING"
+if [ -n "$OB_PENDING" ] && [ -n "$CUR_STAGE" ] && [ -f "$TOOLKIT_ROOT/bin/lib/obligations.tsv" ]; then
+  OB_NEXT="$(printf '%s\n' "$OB_PENDING" | tr ',' '\n' | sed -E 's/^ +//' | awk -v cur="$CUR_STAGE" -v tsv="$TOOLKIT_ROOT/bin/lib/obligations.tsv" '
+    function rank(x) { return (x == "P") ? -1 : x + 0 }
+    BEGIN { FS = "\t"; while ((getline l < tsv) > 0) { if (l ~ /^#/ || l == "") continue; split(l, c, "\t"); from[c[1]] = c[8] }; FS = " " }
+    { id = $1; sub(/:$/, "", id)
+      if ((id in from) && from[id] ~ /^[0-9P]$/ && rank(from[id]) > rank(cur)) next
+      out = out (out == "" ? "" : ", ") $0 }
+    END { print out }')"
+fi
 MOD_OPENED="$(printf '%s\n' "$GC" | grep -m1 -E '^Obligation look ' | grep -q 'no module has been opened' && echo 0 || echo '≥1')"
 GC_NEXT="$(printf '%s\n' "$GC" | grep -m1 '^Next up:' | sed 's/^Next up: *//')"
 TK_UPD="$(printf '%s\n' "$GC" | grep -m1 '^Toolkit updates:' | sed 's/^Toolkit updates: *//; s/\..*$//')"
@@ -151,6 +208,13 @@ if [ -x "$PROJECT_DIR/bin/coherence-cadence.sh" ]; then
   COH="coherence $COH_OUT"
 fi
 
+# existing-app-change: the agent-slot and done- signals are pipeline-build bookkeeping. A change
+# stream delivered in rounds left them reading "agent slots unfilled: 35 in 6 file(s)" and
+# "done- stalled" through four delivered rounds, and NEXT pointed at them (#301). In that mode
+# only, they are dropped from WATCH and NEXT; the round line above is the progress readout.
+# Every other mode prints exactly as before (tests/wave2/test-status-existing-app.sh, byte-diff).
+if [ "$EAC" = 1 ]; then DONE_STALL=""; NOT_DONE_PASS=""; PH_TOTAL=0; fi
+
 # --- NEXT: ordered lookup, earliest wins. Owner skill in the right-hand comment. -------------
 next_action() {
   if [ -n "$APPROVED_OVER" ]; then echo "$APPROVED_OVER is approved in PROJECT.md but its gate FAILS — fix the gate, or re-open the approval with the user (bin/gate-check.sh)"; return; fi   # conversion-runbook.md §2
@@ -166,7 +230,7 @@ next_action() {
   if [ -n "$LAST_FAIL" ]; then echo "last gate FAILED for: $LAST_FAIL— fix and re-exec (docs/BUILD-LOG.md, .mpr-snapshots/last-mxbuild-errors.json)"; return; fi   # iterative-build-loop.md Gate: BUILD
   if [ -n "$DONE_STALL" ]; then echo "$DONE_STALL — done- needs the coverage checklist; run bin/coverage-preflight.sh to see what blocks it (iterative-build-loop.md)"; return; fi
   if [ -n "$NOT_DONE_PASS" ]; then echo "gate-passed but not done-: $NOT_DONE_PASS— walk the happy path + coverage checklist, then git mv to done- (iterative-build-loop.md step 13-15)"; return; fi
-  if [ -n "$OB_PENDING" ]; then echo "discharge: $OB_PENDING (bin/lib/obligations.tsv names the artifact each owes)"; return; fi
+  if [ -n "$OB_NEXT" ]; then echo "discharge: $OB_NEXT (bin/lib/obligations.tsv names the artifact each owes)"; return; fi
   [ -n "$GC_NEXT" ] && { echo "$GC_NEXT"; return; }
   echo "nothing overdue — take the next script in architecture/build-plan.md"
 }
@@ -200,7 +264,8 @@ for _w in "${APPROVED_OVER:+APPROVED OVER A FAILING GATE: $APPROVED_OVER}" "$DON
 done
 if [ "$BRIEF" = 1 ]; then
   echo "WHERE   $NAME · $STAGE_LINE${ENTRY:+ · $ENTRY}${ADOPTED:+ · joined at $ADOPTED}"
-  echo "STATE   scripts $N_SCRIPTS written / $N_PASS gate-pass / $N_DONE done- · modules opened $MOD_OPENED${SKELETON:+ · skeleton $SKELETON} · UNSYNCED $UNSYNCED · open questions $OPEN_Q"
+  [ -n "$ROUND_LINE" ] && echo "ROUND   $ROUND_LINE"
+  echo "STATE   scripts $N_SCRIPTS written / $N_PASS gate-pass / $N_DONE done- · modules opened $MOD_OPENED${SKELETON:+ · skeleton $SKELETON} · UNSYNCED $UNSYNCED · open questions $OPEN_Q${MANUAL:+ · $MANUAL}"
   [ -n "$WATCH" ] && echo "WATCH   $WATCH"
   echo "NEXT    $NEXT"
   "$TOOLKIT_ROOT/bin/token-burn.sh" "$PROJECT_DIR" --brief 2>/dev/null
@@ -208,8 +273,10 @@ if [ "$BRIEF" = 1 ]; then
 fi
 printf '\n%s — %s%s%s\n' "$NAME" "$STAGE_LINE" "${ENTRY:+ · $ENTRY}" "${ADOPTED:+ · joined at stage $ADOPTED}"
 printf '%s\n\n' "$TK"
+[ -n "$ROUND_LINE" ] && printf 'ROUND     %s\n' "$ROUND_LINE"
 printf 'DONE      scripts: %s written, %s gate-pass, %s done-  ·  modules opened: %s%s\n' "$N_SCRIPTS" "$N_PASS" "$N_DONE" "$MOD_OPENED" "${SKELETON:+  ·  skeleton proven $SKELETON}"
 printf 'OVERDUE   %s  ·  %s  ·  %s  ·  UNSYNCED markers: %s  ·  open questions: %s\n' "$DOCTOR" "$LINT" "${COH:-coherence: cadence script not installed}" "$UNSYNCED" "$OPEN_Q"
+[ -n "$MANUAL" ] && printf '          %s (docs/manual-steps.md)\n' "$MANUAL"
 [ -n "$OB_PENDING" ] && printf '          obligations pending: %s\n' "$OB_PENDING"
 [ -n "$LAST_FAIL" ] && printf '          last gate FAILED: %s\n' "$LAST_FAIL"
 [ -n "$WATCH" ] && printf 'WATCH     %s\n' "$WATCH"
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index 9f3774d1..aca2fb93 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -199,6 +199,63 @@ end — a regression found three modules later costs the same to fix and much mo
 
 ---
 
+## Delivering in rounds — the round is the unit of status
+
+A backlog of small stories (1–5 points each) is delivered in rounds of a few stories, and the stage
+machine does not see rounds: on a field run (2026-10-13, 11 stories in 4 rounds on a 127-module
+app) `bin/status.sh` still said **"Stage 1 — Analysis, in progress"** after the fourth delivered
+round, with "agent slots unfilled: 35" and "done- stalled" in its WATCH line. Stage 0a (the map) is
+still the one-time prerequisite; stages 1–4 run per round over that round's stories.
+
+Record each round as one row in `PROJECT.md`, under a section you add when the first round starts:
+
+```markdown
+## Rounds
+
+| Round | Title | Stories | State |
+|---|---|---|---|
+| 1 | Export fixes | S-101, S-102, S-104 | delivered |
+| 2 | Approval rework | S-110, S-111 | in test |
+```
+
+- **Append, never reorder.** The last row is the round in flight; `status.sh` prints it as
+  `ROUND   Round 2: Approval rework — in test · stories: S-110, S-111 · 1 of 2 round(s) delivered`.
+- **State** is one word or phrase: `planned` · `building` · `in test` · `delivered`. Only a state
+  starting with `delivered` counts as delivered. Update the cell when the round moves, not later.
+- **Stories** names the ids from wherever the stories live (a ticket system, a `stories.json`, change
+  log rows in `PROJECT.md`). The per-story record — scope, touched units, decisions, test verdict,
+  manual steps — stays there; this table does not copy it.
+
+In this entry mode `status.sh` drops the agent-slot and `done-` signals from WATCH and NEXT: a
+change stream delivered in rounds does not fill pipeline agent stubs or rename scripts to `done-`,
+so those lines measured nothing. The round line replaces them. Other modes print as before.
+
+---
+
+## Edits mxcli cannot make — a targeted manual-step list
+
+Some edits cannot go through `describe → exec` safely. Field case (2026-10-13): six microflow edits
+whose decision branches rejoin early, where re-executing the described microflow would change the
+flow (upstream mxcli #923) — three were done by hand in Studio Pro, three by a BSON patch. That is
+neither a whole-model handoff (`handoff-to-studio-pro.md`) nor an MDL script, and it needs its own
+deliverable.
+
+Copy `<toolkit>/templates/manual-steps.md` to `docs/manual-steps.md` and write one section per edit:
+the document by full path, why mxcli cannot do it, what it depends on, the exact clicks with an
+anchor (the existing activity or widget it goes next to, by caption or name), a **Check** a person can
+run in the app, and one `- [ ] Done` line. List the steps in dependency order: attributes an MDL
+script adds come before the hand edit that uses them.
+
+- **A step done by patch still goes through `./bin/exec.sh --patch <script>`.** The snapshot, the
+  mxbuild gate and the BUILD-LOG row are its evidence; a patch run any other way leaves none, and the
+  Done line cannot cite one.
+- **Tick the Done line only after its Check passed**, and name the evidence on it: the commit for a
+  hand edit, the BUILD-LOG row for a patch.
+- `status.sh` counts the file: `manual steps pending N of M` (unticked Done lines of all Done lines).
+  A round with pending manual steps is not `delivered`.
+
+---
+
 ## Coverage in this mode
 
 The ledger in this mode is `mxcli brain plan`, not a hand-kept `coverage-ledger.md`. Each BRD leaf
@@ -237,5 +294,7 @@ it is the only entry mode where that is true.
 - Knowledge base — Path D, scoped, with counts recorded: modules, and per in-scope module the entity, page and microflow totals `SHOW …` returned, so a reader can see the change against the app.
 - BRDs for the change, each with as-is and to-be — and one line saying how many capabilities were *not* BRD'd and why.
 - A build plan over the change.
+- When the work arrives as a backlog: a `## Rounds` table in `PROJECT.md`, one row per round, its state current.
+- When an edit cannot go through mxcli: `docs/manual-steps.md` from `templates/manual-steps.md`, every step with its Check and a ticked Done line naming its evidence.
 - **A regression baseline that was green before the change and is green after it** — stated as N journeys over M modules, re-run at every module gate. Without this the rest is unverified.
 - Anything reusable learned about the app → `skills/learned-*.md`; process learnings → `process/process-learnings.md`.
diff --git a/templates/manual-steps.md b/templates/manual-steps.md
new file mode 100644
index 00000000..825f8c5a
--- /dev/null
+++ b/templates/manual-steps.md
@@ -0,0 +1,40 @@
+# Manual Studio Pro steps — <change or round name>
+
+<!-- Copy to docs/manual-steps.md in the project. Template: templates/manual-steps.md in the toolkit;
+     the rules are in skills/existing-app-change.md → "Edits mxcli cannot make".
+
+     bin/status.sh counts this file: every line that starts "- [ ] Done" is a PENDING step, every
+     "- [x] Done" a done one. One such line per step, nothing else in the file starts that way.
+     Fenced blocks (```) are not counted, which is why the worked example below is fenced. -->
+
+**Order matters.** Steps are listed in the order they must be done. A step that needs something an
+MDL script creates (a new attribute, a new microflow) names that script under *Depends on*, and that
+script is applied first.
+
+**A step done by patch is still an exec.** If a step is done by a Python/BSON patch instead of by
+hand, it runs as `./bin/exec.sh --patch <script>` — the snapshot, the mxbuild gate and the BUILD-LOG
+row are the evidence, and a patch run any other way has none. Record the BUILD-LOG date on the Done line.
+
+---
+
+## Steps
+
+<!-- One section per step, copied from the example. Delete this comment and the example block
+     once the first real step is written. -->
+
+```markdown
+### MS-01 — Add the "second approver" branch to ACT_Order_Approve
+
+- **Document:** `Orders` › `Microflows` › `Approval` › `ACT_Order_Approve`
+- **Why mxcli cannot do it:** the decision's branches rejoin before the end event; DESCRIBE → exec
+  of this microflow re-orders the flow (upstream mxcli #923), so it is edited in place instead.
+- **Depends on:** `mdlsource/031-orders-approver-attrs.mdl` (adds `Order.SecondApproverRequired`) — applied first.
+- **Exact clicks:**
+  1. Open the microflow. Find the activity captioned `Retrieve approval policy` (the anchor).
+  2. After it, insert a Decision with caption `Above 250?` and expression `$Order/Amount > 250`.
+  3. `true` → Change object `$Order`, set `SecondApproverRequired` = `true`, no commit. `false` → straight on.
+  4. Join both branches into the existing merge before `Commit order`.
+- **Check (a person can run this in the app):** as `Buyer`, submit an order of 300 → the order shows
+  "Waiting for second approver". Submit one of 200 → it does not.
+- [ ] Done — by hand (commit `<sha>`) / by patch (`./bin/exec.sh --patch <script>`, BUILD-LOG row `<date>`)
+```
diff --git a/tests/wave2/test-status-existing-app.sh b/tests/wave2/test-status-existing-app.sh
new file mode 100755
index 00000000..594468af
--- /dev/null
+++ b/tests/wave2/test-status-existing-app.sh
@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# test-status-existing-app.sh — bin/status.sh in existing-app-change mode (#301) and the manual
+# Studio Pro step count (#298).
+#
+# Usage: bash tests/wave2/test-status-existing-app.sh bin/status.sh
+#
+# GOLDEN INPUT IS THE REAL SCAFFOLD. Every PROJECT.md here is written by the real
+# bin/init-project.sh (agent stubs with their unfilled slots included); the fixture adds only an
+# "Entry mode:" line, a BUILD-LOG and the sections under test. The baseline is status.sh as it was
+# at BASE_REF (the commit before this change), run from the SAME toolkit copy as the subject, so the
+# two outputs differ only by the script.
+#
+#   T1  pipeline project (migration), --brief and full: byte-identical to the baseline, with the
+#       agent-slot and done- stall WATCH items present in both (control: the noise is real there)
+#   T2  pipeline project carrying a "## Rounds" section: still byte-identical (the section is
+#       read in existing-app-change mode only)
+#   T3  existing-app-change, rounds recorded: ROUND line is the LAST row, with stories and the
+#       delivered count; full screen carries it too
+#   T4  existing-app-change: no "agent slots unfilled" / "done- stalled" in WATCH, NEXT does not
+#       point at done-; the baseline on the same project DID print them (so the case can fail)
+#   T5  existing-app-change, no Rounds section: the ROUND line says none recorded and where to add it
+#   T6  Rounds table without a Stories column: no stories part, no crash
+#   T7  docs/manual-steps.md: unticked Done lines counted, ticked ones in the total, the fenced
+#       example ignored — on --brief STATE and on the full screen
+#   T8  the shipped template copied as-is counts 0 of 0 (its example is fenced)
+
+export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
+export MXTK_NO_GUIDE=1
+export MXTK_SYNC_SKIP_CLONE_CHECK=1
+set -uo pipefail
+
+SUT="${1:?usage: test-status-existing-app.sh /path/to/bin/status.sh}"
+case "$SUT" in /*) ;; *) SUT="$PWD/$SUT" ;; esac
+SRC="$(cd "$(dirname "$SUT")/.." && pwd)"
+BASE_REF="${BASE_REF:-b9cf37c44884a74a357b7b14bc595ea78304a0b2}"
+W="$(mktemp -d "${TMPDIR:-/tmp}/statusea.XXXXXX")" || exit 2
+trap 'rm -rf "$W"; rm -f "$MXTK_LEAKGUARD_DENYFILE"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/  FAIL-detail: /'; }
+
+# One toolkit copy, not a git checkout, so the toolkit sha reads "?" for both scripts alike.
+mkdir -p "$W/tk"
+(cd "$SRC" && tar --exclude=.git --exclude=node_modules -cf - .) | (cd "$W/tk" && tar -xf -)
+cp "$SUT" "$W/tk/bin/status.sh"
+HAVE_BASE=0
+if git -C "$SRC" show "$BASE_REF:bin/status.sh" > "$W/tk/bin/status-baseline.sh" 2>/dev/null; then
+  chmod +x "$W/tk/bin/status-baseline.sh"; HAVE_BASE=1
+fi
+NEW="$W/tk/bin/status.sh"; OLD="$W/tk/bin/status-baseline.sh"
+
+mkproj() {  # mkproj <name> <entry mode text>
+  local d="$W/$1"; mkdir -p "$d/mdlsource" "$d/docs"; : > "$d/Fixture.mpr"
+  "$W/tk/bin/init-project.sh" "$d" >/dev/null 2>&1
+  # Entry mode the way a register records it, right under the Current stage heading.
+  awk -v m="$2" '{print} /^## Current stage/ {getline; print; print ""; print "Entry mode: " m " CONFIRMED"}' \
+    "$d/PROJECT.md" > "$d/PROJECT.md.new" && mv "$d/PROJECT.md.new" "$d/PROJECT.md"
+  # Three gate-passed scripts, none renamed done- — the "done- stalled" condition.
+  local s
+  # Header and row shape as project-bin/exec.sh log_build() writes them (gate column = GATE_STATE).
+  { echo "| when (ISO-8601 local) | script | gate | result | detail |"; echo "|---|---|---|---|---|"; } > "$d/docs/BUILD-LOG.md"
+  for s in 010-a 020-b 030-c; do
+    echo "-- $s" > "$d/mdlsource/$s.mdl"
+    echo "| 2026-10-13T10:00:00+0200 | \`$s.mdl\` | pass | ✅ applied | $s.mdl; lint ok |" >> "$d/docs/BUILD-LOG.md"
+  done
+  echo "$d"
+}
+# The doctor receipt's age ("0 min ago") can tick over between the two runs; it is the only
+# wall-clock text on the screen, so it is masked for the byte comparison and nothing else is.
+norm() { sed -E 's/[0-9]+ (min|h|days) ago/N \1 ago/g'; }
+add_rounds() {  # add_rounds <proj>  (table on stdin) — appended as its own section
+  { printf '\n## Rounds\n\n'; cat; } >> "$1/PROJECT.md"
+}
+
+echo "== bin/status.sh — existing-app-change rounds (#301) + manual steps (#298) =="
+
+# --- T1 / T2: pipeline modes are untouched -------------------------------------------------------
+P="$(mkproj pipe "migration")"
+if [ "$HAVE_BASE" = 1 ]; then
+  for mode in --brief ""; do
+    o="$("$OLD" "$P" $mode 2>&1 | norm)"; n="$("$NEW" "$P" $mode 2>&1 | norm)"
+    [ "$o" = "$n" ] && ok "T1 pipeline project ${mode:-full}: byte-identical to baseline" \
+                    || bad "T1 pipeline project ${mode:-full} output changed" "$(diff <(echo "$o") <(echo "$n"))"
+  done
+  case "$o" in *"agent slots unfilled"*"done- stalled"*|*"done- stalled"*"agent slots unfilled"*) ok "T1 control: the pipeline screen carries agent-slot + done- stall WATCH items";;
+    *) bad "T1 control: expected both WATCH items on the pipeline project (fixture no longer exercises them)" "$o";; esac
+  printf '| Round | Title | Stories | State |\n|---|---|---|---|\n| 1 | Export fixes | S-1 | in test |\n' | add_rounds "$P"
+  for mode in --brief ""; do
+    o="$("$OLD" "$P" $mode 2>&1 | norm)"; n="$("$NEW" "$P" $mode 2>&1 | norm)"
+    [ "$o" = "$n" ] && ok "T2 pipeline project with a Rounds section ${mode:-full}: byte-identical" \
+                    || bad "T2 Rounds section changed a pipeline screen (${mode:-full})" "$(diff <(echo "$o") <(echo "$n"))"
+  done
+else
+  bad "T1/T2 NOT RUN: baseline $BASE_REF not in this checkout's history (fetch full history)"
+fi
+
+# --- T3 / T4: existing-app-change with rounds ------------------------------------------------
+E="$(mkproj eac "Change an existing app")"
+printf '%s\n' '| Round | Title | Stories | State |' '|---|---|---|---|' \
+  '| 1 | Export fixes | S-101, S-102 | delivered |' \
+  '| 2 | Approval rework | S-110, S-111 | in test |' | add_rounds "$E"
+b="$("$NEW" "$E" --brief 2>&1)"
+exp='ROUND   Round 2: Approval rework — in test · stories: S-110, S-111 · 1 of 2 round(s) delivered'
+printf '%s\n' "$b" | grep -qxF "$exp" && ok "T3 --brief ROUND line is the last row, with stories and delivered count" \
+  || bad "T3 --brief ROUND line" "$b"
+[ "$(printf '%s\n' "$b" | sed -n 2p | cut -c1-5)" = "ROUND" ] && ok "T3 ROUND sits right under WHERE" || bad "T3 ROUND line position" "$b"
+f="$("$NEW" "$E" 2>&1)"
+printf '%s\n' "$f" | grep -qF 'ROUND     Round 2: Approval rework — in test' && ok "T3 full screen carries the ROUND line" || bad "T3 full screen ROUND line" "$f"
+case "$b$f" in *"agent slots unfilled"*) bad "T4 agent-slot noise still printed in existing-app mode" "$b";; *) ok "T4 no agent-slot WATCH item";; esac
+case "$b$f" in *"done- stalled"*|*"not done-"*) bad "T4 done- noise still printed in existing-app mode" "$b";; *) ok "T4 no done- stall in WATCH or NEXT";; esac
+if [ "$HAVE_BASE" = 1 ]; then
+  o="$("$OLD" "$E" --brief 2>&1)"
+  case "$o" in *"agent slots unfilled"*) ok "T4 control: the baseline printed the agent-slot noise on this same project";;
+    *) bad "T4 control: baseline did not print agent-slot noise — case cannot fail" "$o";; esac
+  case "$o" in *ROUND*) bad "T4 control: baseline already has a ROUND line?" "$o";; *) ok "T4 control: the baseline has no ROUND line";; esac
+fi
+
+# --- T5: no Rounds section -------------------------------------------------------------------
+E2="$(mkproj eac-none "existing-app-change")"
+b="$("$NEW" "$E2" --brief 2>&1)"
+printf '%s\n' "$b" | grep -q '^ROUND   none recorded — add a row to PROJECT.md "## Rounds"' && ok "T5 no rounds: says none recorded and where" || bad "T5 no-rounds line" "$b"
+
+# --- T6: no Stories column ------------------------------------------------------------------
+E3="$(mkproj eac-nostories "Change an existing app")"
+printf '%s\n' '| Round | Title | State |' '|---|---|---|' '| 1 | Login tweak | building |' | add_rounds "$E3"
+b="$("$NEW" "$E3" --brief 2>&1)"
+printf '%s\n' "$b" | grep -qxF 'ROUND   Round 1: Login tweak — building · 0 of 1 round(s) delivered' && ok "T6 no Stories column: no stories part" || bad "T6 no-Stories-column ROUND line" "$b"
+
+# --- T7: manual steps count ----------------------------------------------------------------
+cat > "$E/docs/manual-steps.md" <<'EOF'
+# Manual Studio Pro steps
+
+```markdown
+- [ ] Done — example, fenced, must not count
+```
+
+### MS-01 — a
+- [x] Done — by hand (commit abc1234)
+### MS-02 — b
+- [ ] Done — pending
+### MS-03 — c
+- [ ] **Done** — pending
+Not a step: - [ ] Done mid-line
+EOF
+b="$("$NEW" "$E" --brief 2>&1)"
+printf '%s\n' "$b" | grep '^STATE' | grep -qF '· manual steps pending 2 of 3' && ok "T7 --brief STATE: manual steps pending 2 of 3" || bad "T7 --brief manual count" "$b"
+f="$("$NEW" "$E" 2>&1)"
+printf '%s\n' "$f" | grep -qF 'manual steps pending 2 of 3 (docs/manual-steps.md)' && ok "T7 full screen: manual count with its file" || bad "T7 full manual count" "$f"
+
+# --- T8: the shipped template counts nothing ------------------------------------------------
+cp "$W/tk/templates/manual-steps.md" "$E2/docs/manual-steps.md" 2>/dev/null
+b="$("$NEW" "$E2" --brief 2>&1)"
+printf '%s\n' "$b" | grep -qF 'manual steps pending 0 of 0' && ok "T8 template copied as-is: 0 of 0" || bad "T8 template count" "$b"
+
+# --- T9: NEXT never names an obligation owed only at a later stage (review of #303) ----------
+# A scaffold always has gate-check "Needs attention" items, which win NEXT before the obligation
+# rule is reached. tk2's gate-check.sh runs the REAL gate-check and drops only that block and its
+# count, so the obligation lines status.sh reads are real output, not typed here.
+mkdir -p "$W/tk2"; (cd "$W/tk" && tar -cf - .) | (cd "$W/tk2" && tar -xf -)
+mv "$W/tk2/bin/gate-check.sh" "$W/tk2/bin/gate-check-real.sh"
+cat > "$W/tk2/bin/gate-check.sh" <<'WRAP'
+#!/usr/bin/env bash
+"$(dirname "$0")/gate-check-real.sh" "$@" 2>/dev/null \
+  | awk '/^Needs attention/{s=1;next} /^Next up:|^Approved over a failing gate:/{s=0} !s' \
+  | sed -E 's/[0-9]+ need attention/0 need attention/'
+WRAP
+chmod +x "$W/tk2/bin/gate-check.sh"
+P9="$W/ob"; mkdir -p "$P9"; : > "$P9/Fixture.mpr"; "$W/tk2/bin/init-project.sh" "$P9" >/dev/null 2>&1
+setstage() { awk -v st="$2" '/^## Current stage/{print; getline; print ""; getline; print st; next} {print}' "$1/PROJECT.md" > "$1/p.new" && mv "$1/p.new" "$1/PROJECT.md"
+             grep -q '^Entry mode:' "$1/PROJECT.md" || printf '\nEntry mode: migration\n' >> "$1/PROJECT.md"; }
+nextof() { "$1" "$2" --brief 2>/dev/null | sed -n 's/^NEXT    //p'; }
+setstage "$P9" "**Stage 3 — Architecture & Design**, in progress."
+grep -q '^\*\*Stage 3' "$P9/PROJECT.md" || bad "T9 setup: stage line not written" "$(sed -n '1,15p' "$P9/PROJECT.md")"
+n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
+case "$n" in "discharge:"*) ok "T9 Stage 3: NEXT still discharges what is owed now";; *) bad "T9 Stage 3: expected a discharge NEXT" "$n";; esac
+case "$n" in *final-look*|*skeleton*|*coherence*) bad "T9 Stage 3: NEXT names an obligation first owed at Stage 5/6" "$n";; *) ok "T9 Stage 3: no Stage 5/6 obligation in NEXT";; esac
+case "$n" in *workflow-count*) ok "T9 Stage 3: a Stage 3 obligation stays in NEXT";; *) bad "T9 Stage 3: Stage 3 obligation dropped" "$n";; esac
+f="$("$W/tk2/bin/status.sh" "$P9" 2>/dev/null)"
+printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' && ok "T9 the screen still lists final-look under obligations pending" || bad "T9 obligations pending line lost final-look" "$f"
+setstage "$P9" "**Stage 1 — Analysis**, in progress."
+n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
+case "$n" in "discharge:"*) bad "T9 Stage 1: every pending obligation is above Stage 1, NEXT should fall through" "$n";; *) ok "T9 Stage 1: NEXT is not a discharge line (falls through to the later rules)";; esac
+if [ "$HAVE_BASE" = 1 ]; then
+  cp "$OLD" "$W/tk2/bin/status-baseline.sh"
+  o="$(nextof "$W/tk2/bin/status-baseline.sh" "$P9")"
+  case "$o" in *final-look*) ok "T9 control: the baseline told a Stage 1 project to discharge final-look";; *) bad "T9 control: baseline did not name final-look — case cannot fail" "$o";; esac
+fi
+
+echo "SCORE: $PASS/$((PASS+FAIL))"
+[ "$FAIL" -eq 0 ]

From 9b73def4b86d1dfc2d38bb6cc44cb9c6a8e7228f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:12:27 +0000
Subject: [PATCH 38/68] Review of #321: NOT YET DUE for final-look only and
 only on the derived readout; unresolvable stamp falls back to last-in-file

- NOT YET DUE now applies to final-look alone, and only when the Current
  stage line is gate-check's own derived readout. Hand-written and scaffold
  lines read as unreadable, so the row stays owed. Every other obligation
  keeps master's verdict.
- _ob_newest_stamp: if any VALID AT stamp does not resolve (squash, rebase,
  shallow clone), use the last stamp in the file as master did. Before, the
  older resolvable stamp won and the report read STALE.
- CHANGELOG: cite #155's field report as the motivation and say the checker
  is proven by fixtures only.

Fixtures: valid-at T3b; final-look T9-T11 (each fails on the previous head).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                              |  4 +--
 bin/lib/obligation-check.sh               | 43 ++++++++++++++---------
 tests/wave2/test-obligation-final-look.sh | 37 ++++++++++++-------
 tests/wave2/test-obligation-valid-at.sh   |  4 +++
 4 files changed, 57 insertions(+), 31 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f357a7da..cddaadbb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(obligations): **Each `PROOF-OF-LOOK` line is checked against the `VALID AT` stamp of its own section, and the report's newest stamp is chosen by commit time ([#155](https://github.com/MendixMau/mxcli-project-toolkit/issues/155)).** A review file that keeps dated addenda was still FAULTing: every proof line was compared with the single newest stamp, so the first section's honest screenshots read "older than VALID AT". The field project's only way back to green was to re-shoot every page and delete its older proof lines. A citation now belongs to the nearest stamp above it (one above every stamp belongs to the headline's), on pretty-printed and one-line HTML alike. "Newest" was last-in-file, so an addendum written above the original stamp went STALE; it is now the stamp with the newest commit time. A stale shot inside a section still FAULTs. Fixture `test-obligation-valid-at.sh` T4-T8 (3 fail on master). Field run 2026-09-26, requirements-driven build — MendixMau
-- fix(obligations): **The final LOOK is held to the per-module LOOK's proof rules, and project-wide obligations are not owed before their stage.** Found in an independent review of #303. `final-look` (from-stage 6) read PENDING on a project still at Stage P, because the from-stage column was only compared with `--adopt`. A project or cluster row whose from-stage is above the register's `## Current stage` now reads `NOT YET DUE` and is not counted as pending. Module rows are unchanged, and an unreadable stage line still means owed. `module-review.md` § "The final LOOK" requires `PROOF-OF-LOOK` lines, but the check ran only for `look`; it now runs for `final-look` too. An unstamped final-look report could never go stale and so passed forever; it is now FAULT ("NO VALID AT"). Fixture `test-obligation-final-look.sh` T4-T10 (4 fail on master). — MendixMau
+- fix(obligations): **Each `PROOF-OF-LOOK` line is checked against the `VALID AT` stamp of its own section, and the report's newest stamp is chosen by commit time ([#155](https://github.com/MendixMau/mxcli-project-toolkit/issues/155)).** A review file that keeps dated addenda was still FAULTing: every proof line was compared with the single newest stamp, so the first section's honest screenshots read "older than VALID AT". The field project's only way back to green was to re-shoot every page and delete its older proof lines. A citation now belongs to the nearest stamp above it (one above every stamp belongs to the headline's), on pretty-printed and one-line HTML alike. "Newest" was last-in-file, so an addendum written above the original stamp went STALE; it is now the stamp with the newest commit time. If any stamp no longer resolves (squash, rebase, shallow clone), the last stamp in the file is used, as before, and staleness reads as unmeasured. A stale shot inside a section still FAULTs. Motivated by the field report in #155 (a requirements-driven build, 2026-09-26). The checker is proven by fixtures only (`test-obligation-valid-at.sh` T3b, T4-T8; 3 fail on master); no field run against a real report yet — MendixMau
+- fix(obligations): **The final LOOK is held to the per-module LOOK's proof rules, and is not owed before Stage 6.** Found in an independent review of #303. `final-look` (from-stage 6) read PENDING on a project still at Stage P, because the from-stage column was only compared with `--adopt`. It now reads `NOT YET DUE` while gate-check's own derived `## Current stage` readout (the line carrying "(derived by gate-check") is below 6. A hand-written or scaffold stage line counts as unreadable, so the row stays owed; hand-written lines disagreed with the gates in 8 of 12 field projects. Every other obligation keeps its verdict. `module-review.md` § "The final LOOK" requires `PROOF-OF-LOOK` lines, but the check ran only for `look`; it now runs for `final-look` too. An unstamped final-look report could never go stale and so passed forever; it is now FAULT ("NO VALID AT"). Fixture `test-obligation-final-look.sh` T4-T11 (3 fail on master). — MendixMau
 - learn(brd-to-build-plan): **No `LOOK` row kind; the paragraph next to the Kind list says why ([#68](https://github.com/MendixMau/mxcli-project-toolkit/issues/68), [#188](https://github.com/MendixMau/mxcli-project-toolkit/issues/188) item 6).** A look is a `HARNESS` row naming the LOOK pass. Whether it happened is read from the `look` and `fidelity` obligations and the look-ledger, never from a State cell a person can set by hand. A second record could say "looked at" while the gate says nobody did. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/obligation-check.sh b/bin/lib/obligation-check.sh
index 6ced1eef..1f59895d 100755
--- a/bin/lib/obligation-check.sh
+++ b/bin/lib/obligation-check.sh
@@ -19,7 +19,7 @@
 #   FAULT    a mark exists but cannot be read as evidence (no denominator on a pass that owes one)
 #   WAIVED   the register says this one is out of scope, with a reason
 #   ADOPTED  the project joined the pipeline above this obligation's stage
-#   NOT YET DUE  a project/cluster row whose from-stage the register's Current stage has not reached
+#   NOT YET DUE  final-look only: gate-check's derived Current stage has not reached its from-stage
 #   N/A      this project is not running the pipeline at all (a-la-carte; existing-app-assurance.md)
 
 set -uo pipefail
@@ -167,18 +167,23 @@ _ob_rank() { case "$1" in P|p) echo 0 ;; [0-7]) echo $(( $1 + 1 )) ;; *) echo 99
 # _ob_current_stage <register>  → prints P or 0-7 from the register's "## Current stage" line, or
 # nothing when it cannot be read (no section, or a hand-written line that names no stage).
 #
-# Why: the from-stage column was read only against --adopt, so a project/cluster row was owed
-# from the day PROJECT.md existed. final-look (from-stage 6, the whole-app LOOK run LAST) read
-# PENDING on a project still at Stage P — an obligation reported before it can be performed is
-# noise, and noise teaches people to skip the obligation lines (review of #303, 2026-10-13).
-# The readout is gate-check's own ("**Stage N — Title**, …", or "**All gates passed**"); the
-# scaffold line init-project.sh writes ("**Stage P — Kickoff**") parses the same way.
-# Unreadable → empty → the caller keeps the old behaviour (owed): "could not tell the stage"
-# must never read as "not due yet".
+# Why: the from-stage column was read only against --adopt, so final-look (from-stage 6, the
+# whole-app LOOK run LAST) read PENDING on a project still at Stage P (review of #303).
+#
+# ONLY gate-check's own derived readout counts — a line containing "(derived by gate-check".
+# A hand-written line, and the scaffold line init-project.sh writes ("**Stage P — Kickoff**"),
+# read as unreadable → empty → owed. Field evidence (review of #321): hand-written lines
+# disagreed with the gates in 8 of 12 projects and gate-check never overwrites them; the
+# scaffold line often never advances because projects query `gate-check.sh . 5` directly.
+# "Could not tell the stage" must never read as "not due yet".
 _ob_current_stage() {
   local reg="$1" line
   [ -f "$reg" ] || return 0
   line="$(awk '/^## Current stage/{f=1;next} f && /^## /{exit} f && /^\*\*/{print;exit}' "$reg" 2>/dev/null | tr -d '\r')"
+  case "$line" in
+    *"(derived by gate-check"*) ;;
+    *) return 0 ;;
+  esac
   case "$line" in
     "**All gates passed"*) printf '7'; return 0 ;;
   esac
@@ -270,22 +275,25 @@ _ob_has_denominator() {
 # "Newest" is by COMMIT TIME, not by position (#155). A report kept as one dated file with an
 # addendum per build row carries several stamps; whether the author appends addenda at the
 # bottom or prepends them under the headline, the stamp that says the most recent thing is the
-# one whose commit is newest. Unresolvable stamps are skipped; with none resolvable, the last
-# stamp in the file is returned (and the callers then treat it as unmeasurable).
+# one whose commit is newest. If ANY stamp does not resolve here (history rewritten by a squash
+# or rebase, a shallow clone), the order of the stamps cannot be measured, so the last stamp in
+# the file is returned, as before: picking an older resolvable stamp instead would report STALE
+# on a report this checker cannot actually date (review of #321).
 _ob_valid_at_stamps() {
   tr -d '\r' < "$1" 2>/dev/null \
     | grep -oiE 'VALID[[:space:]]+AT:?[[:space:]]*[0-9a-f]{7,40}' \
     | grep -oiE '[0-9a-f]{7,40}$'
 }
 _ob_newest_stamp() {
-  local root="$1" hit="$2" h t best="" best_t=-1 last=""
+  local root="$1" hit="$2" h t best="" best_t=-1 last="" unresolved=0
   while IFS= read -r h; do
     [ -n "$h" ] || continue
     last="$h"
     t="$(git -C "$root" show -s --format=%ct "${h}^{commit}" 2>/dev/null || true)"
-    [ -n "$t" ] || continue
+    if [ -z "$t" ]; then unresolved=1; continue; fi
     if [ "$t" -ge "$best_t" ]; then best="$h"; best_t="$t"; fi
   done <<< "$(_ob_valid_at_stamps "$hit")"
+  [ "$unresolved" = 1 ] && best=""
   printf '%s' "${best:-$last}"
 }
 _ob_stale() {
@@ -452,10 +460,11 @@ mxtk_obligations_report() {
       continue
     fi
 
-    # Not yet due: a project/cluster row whose stage the register has not reached. Module rows
-    # are not touched — they are owed by a module being OPENED FOR WORK (_ob_modules), which is
-    # its own "due" test, and their verdicts stay exactly as before.
-    if [ "$scope" != "module" ] && [ "$(_ob_rank "$from_stage")" -gt "$current_rank" ]; then
+    # Not yet due: final-look ONLY, the one row that by definition runs last. Every other row
+    # keeps its verdict whatever the readout says — an early stale FAIL holds the derived
+    # readout back while the build goes on, and a general rule would hide owed passes behind it
+    # (review of #321).
+    if [ "$ob" = "final-look" ] && [ "$(_ob_rank "$from_stage")" -gt "$current_rank" ]; then
       printf 'Obligation %-10s NOT YET DUE — owed from stage %s; the register'"'"'s Current stage is %s (%s)\n' \
         "$ob" "$from_stage" "$current" "$skill"
       continue
diff --git a/tests/wave2/test-obligation-final-look.sh b/tests/wave2/test-obligation-final-look.sh
index de80246d..bc737313 100755
--- a/tests/wave2/test-obligation-final-look.sh
+++ b/tests/wave2/test-obligation-final-look.sh
@@ -12,8 +12,9 @@
 # Review of #303 (2026-10-13), T4-T10: the final LOOK owes the same PROOF-OF-LOOK lines as the
 # per-module LOOK (module-review.md § "The final LOOK" requires them; only ob=look was checked);
 # an unstamped final report is FAULT (with no VALID AT it could never go stale, so it would pass
-# forever); and the row is NOT YET DUE until the register's Current stage reaches its from-stage
-# (6) — it read PENDING from the day PROJECT.md existed. Module rows keep their verdicts.
+# forever); and final-look (ONLY) is NOT YET DUE until gate-check's DERIVED Current stage
+# reaches 6. A hand-written or scaffold stage line is unreadable → owed; every other row keeps
+# its verdict (review of #321: hand-written lines disagree with the gates in 8 of 12 projects).
 # Subject: obligation-check.sh. Producer of the report: module-review.md § "The final LOOK".
 set -uo pipefail
 ARG="${1:?usage: test-obligation-final-look.sh /path/to/bin/gate-check.sh (or lib/obligation-check.sh)}"
@@ -84,26 +85,38 @@ printf '# PROJECT.md\n\n## Current stage\n\n**Stage 5 — Build**, in progress (
 l="$(line)"
 case "$l" in *"NOT YET DUE"*) ok "final-look not owed before stage 6" ;; *) bad "expected NOT YET DUE, got: $l" ;; esac
 
-echo "== T9: register at Stage 6, or all gates passed -> owed (PENDING) =="
-printf '# PROJECT.md\n\n## Current stage\n\n**Stage 6 — Test**, in progress.\n' > "$P/PROJECT.md"
+D=' (derived by gate-check on 2026-10-13; re-run it rather than editing this line).'
+echo "== T9: derived Stage 6, or all gates passed -> owed (PENDING) =="
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 6 — Test**, in progress%s\n' "$D" > "$P/PROJECT.md"
 l="$(line)"
 case "$l" in *PENDING*) ok "owed at stage 6" ;; *) bad "expected PENDING at stage 6, got: $l" ;; esac
-printf '# PROJECT.md\n\n## Current stage\n\n**All gates passed** — through Stage 7 (Cutover)\n' > "$P/PROJECT.md"
+printf '# PROJECT.md\n\n## Current stage\n\n**All gates passed** — through Stage 7 (Cutover) — gates passed: P, 0%s\n' "$D" > "$P/PROJECT.md"
 l="$(line)"
 case "$l" in *PENDING*) ok "owed when all gates passed" ;; *) bad "expected PENDING after all gates, got: $l" ;; esac
 printf '# PROJECT.md\n\n## Current stage\n\nWe are somewhere in the build.\n' > "$P/PROJECT.md"
 l="$(line)"
 case "$l" in *PENDING*) ok "unreadable stage keeps the old verdict (owed)" ;; *) bad "unreadable stage changed the verdict: $l" ;; esac
 
-echo "== T10: module rows keep their verdicts at Stage P =="
-mod() { "$OBCHECK" "$P" 2>&1 | grep -E '^Obligation (look|sweep|journeys|fidelity|dispatch) ' | sed -E 's/ +/ /g'; }
-rm -f "$P/PROJECT.md"; before="$(mod)"
+echo "== T10: a hand-written stage line is not honoured -> owed =="
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 5 — Build**, in progress.\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *PENDING*) ok "hand-written Stage 5 line ignored, final-look owed" ;; *) bad "hand-written line honoured: $l" ;; esac
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 5 verdict: COMPLETE**\n' > "$P/PROJECT.md"
+l="$(line)"
+case "$l" in *PENDING*) ok "free-form hand-written line ignored, final-look owed" ;; *) bad "free-form line honoured: $l" ;; esac
+
+echo "== T11: scaffold line with a module open -> final-look owed; module and other rows unchanged =="
+others() { "$OBCHECK" "$P" 2>&1 | grep -E '^Obligation ' | grep -vE '^Obligation final-look ' | sed -E 's/ +/ /g'; }
+rm -f "$P/PROJECT.md"; before="$(others)"
 printf '# PROJECT.md\n\n## Current stage\n\n**Stage P — Kickoff**, in progress.\n' > "$P/PROJECT.md"
-after="$(mod)"
-[ -n "$before" ] && [ "$before" = "$after" ] && ok "module verdicts identical with and without a Stage P register" \
-  || bad "module verdicts changed: before=[$before] after=[$after]"
+after="$(others)"
+l="$(line)"
+case "$l" in *PENDING*) ok "scaffold Stage P line ignored, final-look owed" ;; *) bad "scaffold line honoured: $l" ;; esac
+[ -n "$before" ] && [ "$before" = "$after" ] && ok "every other obligation line identical with and without the register" \
+  || bad "other verdicts changed: before=[$before] after=[$after]"
+printf '# PROJECT.md\n\n## Current stage\n\n**Stage 3 — Architecture**, in progress%s\n' "$D" > "$P/PROJECT.md"
 l="$("$OBCHECK" "$P" 2>&1 | grep -E '^Obligation skeleton ')"
-case "$l" in *"NOT YET DUE"*) ok "project row from stage 5 not due at Stage P" ;; *) bad "skeleton at Stage P: $l" ;; esac
+case "$l" in *PENDING*) ok "skeleton (from 5) still owed under a derived Stage 3 readout" ;; *) bad "skeleton hidden: $l" ;; esac
 
 echo "pass=$PASS fail=$FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-obligation-valid-at.sh b/tests/wave2/test-obligation-valid-at.sh
index 8f9953b4..da77767a 100755
--- a/tests/wave2/test-obligation-valid-at.sh
+++ b/tests/wave2/test-obligation-valid-at.sh
@@ -50,6 +50,10 @@ echo "== T3: newest stamp sits past byte 8000 -> still seen =="
 { printf '<p>ModuleX: 1 of 1 pages reviewed</p>\nVALID AT: %s\n' "$OLD"; head -c 9000 /dev/zero | tr '\0' 'x'; printf '\nVALID AT: %s\n' "$NEW"; } > "$REP"
 [ "$(stale)" -eq 0 ] && ok "stamp past 8000 bytes seen" || bad "stamp past 8000 bytes ignored (STALE)"
 
+echo "== T3b: one stamp unresolvable here (squash/rebase/shallow) -> last-in-file, unmeasurable, not STALE =="
+printf '<p>ModuleX: 1 of 1 pages reviewed</p>\nVALID AT: %s\n<h2>Addendum</h2>\nVALID AT: deadbee1\n' "$OLD" > "$REP"
+[ "$(stale)" -eq 0 ] && ok "unresolvable stamp falls back to last-in-file (unmeasured)" || bad "older resolvable stamp picked over an unresolvable one (STALE)"
+
 # ── T4-T8: dated report (owes PROOF-OF-LOOK), commits and shot mtimes at fixed times ──
 Q="$WORK/q"; mkdir -p "$Q/architecture/modules/ModuleX" "$Q/mdlsource" "$Q/design/ui-reviews/shots"
 git -C "$Q" init -q . 2>/dev/null

From b5b73e47d849517c3947d1bcd79951c52e3b5c3a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:13:03 +0000
Subject: [PATCH 39/68] fix(lint-rules): re-seed check scoped to stock-seeded
 rules; opt-out needs a reason and refuses stock rules (#264 review 2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- The REVERTED path (installer restore and lint-gate BLIND) applies only to
  MXTK_LINT_RULES_STOCK, the file names `mxcli init` seeds. A headerless toolkit-only rule
  (ux001, txt*) or configurable conv020 is a local edit: still LOCALLY MODIFIED / configured,
  never overwritten, not BLIND. The receipt row gains a kind column (stock | toolkit |
  configurable) so lint-gate, which has no manifest, can tell; rows without one are healed by
  the next sync and not checked until then. A receipt-listed rule that is missing is still
  reported for every kind.
- One header test in both: anchored `^# mxtk-lint-rule:` (lint-gate used a substring match).
- .claude/lint-rules-disabled.txt: each line needs `# reason: …` (a user decision, asked in chat
  and recorded in PROJECT.md); a line with no reason, or naming a stock-seeded rule, is ignored
  with a warning by both the installer and lint-gate. The BLIND message no longer suggests
  opting out. lint-rules/README.md rewritten to match (CONV010 cannot be opted out).
- The installer no longer advises adding a project's hash to STOCK-HASHES.txt.
- tests/wave2/test-lint-receipt-revert.sh: kinds in the receipt (T0), reasonless and reasoned
  opt-out (T10), stock opt-out refused (T12), headerless ux001 and configured headerless conv020
  not overwritten and not BLIND (T13, T14). 51/51 here; 14 fail with master's installer, 25 with
  master's installer and lint-gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |   2 +-
 bin/lib/install-lint-rules.sh           | 104 +++++++++++++++++-------
 lint-rules/README.md                    |  37 ++++++---
 project-bin/lint-gate.sh                |  61 +++++++++-----
 skills/lint-that-actually-runs.md       |   2 +-
 tests/wave2/test-lint-receipt-revert.sh |  55 +++++++++++--
 6 files changed, 190 insertions(+), 71 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c0a17a4..3ef833cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a rule whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or that is missing, is named, the remedy `bin/sync-project.sh <project>` is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the printed remedy always clears it, `bin/lib/install-lint-rules.sh` now restores a rule whose receipt row exists and whose header is gone even when its stock hash is not in `STOCK-HASHES.txt` (an mxcli upgrade, then init; it was reported LOCALLY MODIFIED and never written), prunes receipt rows for rules no longer shipped, and honours a new `.claude/lint-rules-disabled.txt` opt-out that lint-gate also reads (`lint-rules/README.md` told projects to delete txt002, which would now read as a re-seed). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 38/38 here, 21 fail on master's lint-gate and installer. — AlvinnYeo
+- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a stock-seeded rule (the file names `mxcli init` writes, now marked `stock` in the receipt) whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or any receipt-listed rule that is missing, is named, the remedy `bin/sync-project.sh <project>` (fallback `--upgrade-lint-rules all`) is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the remedy always clears it, `bin/lib/install-lint-rules.sh` restores such a stock-seeded rule even when this mxcli's stock hash is not in `STOCK-HASHES.txt` yet (it was reported LOCALLY MODIFIED and never written); a headerless toolkit-only or configurable rule is still a local edit, never overwritten. The installer also writes each receipt row's kind, prunes rows for rules no longer shipped, and honours `.claude/lint-rules-disabled.txt`: one line per rule with `# reason: …`, a user decision recorded in `PROJECT.md`; a line with no reason, or naming a stock-seeded rule, is ignored with a warning (`lint-rules/README.md` had told projects to just delete txt002). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 51/51 here, 25 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/install-lint-rules.sh b/bin/lib/install-lint-rules.sh
index c864520a..633fd1b9 100644
--- a/bin/lib/install-lint-rules.sh
+++ b/bin/lib/install-lint-rules.sh
@@ -95,63 +95,106 @@ _mxtk_lint_receipt_get() {
   return 1
 }
 
+# The receipt row is `<rule-file>  <md5>  <kind>`. kind is where the rule comes from, read from
+# install-manifest.sh: `stock` (MXTK_LINT_RULES_STOCK — `mxcli init` also seeds this file name,
+# so a headerless copy is a re-seed), `toolkit` (toolkit-only; init never writes it, so a
+# headerless copy is a person's edit) or `configurable` (edited by design). lint-gate.sh reads the
+# kind, since a project has no manifest; a row without one (written before kinds existed) is
+# healed by the next sync and is not checked by lint-gate until then.
+_mxtk_lint_kind() {
+  case " ${MXTK_LINT_RULES_STOCK:-} " in *" $1 "*) echo stock; return ;; esac
+  case " ${MXTK_LINT_RULES_CONFIGURABLE:-} " in *" $1 "*) echo configurable; return ;; esac
+  echo toolkit
+}
+
 # Rewrite one receipt line. Read-all/write-all rather than append, so re-installing a rule
 # does not leave two rows for it and let a stale one win the lookup above.
 _mxtk_lint_receipt_set() {
   _receipt="$1"; _f="$2"; _md5="$3"
   _tmp="$_receipt.tmp.$$"
   {
-    printf '# md5 of each toolkit lint rule AS INSTALLED. Written by bin/lib/install-lint-rules.sh.\n'
+    printf '# md5 of each toolkit lint rule AS INSTALLED, and its kind. Written by bin/lib/install-lint-rules.sh.\n'
     printf '# Do not edit. Deleting this file makes a revert-to-stock look like a first install.\n'
     if [ -f "$_receipt" ]; then
       while read -r _n _m _r; do
         case "$_n" in ''|'#'*) continue ;; esac
         [ "$_n" = "$_f" ] && continue
-        printf '%s  %s\n' "$_n" "$_m"
+        printf '%s  %s%s\n' "$_n" "$_m" "${_r:+  $_r}"
       done < "$_receipt"
     fi
-    printf '%s  %s\n' "$_f" "$_md5"
+    printf '%s  %s  %s\n' "$_f" "$_md5" "$(_mxtk_lint_kind "$_f")"
   } > "$_tmp" && mv "$_tmp" "$_receipt"
 }
 
-# DELIBERATE OPT-OUT. .claude/lint-rules-disabled.txt, one rule file per line ('#' comments).
-# A rule listed there is never installed or restored, and its receipt row is pruned, so
-# deleting it is not undone by the next sync and lint-gate.sh (which reads the same file) does
-# not report the deletion as a re-seed. Deleting a rule without listing it is what `mxcli init`
-# does, and is treated as such.
+# DELIBERATE OPT-OUT — a user decision, not an agent's. .claude/lint-rules-disabled.txt holds
+# one rule per line, each WITH its reason:
+#     txt002_non_iso_date_in_user_text.star  # reason: display standard is dd/MM/yyyy (PROJECT.md D-14)
+# The decision is asked in chat and recorded in PROJECT.md; the line here is what the tools
+# read. A listed rule is never installed or restored and its receipt row is pruned, and
+# lint-gate.sh does not report it gone. Refused, with a warning, and the line ignored:
+#   - a line with no `# reason:` text;
+#   - a stock-seeded rule (MXTK_LINT_RULES_STOCK). `mxcli init` writes a stock copy of that file
+#     name back, and the stock rules report a clean pass while inspecting nothing — an opt-out
+#     would turn that into a permanent silent green.
+# _mxtk_lint_is_disabled answers for one rule; _mxtk_lint_disabled_audit warns once per bad line.
+_mxtk_lint_dis_ok() {  # $1 = rule, $2 = rest of the line -> 0 when the line is a valid opt-out
+  case " ${MXTK_LINT_RULES_STOCK:-} " in *" $1 "*) return 1 ;; esac
+  _dis_why="${2#*# reason:}"
+  [ "$_dis_why" != "$2" ] || return 1
+  [ -n "$(printf '%s' "$_dis_why" | tr -d '[:space:]')" ]
+}
 _mxtk_lint_is_disabled() {
   # Own variable names: callers loop with _n/_m/_f, and these are not `local` (POSIX sh).
   _dis_file="$1"; _dis_want="$2"
   [ -f "$_dis_file" ] || return 1
   while read -r _dis_n _dis_rest; do
     case "$_dis_n" in ''|'#'*) continue ;; esac
-    [ "$_dis_n" = "$_dis_want" ] && return 0
+    [ "$_dis_n" = "$_dis_want" ] && _mxtk_lint_dis_ok "$_dis_n" "$_dis_rest" && return 0
   done < "$_dis_file"
   return 1
 }
+_mxtk_lint_disabled_audit() {
+  _dis_file="$1"
+  [ -f "$_dis_file" ] || return 0
+  while read -r _dis_n _dis_rest; do
+    case "$_dis_n" in ''|'#'*) continue ;; esac
+    _mxtk_lint_dis_ok "$_dis_n" "$_dis_rest" && continue
+    case " ${MXTK_LINT_RULES_STOCK:-} " in
+      *" $_dis_n "*) _mxtk_lint_warn \
+        ".claude/lint-rules-disabled.txt: $_dis_n cannot be disabled — IGNORED." \
+        "\`mxcli init\` re-seeds a stock copy of it, which reports a clean pass while inspecting" \
+        "nothing. The rule stays installed. Remove the line." ;;
+      *) _mxtk_lint_warn \
+        ".claude/lint-rules-disabled.txt: $_dis_n has no '# reason: …' — IGNORED, the rule stays installed." \
+        "Disabling a rule is the user's decision: ask in chat, record it in PROJECT.md, then write" \
+        "  $_dis_n  # reason: <why, and where it is recorded>" ;;
+    esac
+  done < "$_dis_file"
+}
 
-# Drop receipt rows for rules this toolkit no longer ships, or that the project disabled.
-# A stale row would make lint-gate.sh report the rule "gone" on every run, forever.
-_mxtk_lint_receipt_prune() {
+# Rewrite the receipt to the current manifest: rows for rules no longer shipped, or validly
+# disabled here, are dropped (a stale row would make lint-gate.sh report the rule "gone" on every
+# run, forever), and every kept row carries its kind. Written only when something changed.
+_mxtk_lint_receipt_finalize() {
   _receipt="$1"; _keep=" $2 "; _dis="$3"
   [ -f "$_receipt" ] || return 0
   _pruned=""; _tmp="$_receipt.tmp.$$"
   {
-    printf '# md5 of each toolkit lint rule AS INSTALLED. Written by bin/lib/install-lint-rules.sh.\n'
+    printf '# md5 of each toolkit lint rule AS INSTALLED, and its kind. Written by bin/lib/install-lint-rules.sh.\n'
     printf '# Do not edit. Deleting this file makes a revert-to-stock look like a first install.\n'
     while read -r _n _m _r; do
       case "$_n" in ''|'#'*) continue ;; esac
       case "$_keep" in *" $_n "*) ;; *) _pruned="$_pruned $_n"; continue ;; esac
       if _mxtk_lint_is_disabled "$_dis" "$_n"; then _pruned="$_pruned $_n"; continue; fi
-      printf '%s  %s\n' "$_n" "$_m"
+      printf '%s  %s  %s\n' "$_n" "$_m" "$(_mxtk_lint_kind "$_n")"
     done < "$_receipt"
   } > "$_tmp"
-  if [ -n "$_pruned" ]; then
-    mv "$_tmp" "$_receipt"
-    echo "Lint receipt: dropped row(s) for rules no longer shipped or disabled here:$_pruned"
-  else
+  if cmp -s "$_tmp" "$_receipt"; then
     rm -f "$_tmp"
+  else
+    mv "$_tmp" "$_receipt"
   fi
+  [ -z "$_pruned" ] || echo "Lint receipt: dropped row(s) for rules no longer shipped or disabled here:$_pruned"
 }
 
 mxtk_install_lint_rules() {
@@ -192,6 +235,7 @@ mxtk_install_lint_rules() {
     fi
   fi
 
+  _mxtk_lint_disabled_audit "$_disabled"
   _drifted=""
   for _kind in managed configurable; do
     if [ "$_kind" = managed ]; then _list="${MXTK_LINT_RULES:-}"; else _list="${MXTK_LINT_RULES_CONFIGURABLE:-}"; fi
@@ -282,22 +326,24 @@ mxtk_install_lint_rules() {
         continue
       fi
 
-      # ---- installed by us, header gone, stock hash not on file -----------------------
-      # The receipt says we installed this file, and the provenance header is gone. That is
-      # a re-seed by an mxcli version STOCK-HASHES.txt does not list yet (an upgrade, then
-      # init), not a hand edit: a hand edit keeps the header. The same test lint-gate.sh uses
-      # to declare the run BLIND, so the remedy it prints (sync) actually clears it (#264
-      # review: without this branch the file was reported LOCALLY MODIFIED and never written,
-      # and lint stayed BLIND forever). The found file is kept beside it, not loaded by lint.
-      if [ -n "$_rec" ] && ! grep -q '^# mxtk-lint-rule:' "$_dst"; then
-        _why="REVERTED TO STOCK — header gone and its hash is not in STOCK-HASHES.txt (newer mxcli?). Restoring it"
+      # ---- stock-seedable, installed by us, header gone, stock hash not on file --------
+      # Only for MXTK_LINT_RULES_STOCK: `mxcli init` seeds those file names, so with the receipt
+      # saying we installed it and the provenance header gone, this is a re-seed by an mxcli
+      # version STOCK-HASHES.txt does not list yet (an upgrade, then init) — not a hand edit.
+      # Without this branch it was reported LOCALLY MODIFIED and never written, and lint-gate.sh,
+      # which applies the same test, stayed BLIND forever (#264 review). Toolkit-only and
+      # configurable rules are never seeded by init: a headerless copy of one is a person's edit
+      # and falls through to the LOCALLY MODIFIED / configured branches below, never overwritten.
+      # The found file is kept beside it; lint loads *.star only.
+      if [ -n "$_rec" ] && [ "$(_mxtk_lint_kind "$_f")" = stock ] && ! grep -q '^# mxtk-lint-rule:' "$_dst"; then
+        _why="REVERTED TO STOCK — header gone; this mxcli's stock hash is not in STOCK-HASHES.txt yet. Restoring it"
         if [ "$_dry" -eq 1 ]; then
           echo "Would install: .claude/lint-rules/$_f ($_why)"
         else
           _bak="$_dst.reseeded-$(date +%Y%m%d%H%M%S)"
           cp "$_dst" "$_bak"
           cp "$_src" "$_dst" && _mxtk_lint_receipt_set "$_receipt" "$_f" "$_srcmd5"
-          echo "Lint rule: $_why — .claude/lint-rules/$_f (found copy kept at $(basename "$_bak"); md5 $_dstmd5 — add it to STOCK-HASHES.txt if it is a stock seed)"
+          echo "Lint rule: $_why — .claude/lint-rules/$_f (the file found is kept at $(basename "$_bak"))"
         fi
         MXTK_LINT_CHANGES=$((MXTK_LINT_CHANGES + 1))
         continue
@@ -346,7 +392,7 @@ mxtk_install_lint_rules() {
   if [ -n "$_drifted" ] && [ -z "$_upg" ]; then
     echo "   (upgrade every drifted lint rule at once with: --upgrade-lint-rules all)"
   fi
-  [ "$_dry" -eq 1 ] || _mxtk_lint_receipt_prune "$_receipt" \
+  [ "$_dry" -eq 1 ] || _mxtk_lint_receipt_finalize "$_receipt" \
     "${MXTK_LINT_RULES:-} ${MXTK_LINT_RULES_CONFIGURABLE:-}" "$_disabled"
   return 0
 }
diff --git a/lint-rules/README.md b/lint-rules/README.md
index 672e033a..f8e5118b 100644
--- a/lint-rules/README.md
+++ b/lint-rules/README.md
@@ -18,7 +18,7 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 | `perf002_nested_data_widgets.star` | PERF002 — a data view / list view / data grid / gallery nested inside two or more other data widgets on the same page: re-queries per row at every level | `MAX_NESTING`, `DATA_WIDGET_CANDIDATES`, `EXCLUDE` (widget_type vocabulary: probe first) |
 | `perf004_npe_system_user_assoc.star` | PERF004 — an association between a non-persistable entity and System.User / System.Session (or an entity generalizing them), which pins session objects to the shared side | `NON_PERSISTABLE_CANDIDATES`, `SYSTEM_TARGETS` (entity_type vocabulary: probe first) |
 | `txt001_build_words_in_user_text.star` | TXT001 — user-visible text (titles, captions, templates, messages, menu items) holding build-process words: `Stage N`, `BR-10`, `F004`, TODO, a version tag, "(local, …)" | `PROJECT_WORDS` (sibling-app and project code names); `LEAK_PATTERNS` if "Stage N" is a real domain word |
-| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — to opt out (display standard is not ISO), list it in `.claude/lint-rules-disabled.txt`, then delete it |
+| `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no — if the display standard is not ISO, the user may opt out: see "Opting out of a rule" |
 | `ui001_widget_layout_traps.star` | UI001 — a list view inside a Data grid 2 column (its own "Load more" / "No items found" in every cell); an inline `width` on an Atlas input without `flex` (ignored) | `DATAGRID_TYPES`, `LISTVIEW_TYPES`, `INPUT_TYPES` (widget_type vocabulary: probe first) |
 
 `err001` and `loop001` first field count (2026-10-12, mxcli 0.26.0, 21-module Mendix 11.12 model,
@@ -106,18 +106,31 @@ fixture on TestCLIApp — setting `ACTION_PREFIX` to an unused string produces t
 the real prefix produces none. `bin/lint-gate.sh` treats `module == "_rule"` as blindness, so
 this turns a silent pass into a gate failure rather than a line in a report nobody reads.
 
-Set `ACTION_PREFIX` / `DELEGATE_PREFIX` to your project's prefixes. If the project has no such
-convention, opt out deliberately rather than leaving it inert: list the file in
-`.claude/lint-rules-disabled.txt`, then delete it (see "Opting out of a rule" below).
+Set `ACTION_PREFIX` / `DELEGATE_PREFIX` to your project's prefixes. CONV010 cannot be opted out
+(`mxcli init` seeds that file name, see below), so on a project without the `ACT_` convention set
+`ACTION_PREFIX` to the prefix its page-action microflows do use. CONV020 can be opted out, as a
+user decision, if the project has no such convention (see "Opting out of a rule").
 
 ## Opting out of a rule
 
-List the rule file, one per line, in `.claude/lint-rules-disabled.txt`, then delete it from
-`.claude/lint-rules/`. A bare delete does not stick: `sync-project.sh` restores a rule it
-installed before, and `bin/lint-gate.sh` reads a rule that its receipt lists but that is missing
-as a `mxcli init` re-seed, so every exec reports `LINT BLIND` (#264). With the rule listed,
-the installer neither installs nor restores it and drops its receipt row, and lint-gate
-skips it.
+Disabling a rule is **the user's decision**, never an agent's: ask in chat, record the answer in
+`PROJECT.md`, then write one line per rule in `.claude/lint-rules-disabled.txt`, with its reason,
+and delete the file from `.claude/lint-rules/`:
+
+```
+txt002_non_iso_date_in_user_text.star  # reason: display standard is dd/MM/yyyy (PROJECT.md D-14)
+```
+
+A listed rule is never installed or restored by `sync-project.sh`, its receipt row is dropped,
+and `bin/lint-gate.sh` does not report it. Two kinds of line are **ignored, with a warning**:
+
+- a line with no `# reason:` text;
+- a stock-seeded rule (`conv010`, `data_change_microflows`, `entity_business_key` —
+  `MXTK_LINT_RULES_STOCK` in `bin/lib/install-manifest.sh`). `mxcli init` writes a stock copy of
+  those file names back, and the stock versions report a clean pass while inspecting nothing.
+
+A bare delete does not stick either: sync restores a rule it installed before, and lint-gate
+reads a receipt-listed rule that is missing as a re-seed, so every exec reports `LINT BLIND` (#264).
 
 ## How these reach a project
 
@@ -126,7 +139,9 @@ on every sync; both call `mxtk_install_lint_rules` in `bin/lib/install-lint-rule
 is one implementation rather than two that drift. Nothing a human edited is ever overwritten
 without `--upgrade-lint-rules <rule|all>`, which backs the local copy up first.
 
-A project's `.claude/.mxtk-lint-receipt` records the md5 of each rule *as installed*. Because
+A project's `.claude/.mxtk-lint-receipt` records the md5 of each rule *as installed*, and its
+kind (`stock`, `toolkit` or `configurable`, from the manifest) so that `bin/lint-gate.sh`, which
+runs in a project with no manifest, checks for a re-seed only where `mxcli init` can cause one. Because
 rules are copied verbatim, that one hash answers both questions the copy path needs: if the
 project's file still matches it, nobody here edited it; if the toolkit's file still matches it,
 the template has not moved. The receipt lives outside `lint-rules/`, which is what makes it
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index eca387c1..740c563f 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -28,16 +28,18 @@
 # in the other the re-seed sat uncommitted for five days and the baseline absorbed the noisier
 # counts. bin/lib/install-lint-rules.sh already writes .claude/.mxtk-lint-receipt (md5 of each
 # rule AS INSTALLED; it survives `mxcli init`), so before linting this script reads it: a rule
-# whose md5 no longer matches its receipt line AND whose `# mxtk-lint-rule:` header is gone (or
-# whose file is gone) was re-seeded, not edited by a person. The run then prints "BLIND — lint
+# whose md5 no longer matches its receipt line AND whose `# mxtk-lint-rule:` header is gone was
+# re-seeded, not edited by a person — checked only for rules the receipt marks `stock` (the file
+# names init seeds; toolkit-only and configurable rules are never seeded, so a headerless copy
+# of one is an edit). A receipt-listed rule whose file is gone is reported for every kind. The run then prints "BLIND — lint
 # rules reverted to stock", names the files, points at sync-project.sh (which restores them and
 # rewrites the receipt, so the next run is clean) and exits 1 without linting; --update-baseline
 # is refused, since baselining stock counts is how the five-day case went in. A rule that still
 # carries the header but differs is a hand edit — install-lint-rules.sh reports those, this does
-# not. No receipt = nothing to compare (pre-receipt installs) = no check. A rule removed on
-# purpose is listed in .claude/lint-rules-disabled.txt (the installer honours the same file and
-# prunes its receipt row). A deliberate headerless local rule: LINT_RULES_REVERTED_OK=1 runs
-# anyway, with the warning.
+# not. No receipt, or a row without a kind = no check (the next sync writes kinds). A non-stock
+# rule removed by the user's decision is listed, with a reason, in .claude/lint-rules-disabled.txt
+# (see lint-rules/README.md "Opting out of a rule"). LINT_RULES_REVERTED_OK=1 runs anyway, with
+# the warning.
 #
 # ACCEPTING DEBT IS RECORDED, NOT SILENT (2026-10-12). Three toolkit-built apps re-baselined
 # 61 times in four days — every acceptance made by the agent whose script caused the rise,
@@ -130,7 +132,7 @@ while [ $# -gt 0 ]; do
               REASON="$2"; shift ;;
     --reason=*) REASON="${1#--reason=}" ;;
     --approved-in-chat) APPROVED=1 ;;
-    -h|--help) sed -n '2,62p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,64p' "$0"; exit 0 ;;
     *) echo "lint-gate: unknown argument '$1'" >&2; exit 2 ;;
   esac
   shift
@@ -159,31 +161,49 @@ RECEIPT="$ROOT/.claude/.mxtk-lint-receipt"
 if [ -f "$RECEIPT" ]; then
   # Read into a variable first: a heredoc inside $(...) does not parse on bash 3.2.
   IFS= read -r -d '' _RCHK <<'PY' || true
-import hashlib, os
+import hashlib, os, re, sys
 rec, d, dis = os.environ["RECEIPT"], os.environ["RULES_DIR"], os.environ["DISABLED"]
+# Receipt rows: <rule-file> <md5> <kind>. kind (stock | toolkit | configurable) is written by
+# bin/lib/install-lint-rules.sh from install-manifest.sh, which a project does not have. A row
+# with no kind predates kinds and is not checked; the next sync writes it.
+rows = []
+for line in open(rec, encoding="utf-8", errors="replace"):
+    parts = line.split()
+    if len(parts) < 3 or parts[0].startswith("#"):
+        continue
+    rows.append((parts[0], parts[1], parts[2]))
+kind = {n: k for n, _, k in rows}
+# Opt-out: `<rule>  # reason: <text>` — the same rule the installer applies. No reason, or a
+# stock-seeded rule (init writes a stock copy back that passes clean while inspecting nothing):
+# the line is ignored, with a warning.
 disabled = set()
 if os.path.isfile(dis):
     for line in open(dis, encoding="utf-8", errors="replace"):
-        w = line.split()
-        if w and not w[0].startswith("#"):
+        w = line.split(None, 1)
+        if not w or w[0].startswith("#"):
+            continue
+        rest = w[1] if len(w) > 1 else ""
+        m = re.search(r"#\s*reason:\s*(\S.*)", rest)
+        if kind.get(w[0]) == "stock":
+            print("lint-gate: lint-rules-disabled.txt: %s is stock-seeded and cannot be disabled — ignored" % w[0], file=sys.stderr)
+        elif not m:
+            print("lint-gate: lint-rules-disabled.txt: %s has no '# reason: ...' — ignored" % w[0], file=sys.stderr)
+        else:
             disabled.add(w[0])
-for line in open(rec, encoding="utf-8", errors="replace"):
-    parts = line.split()
-    if len(parts) < 2 or parts[0].startswith("#"):
-        continue
-    name, want = parts[0], parts[1]
+HEADER = re.compile(rb"^# mxtk-lint-rule:", re.M)   # the installer's test: grep '^# mxtk-lint-rule:'
+for name, want, k in rows:
     if name in disabled:
-        continue  # deliberate opt-out, .claude/lint-rules-disabled.txt
+        continue
     path = os.path.join(d, name)
     if not os.path.isfile(path):
         print("%s\tgone (installed per the receipt, missing now)" % name)
         continue
+    if k != "stock":
+        continue  # init never seeds toolkit-only or configurable rules: an edit, the installer reports it
     data = open(path, "rb").read()
     got = hashlib.md5(data).hexdigest()
-    if got == want:
-        continue
-    if b"# mxtk-lint-rule:" in data:
-        continue  # header kept: a hand edit, which install-lint-rules.sh reports
+    if got == want or HEADER.search(data):
+        continue  # unchanged, or header kept: a hand edit, which install-lint-rules.sh reports
     print("%s\theader gone, md5 %s != receipt %s" % (name, got[:8], want[:8]))
 PY
   REVERTED="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" DISABLED="$ROOT/.claude/lint-rules-disabled.txt" "$PY" -c "$_RCHK")"
@@ -198,7 +218,6 @@ PY
     echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT"
     echo "   If sync reports a rule LOCALLY MODIFIED instead of restoring it:"
     echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT --upgrade-lint-rules all"
-    echo "   Removed one on purpose? List it in .claude/lint-rules-disabled.txt and this stops."
     if [ "${LINT_RULES_REVERTED_OK:-}" = "1" ]; then
       echo "   LINT_RULES_REVERTED_OK=1 — linting anyway; counts below are from the files on disk."
       echo ""
diff --git a/skills/lint-that-actually-runs.md b/skills/lint-that-actually-runs.md
index beb2a0d3..dae239fb 100644
--- a/skills/lint-that-actually-runs.md
+++ b/skills/lint-that-actually-runs.md
@@ -191,7 +191,7 @@ telling a human to do it.
   reverted ARCH002/ARCH003 reports a clean pass while inspecting nothing. This is why the install
   receipt lives outside `lint-rules/` and why installing rules **after** `mxcli init` is not a
   style preference.
-  Between syncs, `bin/lint-gate.sh` reads the same receipt before every lint: a rule whose md5
+  Between syncs, `bin/lint-gate.sh` reads the same receipt before every lint: a stock-seeded rule whose md5
   no longer matches and whose header is gone stops the run as `BLIND — lint rules reverted to
   stock` (exit 1, exec.sh logs `LINT BLIND`), not as a rise on the next script (#264).
 - **Registering a file is not enough — register the pointer.** An earlier workstream's scripts sat
diff --git a/tests/wave2/test-lint-receipt-revert.sh b/tests/wave2/test-lint-receipt-revert.sh
index 5223d4f7..3321c333 100755
--- a/tests/wave2/test-lint-receipt-revert.sh
+++ b/tests/wave2/test-lint-receipt-revert.sh
@@ -50,7 +50,9 @@ R="$P/.claude/.mxtk-lint-receipt"
 [ -f "$R" ] && ok "receipt written by install-lint-rules.sh" || bad "installer wrote no receipt" "$out"
 n=$(grep -cv '^#' "$R" 2>/dev/null || echo 0)
 [ "$n" -ge 3 ] && ok "receipt lists $n rules" || bad "receipt lists $n rules"
-grep -q '^conv010_act_microflow_content.star  [0-9a-f]\{32\}$' "$R" && ok "conv010 row: name + md5" || bad "conv010 row missing" "$(cat "$R")"
+grep -q '^conv010_act_microflow_content.star  [0-9a-f]\{32\}  stock$' "$R" && ok "conv010 row: name + md5 + kind stock" || bad "conv010 row missing" "$(cat "$R")"
+grep -q '^ux001_confirm_before_destructive.star  [0-9a-f]\{32\}  toolkit$' "$R" && ok "ux001 row: kind toolkit" || bad "ux001 row kind wrong" "$(cat "$R")"
+grep -q '^conv020_action_user_feedback.star  [0-9a-f]\{32\}  configurable$' "$R" && ok "conv020 row: kind configurable" || bad "conv020 row kind wrong" "$(cat "$R")"
 
 echo "T1 rules as installed: no receipt complaint, normal ratchet"
 mk "$(v CONV010 warning 26)"
@@ -147,25 +149,62 @@ ls "$P9/.claude/lint-rules/$EBK".reseeded-* >/dev/null 2>&1 && ok "found copy ke
 out=$(gate2 "$P9" 2>&1); rc=$?
 [ "$rc" -eq 0 ] && ok "after sync: rc 0 (remedy clears it)" || bad "still blind after sync (rc $rc)" "$out"
 
-echo "T10 a rule removed on purpose (listed in .claude/lint-rules-disabled.txt) is not a re-seed"
+echo "T10 opt-out: a non-stock rule removed by the user's decision, with a reason"
 P10=$(newproj p10); inst2 "$P10" >/dev/null
-printf '# display standard is dd/MM/yyyy\ntxt002_non_iso_date_in_user_text.star\n' > "$P10/.claude/lint-rules-disabled.txt"
-rm -f "$P10/.claude/lint-rules/txt002_non_iso_date_in_user_text.star"
+T2F=txt002_non_iso_date_in_user_text.star
+printf '%s\n' "$T2F" > "$P10/.claude/lint-rules-disabled.txt"     # no reason
+rm -f "$P10/.claude/lint-rules/$T2F"
 out=$(gate2 "$P10" 2>&1); rc=$?
-[ "$rc" -eq 0 ] && ok "lint-gate: rc 0, no alarm before any sync" || bad "deliberate removal read as a re-seed (rc $rc)" "$out"
+case "$out" in *"$T2F has no '# reason: ...' — ignored"*"BLIND — lint rules reverted"*) ok "no reason: line ignored with a warning, removal still BLIND" ;; *) bad "reasonless opt-out honoured (rc $rc)" "$out" ;; esac
 out=$(inst2 "$P10")
-[ ! -f "$P10/.claude/lint-rules/txt002_non_iso_date_in_user_text.star" ] && ok "sync does not restore a disabled rule" || bad "sync restored a disabled rule" "$out"
-grep -q '^txt002_non_iso_date_in_user_text.star ' "$P10/.claude/.mxtk-lint-receipt" && bad "disabled rule's receipt row kept" || ok "disabled rule's receipt row pruned"
+case "$out" in *"$T2F has no '# reason: …' — IGNORED"*) ok "installer warns about the reasonless line" ;; *) bad "no installer warning" "$out" ;; esac
+[ -f "$P10/.claude/lint-rules/$T2F" ] && ok "reasonless opt-out: sync restores the rule" || bad "reasonless opt-out honoured by sync"
+printf '# decided with the user 2026-10-13\n%s  # reason: display standard is dd/MM/yyyy (PROJECT.md decision D-14)\n' "$T2F" > "$P10/.claude/lint-rules-disabled.txt"
+rm -f "$P10/.claude/lint-rules/$T2F"
+out=$(gate2 "$P10" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "with a reason: lint-gate rc 0, no alarm before any sync" || bad "reasoned opt-out read as a re-seed (rc $rc)" "$out"
+out=$(inst2 "$P10")
+[ ! -f "$P10/.claude/lint-rules/$T2F" ] && ok "sync does not restore it" || bad "sync restored a disabled rule" "$out"
+if grep -q "^$T2F " "$P10/.claude/.mxtk-lint-receipt"; then bad "disabled rule's receipt row kept"; else ok "disabled rule's receipt row pruned"; fi
 rm -f "$P10/.claude/lint-rules/txt001_build_words_in_user_text.star"
 out=$(gate2 "$P10" 2>&1); rc=$?
 case "$out" in *txt001_build_words_in_user_text.star*) ok "an unlisted removal is still caught" ;; *) bad "unlisted removal missed" "$out" ;; esac
+inst2 "$P10" >/dev/null
+
+echo "T12 opt-out is refused for a stock-seeded rule"
+C10=conv010_act_microflow_content.star
+printf '%s  # reason: we do not use ACT_ prefixes\n' "$C10" >> "$P10/.claude/lint-rules-disabled.txt"
+rm -f "$P10/.claude/lint-rules/$C10"
+out=$(gate2 "$P10" 2>&1); rc=$?
+case "$out" in *"$C10 is stock-seeded and cannot be disabled — ignored"*"$C10: gone"*"BLIND — lint rules reverted"*) ok "lint-gate: refused, still BLIND" ;; *) bad "stock opt-out honoured by lint-gate (rc $rc)" "$out" ;; esac
+out=$(inst2 "$P10")
+case "$out" in *"$C10 cannot be disabled — IGNORED"*) ok "installer refuses it with a warning" ;; *) bad "no refusal from the installer" "$out" ;; esac
+[ -f "$P10/.claude/lint-rules/$C10" ] && ok "sync restores the stock-seeded rule" || bad "stock-seeded rule left missing"
+
+echo "T13 a headerless toolkit-only rule (ux001) is a local edit: never overwritten, not BLIND"
+P13=$(newproj p13); inst2 "$P13" >/dev/null
+U1="$P13/.claude/lint-rules/ux001_confirm_before_destructive.star"
+strip_header "$U1"; printf '# local tweak\n' >> "$U1"; um=$(portable_md5 "$U1")
+out=$(gate2 "$P13" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "lint-gate: rc 0, no BLIND for a toolkit-only rule" || bad "headerless ux001 called a re-seed (rc $rc)" "$out"
+out=$(inst2 "$P13")
+case "$out" in *"ux001_confirm_before_destructive.star is LOCALLY MODIFIED"*) ok "installer reports LOCALLY MODIFIED" ;; *) bad "not reported as a local edit" "$out" ;; esac
+[ "$(portable_md5 "$U1")" = "$um" ] && ok "ux001 not overwritten" || bad "ux001 overwritten"
+
+echo "T14 a configured, headerless conv020 is not overwritten and not BLIND"
+C2="$P13/.claude/lint-rules/conv020_action_user_feedback.star"
+strip_header "$C2"; printf 'PROJECT_MODULES = "Orders"\n' >> "$C2"; cm=$(portable_md5 "$C2")
+out=$(gate2 "$P13" 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "lint-gate: rc 0 for a configured conv020" || bad "configured conv020 called a re-seed (rc $rc)" "$out"
+out=$(inst2 "$P13")
+[ "$(portable_md5 "$C2")" = "$cm" ] && ok "conv020 not overwritten" || bad "conv020 overwritten" "$out"
 
 echo "T11 a rule the toolkit stops shipping: its receipt row is pruned, no permanent 'gone'"
 P11=$(newproj p11); inst2 "$P11" >/dev/null
 rm -f "$P11/.claude/lint-rules/ui001_widget_layout_traps.star"   # project tidies the retired rule away
 FEWER=$(printf '%s\n' $(. "$TK2/bin/lib/install-manifest.sh" >/dev/null 2>&1; echo "$MXTK_LINT_RULES") | grep -v '^ui001_widget_layout_traps.star$' | paste -sd' ' -)
 out=$(inst2 "$P11" "$FEWER")
-grep -q '^ui001_widget_layout_traps.star ' "$P11/.claude/.mxtk-lint-receipt" && bad "row for a dropped rule kept" "$out" || ok "row for the dropped rule pruned"
+if grep -q '^ui001_widget_layout_traps.star ' "$P11/.claude/.mxtk-lint-receipt"; then bad "row for a dropped rule kept" "$out"; else ok "row for the dropped rule pruned"; fi
 case "$out" in *"dropped row"*ui001*) ok "installer says so" ;; *) bad "prune not reported" "$out" ;; esac
 [ ! -f "$P11/.claude/lint-rules/ui001_widget_layout_traps.star" ] && ok "dropped rule not reinstalled" || bad "dropped rule reinstalled"
 out=$(gate2 "$P11" 2>&1); rc=$?

From 56d5530a5d6ddc185e0c4614d8431d4711d038fe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:13:31 +0000
Subject: [PATCH 40/68] revert(detection-gaps): restore the intro tightened to
 fit the budget

A feature PR does not squeeze other text to make room (the rule in #316).
Room comes from the baseline trim in #315, merged next. This branch's own
row stays trimmed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 skills/learned-detection-gaps.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/skills/learned-detection-gaps.md b/skills/learned-detection-gaps.md
index a4055417..18706b8c 100644
--- a/skills/learned-detection-gaps.md
+++ b/skills/learned-detection-gaps.md
@@ -3,10 +3,12 @@
 **Applies to:** any mxcli project
 **Purpose:** the cross-project register of MDL constructs that pass one or more verification
 rungs and still fail later — with, for each, the **first oracle that actually catches it**.
-Use it before trusting a green result, and when a runtime symptom appears over a green model.
+Use it two ways: before trusting a green result ("what is this rung known to miss?"), and
+when a runtime symptom appears over a fully green model ("which known gap looks like this?").
 
-Every row was found in the field, most in more than one project. The pattern matters more
-than the bugs: **the rungs form a ladder, and a green result certifies only what its rung sees.**
+Every row here was found in the field, most of them independently in more than one project.
+The point is not the individual bugs (each has its own entry) — it is the pattern: **the
+verification rungs form a ladder, and a green result only certifies what that rung can see.**
 
 ## The ladder
 

From dac33df6d1845157447c8a8cd4a1d5e4c110b799 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:15:20 +0000
Subject: [PATCH 41/68] test-scratch: take over the shared exec lock with
 exec.sh's exact protocol (#324)

test-scratch.sh shares .mpr-snapshots/.exec.lock with exec.sh, so its stale-lock
takeover now mirrors exec_lock_takeover from PR #324 (fix/exec-followups @ ed4efbb):
the same O_EXCL <lock>.takeover file, stale when its pid is dead or after 10 s (empty:
after a minute), re-read and remove only the exact stale line, put a wrongly moved
takeover file back with ln. The port lock uses the same protocol.

New cross-script fixture tests/wave2/test-shared-lock-takeover.sh: 4 rounds of 5 exec.sh
+ 5 test-scratch contenders on one dead-holder lock never produce two holders (master's
test-scratch: overlaps in 3 of 3 runs). exec.sh's block comes from the real exec.sh once
it carries exec_lock_takeover, else from a verbatim copy of #324's block.

Refs #244

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-bin/test-scratch.sh                   | 49 ++++++-----
 .../fixtures/mxtest-guard/exec-lock-block.sh  | 81 +++++++++++++++++++
 tests/wave2/test-shared-lock-takeover.sh      | 75 +++++++++++++++++
 tests/wave2/test-test-scratch.sh              |  2 +-
 5 files changed, 188 insertions(+), 21 deletions(-)
 create mode 100644 tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
 create mode 100644 tests/wave2/test-shared-lock-takeover.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f514aba5..398efbf3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 - fix(test-scratch, app-restart): **both refuse to start on a model whose after-startup is still an mxcli test injection (`MxTest.RegisterEndpoint` / `MxTest.TestRunner`), and print the repair** ([#244](https://github.com/MendixMau/mxcli-project-toolkit/issues/244), BUG-157). A `mxcli test` or `run --test-endpoint` stopped by a signal skips its restore, and the next injection chains `RegisterEndpoint` to itself: StackOverflowError, app down. It happened twice in one day on one machine, and again on a second project. The setting is read from the settings unit's bytes, so no mxcli is needed. The fixture uses a settings unit captured from mxcli's own test model. `test-scratch.sh` exits 3 before copying. `app-restart.sh` exits 3 before stopping, except for a live `--test-endpoint` app, which holds the injection legitimately; if stopping that app leaves the setting behind, it exits 5 (new): stopped, not started. Projects pick this up on sync; a clean model sees no change. — MendixMau, second case AlvinnYeo
 - fix(app-restart): **the recorded pid is verified to still be an `mxcli run` before anything is stopped** (review of #304). With `--cmd` / `MXTK_APP_START_CMD`, the identity check read the override, not the process. A record left by a SIGKILL whose pid the OS had reused sent TERM/KILL to that unrelated process and its children. The pid's own command line (`/proc`, `ps`; on Windows the image name `mxcli.exe`) must now name mxcli and `run`. Otherwise the app counts as not running and the process is not touched. — MendixMau
-- fix(test-scratch): **taking over a stale lock is serialised, so two runs can no longer both hold it** (review of #304). The takeover holds an O_EXCL `<lock>.takeover` marker (cleared after 30s), re-reads the lock, and removes it only if it still holds the line judged stale. A changed lock is put back with `ln`, never `mv -f`. A deterministic replay of the race fails on the old code. — MendixMau
+- fix(test-scratch): **taking over a stale lock is serialised with exactly exec.sh's protocol, so test-scratch and exec.sh never both hold the shared `.exec.lock`** (review of #304). The old takeover moved the lock aside with `mv -f`. It now uses the same O_EXCL `<lock>.takeover` file and rules as exec.sh in #324: stale when its pid is dead or after 10s, re-read under it, remove only the exact stale line, put back a wrongly moved takeover file with `ln`. The port lock uses the same protocol. A new cross-script fixture, `test-shared-lock-takeover.sh`, runs 5 exec.sh + 5 test-scratch contenders on a dead holder's lock: two holders at once on the old code, never on the new. — MendixMau
 - learn(lint-that-actually-runs): **lint a copy of the model only after copying `.claude/lint-rules` (and `lint-config.yaml`) beside it, and compare rule counts before diffing** ([#240](https://github.com/MendixMau/mxcli-project-toolkit/issues/240), BUG-158). A snapshot in `/tmp` gave 51 findings from 8 rules, against 721 from 29 for the project: no notice, exit 0. mxcli's source also shows `lint-config.yaml` is read only from beside the `.mpr`, so an in-repo snapshot loses it as well. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index dc3055a6..413a2292 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -138,27 +138,38 @@ holder_live() {
   case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac
   return 1
 }
-# Taking over a stale lock is itself serialised (#304 review): two runs that both read the same
-# dead holder must not both remove "the stale lock" — the second would remove the lock the first
-# had just taken, and both would run. So a takeover first wins "$f.takeover" (noclobber: O_EXCL;
-# one older than 30s is a takeover that died midway and is cleared), re-reads the lock, and
-# removes it only if it still holds the stale line it judged. It moves the lock aside before
-# checking; a lock that changed in between is put back with `ln`, which refuses to overwrite,
-# never `mv -f`, which would clobber a lock taken meanwhile.
-take_over() {  # $1 = lock file, $2 = the stale line. 0 = handled (retry the take), 1 = another takeover runs
-  local f="$1" held="$2" t="$1.takeover" ts
-  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$t" ) 2>/dev/null; then
-    ts="$(cut -d' ' -f2 "$t" 2>/dev/null | head -1)"
-    case "$ts" in ''|*[!0-9]*) ;; *) [ $(( $(date +%s) - ts )) -gt 30 ] && rm -f "$t" ;; esac
-    return 1
-  fi
-  if [ "$(head -1 "$f" 2>/dev/null || true)" = "$held" ] && mv "$f" "$f.stale.$$" 2>/dev/null; then
-    if [ "$(head -1 "$f.stale.$$" 2>/dev/null || true)" != "$held" ]; then
-      ln "$f.stale.$$" "$f" 2>/dev/null || true   # not the line we judged: put it back, never over a newer one
+# Taking over a stale lock is serialised through a second O_EXCL file, <lock>.takeover — the SAME
+# file name and protocol as exec.sh's exec_lock_takeover (this script shares .exec.lock with it, so
+# the two must exclude each other; keep the bodies in step). Under it the lock is re-read and
+# removed ONLY if it still holds exactly the stale line judged; nothing else ever removes a lock
+# that is not its own. WHY (independent review of #304): the old takeover here moved the lock
+# aside with `mv -f` — check-then-act — so two runs that judged the same dead holder could both
+# end up holding it. A takeover file left by a holder killed mid-takeover is stale once its pid is
+# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put
+# back with `ln` (fails if a new one exists — never clobbers) if what was moved is not the one
+# judged stale. The machine-wide port lock uses the same protocol.
+take_over() {  # $1 = lock file, $2 = the stale lock line. 0 iff it was removed (or already gone)
+  local _tk="$1.takeover" _t _tpid _tsince _tstale _now
+  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
+    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
+    _tstale=0
+    if [ -n "$_t" ]; then
+      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
+    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
+      _tstale=1   # empty for a minute: its creator died between the create and the write
     fi
-    rm -f "$f.stale.$$"
+    if [ "$_tstale" = 1 ]; then
+      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
+        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
+        rm -f "$_tk.stale.$$"
+      fi
+    fi
+    return 1
   fi
-  rm -f "$t"
+  _now="$(head -1 "$1" 2>/dev/null || true)"
+  [ "$_now" = "$2" ] && rm -f "$1"
+  rm -f "$_tk"
   return 0
 }
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
diff --git a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
new file mode 100644
index 00000000..a6a31c34
--- /dev/null
+++ b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
@@ -0,0 +1,81 @@
+# exec-lock-block.sh — VERBATIM copy of project-bin/exec.sh's lock block (exec_lock_live .. the
+# LOCK_TAKEN check) from PR #324, branch fix/exec-followups @ ed4efbb. Used by
+# test-shared-lock-takeover.sh until #324 is merged; that fixture prefers the real exec.sh's block
+# once it carries exec_lock_takeover. Do not edit by hand — re-copy.
+exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
+  [ -n "$1" ] || return 1
+  case "$1" in *[!0-9]*) return 1 ;; esac
+  kill -0 "$1" 2>/dev/null || return 1
+  # Linux: an unreaped zombie still answers kill -0; /proc/<pid>/stat says Z after the "(comm) ".
+  case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac
+  _args="$(ps -o args= -p "$1" 2>/dev/null || true)"
+  case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac   # test-scratch.sh holds it while copying
+  return 1
+}
+exec_lock_try() { ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "$LOG_NAME" > "$LOCK" ) 2>/dev/null; }
+exec_lock_release() {  # the trap: remove the lock only while it is still ours
+  _own="$(cat "$LOCK" 2>/dev/null || true)"
+  [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"
+  return 0
+}
+# Taking over a stale lock is serialised through a second O_EXCL file, $LOCK.takeover. Under
+# it the lock is re-read and removed ONLY if it still holds exactly the stale line judged above;
+# nothing else ever removes a lock that is not its own, so the compare-then-rm cannot hit a
+# fresh lock. WHY (independent review of #304): the old takeover moved the lock aside and put
+# it back with `mv -f` when it found a fresh one there — check-then-act. With 3+ contenders, B
+# moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
+# A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
+# A takeover file left by a holder killed inside those few microseconds is stale once its pid is
+# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put back with `ln` (fails if a new one
+# exists — never clobbers) if what was moved is not the one judged stale.
+exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
+  _tk="$LOCK.takeover"
+  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+    _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
+    case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
+    _tstale=0
+    if [ -n "$_t" ]; then
+      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
+    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
+      _tstale=1   # empty for a minute: its creator died between the create and the write
+    fi
+    if [ "$_tstale" = 1 ]; then
+      if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
+        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
+        rm -f "$_tk.stale.$$"
+      fi
+    fi
+    return 1
+  fi
+  _now="$(head -1 "$LOCK" 2>/dev/null || true)"
+  [ "$_now" = "$1" ] && rm -f "$LOCK"
+  rm -f "$_tk"
+  return 0
+}
+LOCK_TAKEN=0
+for _try in 1 2 3 4 5 6; do
+  if exec_lock_try; then LOCK_TAKEN=1; break; fi
+  _held="$(head -1 "$LOCK" 2>/dev/null || true)"
+  if [ -z "$_held" ] && [ "$_try" -lt 3 ]; then sleep 1; continue; fi   # being written right now
+  _hpid="${_held%% *}"
+  if exec_lock_live "$_hpid"; then
+    _hrest="${_held#* }"; _hsince="${_hrest%% *}"; _hscript="${_hrest#* }"
+    _age=""
+    case "$_hsince" in ''|*[!0-9]*) ;; *) _age=" for $(( $(date +%s) - _hsince ))s" ;; esac
+    [ "$_hrest" = "$_held" ] && _hscript="?"
+    echo "✗ Another session holds this project's exec lock (PID $_hpid, running$_age, script: $_hscript)."
+    echo "  → Wait for it to finish, then re-run. Nothing was written."
+    echo "    (A dead holder is detected and taken over automatically — no manual rm is ever needed.)"
+    exit 1
+  fi
+  if exec_lock_takeover "$_held"; then
+    echo "  (stale exec lock from PID ${_hpid:-?}, which is not running — taking it over)"
+  else
+    sleep 1   # another contender is taking it over right now; look again
+  fi
+done
+if [ "$LOCK_TAKEN" != 1 ]; then
+  echo "✗ Could not take the exec lock $LOCK after 6 attempts — another session keeps re-taking it."
+  echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
+  exit 1
+fi
diff --git a/tests/wave2/test-shared-lock-takeover.sh b/tests/wave2/test-shared-lock-takeover.sh
new file mode 100644
index 00000000..83a8ef07
--- /dev/null
+++ b/tests/wave2/test-shared-lock-takeover.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# test-shared-lock-takeover.sh — exec.sh and test-scratch.sh share .mpr-snapshots/.exec.lock; contending
+# on one DEAD-holder lock, they must never both hold it.
+#
+# Usage: bash tests/wave2/test-shared-lock-takeover.sh [path-to-test-scratch.sh] [path-to-exec.sh]
+#
+# WHY (review of #304, PR #324): both scripts take the same per-project lock and both take over a dead
+# holder's lock. Each was made safe on its own by a serialised takeover (an O_EXCL `<lock>.takeover`,
+# re-read, remove only the exact stale line). Two private protocols would not exclude EACH OTHER: the
+# takeover file name and the compare-then-remove rule must be the same in both scripts.
+#
+# How: the lock code is lifted from each script (exec.sh: exec_lock_live .. the LOCK_TAKEN check;
+# test-scratch.sh: holder_live .. take_lock) into two small contender scripts whose names contain
+# "exec.sh" / "test-scratch.sh", so each script's liveness check recognises the other as a holder.
+# Rounds of 5 + 5 contenders start together on a lock whose holder pid is dead; each holder marks
+# itself in a shared dir while it holds the lock. Two marks at once = two holders = FAIL.
+# When the given exec.sh has no exec_lock_takeover yet (PR #324 unmerged), its block comes from the
+# verbatim copy in fixtures/mxtest-guard/exec-lock-block.sh, and says so.
+set -uo pipefail
+TOOLKIT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TS="${1:-$TOOLKIT/project-bin/test-scratch.sh}"; EX="${2:-$TOOLKIT/project-bin/exec.sh}"
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; }
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/sharedlock.XXXXXX")" || exit 2
+trap 'rm -rf "$WORK"' EXIT
+echo "== test-scratch: $TS"
+
+BLOCK="$WORK/exec-block.sh"
+awk '/^exec_lock_live\(\) \{/ {p=1} p {print} p && /^if \[ "\$LOCK_TAKEN" != 1 \]; then$/ {e=1} e && /^fi$/ {exit}' "$EX" > "$BLOCK"
+if grep -q '^exec_lock_takeover() {' "$BLOCK"; then echo "== exec.sh lock block: $EX"
+else
+  sed '1,4d' \
+    "$TOOLKIT/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh"  > "$BLOCK"
+  echo "== exec.sh lock block: verbatim copy from PR #324 ($EX has no exec_lock_takeover yet)"
+fi
+grep -q '^exec_lock_takeover() {' "$BLOCK" && ok "[setup] exec.sh lock block lifted" || { bad "[setup] no exec.sh lock block"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+awk '/^holder_live\(\) \{/ {p=1} /^release\(\) \{/ {p=0} p' "$TS" > "$WORK/ts-block.sh"
+grep -q '^take_lock() {' "$WORK/ts-block.sh" && ok "[setup] test-scratch take_lock lifted" || { bad "[setup] no take_lock in $TS"; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+
+LOCK="$WORK/.exec.lock"; HOLD="$WORK/holding"; mkdir -p "$HOLD"
+hold() {  # body shared by both contenders: mark, look for another mark, unmark
+  cat <<'H'
+touch "$HOLD/$$"; n=$(ls "$HOLD" | wc -l | tr -d ' ')
+[ "$n" -gt 1 ] && echo "OVERLAP $$ with $(ls "$HOLD" | tr '\n' ' ')" >> "$WORK/overlaps"
+echo "$ROLE $$" >> "$WORK/holders"; sleep 0.3; rm -f "$HOLD/$$"
+H
+}
+{ echo 'LOCK="$1"; LOG_NAME="exec-contender"; ROLE=exec'; cat "$BLOCK"; hold
+  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-exec.sh"
+{ echo 'LOCK="$1"; ROLE=scratch'; cat "$WORK/ts-block.sh"
+  echo 'take_lock "$LOCK" "the exec lock" >/dev/null 2>&1 || exit 1'; hold
+  echo '_own="$(head -1 "$LOCK" 2>/dev/null)"; [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"'; } > "$WORK/contender-test-scratch.sh"
+
+sleep 0 & DEAD=$!; wait "$DEAD"   # a pid that is certainly not running now
+ROUNDS=4
+for r in $(seq 1 "$ROUNDS"); do
+  printf '%s %s exec.sh\n' "$DEAD" "$(date +%s)" > "$LOCK"; rm -f "$LOCK.takeover"
+  PIDS=""
+  for i in 1 2 3 4 5; do
+    WORK="$WORK" HOLD="$HOLD" bash "$WORK/contender-exec.sh" "$LOCK" >/dev/null 2>&1 & PIDS="$PIDS $!"
+    WORK="$WORK" HOLD="$HOLD" bash "$WORK/contender-test-scratch.sh" "$LOCK" >/dev/null 2>&1 & PIDS="$PIDS $!"
+  done
+  for p in $PIDS; do wait "$p"; done
+done
+N="$(wc -l < "$WORK/holders" 2>/dev/null | tr -d ' ')"
+[ "${N:-0}" -ge "$ROUNDS" ] && ok "the dead holder's lock was taken over in every round ($N holds over $ROUNDS rounds)" || bad "only ${N:-0} holds in $ROUNDS rounds"
+grep -q '^exec ' "$WORK/holders" 2>/dev/null && grep -q '^scratch ' "$WORK/holders" 2>/dev/null \
+  && ok "both scripts won the lock at some point (they really contended)" || echo "  note: one script won every round: $(cut -d' ' -f1 "$WORK/holders" 2>/dev/null | sort | uniq -c | tr '\n' ' ')"
+if [ -s "$WORK/overlaps" ]; then bad "two holders at once: $(head -3 "$WORK/overlaps" | tr '\n' ' ')"; else ok "never two holders at once"; fi
+[ -e "$LOCK.takeover" ] && bad "takeover file left behind" || ok "no takeover file left behind"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index ecb26de0..830d1c62 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -114,7 +114,7 @@ OUT="$( L="$L" LIVE="$LIVE" bash -c '
 has "the second taker is refused (the live lock survives)" "$OUT" "rc=1"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = "$LIVE" ] && ok "the lock still names the live holder" || bad "the live holder's lock was replaced: $(cat "$L" 2>/dev/null)"
 [ -e "$L.takeover" ] && bad "takeover marker left behind" || ok "takeover marker cleared"
-echo "-- a takeover marker older than 30s (a takeover that died midway) is cleared"
+echo "-- a takeover marker whose pid is dead (a takeover that died midway) is cleared"
 printf '999999 1 test-scratch.sh\n' > "$L"; printf '999998 1\n' > "$L.takeover"
 OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
 has "taken after clearing the dead marker" "$OUT" "rc=0"

From 0f1c512f1f718d48fd7a37898b793e1346b3cffd Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:15:20 +0000
Subject: [PATCH 42/68] docs(ui-loop): name the third watch-compat verdict
 (unknown)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The watch paragraph listed only `restart needed` and `watch can apply
this`; exec.sh now also prints `unknown — restart if behaviour looks
stale` for statements on neither column. Reworded within the same
paragraph to stay inside the baseline word budget.

Refs #287 #289

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md      | 2 +-
 skills/ui-loop.md | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 543b3aeb..3b34b9d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
+- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/skills/ui-loop.md b/skills/ui-loop.md
index 9c89980d..50139995 100644
--- a/skills/ui-loop.md
+++ b/skills/ui-loop.md
@@ -205,10 +205,10 @@ diagnosis rounds spent on "defects" that were a stale runtime (#284, #275, #285)
 | | a new page (`create page`), or a page that gets a `Url` — the route table predates it and the deep link lands on Home |
 | | theme SCSS or theme JS (`themesource/`, `theme/`) — one edit dropped the page bundles (404), another left a 24 px column the model says is 120 |
 
-`bin/exec.sh` runs this table for you after every applied script (`--watch-compat <script>`
-prints the same verdict without running anything): it reads the statement heads and checks theme
-SCSS/JS against the running app's boot time, and prints `restart needed: <reasons>` or `watch can
-apply this`. Advisory only — it never blocks. A `create or replace page` is reported reloadable
+`bin/exec.sh` runs this table after every applied script (`--watch-compat <script>` alone
+writes nothing): it reads statement heads, checks theme SCSS/JS against the app's boot time, and
+prints `restart needed: <reasons>`, `watch can apply this`, or, for a statement in neither
+column, `unknown — restart if behaviour looks stale`. Advisory only — it never blocks. A `create or replace page` is reported reloadable
 with a note: restart if that page is new, because a script cannot tell new from replaced.
 
 **A stale runtime looks like a defect.** Before diagnosing any of these right after an exec,

From 1fd5b14b0de277cbc0fbe28c9079ba76b44f9703 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:16:56 +0000
Subject: [PATCH 43/68] =?UTF-8?q?test-stack-up:=20PR=20#319=20review=20fix?=
 =?UTF-8?q?es=20=E2=80=94=20whole-path=20deployment=20match,=20bounded=20p?=
 =?UTF-8?q?resumption,=20sync=20remedy,=20stable=20lstart?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. DEPLOY_DIRS is an array; the joined-line branch (macOS ps / Windows CIM)
   matches a deployment dir whole (end, "/", or " -flag"), so a spaced path's
   fragment can no longer verify a foreign checkout.
2. An unnamed / Windows holder is presumed ours only while the run-local
   record is younger than BOOT_TIMEOUT; after that it blocks (exit 4).
3. The old-_common.sh guard names `sync-project.sh <root> --upgrade-bin _common.sh`.
4. pid_lstart runs under LC_ALL=C TZ=UTC0; --reap re-checks the start time
   right before each kill; --track refuses pid 0/1, itself and its caller.
5. Fixture comment corrected.

Fixtures: test-stack-up-local.sh T15 (spaced paths, forced joined-line
branch), T16 (presumption bound), T14 additions (pid 1, calling shell,
cross-TZ track) — 7 assertions fail on the previous head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 project-bin/_common.sh             |  7 +++--
 project-bin/app-restart.sh         |  3 +-
 project-bin/test-stack-up.sh       | 38 +++++++++++++++++---------
 tests/wave2/test-stack-up-local.sh | 44 ++++++++++++++++++++++++++++--
 4 files changed, 74 insertions(+), 18 deletions(-)

diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 1a1414c3..5728f969 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -898,7 +898,10 @@ EOF_ARGS
     done
     return 1
   fi
-  # One joined line: match "runtimelauncher.jar <dir>" followed by the end, a slash or a space.
+  # One joined line: arguments are not delimited, so a directory is matched WHOLE — followed by the
+  # end of the line, a lone slash, or a space and a flag (" -"). A space and anything else could be
+  # the rest of a longer, spaced path: "/work/a" must not match "…runtimelauncher.jar /work/a b/x"
+  # (a foreign checkout read as ours, PR #319 review). Each <dir> arrives as ONE argument.
   line="$(printf '%s' "$args" | head -1 | tr -d '"')"
   [ "$(mxtk_platform)" = windows ] && line="$(printf '%s' "$line" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
   for d in "$@"; do
@@ -906,7 +909,7 @@ EOF_ARGS
       [ -n "$cand" ] || continue
       [ "$(mxtk_platform)" = windows ] && cand="$(native_path "$cand" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
       case "$line" in
-        *"runtimelauncher.jar $cand"|*"runtimelauncher.jar $cand/"|*"runtimelauncher.jar $cand "*|*"runtimelauncher.jar $cand/ "*) return 0 ;;
+        *"runtimelauncher.jar $cand"|*"runtimelauncher.jar $cand/"|*"runtimelauncher.jar $cand -"*|*"runtimelauncher.jar $cand/ -"*) return 0 ;;
       esac
     done
   done
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index c7c70f8b..5080dbf5 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -133,7 +133,8 @@ mask() {  # print argv joined, with the value after any password/secret/token/ke
 # _common.sh, shared with test-stack-up.sh. A project whose bin/_common.sh predates them stops here
 # with the remedy, instead of dying mid-restart on "command not found".
 command -v mxtk_port_holder >/dev/null 2>&1 || {
-  echo "app-restart: bin/_common.sh is older than this script (no mxtk_port_holder) — run the toolkit's bin/sync-project.sh" >&2; exit 2; }
+  echo "app-restart: bin/_common.sh is older than this script (no mxtk_port_holder)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $PROJECT_ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
 # blocked <port> "<pid>|<name>" <when> — exit 4, the holder named, nothing of it touched.
 blocked() {
   echo "✗ app-restart: instrument blocked — port :$1 is held by $(mxtk_holder_text "$2"), not this project's run --local." >&2
diff --git a/project-bin/test-stack-up.sh b/project-bin/test-stack-up.sh
index dfc0e141..31bc94ad 100755
--- a/project-bin/test-stack-up.sh
+++ b/project-bin/test-stack-up.sh
@@ -159,7 +159,8 @@ esac
 # Helpers moved to _common.sh (#160). A project whose bin/_common.sh predates them stops here with
 # the remedy instead of dying mid-run on "command not found".
 command -v mxtk_pid_runs_deployment >/dev/null 2>&1 || {
-  echo "test-stack-up: bin/_common.sh is older than this script (no mxtk_pid_runs_deployment) — run the toolkit's bin/sync-project.sh" >&2; exit 2; }
+  echo "test-stack-up: bin/_common.sh is older than this script (no mxtk_pid_runs_deployment)." >&2
+  echo "  → <toolkit>/bin/sync-project.sh $ROOT --upgrade-bin _common.sh   (backs up a hand-edited copy first)" >&2; exit 2; }
 
 ok()   { printf '  \033[32m✓\033[0m %s\n' "$1"; }
 bad()  { printf '  \033[31m✗\033[0m %s\n' "$1"; }
@@ -263,7 +264,7 @@ find_app_port() {
     hits="$hits $p"
     h="$(mxtk_port_holder "$p")" || continue
     [ "${h%%|*}" = "?" ] && continue
-    if mxtk_pid_runs_deployment "${h%%|*}" $DEPLOY_DIRS; then echo "$p|verified|runtime"; return 0; fi
+    if mxtk_pid_runs_deployment "${h%%|*}" "${DEPLOY_DIRS[@]}"; then echo "$p|verified|runtime"; return 0; fi
   done
   # 3. Otherwise a hit is UNVERIFIED ownership: it proves a Mendix answered, not that it is ours.
   for p in $hits; do
@@ -286,9 +287,10 @@ if [ -L "$MPR" ]; then
   case "$_t" in /*) ;; *) _t="$MPR_DIR/$_t" ;; esac
   MODEL_DIR="$(cd "$(dirname "$_t")" 2>/dev/null && pwd -P)" || MODEL_DIR="$MPR_DIR"
 fi
-# Where this project's runtime is deployed, on either layout. Paths with spaces are not split-safe
-# here; mxtk_pid_runs_deployment then simply finds no match (unverified, as before).
-DEPLOY_DIRS="$ROOT/deployment $ROOT/app/deployment $MPR_DIR/deployment $MODEL_DIR/deployment"
+# Where this project's runtime is deployed, on either layout. An ARRAY, never a space-joined string:
+# word-split, "/work/a b/proj/deployment" became the fragment "/work/a", which matched any
+# runtime under "/work/a b/…" on the joined-command-line branch — a foreign checkout read as ours.
+DEPLOY_DIRS=("$ROOT/deployment" "$ROOT/app/deployment" "$MPR_DIR/deployment" "$MODEL_DIR/deployment")
 LOCAL_HS="$MPR_DIR/.mxcli/run-local.json"
 pick_local_hs() {
   local d
@@ -318,19 +320,23 @@ run_local_ports() {
 # own_holder "<pid>|<name>" — is this port holder this project's own process? Yes when it is the
 # live recorded run --local pid or under it (the runtime mxcli started), or when its command line
 # runs this project's deployment dir (a newer run --local still booting, Studio Pro running THIS
-# project). With a live record and a holder that cannot be placed — unnamed, or Windows where Git
-# Bash shows no parent pids — it is presumed ours: blocking our own boot is the worse error, and a
-# real stranger is named on the next run once the record is gone.
+# project). With a live record and a holder that cannot be placed — unnamed (a root-owned process
+# is "?" to a non-root lsof), or Windows where Git Bash shows no parent pids — it is presumed ours
+# only while the record is younger than BOOT_TIMEOUT: a boot has that long to answer. Past it the
+# presumption ends and the holder blocks (exit 4) — otherwise a real stranger would read "booting"
+# forever, which is #262's failure again.
 own_holder() {
   local hp="${1%%|*}" lp=""
   pick_local_hs && lp="$(hs_field pid)" && pid_alive "$lp" || lp=""
-  [ "$hp" != "?" ] && mxtk_pid_runs_deployment "$hp" $DEPLOY_DIRS && return 0
+  [ "$hp" != "?" ] && mxtk_pid_runs_deployment "$hp" "${DEPLOY_DIRS[@]}" && return 0
   # A runtime whose command line names ANOTHER deployment dir is foreign, whatever else is true.
   [ "$hp" != "?" ] && case "$(mxtk_pid_args "$hp" 2>/dev/null)" in *runtimelauncher.jar*) return 1 ;; esac
   [ -n "$lp" ] || return 1
-  [ "$hp" = "?" ] && return 0
-  [ "$(mxtk_platform)" = windows ] && return 0
-  mxtk_pid_in_tree "$hp" "$lp"
+  mxtk_pid_in_tree "$hp" "$lp" && return 0
+  if [ "$hp" = "?" ] || [ "$(mxtk_platform)" = windows ]; then
+    [ -n "$(find "$LOCAL_HS" -mmin -$(( (BOOT_TIMEOUT + 59) / 60 )) 2>/dev/null)" ] && return 0
+  fi
+  return 1
 }
 # Exit 4 if a run --local of this project could not bind its ports. Never stops the holder.
 # Returns 3 (and sets OWN_HOLDING) when a port is held by this project's own process — it is
@@ -456,7 +462,8 @@ prove_app() {
 BG_PIDS="${BG_PIDS:-$ROOT/.claude/loop/bg-pids.tsv}"
 STALE_HOURS="${MXTK_STALE_HOURS:-4}"
 case "$STALE_HOURS" in ''|*[!0-9]*) echo "MXTK_STALE_HOURS takes whole hours" >&2; exit 2 ;; esac
-pid_lstart() { ps -o lstart= -p "$1" 2>/dev/null | sed 's/  */ /g; s/^ //; s/ $//'; }
+# Fixed locale and zone, so a --track in one shell and a --reap in another spell the start time alike.
+pid_lstart() { LC_ALL=C TZ=UTC0 ps -o lstart= -p "$1" 2>/dev/null | sed 's/  */ /g; s/^ //; s/ $//'; }
 # bg_scan — prints "<state>|<pid>|<age h>|<label>" per record line: live | stale | gone (dead, or the
 # pid now belongs to a process that started at another time).
 bg_scan() {
@@ -488,6 +495,8 @@ bg_prune() {
 if [ "$MODE" = "track" ]; then
   T_PID="${2:-}"; T_LABEL="${3:-process}"
   case "$T_PID" in ''|*[!0-9]*) echo "usage: $0 --track <pid> [label]" >&2; exit 2 ;; esac
+  # Never pid 1, this script, or the shell that called it: --reap would later stop the caller itself.
+  case "$T_PID" in 0|1|"$$"|"$PPID") echo "test-stack-up: refusing to track pid $T_PID (init, this script, or the calling shell) — pass the background process's pid (\$! after starting it)" >&2; exit 2 ;; esac
   [ "$(mxtk_platform)" = windows ] && { echo "test-stack-up: --track is not supported on Git Bash (no process start time to check a reused pid against); nothing recorded"; exit 0; }
   T_LS="$(pid_lstart "$T_PID")"
   [ -n "$T_LS" ] || { echo "test-stack-up: pid $T_PID is not running — nothing recorded" >&2; exit 1; }
@@ -514,6 +523,9 @@ if [ "$MODE" = "reap" ]; then
   REAPED=0
   while IFS='|' read -r st pid age lab; do
     [ "$st" = stale ] || continue
+    # Re-checked at the moment of the kill: the scan above may be seconds old.
+    _ls="$(awk -F'\t' -v p="$pid" '$1 == p { print $3; exit }' "$BG_PIDS")"
+    [ -n "$_ls" ] && [ "$(pid_lstart "$pid")" = "$_ls" ] || { warn "pid $pid changed since the scan — not touched"; continue; }
     KIDS="$(pgrep -P "$pid" 2>/dev/null | tr '\n' ' ' || true)"   # portability-ok: pgrep -P (by parent pid of a recorded pid); Windows returned above
     kill -TERM "$pid" $KIDS 2>/dev/null || true
     for _ in 1 2 3 4 5; do kill -0 "$pid" 2>/dev/null || break; sleep 1; done
diff --git a/tests/wave2/test-stack-up-local.sh b/tests/wave2/test-stack-up-local.sh
index 9e27c37c..0159a8b2 100755
--- a/tests/wave2/test-stack-up-local.sh
+++ b/tests/wave2/test-stack-up-local.sh
@@ -17,12 +17,14 @@
 # runtimelauncher.jar on this project's deployment dir (both layouts); a foreign one stays unverified.
 # T11-T13 (#262 follow-up): this project's own booting runtime on its port is NOT READY (exit 1),
 # never INSTRUMENT BLOCKED. T14 (#278): --track / --reap act on the project's own pid record only.
+# T15-T16 (PR #319 review): spaced paths match whole, never as fragments (incl. the joined-line
+# branch, forced); an unnamed holder is presumed ours only while the record is < BOOT_TIMEOUT old.
 # T7 (#262): a port the run --local loop needs is held by a process that is not this project's
 # loop (here the fake app itself, behind a dead handshake — Studio Pro's runtime in the field) →
 # exit 4, "INSTRUMENT BLOCKED", the holder named with its pid, and it is still alive afterwards.
 #
 # usage: test-stack-up-local.sh /path/to/test-stack-up.sh
-# No pipefail: every assertion is `printf "$OUT" | grep -q …`, and grep -q exits on the first match —
+# No pipefail: every assertion is `printf '%s' "$OUT" | grep -q …`, and grep -q exits on the first match —
 # with pipefail the printf's SIGPIPE on a long $OUT then failed a passing assertion (seen on T2).
 set -u
 
@@ -269,6 +271,41 @@ OUT="$(cd "$P" && bash bin/test-stack-up.sh --no-docker 2>&1)"; RC=$?
 kill -0 "$B13PID" 2>/dev/null && ok "own runtime untouched" || bad "own runtime killed"
 fi
 
+if [ "$CAN_NAME" = 1 ]; then
+echo "== T15 (#319 review): a project path with a space — whole paths, never word-split fragments =="
+mkdir -p "$WORK/sp ace"
+P="$(mkproj "sp ace/t15" root)"; mkdir -p "$P/deployment" "$WORK/sp ace/other/deployment"
+srv R15 R15PID mx -jar "$JAR" "$P/deployment"
+srv F15 F15PID mx -jar "$JAR" "$WORK/sp ace/other/deployment"
+printf 'APP_PORTS="%s"\n' "$R15" >> "$P/.claude/loop/stack.conf"
+OUT="$(run "$P")"
+[ "$(envv "$P" APP_OWNERSHIP)" = verified ] && [ "$(envv "$P" APP_SOURCE)" = runtime ] \
+  && ok "own runtime under a spaced path verified" || bad "spaced own runtime not verified" "$OUT"
+printf 'APP_PORTS="%s"\n' "$F15" >> "$P/.claude/loop/stack.conf"
+OUT="$(run "$P")"
+[ "$(envv "$P" APP_OWNERSHIP)" = unverified ] && ok "a foreign runtime under the same spaced prefix stays unverified" \
+  || bad "foreign runtime under the spaced prefix verified" "$(cat "$P/.claude/loop/stack.env" 2>&1)"
+# The joined-line branch (macOS ps / Windows CIM) has no argv boundaries; CI is Linux, so force it.
+jl() { ( PROJECT_ROOT="$P"; . "$P/bin/_common.sh"; mxtk_platform() { echo macos; }; mxtk_pid_runs_deployment "$@" ); }
+jl "$R15PID" "$P/deployment" && ok "joined line: own spaced deployment dir matches" || bad "joined line: own spaced dir missed"
+jl "$F15PID" "$WORK/sp" && bad "joined line: fragment '$WORK/sp' matched a runtime under '$WORK/sp ace/'" || ok "joined line: a path fragment never matches"
+jl "$F15PID" "$P/deployment" && bad "joined line: foreign runtime matched our dir" || ok "joined line: foreign runtime does not match"
+
+echo "== T16 (#319 review): an unnamed holder is presumed ours only while the record is younger than BOOT_TIMEOUT =="
+mkdir -p "$WORK/blind"
+for t in lsof ss; do printf '#!/bin/sh\nexit 1\n' > "$WORK/blind/$t"; chmod +x "$WORK/blind/$t"; done
+P="$(mkproj t16 root)"
+srv B16 B16PID boot
+handshake "$P" "$WATCH_PID"
+sed -i.bak "s/^  \"appPort\": [0-9]*/  \"appPort\": $B16/; s/^  \"adminPort\": [0-9]*/  \"adminPort\": 1/" "$P/.mxcli/run-local.json"
+touch "$P/.mxcli/run-local.json"
+OUT="$(cd "$P" && PATH="$WORK/blind:$PATH" bash bin/test-stack-up.sh --check 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && ok "fresh record, unnamed holder: NOT READY (exit 1)" || bad "fresh record rc=$RC, want 1" "$OUT"
+touch -t "$BOOT" "$P/.mxcli/run-local.json"
+OUT="$(cd "$P" && PATH="$WORK/blind:$PATH" bash bin/test-stack-up.sh --check 2>&1)"; RC=$?
+[ "$RC" -eq 4 ] && printf '%s' "$OUT" | grep -q "INSTRUMENT BLOCKED" && ok "record older than BOOT_TIMEOUT: blocked (exit 4), not 'booting' forever" || bad "stale record rc=$RC, want 4" "$OUT"
+fi
+
 echo "== T14 (#278): tracked test processes — only this project's own record, only stale ones =="
 P="$(mkproj t14 root)"
 ( sleep 600 & wait ) & OLDRUN=$!; PIDS="$PIDS $OLDRUN"
@@ -277,7 +314,10 @@ sleep 600 & YOUNG=$!; PIDS="$PIDS $YOUNG"
 sleep 600 & REUSED=$!; PIDS="$PIDS $REUSED"
 bash -c "exec -a 'node journey-runner.js' sleep 600" & DECOY14=$!; PIDS="$PIDS $DECOY14"
 ( cd "$P" && bash bin/test-stack-up.sh --track "$OLDRUN" journey-runner ) >/dev/null 2>&1 && ok "--track records a live pid" || bad "--track failed"
-( cd "$P" && bash bin/test-stack-up.sh --track "$YOUNG" monitor ) >/dev/null 2>&1
+# Tracked under another time zone: --track and --reap must spell the start time alike (LC_ALL=C TZ=UTC0).
+( cd "$P" && TZ=XYZ-14 LC_ALL=C bash bin/test-stack-up.sh --track "$YOUNG" monitor ) >/dev/null 2>&1
+( cd "$P" && bash bin/test-stack-up.sh --track 1 init ) >/dev/null 2>&1; [ $? -eq 2 ] && ok "--track refuses pid 1" || bad "--track accepted pid 1"
+( cd "$P" && bash bin/test-stack-up.sh --track "$BASHPID" me ) >/dev/null 2>&1; [ $? -eq 2 ] && ok "--track refuses the calling shell" || bad "--track accepted the calling shell"
 ( cd "$P" && bash bin/test-stack-up.sh --track "$DEAD_PID" gone ) >/dev/null 2>&1 && bad "--track accepted a dead pid" || ok "--track refuses a dead pid"
 BG="$P/.claude/loop/bg-pids.tsv"
 # Age the first line; a REUSED pid: recorded start time differs from the running process's.

From 128f69b22f1782f01da7bcb63e4310af2907c497 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:19:24 +0000
Subject: [PATCH 44/68] Extraction report reads extraction-quality*.json
 (#151); token-burn cost, windows, agent time, prompts (#296)

extraction-report.sh: find every extraction-quality*.json at analysis/<src>/,
analysis/<src>/extracted/ and inside the KB; one row per dimension the file
declares; selfGraded+passed, passed under its own threshold, an unconfirmed 0/0
dimension and unparseable JSON are faults. A code-extracted/mixed KB with no
score file now shows one fault section (documents KB: skipped). The score file
in <kb>/extracted/ is no longer misread as an item array. No captured validator
output exists in the repo; the fixture reads the skill's documented example.

token-burn.sh: opt-in --rates FILE (per-Mtok prices from the project, none
built in; unmatched models UNPRICED), --windows FILE, --effort/--gap (agent
working time from main-thread gaps, human prompt count by origin.kind).
Aggregates only. Output without the new flags is byte-identical (verified on the
captured fixture and a live transcript, before the last-record fix; T9 asserts). Field run on a real
multi-day transcript: 89 human prompts, matching an independent count.

token-burn.sh: usage per message.id now from its LAST record (subagent
output was undercounted: fixture 60 -> 1559 output tokens, a live multi-agent
session 37,791 -> 84,915). Found while promoting #171.

Closes #151
Closes #296

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |   3 +
 bin/extraction-report.sh                      | 203 ++++++++++-
 bin/token-burn.sh                             | 323 ++++++++++++++++--
 skills/extractor-quality-loop.md              |   6 +
 tests/wave2/fixtures/token-burn/CAPTURE.md    |  56 ++-
 .../fixtures/token-burn/effort/s-3.jsonl      |  19 ++
 tests/wave2/test-extraction-quality-report.sh | 145 ++++++++
 tests/wave2/test-token-burn.sh                |  93 ++++-
 8 files changed, 807 insertions(+), 41 deletions(-)
 create mode 100644 tests/wave2/fixtures/token-burn/effort/s-3.jsonl
 create mode 100755 tests/wave2/test-extraction-quality-report.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..1764be41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(token-burn): **usage is taken from each `message.id`'s LAST record, not its first — subagent output was undercounted.** The header claimed every streamed record of a message carries the same usage; in subagent transcripts the early records carry a partial `output_tokens`. On the captured fixture the subagent model's output went 60 → 1,559 (headline 59,858 → 61,357); on a 2026-10 multi-agent session 37,791 → 84,915 subagent output tokens; a field measurement on harness 2.1.296 saw up to 7×. Main-thread records were identical first to last, so main numbers do not move. **Every existing subagent-heavy token count rises after sync**; fixture expectations re-derived independently (`tests/wave2/fixtures/token-burn/CAPTURE.md`) — found while promoting [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171) (measured-claims §7), MendixMau
+- new(extraction-report): **the Stage 1 surface now reads the validator's `extraction-quality*.json` — one row per dimension the file declares, a self-graded pass shown as a fault** ([#151](https://github.com/MendixMau/mxcli-project-toolkit/issues/151)). `extractor-quality-loop.md` makes that file the proof of the 95% gate, yet nothing read it: a field build scored its process-model extractor at 100% on 7 dimensions and the report showed "2 pass, 18 skipped" with no quality section. Found at `analysis/<src>/`, `analysis/<src>/extracted/` and the same two inside the KB; dimension keys come from the file. Faults only where the skill's rules show in the file: `selfGraded` + `passed`, `passed` under its own `threshold`, a 0/0 dimension absent from `confirmedZeros`, unparseable JSON. **Behaviour change for existing projects:** a code-extracted or mixed KB with no score file now carries one `fault` section (migration-pipeline.md does not start BRDs before the 95% gate, so an unscored extraction is unmeasured); documents KBs get `skipped`, the gate (`gate-check.sh`, presence of the page) and the exit code are unchanged. A score file inside `<kb>/extracted/` is no longer misread as an unparseable item file. No captured validator output exists in this repo (no pipeline ships a validator), so the fixture reads the skill's documented example at run time; `tests/wave2/test-extraction-quality-report.sh` — MendixMau
+- new(token-burn): **`--rates`, `--windows`, `--effort`: cost at the project's own per-Mtok rates, agent working time, human prompt count, per-window attribution — aggregates only** ([#296](https://github.com/MendixMau/mxcli-project-toolkit/issues/296)). A field team had to answer "money and time per round and per feature" with ad-hoc transcript scripts. No price is built in (rates file, model globs, first match wins; an unmatched model is UNPRICED and the total marked incomplete, never 0); agent time = main-thread gaps <= `--gap` minutes (default 5) not ending at a human prompt; human prompts = `origin.kind == "human"` user records (task notifications, peer messages, tool results, meta and compact summaries excluded), once per uuid, text never printed. Without the new flags the new code adds nothing to screen, `--json` or `--brief` output (byte-identical to the previous script before the last-record fix below; fixture T9 asserts no new section or key). Field run on a real multi-day transcript: human prompts matched an independent count (89 = 89). The human-prompt fixture records are hand-built from a profile of real record shapes — committing a scrubbed real capture was refused; `tests/wave2/test-token-burn.sh` T9-T14 — jopterhorst
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/extraction-report.sh b/bin/extraction-report.sh
index de4c8f08..7117843b 100755
--- a/bin/extraction-report.sh
+++ b/bin/extraction-report.sh
@@ -255,7 +255,11 @@ def analyse(kb):
     # and the reverse is not: a merge cannot invent an item it never loaded.
     xcounts, xstate, xfiles = {}, ABSENT, []
     if os.path.isdir(extracted):
-        xfiles = ls(extracted, r'.*\.json$')
+        # The validator's score file may sit here (#151: a field extractor wrote
+        # extracted/extraction-quality-<name>.json). It is a report about the extraction, not
+        # an item array of it — counted as one, it read as "would not parse" and weakened the
+        # second opinion on every zero. It is read by the quality section below instead.
+        xfiles = [f for f in ls(extracted, r'.*\.json$') if not f.startswith('extraction-quality')]
         broke = []
         for f in xfiles:
             st, items, det = read_json_list(os.path.join(extracted, f))
@@ -438,6 +442,133 @@ def analyse(kb):
     a['manifest'] = manifest if man_state in (OK, EMPTY) else []
     a['manifestState'] = man_state
 
+    # -- extraction quality: the validator's own score file (#151) --------------------------------
+    #
+    # `extractor-quality-loop.md` makes `extraction-quality.json` the proof that an extraction
+    # reached its >=95% gate. This page still scores nothing: every figure below is the
+    # validator's, read and printed — dimension keys come FROM THE FILE (a non-code source
+    # declares its own), never from a fixed list. What this page adds is only what the skill
+    # states as a rule and the file itself can show broken:
+    #   - `selfGraded` with `passed: true` is a FAULT — "a self-graded report cannot pass";
+    #   - `passed: true` with `overallScore` under `threshold` is a contradiction, a FAULT;
+    #   - a dimension at 0 found / 0 expected that `confirmedZeros` does not name is a FAULT
+    #     (the Suspicious-Zero Gate: 0/0 scores 100 by arithmetic);
+    #   - a file that will not parse is a FAULT, never an absent score.
+    # Locations: the skill's `analysis/<Project>/extraction-quality.json` (the KB's parent),
+    # its `extracted/` (where a field extractor wrote `extraction-quality-<name>.json`), and the
+    # same two inside the KB. Every `extraction-quality*.json` found is one section.
+    qdirs, qfiles = [], []
+    for d in (os.path.dirname(kb), os.path.join(os.path.dirname(kb), 'extracted'),
+              kb, extracted):
+        rd = os.path.realpath(d)
+        if rd in qdirs or not os.path.isdir(d):
+            continue
+        qdirs.append(rd)
+        qfiles += [os.path.join(d, f) for f in ls(d, r'extraction-quality.*\.json$')]
+    a['quality'] = []
+    QLOC = ('analysis/<src>/extraction-quality*.json, analysis/<src>/extracted/, and the same '
+            'two inside the knowledge base')
+
+    def num(v):
+        return v if isinstance(v, (int, float)) and not isinstance(v, bool) else None
+
+    for qf in qfiles:
+        rel = os.path.relpath(qf, project)
+        q = {'file': rel, 'rows': [], 'faults': [], 'notes': []}
+        try:
+            with open(qf) as fh:
+                data = json.load(fh)
+        except Exception as e:
+            data, q['verdict'] = None, ('fault', f'{rel} is present but unreadable — '
+                                                 f'{type(e).__name__}: {e}. Not a missing score: '
+                                                 f'a broken one.')
+        if data is not None and not isinstance(data, dict):
+            data, q['verdict'] = None, ('fault', f'{rel} is valid JSON but a '
+                                                 f'{type(data).__name__}, not the report object '
+                                                 f'extractor-quality-loop.md defines.')
+        if data is not None:
+            thr = num(data.get('threshold'))
+            if thr is None:
+                thr = 95
+                q['notes'].append('no `threshold` in the file — compared against the skill\'s 95.')
+            overall, passed, sg = num(data.get('overallScore')), data.get('passed'), data.get('selfGraded')
+            cz = data.get('confirmedZeros') if isinstance(data.get('confirmedZeros'), list) else []
+            cz_names = {z.get('dimension') for z in cz if isinstance(z, dict)}
+            dims = data.get('dimensions')
+            if not isinstance(dims, dict) or not dims:
+                q['faults'].append('no `dimensions` object — there is nothing the overall score '
+                                   'is an average of.')
+                dims = {}
+            for dk, dv in dims.items():
+                if not isinstance(dv, dict):
+                    q['rows'].append({'dimension': dk, 'score': None, 'found': None,
+                                      'expected': None, 'gaps': [],
+                                      'flag': 'not an object — unreadable'})
+                    q['faults'].append(f'dimension {dk} is not an object.')
+                    continue
+                sc, fo, ex = num(dv.get('score')), num(dv.get('found')), num(dv.get('expected'))
+                gaps = dv.get('gaps') if isinstance(dv.get('gaps'), list) else []
+                flag = ''
+                if fo == 0 and ex == 0 and dk not in cz_names:
+                    flag = 'unconfirmed zero'
+                    q['faults'].append(f'dimension {dk} is 0 found / 0 expected and is not in '
+                                       f'confirmedZeros — the Suspicious-Zero Gate needs two '
+                                       f'methods agreeing before a zero may score.')
+                elif sc is None:
+                    flag = 'no score'
+                elif sc < thr:
+                    flag = f'below {thr:g}'
+                q['rows'].append({'dimension': dk, 'score': sc, 'found': fo, 'expected': ex,
+                                  'gaps': [str(g) for g in gaps], 'flag': flag})
+            if sg and passed is True:
+                q['faults'].append('self-graded pass: `selfGraded` is set and `passed` is true. '
+                                   'extractor-quality-loop.md: a self-graded report cannot pass '
+                                   'the 95% gate until a second mechanism has scored it.')
+            if passed is True and overall is not None and overall < thr:
+                q['faults'].append(f'`passed` is true but overallScore {overall:g} is under the '
+                                   f'file\'s own threshold {thr:g}.')
+            q.update({'overallScore': overall, 'threshold': thr, 'passed': passed,
+                      'selfGraded': sg if sg else False, 'confirmedZeros': cz,
+                      'scoredAt': data.get('scoredAt'), 'project': data.get('project')})
+            if q['faults']:
+                q['verdict'] = ('fault', ' '.join(q['faults']))
+            elif sg:
+                q['verdict'] = ('manual', 'self-graded and not passed — an inventory awaiting a '
+                                          'second mechanism (a different parser, a runtime probe, '
+                                          'an SME pass) before the gate can be judged.')
+            elif passed is not True:
+                q['verdict'] = ('manual', f'the file records the extraction as not passed '
+                                          f'(overall {"?" if overall is None else format(overall, "g")} '
+                                          f'against {thr:g}) — the quality loop is still running; '
+                                          f'continuing it or waiving the gate is a human call.')
+            else:
+                q['verdict'] = ('pass', f'passed: overall {"?" if overall is None else format(overall, "g")} '
+                                        f'against threshold {thr:g}, {len(q["rows"])} dimension(s), '
+                                        f'{len(cz)} confirmed zero(s) — the validator\'s figures, '
+                                        f'read, not re-scored.')
+        a['quality'].append(q)
+        a['sections']['quality:' + rel] = {
+            'key': 'quality:' + rel, 'label': 'Extraction quality — ' + os.path.basename(qf),
+            'family': 'quality', 'file': rel, 'state': OK if data is not None else BROKEN,
+            'count': len(q['rows']), 'items': [], 'second': None, 'third': None,
+            'expect': E, 'verdict': q['verdict']}
+    if not qfiles:
+        if prov == 'documents':
+            v = ('skipped', 'no extraction-quality*.json, and none is owed: a documents knowledge '
+                            'base ran no extractor, so there is nothing for a validator to score.')
+        elif prov in ('code-extracted', 'mixed'):
+            v = ('fault', f'an extractor produced this knowledge base ({prov}) but no '
+                          f'extraction-quality*.json was found ({QLOC}). extractor-quality-loop.md '
+                          f'makes that file the proof of the >=95% gate, and migration-pipeline.md '
+                          f'does not start BRDs before it — an unmeasured extraction, not a pass.')
+        else:
+            v = ('manual', 'provenance undetermined — whether an extractor ran, and so whether a '
+                           'score file is owed, needs a human.')
+        a['sections']['extractionQuality'] = {
+            'key': 'extractionQuality', 'label': 'Extraction quality', 'family': 'quality',
+            'file': '', 'state': ABSENT, 'count': 0, 'items': [], 'second': None, 'third': None,
+            'expect': E, 'verdict': v}
+
     # -- BRDs: Stage 2's artifact, shown here only as a forward link -----------------------------
     a['brdCount'] = len(ls(os.path.join(kb, 'brd'), r'.*\.brd\.json$'))
 
@@ -516,6 +647,9 @@ result = {
         'path': a['path'], 'provenance': a['provenance'], 'brdCount': a['brdCount'],
         'verdicts': a['tally'], 'discrepancies': a['faults'], 'dimensions': a['dims'],
         'sections': {k: s['verdict'][0] for k, s in a['sections'].items()},
+        'extractionQuality': [dict({k: q.get(k) for k in (
+            'file', 'overallScore', 'threshold', 'passed', 'selfGraded', 'confirmedZeros',
+            'rows', 'faults', 'notes')}, verdict=q['verdict'][0]) for q in a['quality']],
     } for a in analysed],
 }
 
@@ -632,10 +766,10 @@ for a in analysed:
                if d['documentsExpected'] is not None else
                'No discovery-manifest.json, so there is no expected count to divide by — the '
                'number on the left is a count, not a coverage.', doc_na)
-        + card('Overall score', '<span class="qv r-unranked">not computed</span>',
-               'Deliberately. The six scored dimensions and the &ge;95% threshold are '
-               '<code>skills/extractor-quality-loop.md</code>&rsquo;s judgement; a composite '
-               'invented here would be a number with no skill behind it.')
+        + card('Overall score', '<span class="qv r-unranked">not computed here</span>',
+               'Deliberately. The scored dimensions and the &ge;95% threshold are '
+               '<code>skills/extractor-quality-loop.md</code>&rsquo;s; the validator&rsquo;s own '
+               'score, when it wrote one, is printed under <em>Extraction quality</em> below.')
         + '</div>')
 
     mod_table = ('<div class="scroll"><table><thead><tr><th>Module</th><th>Items</th></tr></thead>'
@@ -656,6 +790,52 @@ for a in analysed:
     t = a['tally']
 
     code_blocks = ''.join(section_block(a['sections'][k]) for k, _f, _x, _l, _e in CODE_SECTIONS)
+
+    def fmt_num(v):
+        return '<span class="unknown">not stated</span>' if v is None else esc(format(v, 'g'))
+
+    for q in a['quality']:
+        s = a['sections']['quality:' + q['file']]
+        if 'overallScore' not in q:
+            continue                      # broken file: the verdict text is the content
+        rows = ''.join(
+            '<tr>'
+            f'<td class="mono">{esc(r["dimension"])}</td>'
+            f'<td class="num">{fmt_num(r["score"])}</td>'
+            f'<td class="num">{fmt_num(r["found"])} / {fmt_num(r["expected"])}</td>'
+            f'<td>{"; ".join(esc(g) for g in r["gaps"][:12]) or "—"}'
+            + (f' <span class="note">(+{len(r["gaps"]) - 12} more)</span>' if len(r["gaps"]) > 12 else '')
+            + '</td>'
+            + (f'<td class="why-fault">{esc(r["flag"])}</td>' if r['flag'] == 'unconfirmed zero' or 'unreadable' in r['flag']
+               else f'<td>{esc(r["flag"])}</td>')
+            + '</tr>' for r in q['rows'])
+        sg = q['selfGraded']
+        facts = (
+            f'<p class="why">Overall <strong>{fmt_num(q["overallScore"])}</strong> against threshold '
+            f'<strong>{esc(format(q["threshold"], "g"))}</strong> &middot; passed: '
+            f'<strong>{esc(q["passed"])}</strong> &middot; self-graded: '
+            + ('<strong class="unknown">' + esc(sg if sg is not True else 'yes') + '</strong>' if sg else 'no')
+            + (f' &middot; scored {esc(q["scoredAt"])}' if q.get('scoredAt') else '') + '</p>')
+        cz = ''.join(f'<li><span class="mono">{esc(z.get("dimension"))}</span> — '
+                     f'{esc(", ".join(map(str, z.get("methods") or [])) or "no methods named")}'
+                     f'{(" — " + esc(z.get("note"))) if z.get("note") else ""}</li>'
+                     for z in q['confirmedZeros'] if isinstance(z, dict))
+        s['body'] = (facts
+                     + ''.join(f'<p class="note">{esc(n)}</p>' for n in q['notes'])
+                     + '<div class="scroll"><table><thead><tr><th>Dimension</th><th>Score</th>'
+                       '<th>Found / expected</th><th>Gaps</th><th>Flag</th></tr></thead><tbody>'
+                     + (rows or '<tr><td colspan="5" class="unknown">no dimensions in the file</td></tr>')
+                     + '</tbody></table></div>'
+                     + ('<p class="note">Confirmed zeros (two methods agreed):</p><ul class="oq">'
+                        + cz + '</ul>' if cz else
+                        '<p class="note">No confirmed zeros recorded.</p>'))
+        if s['verdict'][0] != 'pass':
+            # section_block prints only the reason for a non-pass verdict; for a quality file
+            # the figures ARE the evidence for the fault, so they go under it.
+            s['tail'] = s['body']
+    quality_blocks = ''.join(
+        section_block(s) + (s.get('tail') or '')
+        for k, s in a['sections'].items() if s['family'] == 'quality')
     doc_blocks  = ''.join(section_block(a['sections'][k]) for k, _l, _e in DOC_SECTIONS)
 
     body = f"""<!DOCTYPE html>
@@ -780,6 +960,13 @@ for a in analysed:
      figure reads <em>not measured</em> — it is never rounded up to a full bar.</p>
   {dims}
 
+  <h2>Extraction quality</h2>
+  <p class="lede">The validator&rsquo;s own score file(s) per <code>skills/extractor-quality-loop.md</code>,
+     printed as written — one row per dimension the file declares. Faulted here only where the
+     skill&rsquo;s own rules show in the file: a self-graded pass, a pass under its own threshold,
+     a 0/0 dimension no second method confirmed.</p>
+  {quality_blocks}
+
   <h2>Extracted constructs</h2>
   {code_blocks}
 
@@ -841,6 +1028,12 @@ elif not quiet:
                 print(f"      MANUAL {s['key']}: {s['verdict'][1]}")
         for x in a['faults']:
             print(f"      FAULT  {x}")
+        for q in a['quality']:
+            if 'overallScore' in q:
+                print(f"      quality {q['file']}: overall "
+                      f"{'?' if q['overallScore'] is None else format(q['overallScore'], 'g')}"
+                      f" / threshold {q['threshold']:g}, passed={q['passed']}, "
+                      f"selfGraded={'yes' if q['selfGraded'] else 'no'}, {len(q['rows'])} dimension(s)")
         d = a['dims']
         print(f"      zeros corroborated: {d['zerosCorroborated']}/{d['zerosTotal']}; "
               f"module attribution: "
diff --git a/bin/token-burn.sh b/bin/token-burn.sh
index 668c2a34..cc89e643 100755
--- a/bin/token-burn.sh
+++ b/bin/token-burn.sh
@@ -7,6 +7,9 @@
 #   bin/token-burn.sh <project-root> --scan-all   # look in every transcript dir, not only the
 #                                                 # project's own and its ancestors/descendants
 #   bin/token-burn.sh <project-root> --json       # the same numbers as one JSON object
+#   ... --rates FILE     # + cost per model at YOUR per-Mtok rates (format: "RATES FILE" below)
+#   ... --windows FILE   # + per-window table: tokens, cost, agent time, human prompts
+#   ... --effort [--gap MIN]  # + agent working time and human prompt count (default gap 5 min)
 #
 # PRODUCER. The Claude Code harness (CLI, desktop app, IDE extension) writes one JSONL
 # transcript per session under `$CLAUDE_CONFIG_DIR/projects/<slug>/<session>.jsonl` (default
@@ -21,8 +24,14 @@
 # by `message.model`. Three facts about the format, each learned from a real transcript
 # (2026-09-18, a 17,000-line toolkit session) and each one a silent miscount if ignored:
 #   1. The harness writes ONE RECORD PER STREAMED CONTENT BLOCK, all carrying the same
-#      `message.id` and the same usage — that session had 4,336 assistant records for 1,989
-#      messages. Summing records overcounts ~2×. Usage is summed ONCE per `message.id`.
+#      `message.id` — that session had 4,336 assistant records for 1,989 messages, so summing
+#      records overcounts ~2×. Usage is summed ONCE per `message.id`, from that id's LAST
+#      record: the usage is NOT the same on every record. In subagent transcripts the early
+#      records carry a partial `output_tokens` (the captured fixture: 60 on the first record,
+#      1,559 on the last; a 2026-10 multi-agent session: 37,791 vs 84,915 subagent output
+#      tokens, first vs last). Keeping the first record undercounted subagent output by up to
+#      7× in a field measurement; main-thread records were identical first to last. The
+#      message's day and time are its FIRST record's (when it started).
 #   2. `message.model` is `<synthetic>` on harness-generated records (aborts, errors). Skipped.
 #   3. `cwd` is per RECORD, not per session, and a session launched in `~` can spend most of its
 #      tokens inside `~/proj`. So records are attributed to the project by their own `cwd`
@@ -43,25 +52,67 @@
 # which stage a session was actually working — the caveat is printed with the table. Dispatch
 # lines (runbook §1c) will sharpen it once they carry a stage and a date.
 #
-# Exit 0 always — this is read, never gated on. Bash 3.2 + Python 3 via lib/portable.sh.
+# COST, TIME AND PROMPTS (#296, opt-in — without these flags every output above is byte-for-
+# byte what it was). Asked for in the field as "money and time per round and per feature",
+# which the project had to answer with ad-hoc scripts over the transcripts.
+#   RATES FILE (--rates): no price is built in — rates change per model, plan and month, so they
+#     come from the project. One line per model glob, first match wins, `*` as a catch-all:
+#         currency EUR                      # optional label, default EUR
+#         # glob          input  cache-write  cache-read  output     (per million tokens)
+#         claude-fable-*  2.80   3.50         0.28        14.00
+#         *               0.90   1.10         0.09        4.50
+#     A model no line matches is printed UNPRICED and the total is marked incomplete — never 0.
+#   WINDOWS FILE (--windows): one line per window, `<start> <name...>`, start as YYYY-MM-DD or
+#     YYYY-MM-DDTHH:MM[:SS] (UTC); a window runs until the next one starts, the last one is
+#     open-ended, and anything before the first lands in "(before first window)". Use it for
+#     setup / map / round N / wrap-up boundaries.
+#   AGENT WORKING TIME: per main-thread transcript file, the sum of gaps between consecutive
+#     user/assistant records that are <= --gap minutes, EXCLUDING every gap that ends at a
+#     human prompt (that gap is the human thinking, not the agent working). Subagent time is
+#     not added: it runs inside the main thread's own gaps.
+#   HUMAN PROMPTS: main-thread `user` records that are not tool results, not `isMeta`, not a
+#     compact summary; when the harness writes `origin`, only `origin.kind == "human"` counts
+#     (task notifications and peer messages are `user` records too); older records without
+#     `origin` count unless their text starts with `<` (harness-injected command/notification
+#     wrappers). Counted once per `uuid`. The text is read only to make that test and is
+#     never printed — every output is an aggregate.
+#
+# Exit 0 always — this is read, never gated on (a malformed --rates/--windows file is a usage
+# error, exit 1). Bash 3.2 + Python 3 via lib/portable.sh.
 set -u
 TOOLKIT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck source=lib/portable.sh
 . "$TOOLKIT_ROOT/bin/lib/portable.sh"
 
-PROJECT_DIR=""; MODE=screen; SCAN_ALL=0
-for a in "$@"; do
+PROJECT_DIR=""; MODE=screen; SCAN_ALL=0; RATES=""; WINDOWS=""; EFFORT=0; GAP=5
+USAGE="usage: bin/token-burn.sh <project-root> [--brief|--json] [--scan-all] [--rates FILE] [--windows FILE] [--effort] [--gap MIN]"
+while [ $# -gt 0 ]; do
+  a="$1"
   case "$a" in
     --brief) MODE=brief ;;
     --json) MODE=json ;;
     --scan-all) SCAN_ALL=1 ;;
-    -h|--help) sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    --effort) EFFORT=1 ;;
+    --rates|--windows|--gap)
+      [ $# -ge 2 ] || { echo "$a needs a value" >&2; echo "$USAGE" >&2; exit 1; }
+      case "$a" in
+        --rates) RATES="$2" ;;
+        --windows) WINDOWS="$2" ;;
+        --gap) GAP="$2"; EFFORT=1 ;;
+      esac
+      shift ;;
+    -h|--help) sed -n '2,11p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
     --*) echo "unknown option: $a" >&2; exit 1 ;;
     *) PROJECT_DIR="$a" ;;
   esac
+  shift
+done
+[ -n "$PROJECT_DIR" ] || { echo "$USAGE" >&2; exit 1; }
+for f in "$RATES" "$WINDOWS"; do
+  [ -z "$f" ] || [ -f "$f" ] || { echo "not a file: $f" >&2; exit 1; }
 done
-[ -n "$PROJECT_DIR" ] || { echo "usage: bin/token-burn.sh <project-root> [--brief|--json] [--scan-all]" >&2; exit 1; }
-PROJECT_DIR="$(cd "$PROJECT_DIR" 2>/dev/null && pwd)" || { echo "not a directory: $1" >&2; exit 1; }
+case "$GAP" in ''|*[!0-9.]*) echo "--gap takes minutes (a number), got: $GAP" >&2; exit 1 ;; esac
+PROJECT_DIR="$(cd "$PROJECT_DIR" 2>/dev/null && pwd)" || { echo "not a directory: $PROJECT_DIR" >&2; exit 1; }
 
 TRANSCRIPTS="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects"
 if [ ! -d "$TRANSCRIPTS" ]; then
@@ -74,11 +125,84 @@ if [ ! -d "$TRANSCRIPTS" ]; then
 fi
 
 require_py
-"$PY" - "$PROJECT_DIR" "$TRANSCRIPTS" "$MODE" "$SCAN_ALL" <<'PYEOF'
-import json, os, re, sys
+"$PY" - "$PROJECT_DIR" "$TRANSCRIPTS" "$MODE" "$SCAN_ALL" "$RATES" "$WINDOWS" "$EFFORT" "$GAP" <<'PYEOF'
+import json, os, re, sys, fnmatch, calendar
 from collections import defaultdict
 
 project, root, mode, scan_all = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4] == "1"
+rates_file, windows_file = sys.argv[5], sys.argv[6]
+want_effort = sys.argv[7] == "1" or bool(windows_file)
+gap_s = float(sys.argv[8]) * 60.0
+
+def die(msg):
+    sys.stderr.write("token-burn: " + msg + "\n")
+    sys.exit(1)
+
+def epoch(ts):
+    """ISO-8601 UTC (the transcript's `2026-09-08T00:59:57.347Z`, or a windows-file start) ->
+    seconds. None when it does not parse — such a record carries no time, never time 0."""
+    m = re.match(r"^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?)?(Z|[+-]00:?00)?$", ts or "")
+    if not m:
+        return None
+    y, mo, d, hh, mi, ss, frac = m.group(1, 2, 3, 4, 5, 6, 7)
+    t = calendar.timegm((int(y), int(mo), int(d), int(hh or 0), int(mi or 0), int(ss or 0), 0, 0, 0))
+    return t + (float(frac) if frac else 0.0)
+
+# --- --rates: per-Mtok prices from the project's own file, never built in -------------------
+currency, rates = "EUR", []
+if rates_file:
+    with open(rates_file, encoding="utf-8", errors="replace") as fh:
+        for n, line in enumerate(fh, 1):
+            line = line.split("#", 1)[0].strip()
+            if not line:
+                continue
+            f = line.split()
+            if f[0] == "currency" and len(f) == 2:
+                currency = f[1]
+                continue
+            if len(f) != 5:
+                die("%s:%d: want `<model-glob> <input> <cache-write> <cache-read> <output>` (per Mtok), got %d field(s)" % (rates_file, n, len(f)))
+            try:
+                rates.append((f[0], [float(x) for x in f[1:]]))
+            except ValueError:
+                die("%s:%d: rates must be numbers" % (rates_file, n))
+    if not rates:
+        die("%s: no rate lines" % rates_file)
+
+def rate_for(model):
+    for glob, r in rates:
+        if fnmatch.fnmatchcase(model, glob):
+            return r
+    return None
+
+def cost_of(model, vals):
+    r = rate_for(model)
+    return None if r is None else sum(v * x for v, x in zip(vals, r)) / 1e6
+
+# --- --windows: named time windows, each running until the next one starts ------------------
+windows = []
+if windows_file:
+    with open(windows_file, encoding="utf-8", errors="replace") as fh:
+        for n, line in enumerate(fh, 1):
+            line = line.split("#", 1)[0].strip()
+            if not line:
+                continue
+            f = line.split(None, 1)
+            t = epoch(f[0])
+            if t is None or len(f) < 2:
+                die("%s:%d: want `<YYYY-MM-DD[THH:MM[:SS]]> <name>`" % (windows_file, n))
+            windows.append((t, f[1].strip(), f[0]))
+    if not windows:
+        die("%s: no window lines" % windows_file)
+    windows.sort()
+BEFORE = "(before first window)"
+
+def window_for(t):
+    name = BEFORE
+    for start, wname, _raw in windows:
+        if t is not None and t >= start:
+            name = wname
+    return name
 
 def slug(path):
     return re.sub(r"[^A-Za-z0-9]", "-", path)
@@ -120,6 +244,24 @@ by_day = defaultdict(lambda: [0, 0, 0, 0, 0])
 day_model = defaultdict(lambda: defaultdict(int)) # day -> model -> headline
 sidechain = [0, 0]                                 # headline tokens: main, subagent
 n_files = n_records = n_synthetic = 0
+msgs = []                                          # (epoch, model, vals, is_sidechain) per message
+last, order = {}, []                               # message.id -> [first ts, model, LAST usage, sidechain]
+human_seen = set()
+humans = []                                        # epoch per human prompt
+timeline = defaultdict(list)                       # main-thread file -> [(epoch, is_human)]
+
+def is_human_prompt(rec):
+    if rec.get("type") != "user" or rec.get("isSidechain") or rec.get("isMeta") or rec.get("isCompactSummary"):
+        return False
+    c = (rec.get("message") or {}).get("content")
+    if isinstance(c, list):
+        if any(isinstance(b, dict) and b.get("type") == "tool_result" for b in c):
+            return False
+        texts = [b.get("text") for b in c if isinstance(b, dict) and b.get("type") == "text"]
+        c = texts[0] if texts else ""
+    if isinstance(rec.get("origin"), dict):
+        return rec["origin"].get("kind") == "human"
+    return isinstance(c, str) and not c.lstrip().startswith("<")
 
 for d in dirs:
     for f in jsonl_files(d):
@@ -130,6 +272,18 @@ for d in dirs:
                     rec = json.loads(line)
                 except ValueError:
                     continue
+                if want_effort and rec.get("type") in ("user", "assistant") and not rec.get("isSidechain") \
+                        and os.sep + "subagents" + os.sep not in f and under_project(rec.get("cwd")):
+                    t = epoch(rec.get("timestamp"))
+                    if t is not None:
+                        hp = is_human_prompt(rec)
+                        if hp:
+                            key = rec.get("uuid") or (f + "@" + str(rec.get("timestamp")))
+                            if key in human_seen:
+                                continue
+                            human_seen.add(key)
+                            humans.append(t)
+                        timeline[f].append((t, hp))
                 if rec.get("type") != "assistant":
                     continue
                 msg = rec.get("message") or {}
@@ -141,20 +295,28 @@ for d in dirs:
                     continue
                 n_records += 1
                 mid = msg.get("id") or rec.get("uuid") or (f + str(n_records))
+                u = msg.get("usage") or {}
+                vals = [int(u.get(k) or 0) for k in KEYS]
                 if mid in seen:
+                    last[mid][2] = vals          # later record of the same message: its usage wins
                     continue
                 seen.add(mid)
-                u = msg.get("usage") or {}
-                vals = [int(u.get(k) or 0) for k in KEYS]
-                day = (rec.get("timestamp") or "")[:10] or "????-??-??"
-                for i, v in enumerate(vals):
-                    by_model[model][i] += v
-                    by_day[day][i] += v
-                by_model[model][4] += 1
-                by_day[day][4] += 1
-                head = vals[0] + vals[1] + vals[3]
-                day_model[day][model] += head
-                sidechain[1 if rec.get("isSidechain") else 0] += head
+                order.append(mid)
+                last[mid] = [rec.get("timestamp") or "", model, vals, bool(rec.get("isSidechain"))]
+
+# one entry per message.id: first record's time, LAST record's usage (see header, fact 1)
+for mid in order:
+    ts, model, vals, side = last[mid]
+    day = ts[:10] or "????-??-??"
+    for i, v in enumerate(vals):
+        by_model[model][i] += v
+        by_day[day][i] += v
+    by_model[model][4] += 1
+    by_day[day][4] += 1
+    head = vals[0] + vals[1] + vals[3]
+    day_model[day][model] += head
+    msgs.append((epoch(ts), model, vals, side))
+    sidechain[1 if side else 0] += head
 
 def headline(v):
     return v[0] + v[1] + v[3]
@@ -220,6 +382,87 @@ caveat = ("stage = highest stage whose dated PROJECT.md row is on or before that
           "UNMAPPED = before the first dated row" if stage_rows else
           "no dated stage rows in PROJECT.md — every day is UNMAPPED")
 
+# --- opt-in: cost, agent time, human prompts, windows (#296) -------------------------------
+def money(x):
+    return "UNPRICED" if x is None else "%.2f" % x
+
+cost = None
+if rates_file:
+    cm = {}
+    unpriced = set()
+    for t, mdl, vals, side in msgs:
+        r = rate_for(mdl)
+        if r is None:
+            unpriced.add(mdl)
+            continue
+        e = cm.setdefault(mdl, [0.0, 0.0, 0.0, 0.0])
+        for i in range(4):
+            e[i] += vals[i] * r[i] / 1e6
+    side_cost = [0.0, 0.0]
+    for t, mdl, vals, side in msgs:
+        c = cost_of(mdl, vals)
+        if c is not None:
+            side_cost[1 if side else 0] += c
+    cost = {"currency": currency, "rates_file": rates_file,
+            "by_model": {m: [round(x, 4) for x in v] + [round(sum(v), 4)] for m, v in cm.items()},
+            "total": round(sum(sum(v) for v in cm.values()), 4),
+            "main": round(side_cost[0], 4), "subagents": round(side_cost[1], 4),
+            "unpriced_models": sorted(unpriced), "complete": not unpriced}
+
+def agent_seconds(pred=lambda t: True):
+    tot = 0.0
+    for f, evs in timeline.items():
+        evs = sorted(evs)
+        for (t0, _h0), (t1, h1) in zip(evs, evs[1:]):
+            d = t1 - t0
+            if 0 < d <= gap_s and not h1 and pred(t1):
+                tot += d
+    return tot
+
+def hm(sec):
+    mins = int(round(sec / 60.0))
+    return "%dh %02dm" % (mins // 60, mins % 60)
+
+effort = None
+if want_effort:
+    effort = {"agent_seconds": round(agent_seconds()), "human_prompts": len(humans),
+              "gap_minutes": gap_s / 60.0, "main_thread_files": len(timeline)}
+
+win = None
+if windows:
+    names = [BEFORE] + [w for _t, w, _r in windows]
+    order = []
+    for n in names:
+        if n not in order:
+            order.append(n)
+    win = {n: {"messages": 0, "usage": [0, 0, 0, 0], "cost": 0.0 if rates_file else None,
+               "unpriced": 0, "agent_seconds": 0, "human_prompts": 0} for n in order}
+    starts = {}
+    for t, n, raw in windows:
+        starts.setdefault(n, raw)
+    for t, mdl, vals, side in msgs:
+        w = win[window_for(t)]
+        w["messages"] += 1
+        for i in range(4):
+            w["usage"][i] += vals[i]
+        if rates_file:
+            c = cost_of(mdl, vals)
+            if c is None:
+                w["unpriced"] += 1
+            else:
+                w["cost"] += c
+    for t in humans:
+        win[window_for(t)]["human_prompts"] += 1
+    for n in order:
+        win[n]["agent_seconds"] = round(agent_seconds(lambda t, n=n: window_for(t) == n))
+        if win[n]["cost"] is not None:
+            win[n]["cost"] = round(win[n]["cost"], 4)
+        win[n]["start"] = starts.get(n)
+    if not any(win[BEFORE][k] for k in ("messages", "human_prompts", "agent_seconds")):
+        del win[BEFORE]
+        order.remove(BEFORE)
+    win = {"order": order, "windows": win}
+
 # --- output -------------------------------------------------------------------------------
 if mode == "json":
     out = {
@@ -232,6 +475,13 @@ if mode == "json":
         "headline": {"main": sidechain[0], "subagents": sidechain[1]},
         "current_stage": current, "caveat": caveat,
     }
+    # opt-in keys only: without the flags the object is exactly what it was
+    if cost is not None:
+        out["cost"] = cost
+    if effort is not None:
+        out["effort"] = effort
+    if win is not None:
+        out["windows"] = win
     print(json.dumps(out, indent=1, sort_keys=True))
     sys.exit(0)
 
@@ -286,4 +536,35 @@ for s in sorted(by_stage, key=stage_sort):
 print("  caveat: %s" % caveat)
 if current:
     print("  register says current stage %s%s" % (current, "" if current in by_stage else " — no day attributed to it yet"))
+if cost is not None:
+    print()
+    print("COST (%s per Mtok from %s)" % (currency, rates_file))
+    fmtc = "%-22s %9s %11s %11s %9s %10s"
+    print(fmtc % ("MODEL", "INPUT", "CACHE-WRITE", "CACHE-READ", "OUTPUT", "TOTAL"))
+    for m in sorted(by_model, key=lambda m: -headline(by_model[m])):
+        if m in cost["by_model"]:
+            v = cost["by_model"][m]
+            print(fmtc % (short(m), money(v[0]), money(v[1]), money(v[2]), money(v[3]), money(v[4])))
+        else:
+            print(fmtc % (short(m), "", "", "", "", "UNPRICED"))
+    print(fmtc % ("TOTAL", "", "", "", "", money(cost["total"]) + ("" if cost["complete"] else "+")))
+    if cost["main"] + cost["subagents"]:
+        print("  subagents (Agent tool): %s %s of %s" % (money(cost["subagents"]), currency, money(cost["total"])))
+    if not cost["complete"]:
+        print("  INCOMPLETE — no rate line matches: %s (add a line or a `*` catch-all)" % ", ".join(cost["unpriced_models"]))
+if effort is not None:
+    print()
+    print("agent working time: %s (main thread, gaps <= %g min, gaps ending at a human prompt excluded) · human prompts: %d" % (
+        hm(effort["agent_seconds"]), gap_s / 60.0, effort["human_prompts"]))
+if win is not None:
+    print()
+    print("WINDOWS (from %s; each runs until the next starts)" % windows_file)
+    fmtw = "%-24s %-17s %6s %9s %11s %10s %10s %8s"
+    print(fmtw % ("WINDOW", "FROM", "MSGS", "HEADLINE", "CACHE-READ", "COST", "AGENT-TIME", "PROMPTS"))
+    for n in win["order"]:
+        w = win["windows"][n]
+        c = "-" if w["cost"] is None else money(w["cost"]) + ("+" if w["unpriced"] else "")
+        print(fmtw % (n[:24], w["start"] or "", w["messages"], k(headline(w["usage"])), k(w["usage"][2]),
+                      c, hm(w["agent_seconds"]), w["human_prompts"]))
+    print("  agent time = main-thread gaps <= %g min not ending at a human prompt; a trailing + = some messages unpriced" % (gap_s / 60.0))
 PYEOF
diff --git a/skills/extractor-quality-loop.md b/skills/extractor-quality-loop.md
index fea175d2..ae5ca148 100644
--- a/skills/extractor-quality-loop.md
+++ b/skills/extractor-quality-loop.md
@@ -177,6 +177,12 @@ Noting these as "BRD-only" in the quality report is correct and expected.
 }
 ```
 
+**Where it is read:** `bin/extraction-report.sh` (the Stage 1 surface) renders every
+`extraction-quality*.json` at `analysis/<Project>/` or `analysis/<Project>/extracted/` (also
+inside the knowledge base), one row per key of `dimensions`. A code-extracted knowledge base
+with no such file, a `selfGraded` pass, a pass under `threshold`, or a 0/0 dimension missing
+from `confirmedZeros` shows there as a fault.
+
 ### A score without a second mechanism is self-graded — label it, never let it pass alone
 
 When the "ground truth" side of the comparison is a manual read with no independent second
diff --git a/tests/wave2/fixtures/token-burn/CAPTURE.md b/tests/wave2/fixtures/token-burn/CAPTURE.md
index b30847c6..4ea125bc 100644
--- a/tests/wave2/fixtures/token-burn/CAPTURE.md
+++ b/tests/wave2/fixtures/token-burn/CAPTURE.md
@@ -8,7 +8,10 @@ plus one of its Agent-tool subagent transcripts), then scrubbed. Every structura
 it was imagined:
 
 - one `assistant` record **per streamed content block**, all carrying the same `message.id`
-  and the same `usage` (the ~2× overcount if summed per record);
+  (the ~2× overcount if summed per record) — but NOT always the same `usage`: in the subagent
+  transcript `msg` ids with a later record carry a larger `output_tokens` on that last record
+  (60 on the first records of the 2026-09-17 messages, 1559 summed over last records). The
+  instrument takes each id's LAST record; the numbers below were recomputed that way;
 - `message.model` = `<synthetic>` on a harness-generated record (exactly one kept);
 - `cwd` is **per record**: a session launched in `~` spends records in `~`, `~/proj` and
   `~/proj/app`;
@@ -47,19 +50,58 @@ publish.
 
 ## Expected numbers (computed independently of the instrument)
 
-One Python one-liner over both files: unique `message.id`, `type == assistant`, model not
-`<synthetic>`, `cwd` at or under `/srv/example/proj`. Columns are
+One Python one-liner over both files: unique `message.id` (usage from its LAST record),
+`type == assistant`, model not `<synthetic>`, `cwd` at or under `/srv/example/proj`. Columns are
 input · cache-write · cache-read · output · messages; headline = input + cache-write + output.
 
 | | input | cache-write | cache-read | output | msgs | headline |
 |---|---|---|---|---|---|---|
 | claude-fable-5-1 | 288 | 31365 | 2607781 | 15524 | 9 | 47177 |
-| claude-sonnet-5 (subagent) | 26 | 59772 | 998476 | 60 | 13 | 59858 |
-| **total** | 314 | 91137 | 3606257 | 15584 | 22 | 107035 |
+| the subagent model (subagent) | 26 | 59772 | 998476 | 1559 | 13 | 61357 |
+| **total** | 314 | 91137 | 3606257 | 17083 | 22 | 108534 |
+
+(Taking the FIRST record per id, as the instrument did until 2026-10-13, gives subagent output
+60 and headline 59858 — a 26× undercount of that model's output on this sample.)
 
 Records: 52 in-project assistant records collapse to 22 messages; 76 records at
 `/srv/example` are excluded; 6 records of `msg_14` are at `/srv/example/proj/app` and count.
 
-Per day (headline): 2026-09-08 → 38527 (5 msgs) · 2026-09-17 → 59858 (13) · 2026-09-18 → 8650 (4).
+Per day (headline): 2026-09-08 → 38527 (5 msgs) · 2026-09-17 → 61357 (13) · 2026-09-18 → 8650 (4).
 With `PROJECT.md` beside: stage 1 = 2026-09-08 = 38527 (`39k`); stage 2 = 09-17 + 09-18 =
-68508 (`69k`, sonnet-5 87% · fable-5-1 13%, cache-read 1438109 → `1438k`); current stage 2.
+70007 (`70k`, subagent model 88% · fable-5-1 12%, cache-read 1438109 → `1438k`); current stage 2.
+
+## `effort/s-3.jsonl` — hand-built, and why (#296)
+
+**This file is NOT a capture.** The captured `s-1.jsonl` carries no main-thread human prompt
+(its `user` records were not selected), so the human-prompt classifier has nothing captured to
+run on. A fresh capture was taken from a real session and refused at commit time — a real
+session's transcript, even scrubbed, is not something to publish from a shared machine. So
+`s-3.jsonl` is built by hand, with every key and value shape taken from a profile of a real
+harness transcript (harness 2.1.29x, 2026-10): only keys and value kinds were read, never text.
+The facts it encodes, each seen in that profile:
+
+- human prompts are `type: user` with `origin: {"kind": "human"}` and `promptSource: "sdk"`;
+  some carry `promptId`/`userType`, some (written by a remote client) do not; content is a
+  string or a list holding `text` blocks;
+- task notifications and peer messages are ALSO `type: user`, distinguished only by
+  `origin.kind` (`task-notification`, `peer`) — peer ones also `isMeta: true`;
+- tool results are `type: user` with a `tool_result` block and a top-level `toolUseResult`;
+- `isMeta: true` and `isCompactSummary: true` records are `type: user` too;
+- records with no `origin` exist (older harness versions, and harness-injected command
+  wrappers whose text starts with `<`);
+- a human prompt record can be written twice with the same `uuid`.
+
+Plus one record whose `cwd` is outside the project and one `isSidechain: true` record.
+Field proof is a run, not this file: on the real transcript profiled above the instrument
+counted the same number of human prompts (89) as an independent count of `origin.kind ==
+"human"`, non-meta, non-compact records.
+
+Expected (independent Python over the files, not the instrument): main-thread agent time
+with the 5-minute cut-off = 220.465 s (captured `s-1.jsonl`; 164.6 s before
+2026-09-18T02:00, 55.8 s after) + 371 s (`s-3.jsonl`) = **591 s**; with a 1-minute cut-off
+the 114 s gap drops out of `s-3` → **477 s**. Human prompts: **4** (`h-1`, `h-2`, `h-3` once,
+`h-4` with no `origin`). Windows `2026-09-01 setup` / `2026-09-17 round 1` /
+`2026-09-18T02:00 wrap-up`: setup 5 msgs 38527 headline; round 1 13 msgs 61357; wrap-up 4
+captured + 6 `s-3` msgs = 10, 10557 headline, 427 s, 4 prompts. Rates
+`claude-fable-* 2/2.5/0.2/10` + `* 1/1/0.1/5` per Mtok on the captured pair: 0.7557847 +
+0.1674406 = 0.9232253.
diff --git a/tests/wave2/fixtures/token-burn/effort/s-3.jsonl b/tests/wave2/fixtures/token-burn/effort/s-3.jsonl
new file mode 100644
index 00000000..276bdf14
--- /dev/null
+++ b/tests/wave2/fixtures/token-burn/effort/s-3.jsonl
@@ -0,0 +1,19 @@
+{"type":"user","sessionId":"s-3","uuid":"h-1","parentUuid":null,"isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:00:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-1","parentUuid":"h-1","isSidechain":false,"timestamp":"2026-09-20T10:00:05.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e1","type":"message","role":"assistant","content":[{"type":"tool_use","id":"tu-1","name":"Tool","input":{}}],"usage":{"input_tokens":100,"cache_creation_input_tokens":1000,"cache_read_input_tokens":10000,"output_tokens":50}}}
+{"type":"user","sessionId":"s-3","uuid":"t-1","parentUuid":"a-1","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:00:06.000Z","cwd":"/srv/example/proj","toolUseResult":"[scrubbed]","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"tu-1","content":"[scrubbed]"}]}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-2","parentUuid":"t-1","isSidechain":false,"timestamp":"2026-09-20T10:01:06.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e2","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":10,"cache_creation_input_tokens":0,"cache_read_input_tokens":20000,"output_tokens":200}}}
+{"type":"user","sessionId":"s-3","uuid":"n-1","parentUuid":"a-2","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:03:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"task-notification"},"promptSource":"system","message":{"role":"user","content":"<scrubbed>"}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-3","parentUuid":"n-1","isSidechain":false,"timestamp":"2026-09-20T10:03:10.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e3","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":5,"cache_creation_input_tokens":500,"cache_read_input_tokens":0,"output_tokens":30}}}
+{"type":"user","sessionId":"s-3","uuid":"h-2","parentUuid":"a-3","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:20:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":[{"type":"text","text":"[scrubbed]"}]}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-4","parentUuid":"h-2","isSidechain":false,"timestamp":"2026-09-20T10:20:30.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e4","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":1,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":1}}}
+{"type":"user","sessionId":"s-3","uuid":"m-1","parentUuid":"a-4","isSidechain":false,"userType":"external","isMeta":true,"timestamp":"2026-09-20T10:20:31.000Z","cwd":"/srv/example/proj","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"user","sessionId":"s-3","uuid":"h-3","parentUuid":"m-1","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:21:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"user","sessionId":"s-3","uuid":"h-3","parentUuid":"m-1","isSidechain":false,"timestamp":"2026-09-20T10:21:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-5","parentUuid":"h-3","isSidechain":false,"timestamp":"2026-09-20T10:21:20.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e5","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":2,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":2}}}
+{"type":"user","sessionId":"s-3","uuid":"c-1","parentUuid":"a-5","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:22:00.000Z","cwd":"/srv/example/proj","message":{"role":"user","content":"<scrubbed>"}}
+{"type":"user","sessionId":"s-3","uuid":"h-4","parentUuid":"c-1","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:22:30.000Z","cwd":"/srv/example/proj","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"user","sessionId":"s-3","uuid":"k-1","parentUuid":"h-4","isSidechain":false,"userType":"external","isCompactSummary":true,"timestamp":"2026-09-20T10:23:00.000Z","cwd":"/srv/example/proj","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-6","parentUuid":"k-1","isSidechain":false,"timestamp":"2026-09-20T10:23:10.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e6","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":3,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":3}}}
+{"type":"user","sessionId":"s-3","uuid":"p-1","parentUuid":"a-6","isSidechain":false,"userType":"external","isMeta":true,"timestamp":"2026-09-20T10:24:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"peer"},"promptSource":"system","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"user","sessionId":"s-3","uuid":"x-1","parentUuid":"p-1","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:24:10.000Z","cwd":"/srv/example/other","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":"[scrubbed]"}}
+{"type":"user","sessionId":"s-3","uuid":"s-1","parentUuid":null,"isSidechain":true,"userType":"external","timestamp":"2026-09-20T10:24:20.000Z","cwd":"/srv/example/proj","message":{"role":"user","content":"[scrubbed]"}}
diff --git a/tests/wave2/test-extraction-quality-report.sh b/tests/wave2/test-extraction-quality-report.sh
new file mode 100755
index 00000000..7da2f4e7
--- /dev/null
+++ b/tests/wave2/test-extraction-quality-report.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# test-extraction-quality-report.sh — bin/extraction-report.sh reads the validator's
+# extraction-quality*.json (#151) and renders one row per dimension the file declares.
+#
+# GOLDEN INPUT. No extraction-quality.json exists anywhere in this repo: none of the three
+# pipelines ships a validator, so there is no captured sample output to pin. The input here is
+# the example object in skills/extractor-quality-loop.md "Output Format" — read out of the skill
+# at run time, never copied, so the fixture follows the documented contract if the skill moves.
+# Variants (self-graded, process-model dimensions, 0/0, broken) are mutations of that object.
+# A captured validator output from a field run is still owed.
+#
+#   Q1  documents KB, no score file → section `skipped`, no new fault (existing projects)
+#   Q2  the skill's example at analysis/<src>/extraction-quality.json → read, 6 rows, not
+#       passed → `manual`; figures on the page (score, found/expected, gaps, confirmed zero)
+#   Q3  analysis/<src>/extracted/extraction-quality-<name>.json with the stack's OWN dimension
+#       keys, selfGraded + passed → `fault` "self-graded pass"
+#   Q4  code-extracted KB, no score file → `fault` (the loop is mandatory for an extractor)
+#   Q5  the score file inside <kb>/extracted/ is not counted as an unparseable item file
+#   Q6  a 0/0 dimension not in confirmedZeros → fault; the example's confirmed one is not
+#   Q7  passed:true under its own threshold → fault; broken JSON → fault, page still rendered
+#
+# usage: bash tests/wave2/test-extraction-quality-report.sh /path/to/extraction-report.sh
+
+set -uo pipefail
+SUT="${1:?usage: test-extraction-quality-report.sh /path/to/extraction-report.sh}"
+case "$SUT" in /*) ;; *) SUT="$PWD/$SUT" ;; esac
+TOOLKIT="$(cd "$(dirname "$SUT")/.." && pwd)"
+SKILL="$TOOLKIT/skills/extractor-quality-loop.md"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/eqr.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n     %s\n' "$1" "${2:-}"; }
+has()   { case "$2" in *"$3"*) ok "$1" ;; *) bad "$1" "missing '$3'" ;; esac; }
+hasnt() { case "$2" in *"$3"*) bad "$1" "unexpected '$3'" ;; *) ok "$1" ;; esac; }
+
+# shellcheck disable=SC1091
+. "$TOOLKIT/bin/lib/portable.sh"
+require_py
+
+# the documented example, straight out of the skill
+EXAMPLE="$WORK/example.json"
+awk '/^## Output Format: extraction-quality.json/{f=1;next} f&&/^```json/{g=1;next} g&&/^```/{exit} g' "$SKILL" > "$EXAMPLE"
+"$PY" -c 'import json,sys; d=json.load(open(sys.argv[1])); assert len(d["dimensions"])==6' "$EXAMPLE" \
+  || { echo "could not read the example out of $SKILL"; exit 2; }
+
+mutate() {   # $1 in, $2 out, $3 statements over `d`
+  "$PY" -c 'import json,sys
+d=json.load(open(sys.argv[1]))
+exec(sys.argv[3])
+json.dump(d,open(sys.argv[2],"w"),indent=2)' "$1" "$2" "$3"
+}
+
+doc_kb() {   # a documents-provenance knowledge base
+  mkdir -p "$1/analysis/src/knowledge-base/share"
+  printf '# KB\n\nsomething\n' > "$1/analysis/src/knowledge-base/share/KB.md"
+  printf '# KB_a\n\nsomething\n' > "$1/analysis/src/knowledge-base/share/KB_a.md"
+}
+code_kb() {  # a code-extracted knowledge base (merger output + extracted/)
+  local kb="$1/analysis/src/knowledge-base"
+  mkdir -p "$kb/extracted"
+  printf '[{"name":"Order","module":"Sales"}]\n' > "$kb/entities.json"
+  printf '[{"name":"ACT_Save","module":"Sales"}]\n' > "$kb/logics.json"
+  printf '[{"name":"OrderEdit","module":"Sales"}]\n' > "$kb/screens.json"
+  printf '{"items":[{"type":"entity","name":"Order"},{"type":"logic","name":"ACT_Save"},{"type":"screen","name":"OrderEdit"}]}\n' > "$kb/extracted/a.json"
+}
+run() { bash "$SUT" "$1" "${@:2}" 2>&1; }
+jget() { "$PY" -c 'import json,sys
+d=json.loads(sys.stdin.read()); b=d["bases"][0]
+print(eval(sys.argv[1]))' "$1"; }
+
+# --- Q1 -------------------------------------------------------------------------------------
+P1="$WORK/p1"; doc_kb "$P1"
+J="$(run "$P1" --json)"
+[ "$(printf '%s' "$J" | jget 'b["sections"].get("extractionQuality")')" = skipped ] \
+  && ok "Q1 documents KB, no file → skipped" || bad "Q1 documents KB, no file → skipped" "$J"
+[ "$(printf '%s' "$J" | jget 'b["verdicts"]["fault"]')" = 0 ] && ok "Q1 no new fault" || bad "Q1 no new fault" "$J"
+
+# --- Q2 -------------------------------------------------------------------------------------
+P2="$WORK/p2"; doc_kb "$P2"; cp "$EXAMPLE" "$P2/analysis/src/extraction-quality.json"
+J="$(run "$P2" --json)"
+[ "$(printf '%s' "$J" | jget 'len(b["extractionQuality"][0]["rows"])')" = 6 ] && ok "Q2 six rows" || bad "Q2 six rows" "$J"
+[ "$(printf '%s' "$J" | jget 'b["extractionQuality"][0]["verdict"]')" = manual ] && ok "Q2 not passed → manual" || bad "Q2 not passed → manual" "$J"
+[ "$(printf '%s' "$J" | jget 'b["sections"]["quality:analysis/src/extraction-quality.json"]')" = manual ] \
+  && ok "Q2 section keyed by file" || bad "Q2 section keyed by file" "$J"
+H="$(cat "$P2/analysis/src/knowledge-base/extraction-report.html")"
+has "Q2 html section"        "$H" "<h2>Extraction quality</h2>"
+has "Q2 html dimension key"  "$H" ">entityFields<"
+has "Q2 html found/expected" "$H" "49 / 50"
+has "Q2 html gap text"       "$H" "User.avatar missing"
+has "Q2 html overall"        "$H" "Overall <strong>94.2</strong> against threshold <strong>95</strong>"
+has "Q2 html confirmed zero" "$H" "ts-ast, python-regex"
+O="$(run "$P2")"
+has "Q2 prose line" "$O" "quality analysis/src/extraction-quality.json: overall 94.2 / threshold 95, passed=False, selfGraded=no, 6 dimension(s)"
+
+# --- Q3 -------------------------------------------------------------------------------------
+P3="$WORK/p3"; doc_kb "$P3"; mkdir -p "$P3/analysis/src/extracted"
+mutate "$EXAMPLE" "$P3/analysis/src/extracted/extraction-quality-procmodel.json" '
+d["dimensions"]={k:{"score":100,"found":n,"expected":n,"gaps":[]} for k,n in
+  (("nodes",41),("transitions",57),("guards",12),("documentation",41),("diagramMembership",41),("labelRecall",88),("images",3))}
+d["overallScore"]=100; d["passed"]=True; d["selfGraded"]=True; d["confirmedZeros"]=[]'
+J="$(run "$P3" --json)"
+[ "$(printf '%s' "$J" | jget 'b["extractionQuality"][0]["verdict"]')" = fault ] && ok "Q3 self-graded pass → fault" || bad "Q3 self-graded pass → fault" "$J"
+[ "$(printf '%s' "$J" | jget 'len(b["extractionQuality"][0]["rows"])')" = 7 ] && ok "Q3 the file's own 7 dimensions" || bad "Q3 the file's own 7 dimensions" "$J"
+O="$(run "$P3")"
+has "Q3 prose FAULT names it" "$O" "self-graded pass"
+H="$(cat "$P3/analysis/src/knowledge-base/extraction-report.html")"
+has "Q3 html stack's own key" "$H" ">labelRecall<"
+
+# --- Q4 / Q5 --------------------------------------------------------------------------------
+P4="$WORK/p4"; code_kb "$P4"
+J="$(run "$P4" --json)"
+[ "$(printf '%s' "$J" | jget 'b["sections"].get("extractionQuality")')" = fault ] \
+  && ok "Q4 code-extracted, no file → fault" || bad "Q4 code-extracted, no file → fault" "$J"
+cp "$EXAMPLE" "$P4/analysis/src/knowledge-base/extracted/extraction-quality.json"
+J="$(run "$P4" --json)"
+hasnt "Q5 score file not read as an item array" "$J" "would not parse"
+[ "$(printf '%s' "$J" | jget 'b["extractionQuality"][0]["file"]')" = "analysis/src/knowledge-base/extracted/extraction-quality.json" ] \
+  && ok "Q5 found inside <kb>/extracted" || bad "Q5 found inside <kb>/extracted" "$J"
+
+# --- Q6 -------------------------------------------------------------------------------------
+P6="$WORK/p6"; doc_kb "$P6"
+mutate "$EXAMPLE" "$P6/analysis/src/extraction-quality.json" '
+d["dimensions"]["enumerations"].update(found=0, expected=0, score=100)
+d["dimensions"]["endpoints"].update(found=0, expected=0, score=100, gaps=[])'
+J="$(run "$P6" --json)"
+[ "$(printf '%s' "$J" | jget '[r["flag"] for r in b["extractionQuality"][0]["rows"] if r["dimension"]=="endpoints"][0]')" = "unconfirmed zero" ] \
+  && ok "Q6 unconfirmed 0/0 flagged" || bad "Q6 unconfirmed 0/0 flagged" "$J"
+[ "$(printf '%s' "$J" | jget '[r["flag"] for r in b["extractionQuality"][0]["rows"] if r["dimension"]=="enumerations"][0]')" = "" ] \
+  && ok "Q6 confirmed 0/0 not flagged" || bad "Q6 confirmed 0/0 not flagged" "$J"
+[ "$(printf '%s' "$J" | jget 'b["extractionQuality"][0]["verdict"]')" = fault ] && ok "Q6 → fault" || bad "Q6 → fault" "$J"
+
+# --- Q7 -------------------------------------------------------------------------------------
+P7="$WORK/p7"; doc_kb "$P7"; mkdir -p "$P7/analysis/src/extracted"
+mutate "$EXAMPLE" "$P7/analysis/src/extraction-quality.json" 'd["passed"]=True'
+printf '{"overallScore": 9' > "$P7/analysis/src/extracted/extraction-quality-broken.json"
+J="$(run "$P7" --json)"; RC=$?
+[ "$RC" = 0 ] && ok "Q7 exit 0 (a fault is information)" || bad "Q7 exit 0" "rc=$RC"
+[ "$(printf '%s' "$J" | jget 'sorted(q["verdict"] for q in b["extractionQuality"])')" = "['fault', 'fault']" ] \
+  && ok "Q7 under-threshold pass and broken file both fault" || bad "Q7 both fault" "$J"
+has "Q7 contradiction named" "$J" "under the file's own threshold 95"
+[ -s "$P7/analysis/src/knowledge-base/extraction-report.html" ] && ok "Q7 page still rendered" || bad "Q7 page still rendered"
+
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" = 0 ]
diff --git a/tests/wave2/test-token-burn.sh b/tests/wave2/test-token-burn.sh
index f25bfab7..f815b083 100755
--- a/tests/wave2/test-token-burn.sh
+++ b/tests/wave2/test-token-burn.sh
@@ -4,8 +4,8 @@
 # scrubbed, and the expected sums computed independently of the instrument.
 #
 #   T1  no transcript tree → NOT AVAILABLE in brief, screen and json (available:false), exit 0
-#   T2  --json: per-model arrays to the token; 52 records dedupe to 22 messages; 1 synthetic
-#       skipped; 2 files; subagent headline 59858
+#   T2  --json: per-model arrays to the token, usage from each id's LAST record; 52 records dedupe to 22 messages; 1 synthetic
+#       skipped; 2 files; subagent headline 61357
 #   T3  the two-tree layout: records whose cwd is <root>/app count — moving them out of the
 #       project drops the message count from 22 to 21
 #   T4  --brief: the exact "Tokens this stage:" line for stage 2
@@ -13,6 +13,14 @@
 #   T6  no PROJECT.md → every day UNMAPPED; brief prints the project total and says why
 #   T7  a foreign slug dir only → NOT AVAILABLE with the --scan-all hint; --scan-all finds it
 #   T8  the ancestor slug dir (session launched in the parent) is read by default
+#   --- #296: opt-in cost / agent time / human prompts / windows ---
+#   T9  without the new flags nothing new appears (screen + json; T1-T8 pin the rest)
+#   T10 --rates: per-Mtok cost from a rates file, main vs subagent, a `*` catch-all
+#   T11 --rates with no line for a model: INCOMPLETE, total marked `+`, complete:false — never 0
+#   T12 --effort: agent working time and human prompt count over the captured main thread plus
+#       effort/s-3.jsonl (every user-record class); --gap changes the cut-off
+#   T13 --windows: per-window messages, headline, agent time, prompts
+#   T14 malformed --rates / --windows file → exit 1 with the line number
 #
 #   tests/wave2/test-token-burn.sh /path/to/token-burn.sh
 
@@ -63,12 +71,13 @@ has "T1 json available:false" "$OUT" '"available": false'
 # per-model array can be pinned as one literal (no python here — check-portability)
 J="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --json 2>&1 | tr -d '\n' | tr -s ' ' | sed 's/\[ /[/g; s/ \]/]/g')"
 has "T2 fable-5-1 array" "$J" '"claude-fable-5-1": [288, 31365, 2607781, 15524, 9]'
-has "T2 sonnet-5 array"  "$J" '"claude-sonnet-5": [26, 59772, 998476, 60, 13]'
+# the subagent model's array, matched by its numbers (the model id is the captured one, see CAPTURE.md)
+echo "$J" | grep -Eq '"claude-[a-z]+-5": \[26, 59772, 998476, 1559, 13\]' && ok "T2 subagent-model array (LAST record per id: output 1559, the first record says 60)" || bad "T2 subagent-model array" "$J"
 has "T2 22 messages"     "$J" '"messages": 22'
 has "T2 52 records (dedupe)" "$J" '"records": 52'
 has "T2 1 synthetic"     "$J" '"synthetic_skipped": 1'
 has "T2 2 files"         "$J" '"files": 2'
-has "T2 subagent headline" "$J" '"subagents": 59858'
+has "T2 subagent headline (59858 when the first record was kept)" "$J" '"subagents": 61357'
 has "T2 main headline"   "$J" '"main": 47177'
 has "T2 current stage"   "$J" '"current_stage": "2"'
 
@@ -81,7 +90,7 @@ has "T3 app/ records counted (22 -> 21 once moved out of the root)" "$J3" '"mess
 
 # --- T4: brief -----------------------------------------------------------------------------
 B="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --brief 2>&1)"
-[ "$B" = "Tokens this stage: 69k (sonnet-5 87% · fable-5-1 13% · 1438k cache-read · 2 days · stage 2)" ] \
+printf '%s\n' "$B" | grep -Eqx 'Tokens this stage: 70k \([a-z]+-5 88% · fable-5-1 12% · 1438k cache-read · 2 days · stage 2\)' \
   && ok "T4 brief line exact" || bad "T4 brief line exact" "$B"
 
 # --- T5: screen -----------------------------------------------------------------------------
@@ -89,10 +98,10 @@ S="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" 2>&1)"
 has "T5 synthetic skipped" "$S" "1 synthetic skipped"
 has "T5 22 messages from 52 records" "$S" "22 messages (from 52 records"
 has "T5 current stage line" "$S" "register says current stage 2"
-has "T5 subagent share" "$S" "subagents (Agent tool): 60k of headline (56%)"
+has "T5 subagent share" "$S" "subagents (Agent tool): 61k of headline (57%)"
 # the caveat line legitimately explains what UNMAPPED means; no day or stage row may carry it
 hasnt "T5 no UNMAPPED row" "$(echo "$S" | grep -v '^  caveat:')" "UNMAPPED"
-echo "$S" | grep -Eq '^ *2 +2 +69k +1438k +17 ' && ok "T5 stage-2 row" || bad "T5 stage-2 row" "$(echo "$S" | grep -E '^ *2 ' | head -3)"
+echo "$S" | grep -Eq '^ *2 +2 +70k +1438k +17 ' && ok "T5 stage-2 row" || bad "T5 stage-2 row" "$(echo "$S" | grep -E '^ *2 ' | head -3)"
 echo "$S" | grep -Eq '^ *1 +1 +39k +2168k +5 ' && ok "T5 stage-1 row" || bad "T5 stage-1 row" "$(echo "$S" | grep -E '^ *1 ' | head -3)"
 
 # --- T6: no PROJECT.md ----------------------------------------------------------------------
@@ -103,7 +112,7 @@ sed "s#/srv/example/proj#$P6#g" "$FIX/transcripts/s-1/subagents/agent-1.jsonl" >
 S6="$(CLAUDE_CONFIG_DIR="$CFG6" bash "$SUT" "$P6" 2>&1)"
 has "T6 screen UNMAPPED" "$S6" "UNMAPPED"
 B6="$(CLAUDE_CONFIG_DIR="$CFG6" bash "$SUT" "$P6" --brief 2>&1)"
-has "T6 brief falls back to the project total" "$B6" "Tokens this stage: 107k ("
+has "T6 brief falls back to the project total" "$B6" "Tokens this stage: 109k ("
 has "T6 brief says why" "$B6" "no Current stage line in PROJECT.md"
 
 # --- T7: foreign slug only ------------------------------------------------------------------
@@ -119,5 +128,73 @@ CFG8="$WORK/claude8"; install_tree "$CFG8" "$(slug "$WORK")"
 J8="$(CLAUDE_CONFIG_DIR="$CFG8" bash "$SUT" "$P" --json 2>&1)"
 has "T8 ancestor dir read by default" "$J8" '"messages": 22'
 
+# --- #296 ----------------------------------------------------------------------------------
+fold() { tr -d '\n' | tr -s ' ' | sed 's/\[ /[/g; s/ \]/]/g'; }
+
+# T9: unchanged without the flags
+hasnt "T9 screen has no COST section" "$S" "COST ("
+hasnt "T9 screen has no agent time" "$S" "agent working time"
+hasnt "T9 screen has no WINDOWS section" "$S" "WINDOWS ("
+hasnt "T9 json has no cost key" "$J" '"cost":'
+hasnt "T9 json has no effort key" "$J" '"effort":'
+hasnt "T9 json has no windows key" "$J" '"windows":'
+
+# T10: rates (made-up prices — the instrument carries none of its own)
+RATES="$WORK/rates.txt"
+printf '%s\n' '# test rates, per Mtok' 'currency EUR' 'claude-fable-*  2.00  2.50  0.20  10.00' '*  1.00  1.00  0.10  5.00' > "$RATES"
+J10="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --json --rates "$RATES" 2>&1 | fold)"
+has "T10 total 0.9232"      "$J10" '"total": 0.9232'
+has "T10 main 0.7558"       "$J10" '"main": 0.7558'
+has "T10 subagents 0.1674"  "$J10" '"subagents": 0.1674'
+has "T10 complete"          "$J10" '"complete": true'
+has "T10 currency"          "$J10" '"currency": "EUR"'
+has "T10 tokens unchanged"  "$J10" '"messages": 22'
+S10="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --rates "$RATES" 2>&1)"
+echo "$S10" | grep -Eq '^TOTAL +0\.92$' && ok "T10 screen total" || bad "T10 screen total" "$(echo "$S10" | grep '^TOTAL')"
+has "T10 subagent cost line" "$S10" "subagents (Agent tool): 0.17 EUR of 0.92"
+B10="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --brief --rates "$RATES" 2>&1)"
+[ "$B10" = "$B" ] && ok "T10 --brief unchanged by --rates" || bad "T10 --brief unchanged by --rates" "$B10"
+
+# T11: a model with no rate line
+R11="$WORK/rates-partial.txt"; printf '%s\n' 'claude-fable-*  2.00  2.50  0.20  10.00' > "$R11"
+J11="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --json --rates "$R11" 2>&1 | fold)"
+has "T11 complete:false" "$J11" '"complete": false'
+has "T11 priced part only" "$J11" '"total": 0.7558'
+S11="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --rates "$R11" 2>&1)"
+has "T11 INCOMPLETE named" "$S11" "INCOMPLETE — no rate line matches"
+echo "$S11" | grep -Eq '^TOTAL +0\.76\+$' && ok "T11 total marked +" || bad "T11 total marked +" "$(echo "$S11" | grep '^TOTAL')"
+
+# T12: effort — captured main thread + the user-record classes in effort/s-3.jsonl
+CFG12="$WORK/claude12"; install_tree "$CFG12" "$(slug "$P")"
+sed "s#/srv/example/proj#$P#g" "$FIX/effort/s-3.jsonl" > "$CFG12/projects/$(slug "$P")/s-3.jsonl"
+J12="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --json --effort 2>&1 | fold)"
+has "T12 4 human prompts (dup uuid once; meta, notification, peer, compact, tool result, <wrapper>, sidechain, foreign cwd excluded)" "$J12" '"human_prompts": 4'
+has "T12 agent seconds 591 (220 captured + 371)" "$J12" '"agent_seconds": 591'
+S12="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --effort 2>&1)"
+has "T12 screen line" "$S12" "agent working time: 0h 10m (main thread, gaps <= 5 min, gaps ending at a human prompt excluded) · human prompts: 4"
+J12g="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --json --gap 1 2>&1 | fold)"
+has "T12 --gap 1 cuts the 114 s gap (477)" "$J12g" '"agent_seconds": 477'
+
+# T13: windows
+WIN="$WORK/windows.txt"
+printf '%s\n' '# round boundaries' '2026-09-01 setup' '2026-09-17 round 1' '2026-09-18T02:00 wrap-up' > "$WIN"
+S13="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --windows "$WIN" --rates "$RATES" 2>&1)"
+echo "$S13" | grep -Eq '^setup +2026-09-01 +5 +39k +2168k +[0-9.]+ +0h 03m +0$' && ok "T13 setup row" || bad "T13 setup row" "$(echo "$S13" | grep '^setup')"
+echo "$S13" | grep -Eq '^round 1 +2026-09-17 +13 +61k +998k +[0-9.]+ +0h 00m +0$' && ok "T13 round 1 row" || bad "T13 round 1 row" "$(echo "$S13" | grep '^round 1')"
+echo "$S13" | grep -Eq '^wrap-up +2026-09-18T02:00 +10 +11k +[0-9]+k +[0-9.]+ +0h 07m +4$' && ok "T13 wrap-up row" || bad "T13 wrap-up row" "$(echo "$S13" | grep '^wrap-up')"
+hasnt "T13 no empty before-first row" "$S13" "(before first window)"
+J13="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --json --windows "$WIN" 2>&1 | fold)"
+has "T13 json order" "$J13" '"order": ["setup", "round 1", "wrap-up"]'
+has "T13 json wrap-up agent seconds 427" "$J13" '"agent_seconds": 427'
+
+# T14: malformed config files are usage errors
+printf '%s\n' 'claude-fable-* 2 2.5' > "$WORK/bad-rates.txt"
+OUT="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --rates "$WORK/bad-rates.txt" 2>&1)"; RC=$?
+[ "$RC" = 1 ] && ok "T14 bad rates exit 1" || bad "T14 bad rates exit 1" "rc=$RC"
+has "T14 bad rates names the line" "$OUT" "bad-rates.txt:1:"
+printf '%s\n' 'next tuesday round 2' > "$WORK/bad-win.txt"
+OUT="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --windows "$WORK/bad-win.txt" 2>&1)"; RC=$?
+[ "$RC" = 1 ] && ok "T14 bad windows exit 1" || bad "T14 bad windows exit 1" "rc=$RC"
+
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" = 0 ]

From 57bf81b9d265388c24d57101aee495cd03e2175f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:20:27 +0000
Subject: [PATCH 45/68] report: read per-BRD conformance reports
 (report-<date>-<BRD>.tsv)

conformance-check now writes one report per BRD (#307), but
report-normalize.js kept only report-<date>.tsv, so per-BRD modules never
reached report.json and a stale base file could read as measured. It now
takes the newest date among report-<date>[-<BRD>].tsv and concatenates
every file of that date; single-file projects are unchanged.
pickConformanceFiles is exported; --selftest cases and case 3 of
test-report-normalize-two-tree.sh (fails on master: reads the stale file).

Also: the new fixtures use here-strings instead of `printf | grep -q`,
which under pipefail can SIGPIPE and flip a check (seen once under load).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-tests/e2e/report-normalize.js         | 61 +++++++++++++------
 skills/report-schema.md                       |  3 +
 tests/wave2/test-journey-preflight.sh         |  2 +-
 tests/wave2/test-report-normalize-two-tree.sh | 20 +++++-
 tests/wave2/test-validate-journeys-spans.sh   | 14 ++---
 6 files changed, 75 insertions(+), 27 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d9cf912..7f103734 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date and aggregates every file of that date; single-file projects are unchanged (`--selftest` cases plus case 3 of `test-report-normalize-two-tree.sh`). Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index f6400ce4..21b8e895 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -1366,7 +1366,7 @@ function collectLoop(summaries) {
 }
 
 // ============================================================================
-// SOURCE 4 — docs/conformance/report-<date>.tsv (newest by filename)
+// SOURCE 4 — docs/conformance/report-<date>[-<BRD>].tsv (newest date by filename, all BRDs)
 // ============================================================================
 function collectConformance(input, ctx) {
   const checks = [];
@@ -1430,6 +1430,17 @@ function collectConformance(input, ctx) {
   };
 }
 
+// Which conformance files make up the newest run: the newest date among report-<date>.tsv
+// and report-<date>-<BRD>.tsv, and every file of that date (sorted). A per-BRD run and an
+// older single-file run never mix: only the newest date is read.
+function pickConformanceFiles(names) {
+  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-[A-Za-z0-9_.-]+)?\.tsv$/;
+  const hits = names.map(n => [n, re.exec(n)]).filter(([, m]) => m);
+  if (!hits.length) return { date: null, files: [] };
+  const date = hits.map(([, m]) => m[1]).sort().pop();
+  return { date, files: hits.filter(([, m]) => m[1] === date).map(([n]) => n).sort() };
+}
+
 // ============================================================================
 // SOURCE 5 — architecture/modules/*/coverage-ledger.md
 // ============================================================================
@@ -2440,21 +2451,24 @@ function loadInputs(outFile) {
     return { module: mod, file: readFileInput(rel), mtime };
   });
 
-  // Newest conformance report BY FILENAME — the names are ISO dates, so lexical sort
-  // is chronological, and mtime would reorder on a git checkout.
-  let confRel = null, confDate = null;
-  try {
-    const files = fs.readdirSync(abs(INPUTS.conformanceDir))
-      .filter(f => /^report-\d{4}-\d{2}-\d{2}\.tsv$/.test(f)).sort();
-    if (files.length) {
-      confRel = `${INPUTS.conformanceDir}/${files[files.length - 1]}`;
-      confDate = files[files.length - 1].slice(7, 17);
-    }
-  } catch { /* handled below */ }
-  const conformance = confRel
-    ? readFileInput(confRel)
-    : { status: 'missing', path: `${INPUTS.conformanceDir}/report-<date>.tsv`,
-        error: 'no report-<date>.tsv found' };
+  // Newest conformance report date BY FILENAME — the names are ISO dates, so lexical sort
+  // is chronological, and mtime would reorder on a git checkout. Every file of that date is
+  // read: the single report-<date>.tsv and/or the per-BRD report-<date>-<BRD>.tsv files
+  // conformance-check writes (one per BRD); their rows are concatenated.
+  let confPick = { date: null, files: [] };
+  try { confPick = pickConformanceFiles(fs.readdirSync(abs(INPUTS.conformanceDir))); }
+  catch { /* handled below */ }
+  const confDate = confPick.date;
+  let conformance;
+  if (!confPick.files.length) {
+    conformance = { status: 'missing', path: `${INPUTS.conformanceDir}/report-<date>.tsv`,
+                    error: 'no report-<date>.tsv or report-<date>-<BRD>.tsv found' };
+  } else {
+    const parts = confPick.files.map(n => readFileInput(`${INPUTS.conformanceDir}/${n}`));
+    const broken = parts.find(p => p.status !== 'ok');
+    conformance = broken || (parts.length === 1 ? parts[0]
+      : { status: 'ok', path: parts.map(p => p.path).join(', '), text: parts.map(p => p.text).join('\n') });
+  }
 
   const ledgers = listDirs(INPUTS.modulesDir)
     .map(mod => ({ module: mod, file: readFileInput(`${INPUTS.modulesDir}/${mod}/coverage-ledger.md`) }))
@@ -2622,6 +2636,19 @@ function selftest() {
   t('a setup row is kind "setup", not "ui"',
     jSetup.checks.filter(c => c.id === 'journey/_/preflight-admin').map(c => c.kind), ['setup']);
 
+  // Conformance: newest date wins; per-BRD files of that date are all read; single file unchanged.
+  t('one base file → that file', pickConformanceFiles(['report-2026-10-01.tsv', 'notes.md']),
+    { date: '2026-10-01', files: ['report-2026-10-01.tsv'] });
+  t('per-BRD files of the newest date, all of them; a stale older base file is ignored',
+    pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F002.tsv', 'report-2026-10-12-F001.tsv', 'report-2026-10-01-F001.tsv']),
+    { date: '2026-10-12', files: ['report-2026-10-12-F001.tsv', 'report-2026-10-12-F002.tsv'] });
+  t('no report files → none', pickConformanceFiles(['readme.txt']), { date: null, files: [] });
+  const confMulti = normalize({ ...base, conformance: { status: 'ok', path: 'a, b',
+    text: 'module\tpointer\tstored\tobserved\tverdict\nOrders\t/x\t1\t1\tOK\n' +
+          '\nmodule\tpointer\tstored\tobserved\tverdict\nBilling\t/y\t2\t3\tSTALE\n' } });
+  t('concatenated per-BRD reports yield both modules',
+    confMulti.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance').map(c => c.module).sort(), ['Billing', 'Orders']);
+
   // An aborted run (preflight / signal) is kept but is never a result.
   const jAb = normalize({ ...base, journeyFindings: { status: 'ok', path: 'journey-findings.json',
     data: { capturedAt: '2026-01-01T00:00:00Z', positiveControl: false, aborted: 'preflight',
@@ -3122,5 +3149,5 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { normalize, normReq, declaredChecks, parseLedger,
+module.exports = { normalize, normReq, declaredChecks, parseLedger, pickConformanceFiles,
                    V_JOURNEY, V_LOOP, V_WALK, V_CONF, selftest };
diff --git a/skills/report-schema.md b/skills/report-schema.md
index 3148b9fe..29365c6f 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -143,6 +143,9 @@ any real project. The **Deriving the values** section says where each one actual
     { "name": "positive-control", "verdict": "fault",   "reason": "not requested (--positive-control absent)" },
     { "name": "monkey",           "verdict": "skipped", "reason": "--skip-monkey" },
     { "name": "conformance",      "verdict": "pass",    "log": "docs/conformance/report-<date>.tsv" }
+      // conformance reads the NEWEST date among report-<date>.tsv and the per-BRD
+      // report-<date>-<BRD>.tsv files, and every file of that date (rows concatenated;
+      // "log" then lists them comma-separated). An older date is never mixed in.
   ],
 
   // Rollups have denominators, so they are not checks.
diff --git a/tests/wave2/test-journey-preflight.sh b/tests/wave2/test-journey-preflight.sh
index ba8755b9..c4848aa1 100755
--- a/tests/wave2/test-journey-preflight.sh
+++ b/tests/wave2/test-journey-preflight.sh
@@ -396,7 +396,7 @@ PROJ_CFG="$WORK/tests/e2e/project.config.js"; cp "$PROJ_CFG" "$WORK/cfg.bak"
 sed -e "s/^const DEFAULT_PASS = '.*';/const DEFAULT_PASS = 'fixture-project-pass';/" "$WORK/cfg.bak" > "$PROJ_CFG"
 E2EOUT="$(cd "$WORK/tests/e2e" && env -u TEST_PASS -u APP_PASS -u ALLOW_CONFIG_CREDENTIALS -u M2EE_ADMIN_PORT APP_PORT=1 M2EE_ADMIN_PASS="$MARK" \
           MXCLI="$WORK/stub/mxcli" STUB_ARGV="$WORK/argv" node journey-runner.js "$J/J-one.journey.json" 2>&1)"; RC=$?
-printf '%s\n' "$E2EOUT" | grep -q 'SETUP  credentials' && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
+grep -q 'SETUP  credentials' <<< "$E2EOUT" && bad "project-set password refused" "$E2EOUT" || ok "no credentials refusal"
 [ -f "$WORK/argv" ] && ok "went on to the admin probe (the stub answers 403 → exit $RC)" || bad "probe never ran" "$E2EOUT"
 cp "$WORK/cfg.bak" "$PROJ_CFG"
 
diff --git a/tests/wave2/test-report-normalize-two-tree.sh b/tests/wave2/test-report-normalize-two-tree.sh
index f8bcea97..203581ae 100644
--- a/tests/wave2/test-report-normalize-two-tree.sh
+++ b/tests/wave2/test-report-normalize-two-tree.sh
@@ -9,7 +9,8 @@
 # step then showed 8 of 9 instruments FAULT ("design-audit.json does not exist", "no
 # coverage-ledger.md under architecture/modules/*/") over artefacts that were on disk, and wrote
 # the report into a stray app/docs/report.json — so the render step found nothing to render.
-# Case 1 is that shape in miniature; case 2 is the single-tree regression guard.
+# Case 1 is that shape in miniature; case 2 is the single-tree regression guard; case 3 reads
+# per-BRD conformance reports (report-<date>-<BRD>.tsv, PR #307).
 #
 # The artefacts here are SYNTHETIC and minimal. That is deliberate and allowed: the field-proof
 # rule's "golden input is captured" governs parsers of tool output, and nothing below exercises a
@@ -91,6 +92,23 @@ else
   bad "single tree: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out2" | cut -c1-300)"
 fi
 
+# --- 3. per-BRD conformance reports (conformance-check writes report-<date>-<BRD>.tsv) ---------
+# The newest date wins and every BRD file of that date is read; an older single-file report is
+# not mixed in (it used to be the ONLY file read, shown as measured although stale).
+P="$WORK/perbrd"; lay_out "$P" "$P"
+rm -f "$P/docs/conformance/"report-*.tsv
+printf 'module\tclaim\tstored\tobserved\tverdict\nStale\t/old\t1\t1\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
+printf 'module\tclaim\tstored\tobserved\tverdict\nOrders\t/useCases\t3\t3\tOK\n' > "$P/docs/conformance/report-2026-10-12-F001.tsv"
+printf 'module\tclaim\tstored\tobserved\tverdict\nBilling\t/pages\t2\t4\tUNDERSTATED\n' > "$P/docs/conformance/report-2026-10-12-F002.tsv"
+( cd "$P/tests/e2e" && node report-normalize.js --out docs/report.json ) >"$WORK/out3" 2>&1
+if [ -s "$P/docs/report.json" ]; then
+  mods="$(node -e 'const r=require(process.argv[1]); console.log(r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance").map(c=>c.module).sort().join(","))' "$P/docs/report.json")"
+  [ "$mods" = "Billing,Orders" ] && ok "per-BRD reports of the newest date are all read (Billing, Orders); the older single file is not" \
+    || bad "per-BRD conformance reports not aggregated" "$mods"
+else
+  bad "per-BRD: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out3" | cut -c1-300)"
+fi
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-validate-journeys-spans.sh b/tests/wave2/test-validate-journeys-spans.sh
index 0c55ee6c..30ba6a2a 100644
--- a/tests/wave2/test-validate-journeys-spans.sh
+++ b/tests/wave2/test-validate-journeys-spans.sh
@@ -58,18 +58,18 @@ for c in negonly negempty negdecl positive; do
   [ "$RC" -eq 0 ] && ok "$c → no problems" || bad "$c rejected" "$OUT"
 done
 run negonly
-printf '%s' "$OUT" | grep -q 'NEVER checked' && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
+grep -q 'NEVER checked' <<< "$OUT" && bad "still claims the negative-only claim is never checked" "$OUT" || ok "no 'NEVER checked' message"
 
 echo "== T2: what the runner cannot read is still a problem =="
-run nothing; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'declares nothing the runner reads'; } \
+run nothing; { [ "$RC" -eq 1 ] && grep -q 'declares nothing the runner reads' <<< "$OUT"; } \
   && ok "empty spans block → problem, says the runner records it INVALID" || bad "empty spans block accepted" "$OUT"
-printf '%s' "$OUT" | grep -q 'records it INVALID' && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
-run legacy; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'is an array — the old shape'; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
-run livenum; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'liveness: must be a non-empty string'; } \
+grep -q 'records it INVALID' <<< "$OUT" && ok "message matches the runner's loud INVALID" || bad "message does not mention INVALID" "$OUT"
+run legacy; { [ "$RC" -eq 1 ] && grep -q 'is an array — the old shape' <<< "$OUT"; } && ok "array-shaped spans → problem naming the old shape" || bad "legacy array shape accepted or not named" "$OUT"
+run livenum; { [ "$RC" -eq 1 ] && grep -q 'liveness: must be a non-empty string' <<< "$OUT"; } \
   && ok "liveness of the wrong type → problem" || bad "bad liveness accepted" "$OUT"
-run livepos; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'only read for a negative-only claim'; } \
+run livepos; { [ "$RC" -eq 1 ] && grep -q 'only read for a negative-only claim' <<< "$OUT"; } \
   && ok "liveness beside ordered → problem (never read)" || bad "unread liveness accepted" "$OUT"
-run badre; { [ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q 'not a valid regex'; } \
+run badre; { [ "$RC" -eq 1 ] && grep -q 'not a valid regex' <<< "$OUT"; } \
   && ok "mustNotFire that is not a regex → problem" || bad "invalid regex accepted" "$OUT"
 
 echo "== T3: the validator's own selftest =="

From 8fc7c6a9dec8db953e25b46fb79a6e9d93f59b1d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:21:05 +0000
Subject: [PATCH 46/68] Address re-review on #307: directory ledgers, log
 field, warning fixture

- agents/review-agent.md: the sweep faults on empty refs or refs with no
  RefKind, not on missing call edges.
- verify-module.sh: resolve_ledger_hint accepts a directory LEDGER_FILE and
  a module with only the per-BRD directory, instead of falling back to
  architecture/coverage-ledger.md. test-verify-ledger-hint.sh (4).
- review-module.sh: a module with only <M>/coverage-ledger/*.md is a ledger
  (conformance and coverage rungs, BRD names read from the per-BRD files);
  the reuse log/summary field names the report files actually read.
  test-review-conformance-per-brd.sh case 1b (6 checks).
- graph-sweep.sh: fixture for the "no orphan-read kinds" WARNING branch and
  its absence when an action edge exists (test-catalog-edge-guard.sh, 20).
- CHANGELOG: per-BRD reports reach docs/report.json via #310.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  4 +-
 agents/review-agent.md                        |  4 +-
 project-bin/review-module.sh                  | 28 +++++----
 project-bin/verify-module.sh                  | 12 +++-
 tests/wave2/test-catalog-edge-guard.sh        | 20 ++++++-
 .../wave2/test-review-conformance-per-brd.sh  | 18 ++++++
 tests/wave2/test-verify-ledger-hint.sh        | 59 +++++++++++++++++++
 7 files changed, 128 insertions(+), 17 deletions(-)
 create mode 100755 tests/wave2/test-verify-ledger-hint.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 61aa3bb2..64fe5e10 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(graph-sweep, app-facts): **the catalog guard checks the refs table, not the `build_mode` label; mxcli v0.24+ labels a complete catalog `source` and both scripts refused every one** ([#259](https://github.com/MendixMau/mxcli-project-toolkit/issues/259)). Field report: four module reviews recorded the sweep as "Instrument FAULT" on a fresh catalog with 5,368 refs rows. Now only an empty or kind-less refs table FAULTs, naming the mode and the per-kind edge counts; a model with no microflow-to-microflow calls (reached only from pages and buttons) still sweeps, and graph-sweep warns when no orphan-read kind is present. `manifest.json` records the real mode. `tests/wave2/test-catalog-edge-guard.sh` (16 checks, both layouts) fails 14 on master's scripts, including the verbatim FAULT line. Synthetic catalogs; a field run on a v0.24 project is still owed. — AlvinnYeo
-- fix(conformance-check, review-module, verify-module, coverage-ledger): **per-BRD ledgers (`<Module>/coverage-ledger/<BRD>.md`) are all measured, one report per BRD, review/verify read every report of the run, and an index file is named as one instead of "0 measurable rows"** ([#260](https://github.com/MendixMau/mxcli-project-toolkit/issues/260)). Field report: every module with an index ended in `FAULT: 0 measurable rows extracted from 1 ledger(s).`, while `LEDGER_FILE` on one per-BRD file measured 128 rows. `LEDGER_FILE` (file or directory) is in the usage text. **Upgrade notes:** (a) a `LEDGER_FILE` that does not exist now FAULTs instead of silently falling back to another ledger, and `verify-module.sh` reads `LEDGER_FILE` and passes it on to conformance through the environment, so a stale export now FAULTs the conformance rung; (b) baseline pointers of per-BRD rows are re-keyed `<BRD>:<pointer>`, so a project that had both a filled index and a per-BRD directory sees its old rows go unmatched and the new ones re-seeded as "newly baselined" on the first run after upgrade, with no regressions reported: run conformance once, then re-check. Fixtures: `test-conformance-per-brd-ledger.sh` (19, both layouts), `test-review-conformance-per-brd.sh` (4, both layouts), all failing on master. A field run on a per-BRD project is still owed. — AlvinnYeo
+- fix(graph-sweep, app-facts): **the catalog guard checks the refs table, not the `build_mode` label; mxcli v0.24+ labels a complete catalog `source` and both scripts refused every one** ([#259](https://github.com/MendixMau/mxcli-project-toolkit/issues/259)). Field report: four module reviews recorded the sweep as "Instrument FAULT" on a fresh catalog with 5,368 refs rows. Now only an empty or kind-less refs table FAULTs, naming the mode and the per-kind edge counts; a model with no microflow-to-microflow calls (reached only from pages and buttons) still sweeps, and graph-sweep warns when no orphan-read kind is present. `manifest.json` records the real mode. `tests/wave2/test-catalog-edge-guard.sh` (20 checks, both layouts) fails 16 on master's scripts, including the verbatim FAULT line. Synthetic catalogs; a field run on a v0.24 project is still owed. — AlvinnYeo
+- fix(conformance-check, review-module, verify-module, coverage-ledger): **per-BRD ledgers (`<Module>/coverage-ledger/<BRD>.md`) are all measured, one report per BRD, review/verify read every report of the run and accept a directory-only ledger, and an index file is named as one instead of "0 measurable rows"** ([#260](https://github.com/MendixMau/mxcli-project-toolkit/issues/260)). Field report: every module with an index ended in `FAULT: 0 measurable rows extracted from 1 ledger(s).`, while `LEDGER_FILE` on one per-BRD file measured 128 rows. `LEDGER_FILE` (file or directory) is in the usage text. **Upgrade notes:** (a) a `LEDGER_FILE` that does not exist now FAULTs instead of silently falling back to another ledger, and `verify-module.sh` reads `LEDGER_FILE` and passes it on to conformance through the environment, so a stale export now FAULTs the conformance rung; (b) baseline pointers of per-BRD rows are re-keyed `<BRD>:<pointer>`, so a project that had both a filled index and a per-BRD directory sees its old rows go unmatched and the new ones re-seeded as "newly baselined" on the first run after upgrade, with no regressions reported: run conformance once, then re-check. Per-BRD reports reach `docs/report.json` via #310, whose `report-normalize.js` filter is extended there (it reads only `report-<date>.tsv` today). Fixtures: `test-conformance-per-brd-ledger.sh` (19, both layouts), `test-review-conformance-per-brd.sh` (6, both layouts), `test-verify-ledger-hint.sh` (4), all failing on master. A field run on a per-BRD project is still owed. — AlvinnYeo
 - fix(verify-module): **a stack rung exit 4 from `test-stack-up.sh` (port held by another process) is an instrument FAULT, not a FINDING** — follow-up to [#313](https://github.com/MendixMau/mxcli-project-toolkit/pull/313), whose header says to record it as blocked, not as a test failure; review of #313 found verify-module grading it as findings. Scoped to the stack rung (exit 4 is NOT APPLICABLE from conformance-check). `tests/wave2/test-verify-stack-blocked.sh` (6) fails 2 on master. — AlvinnYeo (port-holder report), review of #313
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/agents/review-agent.md b/agents/review-agent.md
index 22d69171..68d25615 100644
--- a/agents/review-agent.md
+++ b/agents/review-agent.md
@@ -141,8 +141,8 @@ current — that block is the single source of truth and gets corrected independ
 Both are read-only. Neither touches the `.mpr`. Both refuse to report a clean sweep from a stale
 or empty catalog rather than silently passing.
 
-**Stale-catalog self-heal:** if `graph-sweep.sh` faults because the catalog is stale, empty, or
-has no `call` edges (its `build_mode` label is reported, not judged — mxcli v0.24+ writes
+**Stale-catalog self-heal:** if `graph-sweep.sh` faults because the catalog is stale, its refs table
+is empty, or its refs carry no `RefKind` (its `build_mode` label is reported, not judged — mxcli v0.24+ writes
 `source` for a complete catalog), you may run `./mxcli -p <mpr> -c 'REFRESH CATALOG FULL'`
 yourself and retry once — this rebuilds the catalog database, it does not write to `.mpr` content, so it's outside what the
 project's write-approval rule protects. If the retry still faults, report it; don't loop.
diff --git a/project-bin/review-module.sh b/project-bin/review-module.sh
index af0259b1..c9923dcb 100755
--- a/project-bin/review-module.sh
+++ b/project-bin/review-module.sh
@@ -316,9 +316,13 @@ conf_slice() {
 # measure, which is a FAULT and emphatically not a pass — "no ledger" is exactly the hole
 # that let projects ship with no coverage-ledger.md at all and read as silence.
 LEDGER="$ROOT/architecture/modules/$MODULE/coverage-ledger.md"
-if [ ! -f "$LEDGER" ]; then
+# A module may keep ONLY the per-BRD directory (<Module>/coverage-ledger/<BRD>.md) with no index
+# file beside it; that is a ledger, and conformance-check.sh / coverage-preflight.sh both read it.
+LEDGER_PB_DIR="${LEDGER%.md}"
+has_ledger() { [ -f "$LEDGER" ] || ls "$LEDGER_PB_DIR"/*.md >/dev/null 2>&1; }
+if ! has_ledger; then
   fault_instrument "conformance (ledger claims vs live model)" conformance \
-    "no architecture/modules/$MODULE/coverage-ledger.md" \
+    "no architecture/modules/$MODULE/coverage-ledger.md or coverage-ledger/*.md" \
     "This module has made no recorded claims, so none could be measured." \
     "Its conformance is UNMEASURED, not clean: there is no row here saying" \
     "'the model matches the decision' because there is no decision on file."
@@ -332,6 +336,10 @@ elif [ -n "$REUSE_CONF" ]; then
   RC_FILES=(); RC_N=0
   [ -f "$RC_PATH" ] && { RC_FILES[$RC_N]="$RC_PATH"; RC_N=$((RC_N+1)); }
   for f in "${RC_PATH%.tsv}"-*.tsv; do [ -f "$f" ] && { RC_FILES[$RC_N]="$f"; RC_N=$((RC_N+1)); }; done
+  # The files actually read, project-relative, for the log fields — on a per-BRD run the base
+  # name passed in does not exist, so naming it would point a reader at nothing.
+  RC_LIST=""
+  for f in ${RC_FILES[@]+"${RC_FILES[@]}"}; do RC_LIST="${RC_LIST:+$RC_LIST, }${f#$ROOT/}"; done
   if [ "$RC_N" -eq 0 ]; then
     c_warn "  ! INSTRUMENT FAULT"; echo " — $REUSE_CONF does not exist"
     echo "      The caller said it had already measured conformance and it had not."
@@ -346,13 +354,13 @@ elif [ -n "$REUSE_CONF" ]; then
       c_warn "  ! INSTRUMENT FAULT"; echo " — $REUSE_CONF carries no rows for $MODULE"
       echo "      Reusing it would report zero measurements as a clean module."
       printf 'conformance (reused)\tFAULT\t2\t-\t(no rows for %s)\n' "$MODULE" >> "$SUMMARY"
-      note_instrument conformance fault 2 "" "${REUSE_CONF}" \
+      note_instrument conformance fault 2 "" "$RC_LIST" \
         "reused report carries no rows for $MODULE — refusing to report a clean run over zero measurements"
       FAULTED=$((FAULTED+1))
     else
-      c_ok "  ✓ reused"; echo "  ($RC_ROWS rows from $RC_N report(s): ${REUSE_CONF%.tsv}[-<BRD>].tsv)"
-      printf 'conformance (reused)\tPASS\t0\t-\t%s\n' "$REUSE_CONF" >> "$SUMMARY"
-      note_instrument conformance pass 0 "" "$REUSE_CONF" ""
+      c_ok "  ✓ reused"; echo "  ($RC_ROWS rows from $RC_N report(s): $RC_LIST)"
+      printf 'conformance (reused)\tPASS\t0\t-\t%s\n' "$RC_LIST" >> "$SUMMARY"
+      note_instrument conformance pass 0 "" "$RC_LIST" ""
     fi
   fi
 else
@@ -411,7 +419,7 @@ cand="$(_tool coverage-check.sh)"
 # The BRD is named by the ledger itself; guessing with `ls | head -1` picks another
 # module's BRD and reports its leaves as this module's coverage.
 BRD=""
-if [ -f "$LEDGER" ]; then
+if has_ledger; then
   # ALL the BRDs the ledger names, not just the first — and the COUNT is reported, because
   # coverage-check.sh measures one BRD per run and a module with five of them was silently
   # having one fifth of its requirements measured and printed as the module's coverage
@@ -426,7 +434,7 @@ if [ -f "$LEDGER" ]; then
   while IFS= read -r cand; do
     [ -n "$cand" ] && [ -f "$ROOT/$cand" ] && BRD_ALL="$BRD_ALL$cand"$'\n'
   done <<EOF
-$(grep -oE '[A-Za-z0-9_/.-]*\.brd\.json' "$LEDGER" 2>/dev/null | sort -u)
+$(cat "$LEDGER" "$LEDGER_PB_DIR"/*.md 2>/dev/null | grep -oE '[A-Za-z0-9_/.-]*\.brd\.json' | sort -u)
 EOF
   BRD_N=$(printf '%s' "$BRD_ALL" | grep -c . || true)
   BRD_REL="$(printf '%s' "$BRD_ALL" | head -1)"
@@ -436,9 +444,9 @@ if [ -z "$COV" ]; then
   fault_instrument "coverage (BRD leaves: UNCLAIMED/PHANTOM/DOUBLE)" coverage \
     "coverage-check.sh not reachable (neither bin/ nor the toolkit)" \
     "Requirement traceability for $MODULE is UNMEASURED, not clean."
-elif [ ! -f "$LEDGER" ]; then
+elif ! has_ledger; then
   fault_instrument "coverage (BRD leaves: UNCLAIMED/PHANTOM/DOUBLE)" coverage \
-    "no coverage-ledger.md for $MODULE" \
+    "no coverage-ledger.md or coverage-ledger/*.md for $MODULE" \
     "Requirement traceability for $MODULE is UNMEASURED, not clean."
 elif [ -z "$BRD" ]; then
   fault_instrument "coverage (BRD leaves: UNCLAIMED/PHANTOM/DOUBLE)" coverage \
diff --git a/project-bin/verify-module.sh b/project-bin/verify-module.sh
index ded6eb61..fc4681aa 100755
--- a/project-bin/verify-module.sh
+++ b/project-bin/verify-module.sh
@@ -452,8 +452,16 @@ fi
 # requirements to check against" is precisely the hole that let several projects ship with no
 # coverage ledger at all, so coverage-check.sh and the review agent had nothing to run and their
 # absence read as silence.
-LEDGER="${LEDGER_FILE:-$ROOT/architecture/modules/$MODULE/coverage-ledger.md}"
-[ -f "$LEDGER" ] || LEDGER="$ROOT/architecture/coverage-ledger.md"
+# A ledger is a file OR a per-BRD directory (<Module>/coverage-ledger/<BRD>.md) — LEDGER_FILE
+# documents both (conformance-check.sh, coverage-preflight.sh). Testing only `-f` sent a directory
+# LEDGER_FILE silently to architecture/coverage-ledger.md (review of #307, 2026-10-13).
+resolve_ledger_hint() {
+  local l="${LEDGER_FILE:-$ROOT/architecture/modules/$MODULE/coverage-ledger.md}"
+  if [ -z "${LEDGER_FILE:-}" ] && [ ! -f "$l" ] && [ -d "${l%.md}" ]; then l="${l%.md}"; fi
+  [ -f "$l" ] || [ -d "$l" ] || l="$ROOT/architecture/coverage-ledger.md"
+  printf '%s\n' "$l"
+}
+LEDGER="$(resolve_ledger_hint)"
 BRD="${BRD_FILE:-}"
 if [ -z "$BRD" ]; then
   for pat in "$ROOT"/analysis/*/brd/*.brd.json "$ROOT"/analysis/*/knowledge-base/brd/*.brd.json; do
diff --git a/tests/wave2/test-catalog-edge-guard.sh b/tests/wave2/test-catalog-edge-guard.sh
index 06589ea8..0c276b13 100755
--- a/tests/wave2/test-catalog-edge-guard.sh
+++ b/tests/wave2/test-catalog-edge-guard.sh
@@ -21,6 +21,7 @@
 #   2. build_mode 'full'   + action edges only, zero calls -> sweep runs (as on master)
 #   3. build_mode 'full'   + kind-less refs -> FAULT naming the mode and the per-kind counts
 #   4. build_mode 'fast'   + empty refs    -> FAULT, as before
+#   4b. refs typed, but none of the orphan-read kinds -> sweeps, with the orphan-list WARNING
 #   5. app-facts: 'source' + calls and action-only both pass the guard; kind-less FAULTs
 #
 # The catalog databases are SYNTHETIC: no real catalog.db is captured in this repo, and the
@@ -50,7 +51,7 @@ bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "
 WORK="$(mktemp -d "${TMPDIR:-/tmp}/catalog-calls.XXXXXX")"
 trap 'rm -rf "$WORK"' EXIT
 
-# mkdb <db> <build_mode> <refs shape: calls|actions|kindless|empty>
+# mkdb <db> <build_mode> <refs shape: calls|actions|kindless|otherkind|empty>
 mkdb() {
   local db="$1" mode="$2" shape="$3"
   mkdir -p "$(dirname "$db")"; rm -f "$db"
@@ -78,6 +79,8 @@ mkdb() {
         echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','action','Orders');"
         echo "INSERT INTO refs VALUES ('MICROFLOW','Billing.ACT_Send','Orders.ACT_Save','action','Billing');"
         [ "$shape" = calls ] && echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total','call','Orders');" ;;
+      otherkind)
+        echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.Order','retrieve','Orders');" ;;
       kindless)
         echo "INSERT INTO refs VALUES ('PAGE','Orders.Order_Edit','Orders.ACT_Save','','Orders');"
         echo "INSERT INTO refs VALUES ('MICROFLOW','Orders.ACT_Save','Orders.SUB_Total',NULL,'Orders');" ;;
@@ -146,6 +149,21 @@ for layout in single two; do
     bad "[$layout] empty refs not refused" "rc=$rc $(out)"
   fi
 
+  # --- 4b. typed refs, but none the orphan query reads: sweep, and say the orphan list is moot ----
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full otherkind
+  rc="$(sweep "$P")"
+  if [ "$rc" = 0 ] && grep -q "WARNING: the catalog has no call/action/menu_item/show_page/datasource edges" "$WORK/out" \
+     && grep -q "retrieve=1" "$WORK/out"; then
+    ok "[$layout] no orphan-read kinds: sweeps with the orphan-list WARNING (retrieve=1 shown)"
+  else
+    bad "[$layout] missing orphan-read kinds not warned about" "rc=$rc $(out)"
+  fi
+  P="$(proj $layout)"; mkdb "$(mdir "$P")/.mxcli/catalog.db" full actions
+  sweep "$P" >/dev/null
+  ! grep -q "WARNING: the catalog has no call" "$WORK/out" \
+    && ok "[$layout] no orphan-list WARNING when an orphan-read kind is present" \
+    || bad "[$layout] orphan-list WARNING printed on an action-bearing catalog" "$(out)"
+
   # --- 5. app-facts: same guard, through a stub mxcli that drops a prepared catalog -------------
   if [ -f "$AF" ]; then
     for variant in source-calls full-actions full-kindless; do
diff --git a/tests/wave2/test-review-conformance-per-brd.sh b/tests/wave2/test-review-conformance-per-brd.sh
index 9ccf5780..6e806a48 100755
--- a/tests/wave2/test-review-conformance-per-brd.sh
+++ b/tests/wave2/test-review-conformance-per-brd.sh
@@ -13,6 +13,8 @@
 #
 # Cases, each on BOTH layouts (single-tree, and two-tree with the .mpr under app/):
 #   1. --reuse-conformance <base>: both per-BRD siblings are read (2 Orders rows, not a FAULT)
+#   1b. a module with ONLY the per-BRD directory (no coverage-ledger.md index) is a ledger, not
+#      "no ledger"; and the reuse log field names the files read, not the absent base name
 #   2. its own run (stub conformance-check.sh in <project>/bin, which _tool prefers): rows from
 #      both per-BRD reports reach conformance.tsv
 #
@@ -89,6 +91,22 @@ for layout in single two; do
     bad "[$layout] reuse did not slice both per-BRD reports" "slice=$(slice) $(out)"
   fi
 
+  # --- 1b. directory-only ledger; log field names the files actually read ----------------------
+  setup "$layout"
+  rm -f "$P/architecture/modules/Orders/coverage-ledger.md"
+  report "$P/docs/conformance/report-$D-F001.tsv" F001
+  report "$P/docs/conformance/report-$D-F002.tsv" F002
+  run --reuse-conformance "docs/conformance/report-$D.tsv" >/dev/null
+  S="$P/.claude/loop/review/Orders/summary.tsv"
+  if grep -q "no architecture/modules/Orders/coverage-ledger.md" "$WORK/out"; then
+    bad "[$layout] directory-only ledger reported as no ledger" "$(out)"
+  elif [ "$(slice)" = 2 ] && grep -q "conformance (reused).PASS.*report-$D-F001.tsv, docs/conformance/report-$D-F002.tsv" "$S" \
+       && ! grep -q "PASS.0.-.docs/conformance/report-$D.tsv\$" "$S"; then
+    ok "[$layout] directory-only ledger measured; summary names report-$D-F001/F002.tsv"
+  else
+    bad "[$layout] directory-only ledger or log field wrong" "slice=$(slice) $(tr '\n' ' ' < "$S" 2>/dev/null)"
+  fi
+
   # --- 2. own run: every report this run wrote, not just the newest ---------------------------
   setup "$layout"
   cat > "$P/bin/conformance-check.sh" <<EOF
diff --git a/tests/wave2/test-verify-ledger-hint.sh b/tests/wave2/test-verify-ledger-hint.sh
new file mode 100755
index 00000000..41d1cb3f
--- /dev/null
+++ b/tests/wave2/test-verify-ledger-hint.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Usage: bash test-verify-ledger-hint.sh [path-to-verify-module.sh]
+#
+# Fixture for project-bin/verify-module.sh's ledger hint (resolve_ledger_hint), which the
+# coverage rung passes on when coverage-preflight.sh is absent.
+#
+# The defect (review of #307, 2026-10-13): LEDGER_FILE is documented as a file OR a per-BRD
+# directory, but verify-module tested it with `[ -f ]`, so a directory silently fell back to
+# architecture/coverage-ledger.md — another ledger, measured as this module's. A module keeping
+# only <Module>/coverage-ledger/ (no index file) had the same fall-back.
+#
+# The function is extracted from the subject and called directly (a full verify-module run
+# needs a live app). Paths are a scratch tree; both layouts resolve ROOT the same way here,
+# because the ledger lives under architecture/ at the project root in both.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/verify-module.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/verify-ledger.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+FN="$(awk '/^resolve_ledger_hint\(\) \{/{on=1} on{print} on && /^\}/{exit}' "$SUT")"
+[ -n "$FN" ] || { bad "no resolve_ledger_hint() in $SUT — LEDGER_FILE is tested with [ -f ] only"; echo; echo "PASS=$PASS FAIL=$FAIL"; exit 1; }
+
+R="$WORK/proj"; M="$R/architecture/modules"
+mkdir -p "$M/Orders/coverage-ledger" "$M/Billing"
+: > "$M/Orders/coverage-ledger/F001.md"
+: > "$M/Billing/coverage-ledger.md"
+: > "$R/architecture/coverage-ledger.md"
+hint() { ( ROOT="$R"; MODULE="$1"; LEDGER_FILE="${2:-}"; [ -n "$LEDGER_FILE" ] || unset LEDGER_FILE
+           eval "$FN"; resolve_ledger_hint ); }
+
+v="$(hint Orders "$M/Orders/coverage-ledger")"
+[ "$v" = "$M/Orders/coverage-ledger" ] && ok "LEDGER_FILE=<directory> is kept, not replaced by the project ledger" \
+  || bad "directory LEDGER_FILE fell back" "$v"
+v="$(hint Orders)"
+[ "$v" = "$M/Orders/coverage-ledger" ] && ok "a module with only the per-BRD directory resolves to it" \
+  || bad "directory-only module fell back" "$v"
+v="$(hint Billing)"
+[ "$v" = "$M/Billing/coverage-ledger.md" ] && ok "a module with coverage-ledger.md still resolves to the file" \
+  || bad "file ledger changed" "$v"
+v="$(hint Shipping)"
+[ "$v" = "$R/architecture/coverage-ledger.md" ] && ok "a module with neither falls back to the project ledger, as before" \
+  || bad "project fallback changed" "$v"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

From 34cd4ec2b6d5221374d33a297b1e1baa26ce8f68 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:26:01 +0000
Subject: [PATCH 47/68] fix(lint-rules): one opt-out syntax, override never
 baselines, capped backups, honest restore label (#264 re-review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Opt-out reason: the installer now accepts `#\s*reason:` like lint-gate (it required
  `# reason:` exactly, so `#reason: x` was honoured by one tool and ignored by the other).
- LINT_RULES_REVERTED_OK=1 no longer gets past the --update-baseline refusal: the override is
  for looking at counts, and baselining stock counts is how the five-day field case went in.
- `.reseeded-<ts>` backups are capped at the newest 3 per rule.
- A stock-seeded rule restored because its header is gone and its body matches no known stock
  hash is labelled "header missing — restored from toolkit, your copy kept as <file>", not
  "REVERTED TO STOCK": a newer mxcli's seed and a hand edit that lost the header look the same.
- tests/wave2/test-lint-receipt-revert.sh: `#reason:` case, override + --update-baseline,
  backup cap, label. 55/55 here; each new case fails on the previous commit's scripts; 28 fail
  on master's installer + lint-gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |  2 +-
 bin/lib/install-lint-rules.sh           | 15 ++++++++++-----
 project-bin/lint-gate.sh                | 12 +++++++-----
 tests/wave2/test-lint-receipt-revert.sh | 17 +++++++++++++++--
 4 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ef833cf..ac1876fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a stock-seeded rule (the file names `mxcli init` writes, now marked `stock` in the receipt) whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or any receipt-listed rule that is missing, is named, the remedy `bin/sync-project.sh <project>` (fallback `--upgrade-lint-rules all`) is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the remedy always clears it, `bin/lib/install-lint-rules.sh` restores such a stock-seeded rule even when this mxcli's stock hash is not in `STOCK-HASHES.txt` yet (it was reported LOCALLY MODIFIED and never written); a headerless toolkit-only or configurable rule is still a local edit, never overwritten. The installer also writes each receipt row's kind, prunes rows for rules no longer shipped, and honours `.claude/lint-rules-disabled.txt`: one line per rule with `# reason: …`, a user decision recorded in `PROJECT.md`; a line with no reason, or naming a stock-seeded rule, is ignored with a warning (`lint-rules/README.md` had told projects to just delete txt002). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 51/51 here, 25 fail on master's lint-gate and installer. — AlvinnYeo
+- fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a stock-seeded rule (the file names `mxcli init` writes, now marked `stock` in the receipt) whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or any receipt-listed rule that is missing, is named, the remedy `bin/sync-project.sh <project>` (fallback `--upgrade-lint-rules all`) is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules, also under the `LINT_RULES_REVERTED_OK=1` look-anyway override. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the remedy always clears it, `bin/lib/install-lint-rules.sh` restores such a stock-seeded rule even when its body matches no known stock hash (a newer mxcli's seed, or a hand edit that also lost the header: it was reported LOCALLY MODIFIED and never written), labelled `header missing — restored from toolkit, your copy kept as <rule>.reseeded-<ts>` with the newest 3 copies kept; a headerless toolkit-only or configurable rule is still a local edit, never overwritten. The installer also writes each receipt row's kind, prunes rows for rules no longer shipped, and honours `.claude/lint-rules-disabled.txt`: one line per rule with `# reason: …` (`#\s*reason:` in both tools), a user decision recorded in `PROJECT.md`; a line with no reason, or naming a stock-seeded rule, is ignored with a warning (`lint-rules/README.md` had told projects to just delete txt002). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 55/55 here, 28 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/install-lint-rules.sh b/bin/lib/install-lint-rules.sh
index 633fd1b9..42f6560b 100644
--- a/bin/lib/install-lint-rules.sh
+++ b/bin/lib/install-lint-rules.sh
@@ -139,8 +139,9 @@ _mxtk_lint_receipt_set() {
 # _mxtk_lint_is_disabled answers for one rule; _mxtk_lint_disabled_audit warns once per bad line.
 _mxtk_lint_dis_ok() {  # $1 = rule, $2 = rest of the line -> 0 when the line is a valid opt-out
   case " ${MXTK_LINT_RULES_STOCK:-} " in *" $1 "*) return 1 ;; esac
-  _dis_why="${2#*# reason:}"
-  [ "$_dis_why" != "$2" ] || return 1
+  # Same syntax lint-gate.sh accepts (Python `#\s*reason:\s*(\S.*)`): `#`, optional blanks,
+  # `reason:`, then non-blank text.
+  _dis_why="$(printf '%s\n' "$2" | sed -n 's/^.*#[[:space:]]*reason:[[:space:]]*//p')"
   [ -n "$(printf '%s' "$_dis_why" | tr -d '[:space:]')" ]
 }
 _mxtk_lint_is_disabled() {
@@ -336,14 +337,18 @@ mxtk_install_lint_rules() {
       # and falls through to the LOCALLY MODIFIED / configured branches below, never overwritten.
       # The found file is kept beside it; lint loads *.star only.
       if [ -n "$_rec" ] && [ "$(_mxtk_lint_kind "$_f")" = stock ] && ! grep -q '^# mxtk-lint-rule:' "$_dst"; then
-        _why="REVERTED TO STOCK — header gone; this mxcli's stock hash is not in STOCK-HASHES.txt yet. Restoring it"
+        # Not "REVERTED TO STOCK": its body matches no known stock hash, so it is either a
+        # newer mxcli's seed or a hand edit that also lost the header. The two look the same
+        # from here, which is why the copy is kept. Backups are capped at the newest 3 per rule
+        # (the name sorts by time), so a project that re-seeds on every init does not pile up.
         if [ "$_dry" -eq 1 ]; then
-          echo "Would install: .claude/lint-rules/$_f ($_why)"
+          echo "Would install: .claude/lint-rules/$_f (header missing — would restore from toolkit and keep your copy)"
         else
           _bak="$_dst.reseeded-$(date +%Y%m%d%H%M%S)"
           cp "$_dst" "$_bak"
           cp "$_src" "$_dst" && _mxtk_lint_receipt_set "$_receipt" "$_f" "$_srcmd5"
-          echo "Lint rule: $_why — .claude/lint-rules/$_f (the file found is kept at $(basename "$_bak"))"
+          ls "$_dst".reseeded-* 2>/dev/null | sort -r | sed -n '4,$p' | while IFS= read -r _old; do rm -f "$_old"; done
+          echo "Lint rule: .claude/lint-rules/$_f — header missing — restored from toolkit, your copy kept as $(basename "$_bak")"
         fi
         MXTK_LINT_CHANGES=$((MXTK_LINT_CHANGES + 1))
         continue
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index 740c563f..39a15c6a 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -39,7 +39,7 @@
 # not. No receipt, or a row without a kind = no check (the next sync writes kinds). A non-stock
 # rule removed by the user's decision is listed, with a reason, in .claude/lint-rules-disabled.txt
 # (see lint-rules/README.md "Opting out of a rule"). LINT_RULES_REVERTED_OK=1 runs anyway, with
-# the warning.
+# the warning (a check run only: --update-baseline stays refused).
 #
 # ACCEPTING DEBT IS RECORDED, NOT SILENT (2026-10-12). Three toolkit-built apps re-baselined
 # 61 times in four days — every acceptance made by the agent whose script caused the rise,
@@ -218,12 +218,14 @@ PY
     echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT"
     echo "   If sync reports a rule LOCALLY MODIFIED instead of restoring it:"
     echo "     ${TKR:-<toolkit-root>}/bin/sync-project.sh $ROOT --upgrade-lint-rules all"
-    if [ "${LINT_RULES_REVERTED_OK:-}" = "1" ]; then
-      echo "   LINT_RULES_REVERTED_OK=1 — linting anyway; counts below are from the files on disk."
-      echo ""
-    elif [ "$UPDATE" -eq 1 ]; then
+    if [ "$UPDATE" -eq 1 ]; then
+      # Refused even under LINT_RULES_REVERTED_OK: the override is for looking at counts, and
+      # baselining stock counts is exactly how the five-day field case went in.
       echo "lint-gate: REFUSED — --update-baseline over reverted rules would baseline stock counts." >&2
       exit 2
+    elif [ "${LINT_RULES_REVERTED_OK:-}" = "1" ]; then
+      echo "   LINT_RULES_REVERTED_OK=1 — linting anyway; counts below are from the files on disk."
+      echo ""
     else
       echo "BLIND — lint rules reverted to stock; lint not run, nothing compared against the baseline."
       # lint-last.json gets the verdict but no total: lint did not run, and a stale total from
diff --git a/tests/wave2/test-lint-receipt-revert.sh b/tests/wave2/test-lint-receipt-revert.sh
index 3321c333..2a8a046d 100755
--- a/tests/wave2/test-lint-receipt-revert.sh
+++ b/tests/wave2/test-lint-receipt-revert.sh
@@ -94,6 +94,10 @@ out=$(gate --update-baseline --reason "x" 2>&1); rc=$?
 echo "T5 LINT_RULES_REVERTED_OK=1 lints anyway, with the warning"
 out=$(cd "$P" && LINT_RULES_REVERTED_OK=1 LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh 2>&1); rc=$?
 case "$out" in *"REVERTED TO STOCK"*"FAIL —"*) ok "warned, then compared (rise visible)" ;; *) bad "override did not lint" "$out" ;; esac
+before=$(cat "$P/.claude/lint-baseline.json")
+out=$(cd "$P" && LINT_RULES_REVERTED_OK=1 LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh --update-baseline --reason "x" 2>&1); rc=$?
+[ "$rc" -eq 2 ] && [ "$(cat "$P/.claude/lint-baseline.json")" = "$before" ] && ok "override does not get past the --update-baseline refusal" \
+  || bad "stock counts baselined under the override (rc $rc)" "$out"
 
 echo "T6 the remedy is not blocked and clears it (the installer sync-project.sh runs)"
 out=$(install_rules)
@@ -143,11 +147,19 @@ out=$(gate2 "$P9" 2>&1); rc=$?
   && ok "lint-gate: BLIND, names $EBK" || bad "lint-gate did not flag the unknown-hash re-seed (rc $rc)" "$out"
 case "$out" in *"--upgrade-lint-rules all"*) ok "message carries the LOCALLY MODIFIED fallback" ;; *) bad "no --upgrade-lint-rules fallback" "$out" ;; esac
 out=$(inst2 "$P9")
-case "$out" in *"REVERTED TO STOCK"*"$EBK"*) ok "installer restores it (not LOCALLY MODIFIED)" ;; *) bad "installer did not restore it" "$out" ;; esac
+case "$out" in *"$EBK — header missing — restored from toolkit, your copy kept as $EBK.reseeded-"*) ok "installer restores it, labelled 'header missing', copy named" ;; *) bad "installer did not restore it" "$out" ;; esac
+case "$out" in *"REVERTED TO STOCK"*) bad "a body matching no known stock hash called REVERTED TO STOCK" "$out" ;; *) ok "not labelled REVERTED TO STOCK (body matches no known stock hash)" ;; esac
 cmp -s "$TK2/lint-rules/$EBK" "$P9/.claude/lint-rules/$EBK" && ok "file is the toolkit version again" || bad "file not restored"
 ls "$P9/.claude/lint-rules/$EBK".reseeded-* >/dev/null 2>&1 && ok "found copy kept beside it" || bad "found copy not kept"
 out=$(gate2 "$P9" 2>&1); rc=$?
 [ "$rc" -eq 0 ] && ok "after sync: rc 0 (remedy clears it)" || bad "still blind after sync (rc $rc)" "$out"
+# Backups are capped: with 5 older copies already there, one more re-seed leaves the newest 3.
+for i in 1 2 3 4 5; do printf 'old %s\n' "$i" > "$P9/.claude/lint-rules/$EBK.reseeded-2020010100000$i"; done
+cp "$STOCK" "$P9/.claude/lint-rules/$EBK"; inst2 "$P9" >/dev/null
+n=$(ls "$P9/.claude/lint-rules/$EBK".reseeded-* 2>/dev/null | wc -l | tr -d ' ')
+[ "$n" -eq 3 ] && ok "backups capped at 3" || bad "backups not capped ($n)"
+kept_old=""; for i in 1 2 3; do [ -f "$P9/.claude/lint-rules/$EBK.reseeded-2020010100000$i" ] && kept_old="$kept_old $i"; done
+[ -z "$kept_old" ] && ok "the oldest backups are the ones removed" || bad "oldest backups kept:$kept_old"
 
 echo "T10 opt-out: a non-stock rule removed by the user's decision, with a reason"
 P10=$(newproj p10); inst2 "$P10" >/dev/null
@@ -159,7 +171,8 @@ case "$out" in *"$T2F has no '# reason: ...' — ignored"*"BLIND — lint rules
 out=$(inst2 "$P10")
 case "$out" in *"$T2F has no '# reason: …' — IGNORED"*) ok "installer warns about the reasonless line" ;; *) bad "no installer warning" "$out" ;; esac
 [ -f "$P10/.claude/lint-rules/$T2F" ] && ok "reasonless opt-out: sync restores the rule" || bad "reasonless opt-out honoured by sync"
-printf '# decided with the user 2026-10-13\n%s  # reason: display standard is dd/MM/yyyy (PROJECT.md decision D-14)\n' "$T2F" > "$P10/.claude/lint-rules-disabled.txt"
+# `#reason:` with no blank: both tools must accept the same syntax.
+printf '# decided with the user 2026-10-13\n%s  #reason: display standard is dd/MM/yyyy (PROJECT.md decision D-14)\n' "$T2F" > "$P10/.claude/lint-rules-disabled.txt"
 rm -f "$P10/.claude/lint-rules/$T2F"
 out=$(gate2 "$P10" 2>&1); rc=$?
 [ "$rc" -eq 0 ] && ok "with a reason: lint-gate rc 0, no alarm before any sync" || bad "reasoned opt-out read as a re-seed (rc $rc)" "$out"

From 2d9d6b88614cb002aa6fcd6cb47dedb0a881ca6c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:27:55 +0000
Subject: [PATCH 48/68] Review fixes for #323: coverage check, lock refuses,
 PRE-EXISTING row, dropped MCP asks, stricter autocompact advisory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- iterative-build-loop: phase-close check is coverage (applied exec row, --commit-first commit,
  or MCP: commit), N of N, not an equality; pre-exec step 2 commits as "MCP: <what changed>";
  the exec lock refuses (no queue); refusal table gains PRE-EXISTING and "any other refusal:
  read the printed remedy"; the rows each refusal writes are named.
- learned-page-patterns + inbox: the lock refuses, it does not serialise/queue.
- upstream-feedback: the two dropped MCP-build items recorded with why.
- routing: the exec trigger leads with "An exec.sh guard refused a write (not a permission
  prompt)"; stubs re-rendered; baseline unchanged at 79,997 words.
- init-project advisory: reads env AND every autoCompactWindow in project and user settings,
  warns if any is above 250k; string values ("1M") parsed; unreadable values printed as
  "unparseable: <v>" instead of "none set"; values over 12 digits never reach arithmetic.
  Fixture grows to 15 checks (all pass).
- measured-claims §7: notes token-burn.sh keeps the first record today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  4 +-
 README.md                                     |  2 +-
 ROUTING.md                                    |  2 +-
 agents/gate-agent.md                          |  2 +-
 agents/mdl-agent.md                           |  2 +-
 bin/init-project.sh                           | 73 +++++++++++--------
 bin/lib/skill-routing.tsv                     |  2 +-
 .../2026-09-29-parallel-build-hygiene.md      |  3 +-
 skills/iterative-build-loop.md                | 35 +++++----
 skills/learned-page-patterns.md               |  3 +-
 skills/measured-claims.md                     |  2 +
 skills/upstream-feedback.md                   |  6 ++
 tests/wave2/test-init-autocompact.sh          | 38 ++++++++--
 13 files changed, 117 insertions(+), 57 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad407609..073dcd4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,9 +17,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- learn(iterative-build-loop, upstream-feedback): **every model write goes through `exec.sh`; on a refusal the move is commit (`--commit-first`), wait (exec lock) or stop and report — never `FORCE_EXEC` on the agent's own initiative; MCP writes stay allowed and are accepted as unrecorded, recorded by an `MCP:` commit; the gate checks the saved file (save, then check); no batched-gate mode exists, so do not imitate one with overrides; Studio Pro MCP server asks get a third destination in `upstream-feedback.md` with their evidence rows** ([#69](https://github.com/MendixMau/mxcli-project-toolkit/issues/69), [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171), [#173](https://github.com/MendixMau/mxcli-project-toolkit/issues/173)). The phase-close check is a count: model commits = exec rows + `MCP:` commits. Field evidence: a 2026-09-29 two-build comparison (229 errors hidden by a stale disk copy; per-script apply 22–30 s growing to 55–65 s). Routing triggers for the build loop, page patterns and measured claims now name the refusal, the UI round and transcript token counts (stubs re-rendered; baseline unchanged at 79,997 words) — MendixMau
+- learn(iterative-build-loop, upstream-feedback): **every model write goes through `exec.sh`; on a refusal the move is commit (`--commit-first`), wait (exec lock) or stop and report — never `FORCE_EXEC` on the agent's own initiative; MCP writes stay allowed and are accepted as unrecorded, recorded by an `MCP:` commit; the gate checks the saved file (save, then check); no batched-gate mode exists, so do not imitate one with overrides; Studio Pro MCP server asks get a third destination in `upstream-feedback.md` with their evidence rows** ([#69](https://github.com/MendixMau/mxcli-project-toolkit/issues/69), [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171), [#173](https://github.com/MendixMau/mxcli-project-toolkit/issues/173)). The phase-close check is coverage, N of N: every model commit is covered by an applied exec row, a `--commit-first` commit or an `MCP:` commit (the pre-exec sequence now commits as `MCP: …`); the refusal table includes PRE-EXISTING errors and ends with "read the printed remedy"; the exec lock refuses rather than queues, and the text says so. Field evidence: a 2026-09-29 two-build comparison (229 errors hidden by a stale disk copy; per-script apply 22–30 s growing to 55–65 s). Routing triggers for the build loop, page patterns and measured claims now name the refusal, the UI round and transcript token counts (stubs re-rendered; baseline unchanged at 79,997 words) — MendixMau
 - learn(learned-page-patterns, measured-claims): **UI fix rounds: SCSS first, apply directly through `exec.sh`, re-look only changed pages (N of N), and check four regressions before applying (N1 page-column on the layout root, N2 `.d-none` losing to a `display` class, N3 Data Grid 2 `autoFit` columns at 32 px, N4 focus ring); transcript usage is read from each message's LAST record** ([#170](https://github.com/MendixMau/mxcli-project-toolkit/issues/170), [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171)). The round took 1,507 calls against 515 for a comparable build; re-measured on Claude Code 2.1.296 transcripts, sub-agent output read from the first record was up to 7x low while the main loop's was exact — MendixMau
-- new(init-project): **the scaffold prints an auto-compact advisory: a warning when `CLAUDE_CODE_AUTO_COMPACT_WINDOW` or a settings `autoCompactWindow` is above 250k, otherwise a `/autocompact 250k` recommendation; it writes no setting and never fails the scaffold** ([#167](https://github.com/MendixMau/mxcli-project-toolkit/issues/167)). A lead session at a 1M window averaged 363–466k context per call. Fixture `tests/wave2/test-init-autocompact.sh` (9 checks; 4 fail on master) — MendixMau
+- new(init-project): **the scaffold prints an auto-compact advisory: a warning when `CLAUDE_CODE_AUTO_COMPACT_WINDOW` or any `autoCompactWindow` in the project or user settings is above 250k, an "unparseable" line for a value it cannot read, otherwise a `/autocompact 250k` recommendation; it writes no setting and never fails the scaffold** ([#167](https://github.com/MendixMau/mxcli-project-toolkit/issues/167)). A lead session at a 1M window averaged 363–466k context per call. Fixture `tests/wave2/test-init-autocompact.sh` (15 checks; fails on master) — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/README.md b/README.md
index 0c7bcc37..651b9787 100644
--- a/README.md
+++ b/README.md
@@ -587,7 +587,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Task | Skill to load |
 |---|---|
 | Dispatching a build step to a helper — generate its one-file pack (the brief's Build steps row, mxcli brain brief, live DESCRIBEs, example, folder) and hand over the path instead of a reading list. Measured: 25-38% fewer tool calls and 30-41% less time, same quality; the token saving is not proven | `project-bin/context-pack.sh` |
-| Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` |
+| An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` |
 | After marking a module done, or any time "how much is built vs proven" is asked — renders build-plan.html from done- prefixes and verify-module.sh/improvement-register.md, kept as two honestly separate views; --json writes architecture/build-plan.json parsed from build-plan.md's Phase headings (a plan with no Phase headings gets no file) | `project-bin/build-plan-status.sh` |
 | Turning a client-derived Mendix app into a clean, shareable demo with zero client fingerprint — branding, data, custom widgets | `skills/anonymize-client-app-for-demo.md` |
 | Handing a headless-built model to a person — opening it in Studio Pro, a free sandbox, or a colleague's machine: the model travels, the demo data and runtime config (keys, an agent's bound model) do not, and each needs its own re-establish step | `skills/handoff-to-studio-pro.md` |
diff --git a/ROUTING.md b/ROUTING.md
index 3e0b4548..758c6cf8 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -136,7 +136,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Reviewing any module before calling it done — the ONE pass: build, gate, prove, LOOK (is it logical, does it look right, does it match our design, over every page not just the tested ones), confirm with the denominator stated | `skills/module-review.md` | mdl,review,test | 5,6 | baseline |
 | Before any mxcli exec / exec.sh / --mcp write — ask or run? the knob decides | `bin/exec-approval.sh` | mdl,gate | 5,6 | baseline |
 | Dispatching a build step to a helper — generate its one-file pack (the brief's Build steps row, mxcli brain brief, live DESCRIBEs, example, folder) and hand over the path instead of a reading list. Measured: 25-38% fewer tool calls and 30-41% less time, same quality; the token saving is not proven | `project-bin/context-pack.sh` | mdl | 5 | ondemand |
-| Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` | mdl,gate | 5 | ondemand |
+| An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC | `skills/iterative-build-loop.md` | mdl,gate | 5 | ondemand |
 | After marking a module done, or any time "how much is built vs proven" is asked — renders build-plan.html from done- prefixes and verify-module.sh/improvement-register.md, kept as two honestly separate views; --json writes architecture/build-plan.json parsed from build-plan.md's Phase headings (a plan with no Phase headings gets no file) | `project-bin/build-plan-status.sh` | architect,gate,review | 4,5,6 | ondemand |
 | Turning a client-derived Mendix app into a clean, shareable demo with zero client fingerprint — branding, data, custom widgets | `skills/anonymize-client-app-for-demo.md` | mdl,review | 6 | ondemand |
 | Handing a headless-built model to a person — opening it in Studio Pro, a free sandbox, or a colleague's machine: the model travels, the demo data and runtime config (keys, an agent's bound model) do not, and each needs its own re-establish step | `skills/handoff-to-studio-pro.md` | test,review | 6,7 | ondemand |
diff --git a/agents/gate-agent.md b/agents/gate-agent.md
index 505e5241..3e7c647b 100644
--- a/agents/gate-agent.md
+++ b/agents/gate-agent.md
@@ -56,7 +56,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/coverage-ledger.md` | Building the Stage 4 coverage ledger |
 | `bin/coverage-check.sh` | Checking a coverage ledger against its BRD |
-| `skills/iterative-build-loop.md` | Building a module with mxcli, or an exec.sh guard just refused a write |
+| `skills/iterative-build-loop.md` | An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli |
 | `project-bin/conformance-check.sh` | Running the ledger rung alone |
 | `project-bin/graph-sweep.sh` | Running the wiring rung alone |
 | `project-bin/test-stack-up.sh` | Before any runtime test |
diff --git a/agents/mdl-agent.md b/agents/mdl-agent.md
index a9e28c34..bb0e7ff9 100644
--- a/agents/mdl-agent.md
+++ b/agents/mdl-agent.md
@@ -71,7 +71,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `bug-logs/mxcli-bugs.md` | Reading a whole class of tool defects (a retest, a new mxcli release, an audit) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/microflow-loop-antipatterns.md` | Reading what loop bodies do (LOOP_TQ, deferred commit, nested loop, REST in loop, transaction control per item, scheduled-event reachability) from described MDL; the catalog holds top-level activities only and cannot see inside a loop |
-| `skills/iterative-build-loop.md` | Building a module with mxcli, or an exec.sh guard just refused a write |
+| `skills/iterative-build-loop.md` | An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli |
 | `skills/mdl-cookbook-microflows.md` | Writing MDL microflow scripts |
 | `skills/build/mdl/oneshot-mdl-method.md` | Writing a single MDL script that takes a project from nothing to a working vertical slice |
 | `skills/learned-page-patterns.md` | Building and auditing Mendix pages, or starting a UI fix round across many pages |
diff --git a/bin/init-project.sh b/bin/init-project.sh
index 7f04a17a..6523aabc 100755
--- a/bin/init-project.sh
+++ b/bin/init-project.sh
@@ -730,43 +730,58 @@ echo "      bin/install-claude-hooks.sh          # prints the tier table, instal
 # evidence (contrib-promoted, 2026-09-29): a lead session left at a 1M auto-compact window averaged
 # 363-466k context per call against ~128k for a comparable build — the cost gap was context re-read
 # per call, not call count; re-estimated at a 250k window the build cost fell by about a fifth.
-# Reads only what Claude Code itself reads (CLAUDE_CODE_AUTO_COMPACT_WINDOW, then an
-# "autoCompactWindow" number in the user or project settings.json; names checked against the
-# 2.1.x CLI) and never fails the scaffold.
-mxtk_compact_tokens() {   # "250k" | "1M" | "250000" | "auto" -> integer tokens, or empty
+# Reads what Claude Code reads — CLAUDE_CODE_AUTO_COMPACT_WINDOW, and every "autoCompactWindow"
+# value (number or string) in the project's settings.local.json / settings.json AND the user's
+# settings.json; names checked against the 2.1.x CLI — and warns if ANY of them is above 250k.
+# A value it cannot read is printed as "unparseable", never as "none set". Never fails the scaffold.
+mxtk_compact_tokens() {   # "250k" | "1M" | "250000" -> integer tokens; "auto"/garbage -> empty
   local v n mult=1
-  v="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  v="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]"')"
   case "$v" in
     *k) n="${v%k}"; mult=1000 ;;
     *m) n="${v%m}"; mult=1000000 ;;
     *)  n="$v" ;;
   esac
-  case "$n" in ''|*[!0-9]*) return 0 ;; esac   # "auto", "1.5M", garbage: unknown, say nothing about it
-  printf '%s' "$(( 10#$n * mult ))"
+  case "$n" in ''|*[!0-9]*) return 0 ;; esac
+  n="$(printf '%s' "$n" | sed 's/^0*//')"; [ -n "$n" ] || n=0
+  # Beyond 12 digits shell arithmetic can overflow; anything that long is far above 250k anyway.
+  if [ "${#n}" -gt 12 ]; then printf '999999999999'; return 0; fi
+  printf '%s' "$(( n * mult ))"
 }
-_ac_limit=250000; _ac_val=""; _ac_from=""
-if [ -n "${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-}" ]; then
-  _ac_val="$(mxtk_compact_tokens "$CLAUDE_CODE_AUTO_COMPACT_WINDOW")"
-  _ac_from="CLAUDE_CODE_AUTO_COMPACT_WINDOW=$CLAUDE_CODE_AUTO_COMPACT_WINDOW"
-else
-  for _ac_f in "$PROJECT_DIR/.claude/settings.local.json" "$PROJECT_DIR/.claude/settings.json" \
-               "${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/settings.json"; do
-    [ -f "$_ac_f" ] || continue
-    # Largest number found wins: a per-model block may list several, and the warning is for the worst.
-    _ac_n="$( (grep -oE '"autoCompactWindow"[[:space:]]*:[[:space:]]*[0-9]+' "$_ac_f" 2>/dev/null || true) \
-              | grep -oE '[0-9]+$' | sort -n | tail -1 || true)"
-    if [ -n "$_ac_n" ]; then _ac_val="$_ac_n"; _ac_from="autoCompactWindow=$_ac_n in $_ac_f"; break; fi
-  done
+_ac_limit=250000; _ac_over=""; _ac_ok=""; _ac_bad=""; _ac_auto=""
+mxtk_compact_note() {     # $1 raw value, $2 where it came from
+  local t
+  case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]"')" in
+    auto) _ac_auto="$_ac_auto; $2"; return 0 ;;
+  esac
+  t="$(mxtk_compact_tokens "$1")"
+  if [ -z "$t" ]; then _ac_bad="$_ac_bad; unparseable: $1 ($2)"
+  elif [ "$t" -gt "$_ac_limit" ]; then _ac_over="$_ac_over; $1 ($2)"
+  else _ac_ok="$_ac_ok; $1 ($2)"; fi
+}
+[ -z "${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-}" ] || \
+  mxtk_compact_note "$CLAUDE_CODE_AUTO_COMPACT_WINDOW" "CLAUDE_CODE_AUTO_COMPACT_WINDOW"
+for _ac_f in "$PROJECT_DIR/.claude/settings.local.json" "$PROJECT_DIR/.claude/settings.json" \
+             "${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/settings.json"; do
+  [ -f "$_ac_f" ] || continue
+  while IFS= read -r _ac_v; do
+    [ -n "$_ac_v" ] && mxtk_compact_note "$_ac_v" "autoCompactWindow in $_ac_f"
+  done <<< "$( (grep -oE '"autoCompactWindow"[[:space:]]*:[[:space:]]*("[^"]*"|[^,}[:space:]]+)' "$_ac_f" 2>/dev/null || true) \
+              | sed -E 's/^"autoCompactWindow"[[:space:]]*:[[:space:]]*//')"
+done
+if [ -n "$_ac_over" ]; then
+  echo "  - WARNING: auto-compact window is above 250k: ${_ac_over#; }."
+  echo "    A field build at a 1M window averaged 363-466k context per call — every token re-read on"
+  echo "    every call. Lower it with /autocompact 250k (or CLAUDE_CODE_AUTO_COMPACT_WINDOW=250k). Nothing was changed."
 fi
-if [ -n "$_ac_val" ] && [ "$_ac_val" -gt "$_ac_limit" ]; then
-  echo "  - WARNING: auto-compact window is above 250k ($_ac_from). A field build at a 1M window"
-  echo "    averaged 363-466k context per call — every token re-read on every call. Lower it with"
-  echo "    /autocompact 250k (or CLAUDE_CODE_AUTO_COMPACT_WINDOW=250k). Nothing was changed."
-elif [ -n "$_ac_val" ]; then
-  echo "  - Auto-compact window: $_ac_from (at or below 250k — ok)."
-else
-  echo "  - Auto-compact window: none set (\"auto\"), which on a 1M-context model compacts near 1M."
-  echo "    Recommended: /autocompact 250k — a field lead at 1M averaged 363-466k per call. Not set by this script."
+[ -z "$_ac_bad" ] || echo "  - Auto-compact window ${_ac_bad#; } — could not read it; check it is 250k or lower."
+if [ -z "$_ac_over" ] && [ -z "$_ac_bad" ]; then
+  if [ -n "$_ac_ok" ]; then
+    echo "  - Auto-compact window: ${_ac_ok#; } (at or below 250k — ok)."
+  else
+    echo "  - Auto-compact window: none set, or \"auto\" — which on a 1M-context model compacts near 1M."
+    echo "    Recommended: /autocompact 250k — a field lead at 1M averaged 363-466k per call. Not set by this script."
+  fi
 fi
 echo ""
 
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index dc144e7f..0ab9a4a3 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -146,7 +146,7 @@ design-artifacts	skills/design-artifacts.md	Designing the brand and ONE ANNOTATE
 brd-to-build-plan	skills/brd-to-build-plan.md	Turning BRDs plus architecture into a numbered, dependency-ordered build plan	architect	3,4	ondemand	requirements
 coverage-ledger	skills/coverage-ledger.md	Building the Stage 4 coverage ledger — every requirement either claimed by a build-plan row or catalogued with a reason, never invisible	architect,gate	4	ondemand	requirements
 coverage-check	bin/coverage-check.sh	Checking a coverage ledger against its BRD — every scalar leaf CLAIMED, LEDGERED, UNCLAIMED, PHANTOM or DOUBLE-CLAIMED, so coverage is measured rather than remembered	architect,gate	4	ondemand	requirements
-iterative-build-loop	skills/iterative-build-loop.md	Building a module with mxcli, or an exec.sh guard just refused a write — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC	mdl,gate	5	ondemand	build
+iterative-build-loop	skills/iterative-build-loop.md	An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli — verified, iterative, coverage-checklist gated; on a refusal: commit, wait or stop, never FORCE_EXEC	mdl,gate	5	ondemand	build
 mdl-cookbook-microflows	skills/mdl-cookbook-microflows.md	Writing MDL microflow scripts — worked recipes	mdl	5	ondemand	build/mdl
 oneshot-mdl-method	skills/build/mdl/oneshot-mdl-method.md	Writing a single MDL script that takes a project from nothing to a working vertical slice — execution order, why it is deliberately non-idempotent, the instrument hierarchy, and the silent failures that pass every check	mdl	5	ondemand	build/mdl
 learned-page-patterns	skills/learned-page-patterns.md	Building and auditing Mendix pages, or starting a UI fix round across many pages — widget patterns, datasource shapes; for a round: SCSS first, four regressions to check	mdl	5	ondemand	build/pages
diff --git a/contrib/inbox/2026-09-29-parallel-build-hygiene.md b/contrib/inbox/2026-09-29-parallel-build-hygiene.md
index b800b6d4..735ec333 100644
--- a/contrib/inbox/2026-09-29-parallel-build-hygiene.md
+++ b/contrib/inbox/2026-09-29-parallel-build-hygiene.md
@@ -10,7 +10,8 @@
 
 Parallel drafting is the toolkit build's speed advantage (2.6 vs 5.5 min/row; equal calls per
 row), so keep it and remove its friction:
-- ~~Lock/queue mxbuild~~ — done: per-project exec lock in `project-bin/exec.sh` (#304).
+- Lock/queue mxbuild — half done: the per-project exec lock in `project-bin/exec.sh` (#304)
+  refuses a second apply at once (no collision), but does not queue it; the agent re-runs.
 - ~~Usage measurement~~ — promoted 2026-10-14 to `skills/measured-claims.md` §7 (re-measured:
   sub-agent transcripts carry partial output_tokens on early records, up to 7x low).
 - **Still open — batch the gate**: one mxbuild per 3–5 consecutive clean scripts; per-script
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index c2a2591f..5cf1d88a 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -322,17 +322,20 @@ Every MDL script, and every one-off model patch (`--patch`), is applied with `./
 A raw `./mxcli exec` writes no BUILD-LOG row, takes no snapshot and runs no gate, so the change
 shows as "not recorded" to everything that reads the build log (status, done-drift, proof views).
 
-When a guard refuses, nothing in the model changed (the uncommitted-model and `--commit-first`
-refusals also write a `🚫 blocked` row; the Studio Pro and lock refusals only print). Your move
-is one of three — **commit, wait, or stop and report** — never an override:
+When a guard refuses, the script's change is not in the model. Most refusals also write a
+BUILD-LOG row (uncommitted model, `--commit-first`, a failed pre-exec check, a gate that could
+not run, PRE-EXISTING errors, a NEW gate error); the Studio Pro and lock refusals only print.
+Your move is one of three — **commit, wait, or stop and report** — never an override:
 
 | Refusal | Do this |
 |---|---|
 | Uncommitted model changes | Re-run with `--commit-first` (commits the `.mpr` + `mprcontents/` only), or commit them yourself, then re-run |
 | Studio Pro holds the model (also refuses `--commit-first`) | Stop. Ask the person to save (Cmd+S) and close the project; never kill Studio Pro |
-| Another session holds this project's exec lock | Wait for that run to finish, then re-run. A dead holder is taken over automatically — never `rm` the lock |
+| Another session holds this project's exec lock | The lock refuses at once; it does not queue. Re-run after the other apply finishes. A dead holder is taken over automatically — never `rm` the lock |
 | The mxbuild gate cannot run, even after its own download | Stop and report; run `bin/doctor.sh`. `ALLOW_UNVERIFIED=1` only when the person says so |
 | Pre-exec check or a NEW mxbuild error | Fix the script. That is the gate working |
+| `PRE-EXISTING <codes>` — errors already in the model before this script | Not the script's cause. Stop and report: it needs Studio Pro (e.g. "Update security") or a separate fix script, not a retry |
+| Any other refusal | Read the remedy exec.sh prints and do that; the table above is not the full list of guards |
 
 **Never set `FORCE_EXEC=1` on your own initiative** — only when the person tells you to, naming
 the risk. The failure it causes: an agent hits the uncommitted-model guard mid-loop, sets
@@ -342,13 +345,16 @@ between those two events.
 
 **The MCP write path stays allowed** where `learned-mdl-preflight.md` prescribes it (its
 Step 0 write-mode choice), and it is **accepted as unrecorded**: no exec row, no exec gate. Its record
-is the commit you make before the next exec (the pre-exec sequence below), with a message that
-starts `MCP:` and names what changed.
+is the commit you make before the next exec (the pre-exec sequence below, step 2), with a
+message that starts `MCP:` and names what changed.
 
-**Check before closing a phase:** every model-changing commit since the phase began is either
-covered by a BUILD-LOG row or is an `MCP:` commit. Count both: commits = exec rows + `MCP:`
-commits. A commit that is neither is a raw `mxcli exec` — re-run that script through exec.sh,
-or record why it cannot be.
+**Check before closing a phase:** every model-changing commit since the phase began is covered
+by one of three things — an `✅`/`⚠️ applied` BUILD-LOG row for the script it commits, a
+`--commit-first` commit (message `model: commit pending model changes before exec.sh …`), or an
+`MCP:` commit. Blocked and failed rows have no commit, so this is a coverage check, not an
+equality between counts. Done when all N model commits are covered, N of N. A commit covered by
+none of the three is a raw `mxcli exec` — re-run that script through exec.sh, or record why it
+cannot be.
 
 ### The gate checks the saved file — save, then check
 
@@ -364,15 +370,16 @@ The per-script apply grows with the model (field run, 2026-09-29: 22–30 s per
 first slice, 55–65 s in the second, almost all of it mxbuild). What the gate already saves:
 the pre-flight baseline mxbuild is skipped when the verification stamp says the model is
 unchanged since its last clean build, so a run of clean applies costs **one** mxbuild each, not
-two. Concurrent applies from parallel agents queue on the exec lock instead of colliding (two of
-eleven failed applies in that run were concurrent mxbuild collisions, from before the lock).
+two. A second apply while one is running is refused by the exec lock instead of colliding (two
+of eleven failed applies in that run were concurrent mxbuild collisions, from before the lock);
+re-run it after the other apply finishes.
 
 `exec.sh` has **no** batched-gate mode. Do not imitate one with `SKIP_CHECK`, `SKIP_BASELINE`,
 `FORCE_EXEC` or raw `mxcli exec` runs between gates — each of those is an unrecorded or
 unverified write. If gate time dominates, reduce the number of applies at the granularity level
 (see "Iterative Granularity": layer scripts rather than per-page ones where partial recovery is
 unlikely, fewer stub-then-fill passes), keep parallel **drafting**, and let the exec lock
-serialise the applies.
+refuse overlapping applies — re-run a refused one after the other finishes.
 
 ### Pre-exec sequence when MCP work was done
 
@@ -380,7 +387,7 @@ Before running exec.sh after any MCP session:
 
 ```
 1. Cmd+S in Studio Pro (or run save-sp.sh)
-2. git add MyProject.mpr mprcontents/ && git commit -m "Commit MCP changes before exec"
+2. git add MyProject.mpr mprcontents/ && git commit -m "MCP: <what changed>"
 3. Close the project in Studio Pro
 4. ./bin/exec.sh mdlsource/my-script.mdl
 ```
diff --git a/skills/learned-page-patterns.md b/skills/learned-page-patterns.md
index cc9813a6..a48ebe01 100644
--- a/skills/learned-page-patterns.md
+++ b/skills/learned-page-patterns.md
@@ -365,7 +365,8 @@ regressions, and about a fifth of the UI tokens went to round 2 repairing them.
    shares. One theme change fixes N pages; N page scripts fix N pages and drift.
 2. **Then the page scripts.** A drafter that has run `mxcli check` and `page-fidelity.js` on its
    script hands it over for applying with `./bin/exec.sh`. Do not pre-apply to a scratch copy
-   "to be sure": exec.sh's gate is that check, and its lock serialises parallel applies.
+   "to be sure": exec.sh's gate is that check. Its lock refuses a second apply while one runs — re-run after
+   the other apply finishes.
 3. **Re-look only the pages the round changed** — the list is the round's BUILD-LOG rows plus
    the pages an SCSS change reaches. Done when every page on that list has a fresh look
    (`ui-loop.md`), N of N.
diff --git a/skills/measured-claims.md b/skills/measured-claims.md
index a478bcb5..5047588b 100644
--- a/skills/measured-claims.md
+++ b/skills/measured-claims.md
@@ -256,6 +256,8 @@ the early ones carry a partial `output_tokens` (e.g. `[4, 2631]` — first recor
 
 **Rule: sum usage once per `message.id`, from that message's LAST record.** Deduplicating by id
 is right (summing every record double-counts); keeping the *first* record is the undercount.
+`bin/token-burn.sh` keeps the first record per id as of 2026-10-13, so its sub-agent output is
+low until that is fixed (a fix is in flight) — check its header before citing its output totals.
 
 **Cost:** a field comparison of two builds (2026-09-29) briefly concluded "the other build writes
 2.4x more output" — an artefact of reading partial records in both builds' sub-agents. A
diff --git a/skills/upstream-feedback.md b/skills/upstream-feedback.md
index 640c9edf..a030bdbc 100644
--- a/skills/upstream-feedback.md
+++ b/skills/upstream-feedback.md
@@ -42,6 +42,12 @@ would read them. The asks from that run, with what was measured:
 | Save before `mx check`; reload instead of full restart | 229 errors hidden until a real save; 23 restarts |
 | Flag a missing end-of-parallel-path element in the consistency check | observed in that run; no count recorded |
 
+Two more items from that run were dropped from the table on purpose. Both are advice to whoever
+runs an MCP build, not asks of the server, so no owner can act on them: (a) parallel drafting
+sub-agents with the lead as the single writer, which the toolkit already does; (b) commit scripts
+and results, add unit tests, and make timers and external-system failures testable, which the
+toolkit's own test skills cover.
+
 Done when each ask is either in a local draft with its evidence row, or recorded as dropped with
 a reason — none left only in a chat or an inbox note.
 
diff --git a/tests/wave2/test-init-autocompact.sh b/tests/wave2/test-init-autocompact.sh
index 958e0a79..1a683aae 100755
--- a/tests/wave2/test-init-autocompact.sh
+++ b/tests/wave2/test-init-autocompact.sh
@@ -11,6 +11,7 @@
 #
 # Usage: bash test-init-autocompact.sh [path-to-init-project.sh]
 # Fails against master's init-project.sh (no auto-compact line at all).
+# Cases 5-8 (unparseable, string, 20-digit, project+user) were added after review of the first cut.
 
 export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
 export MXTK_NO_GUIDE=1
@@ -24,7 +25,7 @@ trap 'rm -rf "$WORK" "$MXTK_LEAKGUARD_DENYFILE"' EXIT
 
 run() {   # $1 = case name, $2 = env value for CLAUDE_CODE_AUTO_COMPACT_WINDOW ("" = unset)
   local c="$1" envv="$2"
-  mkdir -p "$WORK/home-$c/.claude" "$WORK/proj-$c"
+  mkdir -p "$WORK/home-$c/.claude" "$WORK/proj-$c"   # pre-made dirs/files are kept
   if [ -n "$envv" ]; then
     env CLAUDE_CODE_AUTO_COMPACT_WINDOW="$envv" CLAUDE_CONFIG_DIR="$WORK/home-$c/.claude" \
       bash "$SUBJECT" "$WORK/proj-$c" </dev/null > "$WORK/out-$c" 2>&1
@@ -44,28 +45,55 @@ grep -q 'Recommended: /autocompact 250k' "$WORK/out-none" \
 
 rc=$(run env1m "1M")
 [ "$rc" -eq 0 ] && ok "env 1M: scaffold still exits 0 (advice, not a gate)" || bad "env 1M: scaffold exited $rc"
-grep -q 'WARNING: auto-compact window is above 250k (CLAUDE_CODE_AUTO_COMPACT_WINDOW=1M)' "$WORK/out-env1m" \
+grep -q 'WARNING: auto-compact window is above 250k: 1M (CLAUDE_CODE_AUTO_COMPACT_WINDOW)' "$WORK/out-env1m" \
   && ok "env 1M: warns and names the source" || bad "env 1M: no warning naming the env var"
 
 mkdir -p "$WORK/home-ok/.claude"
 printf '{\n  "modelSettings": {\n    "some-model": {\n      "autoCompactWindow": 250000\n    }\n  }\n}\n' \
   > "$WORK/home-ok/.claude/settings.json"
 run ok "" >/dev/null
-grep -q 'autoCompactWindow=250000 .*at or below 250k' "$WORK/out-ok" \
+grep -q 'Auto-compact window: 250000 (autoCompactWindow in .*at or below 250k' "$WORK/out-ok" \
   && ok "settings 250000: reported ok" || bad "settings 250000: not reported as ok"
 grep -q 'WARNING: auto-compact' "$WORK/out-ok" && bad "settings 250000: warned anyway" || ok "settings 250000: no warning"
 
 mkdir -p "$WORK/home-big/.claude"
 printf '{"autoCompactWindow":1000000}\n' > "$WORK/home-big/.claude/settings.json"
 run big "" >/dev/null
-grep -q 'WARNING: auto-compact window is above 250k (autoCompactWindow=1000000' "$WORK/out-big" \
+grep -q 'WARNING: auto-compact window is above 250k: 1000000 (autoCompactWindow in' "$WORK/out-big" \
   && ok "settings 1000000: warns" || bad "settings 1000000: no warning"
 
 rc=$(run garbage "1.5M")
 [ "$rc" -eq 0 ] && ok "unparseable env value: scaffold exits 0" || bad "unparseable env value: scaffold exited $rc (must never fail on advice)"
+grep -q 'unparseable: 1.5M' "$WORK/out-garbage" \
+  && ok "unparseable env value: reported as unparseable" || bad "unparseable env value: not reported (silence reads as 'none set')"
+grep -q 'none set' "$WORK/out-garbage" && bad "unparseable env value: printed 'none set' — false" || ok "unparseable env value: no false 'none set'"
+
+# A string value in settings ("1M") is a value, not an absence.
+mkdir -p "$WORK/home-str/.claude"
+printf '{"autoCompactWindow": "1M"}\n' > "$WORK/home-str/.claude/settings.json"
+run str "" >/dev/null
+grep -q 'WARNING: auto-compact window is above 250k: "1M"' "$WORK/out-str" \
+  && ok "settings string \"1M\": warns" || bad "settings string \"1M\": no warning"
+
+# A 20-digit number must not reach shell arithmetic (stderr noise / overflow).
+mkdir -p "$WORK/home-huge/.claude"
+printf '{"autoCompactWindow": 99999999999999999999}\n' > "$WORK/home-huge/.claude/settings.json"
+run huge "" >/dev/null
+grep -q 'WARNING: auto-compact window is above 250k: 99999999999999999999' "$WORK/out-huge" \
+  && ok "20-digit value: warns" || bad "20-digit value: no warning"
+grep -qiE 'value too great|syntax error|integer expression' "$WORK/out-huge" \
+  && bad "20-digit value: arithmetic error leaked to output" || ok "20-digit value: no arithmetic error"
+
+# Project settings ok, user settings 1M: BOTH are read, and the worse one warns.
+mkdir -p "$WORK/home-both/.claude" "$WORK/proj-both/.claude"
+printf '{"autoCompactWindow":250000}\n' > "$WORK/proj-both/.claude/settings.json"
+printf '{"autoCompactWindow":1000000}\n' > "$WORK/home-both/.claude/settings.json"
+run both "" >/dev/null
+grep -q 'WARNING: auto-compact window is above 250k: 1000000' "$WORK/out-both" \
+  && ok "project 250k + user 1M: user value still warns" || bad "project 250k + user 1M: user value not read once the project had one"
 
 # Never writes a setting.
-if grep -rqs 'autoCompactWindow' "$WORK"/proj-*/.claude 2>/dev/null; then
+if grep -rqs 'autoCompactWindow' $(ls -d "$WORK"/proj-*/.claude 2>/dev/null | grep -v '/proj-both/') 2>/dev/null; then
   bad "init wrote an autoCompactWindow setting into the project — it must only advise"
 else ok "nothing written: no autoCompactWindow in any scaffolded .claude/"; fi
 

From a1af5be9976b4ad625efca226110cb06837d7edb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:28:24 +0000
Subject: [PATCH 49/68] fix: follow-ups to #306 (baseline cost, CRLF, gate
 wording)

1. Baseline cost. skills/change-intake.md (1,804 words) went baseline for
   lead+ba at Stages 2-7 without paying for it elsewhere. It is now a
   299-word core (trigger, row columns, class -> entry artifact,
   size -> ask, owners, Done when). The why-table, the wrong-vs-right
   example, the full class/size/ask tables, apply and prove steps, the
   owners table and the gate-check explanation moved verbatim to new
   on-demand skills/change-intake-detail.md (lead, ba, architect;
   Stages 2-7), with a pointer from the core. Baseline tier
   79,997 -> 78,492 words (render-routing.sh --check, LC_ALL=C).

2. CRLF. mxtk_change_log_has_section never matched "## Change log\r",
   so on a CRLF PROJECT.md gate-check warned "no section",
   sync-project.sh appended a second empty section, and the scan counted
   0 rows. Both readers now drop a trailing \r (awk, so no grep -q
   SIGPIPE under the callers' pipefail). New fixture case T9; 5 of its
   cases fail on the previous change-log.sh. The fixture also drops
   pipefail, which made T7's "sync says what it appended" flaky.

3. Gate wording. "Done when" expected "0 of M ... not yet applied", a
   string gate-check never prints; it now names the PASS line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                   |   1 +
 README.md                      |   1 +
 ROUTING.md                     |   1 +
 agents/architect-agent.md      |   1 +
 agents/ba-agent.md             |   1 +
 bin/gate-check.sh              |  12 +--
 bin/lib/change-log.sh          |  11 ++-
 bin/lib/skill-routing.tsv      |   1 +
 skills/change-intake-detail.md | 150 ++++++++++++++++++++++++++++++++
 skills/change-intake.md        | 154 ++++++---------------------------
 tests/wave2/test-change-log.sh |  38 +++++++-
 11 files changed, 234 insertions(+), 137 deletions(-)
 create mode 100644 skills/change-intake-detail.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..fe0fb04d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(process): **follow-ups to the change log (#306): baseline cost, CRLF registers, gate wording.** (1) `skills/change-intake.md` went baseline for lead+ba at Stages 2–7 at 1,804 words without paying for it, against `render-routing.sh`'s "a new baseline row is paid for elsewhere" rule. It is now a 299-word core (trigger, row columns, class → entry artifact, size → ask, owners, Done when); the why-table, the wrong-vs-right example, the full tables, apply/prove steps, the owners table and the gate-check explanation moved verbatim to new on-demand `skills/change-intake-detail.md` (lead, ba, architect; Stages 2–7). Baseline tier 79,997 → 78,492 words (`render-routing.sh --check`, `LC_ALL=C`). (2) A `PROJECT.md` saved with CRLF line endings hid the section: `mxtk_change_log_has_section` never matched `## Change log\r`, so gate-check warned "no section", `sync-project.sh` appended a second empty one, and the scan counted 0 rows. Both readers in `bin/lib/change-log.sh` now drop a trailing `\r`; new fixture case T9 in `tests/wave2/test-change-log.sh` (CRLF copy scans, gates and syncs identically to the LF one; 5 of its cases fail on the previous code). The fixture also drops `pipefail`, which let an early-matching `grep -q` SIGPIPE its `printf` and fail T7 intermittently. (3) The skill's "Done when" expected `0 of M … not yet applied`, a string gate-check never prints; it now names the `PASS` line gate-check actually prints — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/README.md b/README.md
index 50f41d55..299231b6 100644
--- a/README.md
+++ b/README.md
@@ -511,6 +511,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 
 | Task | Skill to load |
 |---|---|
+| Applying or proving a change request (CR row), a change whose class, size or status is unclear, or a "Change log:" gate line to explain: full class/size/ask tables, the wrong-vs-right example, apply and prove steps, the owners table and what the warn-only gate check counts | `skills/change-intake-detail.md` |
 | Deep, adaptive interview on one topic, on demand, when a checkpoint's 2+1 or a single question batch isn't enough | `skills/grill-mode.md` |
 | CAC-1, closing Stage 0 in EVERY entry mode — scope IN: full scope or a slice, and in what order. Opens with a brainstorm, not options | `skills/checkpoints/checkpoint-scope.md` |
 | CAC-1b, after Stage 1 — scope OUT: is what extraction produced what you meant. No gate stops you; run it late against the BRDs if it was skipped | `skills/checkpoints/checkpoint-extraction.md` |
diff --git a/ROUTING.md b/ROUTING.md
index 2c55707c..a2c3d1da 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -38,6 +38,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Any pass whose input is missing, stale or unresolvable — before recording UNMEASURED, N/A or a silent skip: name what was missing, say what you assessed against instead, still deliver a verdict | `skills/degrade-to-judgement.md` | all | - | baseline |
 | Putting a question TO the user — any gate, any stage: ask in chat not in a file, two named options plus your recommendation, one batch per gate then end the turn | `skills/interview-protocol.md` | lead,ba,architect | P,0,1,2,3,4,5,6,7 | baseline |
 | The user gives feedback or asks for a change mid-project — "change X", "it also needs Y", a remark on a screenshot or the running app, a stakeholder's ask relayed in chat: log a CR row in PROJECT.md ## Change log BEFORE any edit, size it, then edit the highest artifact it alters (BRD, decision, architecture, wireframe), never the MDL first | `skills/change-intake.md` | lead,ba | 2,3,4,5,6,7 | baseline |
+| Applying or proving a change request (CR row), a change whose class, size or status is unclear, or a "Change log:" gate line to explain: full class/size/ask tables, the wrong-vs-right example, apply and prove steps, the owners table and what the warn-only gate check counts | `skills/change-intake-detail.md` | lead,ba,architect | 2,3,4,5,6,7 | ondemand |
 | Deep, adaptive interview on one topic, on demand, when a checkpoint's 2+1 or a single question batch isn't enough | `skills/grill-mode.md` | ba,architect | P,0,1,2,3,4,5,6,7 | ondemand |
 | Any stage transition — the 2+1 format every CAC uses, and the one-register rule (answers land in PROJECT.md, never in a separate state file). The seven CACs themselves are routed per stage in the situational table | `skills/checkpoints/checkpoint-template.md` | lead,ba,architect | 0,1,2,3,4,6,7 | baseline |
 | CAC-1, closing Stage 0 in EVERY entry mode — scope IN: full scope or a slice, and in what order. Opens with a brainstorm, not options | `skills/checkpoints/checkpoint-scope.md` | ba,architect | 0 | ondemand |
diff --git a/agents/architect-agent.md b/agents/architect-agent.md
index 5e6927a3..bada50f3 100644
--- a/agents/architect-agent.md
+++ b/agents/architect-agent.md
@@ -44,6 +44,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/tool-output-is-not-ground-truth.md` | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude |
 | `bin/status.sh` | The first command of every session, and any time someone asks "where are we" or "what next" — one screen: stage, done/overdue, the ONE next action, from the instruments, never from memory |
 | `skills/retesting-learned-rules.md` | Before obeying any learned-* STOP or workaround that costs a detour — probe the binary you actually have, then stamp the verdict back into the rule |
+| `skills/change-intake-detail.md` | Applying or proving a change request (CR row), a change whose class, size or status is unclear, or a "Change log:" gate line to explain: full class/size/ask tables, the wrong-vs-right example, apply and prove steps, the owners table and what the warn-only gate check counts |
 | `skills/grill-mode.md` | Deep, adaptive interview on one topic, on demand, when a checkpoint's 2+1 or a single question batch isn't enough |
 | `skills/checkpoints/checkpoint-scope.md` | CAC-1, closing Stage 0 in EVERY entry mode |
 | `skills/checkpoints/checkpoint-architecture.md` | CAC-3, after BRD validation and before architecture locks |
diff --git a/agents/ba-agent.md b/agents/ba-agent.md
index 92ef81ee..67383caf 100644
--- a/agents/ba-agent.md
+++ b/agents/ba-agent.md
@@ -56,6 +56,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/tool-output-is-not-ground-truth.md` | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude |
 | `bin/status.sh` | The first command of every session, and any time someone asks "where are we" or "what next" — one screen: stage, done/overdue, the ONE next action, from the instruments, never from memory |
 | `skills/retesting-learned-rules.md` | Before obeying any learned-* STOP or workaround that costs a detour — probe the binary you actually have, then stamp the verdict back into the rule |
+| `skills/change-intake-detail.md` | Applying or proving a change request (CR row), a change whose class, size or status is unclear, or a "Change log:" gate line to explain: full class/size/ask tables, the wrong-vs-right example, apply and prove steps, the owners table and what the warn-only gate check counts |
 | `skills/grill-mode.md` | Deep, adaptive interview on one topic, on demand, when a checkpoint's 2+1 or a single question batch isn't enough |
 | `skills/checkpoints/checkpoint-scope.md` | CAC-1, closing Stage 0 in EVERY entry mode |
 | `skills/checkpoints/checkpoint-extraction.md` | CAC-1b, after Stage 1 |
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index d24a021c..8095c342 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -1768,12 +1768,12 @@ stage_protocol_paths() {
     P)  echo "skills/interview-protocol.md skills/grill-mode.md skills/agent-roles.md skills/bootstrap-project.md skills/cloud-dev-environment.md skills/existing-app-change.md skills/app-analysis.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/platform-link.md" ;;
     0)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-scope.md skills/source-triage.md skills/image-transcription.md skills/small-project-tier.md skills/existing-app-change.md skills/app-analysis.md skills/layering-review.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/assess-migration.md skills/migration-pipeline.md skills/migrate-general.md skills/migrate-outsystems.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/qa-loop-goal-pattern.md skills/mendix-epics-api.md skills/corpus-extraction-integrity.md skills/gate-check-file-locations.md" ;;
     1)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-extraction.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/migration-pipeline.md skills/source-os11.md skills/os-xml-schema.md skills/source-node-express-react.md skills/document-discovery.md skills/extractor-quality-loop.md skills/kb-generation.md skills/corpus-extraction-integrity.md" ;;
-    2)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
-    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/agent-roles.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
-    4)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/small-project-tier.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/learned-constants-and-secrets.md" ;;
-    5|build-ready) echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/microflow-preflight.md skills/mendix-best-practices-index.md skills/ui-preflight-pages.md skills/design-spacing.md skills/learned-stylegallery.md skills/ui-loop.md skills/module-review.md skills/testing-shape.md skills/microflow-loop-antipatterns.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/learned-file-upload-widget.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
-    6)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/agent-roles.md skills/mendix-best-practices-index.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/app-analysis.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/share-demo-package.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
-    7)  echo "skills/interview-protocol.md skills/change-intake.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/close-the-loop.md skills/share-demo-package.md skills/handoff-to-studio-pro.md skills/platform-link.md skills/teamserver-alignment.md skills/deploy-to-sandbox.md" ;;
+    2)  echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/agent-roles.md skills/image-transcription.md skills/small-project-tier.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
+    3)  echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/agent-roles.md skills/small-project-tier.md skills/mendix-best-practices-index.md skills/layering-review.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
+    4)  echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/small-project-tier.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/learned-constants-and-secrets.md" ;;
+    5|build-ready) echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/microflow-preflight.md skills/mendix-best-practices-index.md skills/ui-preflight-pages.md skills/design-spacing.md skills/learned-stylegallery.md skills/ui-loop.md skills/module-review.md skills/testing-shape.md skills/microflow-loop-antipatterns.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/learned-file-upload-widget.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
+    6)  echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/agent-roles.md skills/mendix-best-practices-index.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/app-analysis.md skills/module-dependency-review.md skills/microflow-loop-antipatterns.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/unhappy-path-testing.md skills/monkey-test.md skills/e2e-locators-that-lie.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/share-demo-package.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md skills/teamserver-alignment.md skills/learned-constants-and-secrets.md" ;;
+    7)  echo "skills/interview-protocol.md skills/change-intake.md skills/change-intake-detail.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/close-the-loop.md skills/share-demo-package.md skills/handoff-to-studio-pro.md skills/platform-link.md skills/teamserver-alignment.md skills/deploy-to-sandbox.md" ;;
     *)  echo "" ;;
 # <!-- ROUTING:END -->
   esac
diff --git a/bin/lib/change-log.sh b/bin/lib/change-log.sh
index 6aefe476..bd2b5a8a 100644
--- a/bin/lib/change-log.sh
+++ b/bin/lib/change-log.sh
@@ -33,9 +33,17 @@ Feedback and change requests, one row each, written BEFORE any edit (`skills/cha
 EOF
 }
 
+# CRLF (2026-10-13 review of #306): a PROJECT.md saved on Windows ends every line in \r, so
+# '^## +change log *$' never matched — gate-check reported "no section" and sync-project.sh
+# appended a SECOND empty one; the scan likewise read 0 rows. Both readers drop a trailing \r
+# first, as gate-check.sh does for every table it reads (tr -d '\r'). awk, not tr | grep -q:
+# under the callers' pipefail an early-exiting grep -q can SIGPIPE the producer and turn a hit
+# into a miss.
+#
 # Usage: mxtk_change_log_has_section <PROJECT.md>   — rc 0 when the heading is present
 mxtk_change_log_has_section() {
-  [ -f "$1" ] && grep -qiE '^## +change log *$' "$1"
+  [ -f "$1" ] || return 1
+  awk '{ sub(/\r$/, "") } tolower($0) ~ /^## +change log *$/ { found = 1; exit } END { exit !found }' "$1"
 }
 
 # Usage: mxtk_change_log_scan <PROJECT.md>
@@ -53,6 +61,7 @@ mxtk_change_log_scan() {
     function trim(s) { gsub(/^[ \t]+|[ \t]+$/, "", s); return s }
     function clean(s) { gsub(/[*`]/, "", s); return trim(s) }
     function owe(id, st, why) { rows = rows sprintf("ROW\t%s\t%s\t%s\t%s\n", id, st, why, ask) }
+    { sub(/\r$/, "") }                          # CRLF register: see mxtk_change_log_has_section
     /<!--/ { incomment = 1 }
     incomment { if ($0 ~ /-->/) incomment = 0; next }
     /^## / { insec = (tolower($0) ~ /^## +change log *$/); next }
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index 200b80e4..2299fa62 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -74,6 +74,7 @@ skills-over-scripts	skills/skills-over-scripts.md	Before writing any .js or .sh
 degrade-to-judgement	skills/degrade-to-judgement.md	Any pass whose input is missing, stale or unresolvable — before recording UNMEASURED, N/A or a silent skip: name what was missing, say what you assessed against instead, still deliver a verdict	all	-	baseline	spine
 interview-protocol	skills/interview-protocol.md	Putting a question TO the user — any gate, any stage: ask in chat not in a file, two named options plus your recommendation, one batch per gate then end the turn	lead,ba,architect	P,0,1,2,3,4,5,6,7	baseline	spine
 change-intake	skills/change-intake.md	The user gives feedback or asks for a change mid-project — "change X", "it also needs Y", a remark on a screenshot or the running app, a stakeholder's ask relayed in chat: log a CR row in PROJECT.md ## Change log BEFORE any edit, size it, then edit the highest artifact it alters (BRD, decision, architecture, wireframe), never the MDL first	lead,ba	2,3,4,5,6,7	baseline	spine
+change-intake-detail	skills/change-intake-detail.md	Applying or proving a change request (CR row), a change whose class, size or status is unclear, or a "Change log:" gate line to explain: full class/size/ask tables, the wrong-vs-right example, apply and prove steps, the owners table and what the warn-only gate check counts	lead,ba,architect	2,3,4,5,6,7	ondemand	spine
 grill-mode	skills/grill-mode.md	Deep, adaptive interview on one topic, on demand, when a checkpoint's 2+1 or a single question batch isn't enough	ba,architect	P,0,1,2,3,4,5,6,7	ondemand	spine
 checkpoints	skills/checkpoints/checkpoint-template.md	Any stage transition — the 2+1 format every CAC uses, and the one-register rule (answers land in PROJECT.md, never in a separate state file). The seven CACs themselves are routed per stage in the situational table	lead,ba,architect	0,1,2,3,4,6,7	baseline	spine
 checkpoint-scope	skills/checkpoints/checkpoint-scope.md	CAC-1, closing Stage 0 in EVERY entry mode — scope IN: full scope or a slice, and in what order. Opens with a brainstorm, not options	ba,architect	0	ondemand	spine
diff --git a/skills/change-intake-detail.md b/skills/change-intake-detail.md
new file mode 100644
index 00000000..a05b0fcf
--- /dev/null
+++ b/skills/change-intake-detail.md
@@ -0,0 +1,150 @@
+# Change Intake — Detail: Why, Worked Example, Apply, Prove, Gate Check
+
+**Applies to:** any mxcli project with a `PROJECT.md` (migration, requirements-driven, greenfield, change an existing app), from Stage 2 onward.
+**Purpose:** the on-demand half of `change-intake.md`. That file is the baseline core every lead and ba-agent session reads (trigger, row format, class → entry artifact, size → ask, owners, Done when). Read this one when you apply or prove a change request, when a class, size or status is unclear, or when the `Change log:` gate line needs explaining.
+**Owns:** nothing on its own: `change-intake.md` owns the `## Change log` table in `PROJECT.md` and the classes, sizes and statuses. `conversion-runbook.md` §3b (drift-sync) is the BRD-flush step of this loop; `iterative-build-loop.md`, `close-the-loop.md` and `agent-roles.md` point at `change-intake.md`.
+
+**Trigger:** any message from the user that asks for something to be different from what the artifacts say or what was built, typed, pasted, relayed ("the finance lead wants..."), or said while looking at a screenshot or the running app. Not a trigger: answering a question you asked at a gate (that is `interview-protocol.md`), or a finding from a review pass (that is `finding-disposition.md`).
+
+---
+
+## Why this exists: the change went into MDL, every time
+
+Across 12 mid-build changes on real projects:
+
+| What happened | Count |
+|---|---|
+| Change applied straight in an MDL script | 12 of 12 |
+| BRD, build plan or wireframe updated for it | 0 of 12 |
+| `[sync: … UNSYNCED]` drift markers ever written | 0 |
+| One screenshot-driven fix: rounds before it stuck | 4 (it regressed twice, and every gate was green both times) |
+| One settled entity change sent through ba-agent twice and architect-agent once | ~270k tokens for a handful of document edits |
+
+The drift gate passed on all 12, because it looks for a marker and nobody wrote one. A missing marker looks the same as nothing to sync. The second failure is the opposite one: too much ceremony for a change that was already settled. This skill fixes the first with a row you write *before* the edit. It fixes the second by scaling the ceremony to the size of the change.
+
+### Wrong vs right, same request
+
+The user, looking at the running app: *"The customer form also needs a VAT number."*
+
+**Wrong (what happened 12 times):**
+```
+Sure — adding it now.
+  → mdlsource/0412-customer-vat.mdl   ALTER ENTITY + ALTER PAGE, exec, green
+PROJECT.md: no row.  F003.brd.json: no VAT.  wireframe: no field.  build plan: no step.
+Two sessions later a BRD-driven rebuild of the Customer page drops the field. Every gate is green.
+```
+
+**Right:**
+```
+Logged CR-07: requirement, small → F003.brd.json + Customer_Edit, then MDL.
+  1. PROJECT.md ## Change log: CR-07 row, status agreed (user typed it, small)
+  2. F003.brd.json: VATNumber attribute + its validation, a one-leaf edit by the lead
+  3. Customer_Edit page built → before/after screenshot pair in design/ui-reviews/
+  4. ./bin/exec.sh --cr CR-07 mdlsource/0412-customer-vat.mdl
+  5. Journey customer-edit asserts the field; CR-07 → proven, Closed-by: <commit>, journey customer-edit
+```
+The extra cost is two lines of text and one BRD leaf. The next agent that reads F003 gets VAT.
+
+---
+
+## Step 1 — Capture: one row, before any edit
+
+Append a row to `PROJECT.md` → `## Change log` (the one decision register; no separate file). If the section is missing, `bin/sync-project.sh <project-root>` adds it.
+
+```
+| CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by |
+|---|---|---|---|---|---|---|---|---|
+| CR-07 | 2026-10-13 | user | The customer form also needs a VAT number | requirement | S | F003.brd.json | agreed | |
+```
+
+- **CR**: `CR-` plus the next number. Never reuse a number.
+- **Source**: `user`, or the stakeholder's name and role as the user gave it (`stakeholder (finance lead)`).
+- **Verbatim ask**: the words as typed, not your summary. Your restatement goes in the reply (Step 3). Escape a pipe as `\|`.
+- One ask, one row. "Also make the button blue and add a VAT field" is two rows.
+
+## Step 2 — Classify and size
+
+**Class → entry artifact.** The entry artifact is the highest layer the change alters. It is never the MDL.
+
+| Class | What changed | Entry artifact |
+|---|---|---|
+| `requirement` | what the app must do or store | the BRD (`*.brd.json`), plus a decision row if it settles a choice |
+| `decision` | a choice recorded in `PROJECT.md` | a **new** `CONFIRMED` Decisions row whose Notes say `supersedes D-NN`, or `supersedes <stage>: <old decision, first words>` if the register does not number its decisions. The old row's Status becomes `SUPERSEDED by CR-NN`. Its text is never edited |
+| `structure` | module boundary, entity ownership, integration, security model | `architecture/` blueprint or the module brief |
+| `visual` | how a page looks or flows | the wireframe while the page is unbuilt. Once it is built: a before/after screenshot pair in `design/ui-reviews/`, and the wireframe gets a "BUILT, see ui-reviews" stamp instead of upkeep |
+| `impl` | how something is built, with no behaviour change | none: a regression journey only |
+| `bug` | the build does not do what an artifact already says | none: the artifact was right. Add a regression journey that fails before the fix |
+
+**Size.**
+
+| Size | Test (all must hold for S) |
+|---|---|
+| **S** | one artifact per layer, one module, contradicts no `CONFIRMED` decision |
+| **M** | several artifacts in a layer, or 2+ modules. Still contradicts nothing `CONFIRMED` |
+| **L** | a new feature or module, or it contradicts a `CONFIRMED` decision |
+
+## Step 3 — Who is asked, and when (ask, then stop)
+
+Asking follows `interview-protocol.md` §3. On Claude Code use `AskUserQuestion`. On any other agent use numbered markdown, as §3 "Asking on a non-Claude agent" describes. Either way, end the turn and wait.
+
+| Situation | Ask? | Status path | Who edits |
+|---|---|---|---|
+| **S**, typed by the user themselves | **No question.** Reply with a one-line receipt: `Logged CR-07: visual, small → wireframe + page` | straight to `agreed` | the lead, inline. No subagent |
+| **M** | Restate it in your reply (`refined`). Then **one batched question at the next module gate**: "Apply these N changes? CR-08, CR-09, CR-11" | `open` → `refined` → `agreed` at the gate | one `ba-agent` pass at the gate for the whole batch |
+| **L**, or it contradicts a `CONFIRMED` decision | **Ask and stop now**, before anything is built: the proposal, two named options, your recommendation | `refined` → `agreed` / `rejected` | re-enter the pipeline at the owning stage for that slice (Stage 2 for a new BRD, Stage 3 for structure) |
+| Stakeholder or relayed feedback, any size | Not on its own. It stays `open` until the user agrees or rejects. All such rows are surfaced together at the next gate | `open` → `agreed` / `rejected` | as for its size, after agreement |
+| The meaning is ambiguous | **One** "A or B?" question. It is the only mid-stream interruption this skill allows | `open` until answered | — |
+
+A row the user rejects is kept, with Status `rejected — <reason>`. A rejected ask that nobody can find gets asked for again.
+
+## Step 4 — Apply: top down, as far down as needed
+
+1. Edit the entry artifact (Step 2).
+2. Cascade down only to layers that *restate* what changed. Module briefs point to the BRD and do not copy it (`module-brief.md`), so most BRD edits need no brief edit. If the change adds or retires a build step, add or edit that row in the build plan.
+3. Then write the MDL and run it with `./bin/exec.sh --cr CR-NN <script>`. The tag lands in the BUILD-LOG detail cell, and that BUILD-LOG row is the evidence for Step 5.
+4. Set the status to `applied` and fill Closed-by with the commit that holds the artifact edit.
+
+**Owners** (this replaces the split that `agent-roles.md` lanes contradicted):
+
+| Duty | Owner |
+|---|---|
+| Write and update the CR row and any `PROJECT.md` decision row (the "mark") | the **lead**, the session talking to the user. Helpers report a change to the lead. They never write `PROJECT.md` from the build lanes |
+| Flush a BRD or a module brief (an M batch, or any deferred `[sync: … UNSYNCED]` marker) | **ba-agent** |
+| Flush a wireframe, `design/`, or `architecture/` | **architect-agent** (it owns `design/`) |
+| S edits to any of the above | the **lead**, inline |
+
+When the lead edits a BRD inline in the same session, no `UNSYNCED` marker is needed, because nothing was left unsynced. Use the marker (runbook §3b) only when a flush is deferred.
+
+## Step 5 — Prove
+
+Set the status to `proven` once Closed-by cites the evidence: the commit, plus the journey, test or screenshot pair that shows the change working. For a `bug` or an `impl` row, that is the regression journey. Never weaken or delete an existing journey to make a change pass. That needs its own CR row, which the user agrees to.
+
+---
+
+## The mechanical check (warn-only for now)
+
+`bin/gate-check.sh` prints a `Change log:` line next to `Drift (BRD sync):` and a row on the dashboard:
+
+```
+Change log: WARN — 2 of 6 change request(s) not yet applied (open 1, refined 0, agreed 1); 1 applied/proven with no Closed-by — warn-only (skills/change-intake.md)
+  CR-02  applied  no Closed-by evidence — Orders overview should be a gallery, not a grid
+```
+
+It counts `open`, `refined` and `agreed` rows, plus `applied`/`proven` rows with an empty Closed-by. It also flags any status outside the six words. It **never blocks.** It becomes blocking, for `agreed` rows still unapplied at a module gate, once two projects have run with it and its counts matched a hand count of their change logs. Until then a false FAIL would cost more than the WARN does. What it cannot see is an ask that was never logged: `0 change requests logged` is not proof that nothing changed. That gap is closed by the completion criteria below, not by the script.
+
+When nothing is owed the line is `PASS`, in one of two forms:
+
+```
+Change log: PASS — 0 change requests logged (a change made with no row is invisible here — log every ask first, skills/change-intake.md)
+Change log: PASS — 6 change request(s); every one applied with evidence, proven, or rejected
+```
+
+The first is not evidence that nothing changed (see above). The second is what `change-intake.md` → Done when means by "reads `PASS`".
+
+## Checking each Done-when line
+
+- **Asks → rows:** every change the user asked for in this session has a CR row. N asks give N rows. Count them in the transcript before you claim the module gate.
+- **No MDL before the row:** every `mdlsource/` script written for a CR was executed with `--cr CR-NN`. Its BUILD-LOG row shows `cr: CR-NN`.
+- **Gate line:** before a module gate, `Change log:` reads `PASS` (`N change request(s); every one applied with evidence, proven, or rejected`, or `0 change requests logged`), or every row it still lists under a `WARN` is named in your gate message with a reason.
+- **Evidence:** every `applied`/`proven` row has a Closed-by. Zero rows reported "no Closed-by evidence".
+- **Superseded, not edited:** every `decision` row has a new Decisions row. The old row's Status reads `SUPERSEDED by CR-NN`.
diff --git a/skills/change-intake.md b/skills/change-intake.md
index 2e0cb952..39f7e4b3 100644
--- a/skills/change-intake.md
+++ b/skills/change-intake.md
@@ -1,141 +1,37 @@
-# Change Intake — Feedback Typed in the Terminal, Logged Before It Is Built
+# Change Intake — Log Feedback Before You Build It
 
-**Applies to:** any mxcli project with a `PROJECT.md` (migration, requirements-driven, greenfield, change an existing app), from Stage 2 onward.
-**Purpose:** What to do the moment the user, or a stakeholder they relay, says "change X", "this also needs Y", "that page looks wrong": log it, size it, agree it at the right moment, edit the highest artifact it alters, and prove it. The MDL comes last, never first.
-**Owns:** the `## Change log` table in `PROJECT.md` and the classes, sizes and statuses below. `conversion-runbook.md` §3b (drift-sync) is the BRD-flush step of this loop and points here; `iterative-build-loop.md`, `close-the-loop.md` and `agent-roles.md` point here too.
+**Applies to:** any project with `PROJECT.md`, Stage 2 onward.
+**Purpose:** log a mid-project change before any edit, then edit the highest artifact it alters; MDL last. Why, example, apply/prove, gate check: `change-intake-detail.md`.
 
-**Trigger:** any message from the user that asks for something to be different from what the artifacts say or what was built, typed, pasted, relayed ("the finance lead wants..."), or said while looking at a screenshot or the running app. Not a trigger: answering a question you asked at a gate (that is `interview-protocol.md`), or a finding from a review pass (that is `finding-disposition.md`).
+**Trigger:** the user, or a relayed stakeholder, asks for anything to differ from artifacts or build. Not a gate answer or review finding.
 
----
+## Row first, in `PROJECT.md` `## Change log`
 
-## Why this exists: the change went into MDL, every time
+Columns: CR-NN (never reused), Date, Source, Verbatim ask (`\|` for a pipe), Class, Size, Entry artifact, Status, Closed-by. One ask, one row. Status: open → refined → agreed → applied → proven, or `rejected — reason` (kept).
 
-Across 12 mid-build changes on real projects:
+## Class → entry artifact (never the MDL)
 
-| What happened | Count |
-|---|---|
-| Change applied straight in an MDL script | 12 of 12 |
-| BRD, build plan or wireframe updated for it | 0 of 12 |
-| `[sync: … UNSYNCED]` drift markers ever written | 0 |
-| One screenshot-driven fix: rounds before it stuck | 4 (it regressed twice, and every gate was green both times) |
-| One settled entity change sent through ba-agent twice and architect-agent once | ~270k tokens for a handful of document edits |
+- **requirement** → BRD.
+- **decision** → new `CONFIRMED` row `supersedes D-NN`; old row's Status `SUPERSEDED by CR-NN`, text untouched.
+- **structure** → `architecture/` or module brief.
+- **visual** → wireframe while unbuilt; once built, before/after pair in `design/ui-reviews/`.
+- **impl**, **bug** → regression journey (a bug's fails first).
 
-The drift gate passed on all 12, because it looks for a marker and nobody wrote one. A missing marker looks the same as nothing to sync. The second failure is the opposite one: too much ceremony for a change that was already settled. This skill fixes the first with a row you write *before* the edit. It fixes the second by scaling the ceremony to the size of the change.
+## Size → ask (ask, then stop)
 
-### Wrong vs right, same request
+- **S** (one artifact per layer, one module, contradicts nothing `CONFIRMED`), user-typed: no question; receipt `Logged CR-07: visual, S → wireframe`, `agreed`, lead edits.
+- **M** (several artifacts or modules): restate (`refined`); one batched question at the module gate, one ba-agent pass.
+- **L** (new feature or module, or contradicts `CONFIRMED`): ask now (two options, a recommendation); re-enter the owning stage.
+- **Relayed**: `open` until the next gate asks. **Ambiguous**: one "A or B?".
 
-The user, looking at the running app: *"The customer form also needs a VAT number."*
+## Owners
 
-**Wrong (what happened 12 times):**
-```
-Sure — adding it now.
-  → mdlsource/0412-customer-vat.mdl   ALTER ENTITY + ALTER PAGE, exec, green
-PROJECT.md: no row.  F003.brd.json: no VAT.  wireframe: no field.  build plan: no step.
-Two sessions later a BRD-driven rebuild of the Customer page drops the field. Every gate is green.
-```
+Lead: all CR/decision rows, S edits; helpers never write `PROJECT.md`. ba-agent: BRDs, briefs. architect-agent: wireframes, `design/`, `architecture/`.
 
-**Right:**
-```
-Logged CR-07: requirement, small → F003.brd.json + Customer_Edit, then MDL.
-  1. PROJECT.md ## Change log: CR-07 row, status agreed (user typed it, small)
-  2. F003.brd.json: VATNumber attribute + its validation, a one-leaf edit by the lead
-  3. Customer_Edit page built → before/after screenshot pair in design/ui-reviews/
-  4. ./bin/exec.sh --cr CR-07 mdlsource/0412-customer-vat.mdl
-  5. Journey customer-edit asserts the field; CR-07 → proven, Closed-by: <commit>, journey customer-edit
-```
-The extra cost is two lines of text and one BRD leaf. The next agent that reads F003 gets VAT.
+## Done when
 
----
-
-## Step 1 — Capture: one row, before any edit
-
-Append a row to `PROJECT.md` → `## Change log` (the one decision register; no separate file). If the section is missing, `bin/sync-project.sh <project-root>` adds it.
-
-```
-| CR | Date | Source | Verbatim ask | Class | Size | Entry artifact | Status | Closed-by |
-|---|---|---|---|---|---|---|---|---|
-| CR-07 | 2026-10-13 | user | The customer form also needs a VAT number | requirement | S | F003.brd.json | agreed | |
-```
-
-- **CR**: `CR-` plus the next number. Never reuse a number.
-- **Source**: `user`, or the stakeholder's name and role as the user gave it (`stakeholder (finance lead)`).
-- **Verbatim ask**: the words as typed, not your summary. Your restatement goes in the reply (Step 3). Escape a pipe as `\|`.
-- One ask, one row. "Also make the button blue and add a VAT field" is two rows.
-
-## Step 2 — Classify and size
-
-**Class → entry artifact.** The entry artifact is the highest layer the change alters. It is never the MDL.
-
-| Class | What changed | Entry artifact |
-|---|---|---|
-| `requirement` | what the app must do or store | the BRD (`*.brd.json`), plus a decision row if it settles a choice |
-| `decision` | a choice recorded in `PROJECT.md` | a **new** `CONFIRMED` Decisions row whose Notes say `supersedes D-NN`, or `supersedes <stage>: <old decision, first words>` if the register does not number its decisions. The old row's Status becomes `SUPERSEDED by CR-NN`. Its text is never edited |
-| `structure` | module boundary, entity ownership, integration, security model | `architecture/` blueprint or the module brief |
-| `visual` | how a page looks or flows | the wireframe while the page is unbuilt. Once it is built: a before/after screenshot pair in `design/ui-reviews/`, and the wireframe gets a "BUILT, see ui-reviews" stamp instead of upkeep |
-| `impl` | how something is built, with no behaviour change | none: a regression journey only |
-| `bug` | the build does not do what an artifact already says | none: the artifact was right. Add a regression journey that fails before the fix |
-
-**Size.**
-
-| Size | Test (all must hold for S) |
-|---|---|
-| **S** | one artifact per layer, one module, contradicts no `CONFIRMED` decision |
-| **M** | several artifacts in a layer, or 2+ modules. Still contradicts nothing `CONFIRMED` |
-| **L** | a new feature or module, or it contradicts a `CONFIRMED` decision |
-
-## Step 3 — Who is asked, and when (ask, then stop)
-
-Asking follows `interview-protocol.md` §3. On Claude Code use `AskUserQuestion`. On any other agent use numbered markdown, as §3 "Asking on a non-Claude agent" describes. Either way, end the turn and wait.
-
-| Situation | Ask? | Status path | Who edits |
-|---|---|---|---|
-| **S**, typed by the user themselves | **No question.** Reply with a one-line receipt: `Logged CR-07: visual, small → wireframe + page` | straight to `agreed` | the lead, inline. No subagent |
-| **M** | Restate it in your reply (`refined`). Then **one batched question at the next module gate**: "Apply these N changes? CR-08, CR-09, CR-11" | `open` → `refined` → `agreed` at the gate | one `ba-agent` pass at the gate for the whole batch |
-| **L**, or it contradicts a `CONFIRMED` decision | **Ask and stop now**, before anything is built: the proposal, two named options, your recommendation | `refined` → `agreed` / `rejected` | re-enter the pipeline at the owning stage for that slice (Stage 2 for a new BRD, Stage 3 for structure) |
-| Stakeholder or relayed feedback, any size | Not on its own. It stays `open` until the user agrees or rejects. All such rows are surfaced together at the next gate | `open` → `agreed` / `rejected` | as for its size, after agreement |
-| The meaning is ambiguous | **One** "A or B?" question. It is the only mid-stream interruption this skill allows | `open` until answered | — |
-
-A row the user rejects is kept, with Status `rejected — <reason>`. A rejected ask that nobody can find gets asked for again.
-
-## Step 4 — Apply: top down, as far down as needed
-
-1. Edit the entry artifact (Step 2).
-2. Cascade down only to layers that *restate* what changed. Module briefs point to the BRD and do not copy it (`module-brief.md`), so most BRD edits need no brief edit. If the change adds or retires a build step, add or edit that row in the build plan.
-3. Then write the MDL and run it with `./bin/exec.sh --cr CR-NN <script>`. The tag lands in the BUILD-LOG detail cell, and that BUILD-LOG row is the evidence for Step 5.
-4. Set the status to `applied` and fill Closed-by with the commit that holds the artifact edit.
-
-**Owners** (this replaces the split that `agent-roles.md` lanes contradicted):
-
-| Duty | Owner |
-|---|---|
-| Write and update the CR row and any `PROJECT.md` decision row (the "mark") | the **lead**, the session talking to the user. Helpers report a change to the lead. They never write `PROJECT.md` from the build lanes |
-| Flush a BRD or a module brief (an M batch, or any deferred `[sync: … UNSYNCED]` marker) | **ba-agent** |
-| Flush a wireframe, `design/`, or `architecture/` | **architect-agent** (it owns `design/`) |
-| S edits to any of the above | the **lead**, inline |
-
-When the lead edits a BRD inline in the same session, no `UNSYNCED` marker is needed, because nothing was left unsynced. Use the marker (runbook §3b) only when a flush is deferred.
-
-## Step 5 — Prove
-
-Set the status to `proven` once Closed-by cites the evidence: the commit, plus the journey, test or screenshot pair that shows the change working. For a `bug` or an `impl` row, that is the regression journey. Never weaken or delete an existing journey to make a change pass. That needs its own CR row, which the user agrees to.
-
----
-
-## The mechanical check (warn-only for now)
-
-`bin/gate-check.sh` prints a `Change log:` line next to `Drift (BRD sync):` and a row on the dashboard:
-
-```
-Change log: WARN — 2 of 6 change request(s) not yet applied (open 1, refined 0, agreed 1); 1 applied/proven with no Closed-by — warn-only (skills/change-intake.md)
-  CR-02  applied  no Closed-by evidence — Orders overview should be a gallery, not a grid
-```
-
-It counts `open`, `refined` and `agreed` rows, plus `applied`/`proven` rows with an empty Closed-by. It also flags any status outside the six words. It **never blocks.** It becomes blocking, for `agreed` rows still unapplied at a module gate, once two projects have run with it and its counts matched a hand count of their change logs. Until then a false FAIL would cost more than the WARN does. What it cannot see is an ask that was never logged: `0 change requests logged` is not proof that nothing changed. That gap is closed by the completion criteria below, not by the script.
-
-## Done when (denominators)
-
-- **Asks → rows:** every change the user asked for in this session has a CR row. N asks give N rows. Count them in the transcript before you claim the module gate.
-- **No MDL before the row:** every `mdlsource/` script written for a CR was executed with `--cr CR-NN`. Its BUILD-LOG row shows `cr: CR-NN`.
-- **Gate line:** before a module gate, `Change log:` reads `0 of M … not yet applied`, or every remaining row is named in your gate message with a reason.
-- **Evidence:** every `applied`/`proven` row has a Closed-by. Zero rows reported "no Closed-by evidence".
-- **Superseded, not edited:** every `decision` row has a new Decisions row. The old row's Status reads `SUPERSEDED by CR-NN`.
+- N asks → N rows.
+- Every CR script ran via `./bin/exec.sh --cr CR-NN`.
+- At a module gate, `Change log:` reads `PASS`, or each listed row is named with a reason.
+- Zero "no Closed-by evidence" rows.
+- Decisions superseded, not edited.
diff --git a/tests/wave2/test-change-log.sh b/tests/wave2/test-change-log.sh
index 0755268e..0c5c7ab6 100755
--- a/tests/wave2/test-change-log.sh
+++ b/tests/wave2/test-change-log.sh
@@ -22,11 +22,16 @@
 #       --dry-run writes nothing
 #   T8  exec.sh --cr: a malformed id is refused (exit 2) before anything needs a project; a
 #       well-formed one passes through to --change-class; the BUILD-LOG detail carries "cr:"
+#   T9  CRLF PROJECT.md (saved on Windows): the section is found, the scan and the gate line
+#       match the LF copy exactly, and sync does not append a second section
 
 export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
 export MXTK_NO_GUIDE=1
 export MXTK_SYNC_SKIP_CLONE_CHECK=1
-set -uo pipefail
+# No pipefail, on purpose: every pipeline here is `printf "$OUT" | grep -q …`, and under pipefail a
+# grep -q that matches early can SIGPIPE printf on a long $OUT, turning a hit into a FAIL. Seen as
+# an intermittent "no sync message" in T7 (2026-10-13). No assertion reads an upstream exit code.
+set -u
 
 GATE="${1:?usage: test-change-log.sh /path/to/gate-check.sh}"
 case "$GATE" in /*) ;; *) GATE="$PWD/$GATE" ;; esac
@@ -188,6 +193,37 @@ OUT="$(cd "$WORK/empty" && bash "$EXEC" --cr CR-07 --change-class "$MDL" 2>&1)";
   || bad "--cr then --change-class: rc=$RC" "$OUT"
 grep -q 'cr: \$CR_ID' "$EXEC" && ok "BUILD-LOG detail carries 'cr: <id>'" || bad "BUILD-LOG detail has no cr tag"
 
+echo "== T9: CRLF register =="
+# Same rows as T2 on a fresh real scaffold, then every line ended in CRLF — what an editor on
+# Windows writes. Before the fix the heading regex never matched: has_section failed, the scan
+# counted 0 rows, gate-check said "no section", and sync-project.sh appended a second one.
+P9="$(mkproj t9)"; R9="$P9/PROJECT.md"
+add_rows "$R9" <<'EOF2'
+| CR-01 | 2026-10-13 | user | Customer also needs a VAT number | requirement | S | F003.brd.json | proven | abc1234, journey customer-edit |
+| CR-02 | 2026-10-13 | user | Orders overview should be a gallery, not a grid | visual | S | design/ui-reviews/orders | applied | |
+| CR-03 | 2026-10-13 | stakeholder (finance lead) | Approvals over 10k need a second approver | decision | L | PROJECT.md new row | open | |
+| CR-04 | 2026-10-13 | user | Search \| Reset buttons do nothing | bug | S | none | **agreed** | |
+EOF2
+LF_SCAN="$(mxtk_change_log_scan "$R9")"
+LF_LINE="$("$GATE" --no-html "$P9" 2>&1 | grep '^Change log:')"
+case "$LF_LINE" in "Change log: WARN — 2 of 4 change request(s) not yet applied (open 1, refined 0, agreed 1); 1 applied/proven with no Closed-by"*) ok "LF baseline: WARN, 2 of 4 pending + 1 without evidence" ;;
+  *) bad "LF baseline line" "$LF_LINE" ;; esac
+awk '{ printf "%s\r\n", $0 }' "$R9" > "$R9.crlf" && mv "$R9.crlf" "$R9"
+grep -q $'\r$' "$R9" && ok "precondition: PROJECT.md is CRLF" || bad "CRLF conversion failed"
+mxtk_change_log_has_section "$R9" && ok "has_section finds the heading in a CRLF file" || bad "has_section misses the CRLF heading"
+CR_SCAN="$(mxtk_change_log_scan "$R9")"
+[ "$CR_SCAN" = "$LF_SCAN" ] && ok "scan of the CRLF file = scan of the LF file" \
+  || bad "CRLF scan differs" "$(printf 'LF:\n%s\nCRLF:\n%s' "$LF_SCAN" "$CR_SCAN" | cat -A)"
+printf '%s\n' "$CR_SCAN" | grep -q $'\r' && bad "a \\r leaked into the scan output" || ok "no \\r in the scan output"
+CR_LINE="$("$GATE" --no-html "$P9" 2>&1 | grep '^Change log:')"
+[ "$CR_LINE" = "$LF_LINE" ] && ok "gate line on CRLF = gate line on LF ($LF_LINE)" \
+  || bad "gate line differs on CRLF" "$(printf 'LF:   %s\nCRLF: %s' "$LF_LINE" "$CR_LINE")"
+OUT="$("$SYNC" "$P9" 2>&1)"
+[ "$(count_heading "$R9")" = "1" ] && ok "sync on CRLF: still exactly one '## Change log'" \
+  || bad "sync on CRLF: $(count_heading "$R9") headings"
+printf '%s\n' "$OUT" | grep -q "appended the '## Change log' section" && bad "sync claims it appended a section to a CRLF file that has one" \
+  || ok "sync does not append to a CRLF file"
+
 echo ""
 echo "test-change-log: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]

From 1a7399632c69a0bea70627e08e18a72695a3a8ba Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:28:37 +0000
Subject: [PATCH 50/68] Review fixes: missing score file is manual; usage max
 per message id
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- extraction-report.sh: a code-extracted/mixed KB with no extraction-quality*.json
  is MANUAL ("not produced yet — no shipped pipeline writes a validator"), not a
  fault: nothing mandatory produces the file. Present-but-wrong files stay faults.
- token-burn.sh: per message.id take each usage counter's max over its records,
  so a later record with empty/zero usage cannot erase real numbers (fixture
  case added: fails on the previous commit). Window-name list renamed.
- extractor-quality-loop.md: comment that a fixture parses the example JSON.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  4 +--
 bin/extraction-report.sh                      | 11 ++++---
 bin/token-burn.sh                             | 31 ++++++++++---------
 skills/extractor-quality-loop.md              |  2 ++
 tests/wave2/fixtures/token-burn/CAPTURE.md    |  5 ++-
 .../fixtures/token-burn/effort/s-3.jsonl      |  1 +
 tests/wave2/test-extraction-quality-report.sh |  9 ++++--
 tests/wave2/test-token-burn.sh                |  4 ++-
 8 files changed, 42 insertions(+), 25 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1764be41..bc0a9d84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,8 +17,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(token-burn): **usage is taken from each `message.id`'s LAST record, not its first — subagent output was undercounted.** The header claimed every streamed record of a message carries the same usage; in subagent transcripts the early records carry a partial `output_tokens`. On the captured fixture the subagent model's output went 60 → 1,559 (headline 59,858 → 61,357); on a 2026-10 multi-agent session 37,791 → 84,915 subagent output tokens; a field measurement on harness 2.1.296 saw up to 7×. Main-thread records were identical first to last, so main numbers do not move. **Every existing subagent-heavy token count rises after sync**; fixture expectations re-derived independently (`tests/wave2/fixtures/token-burn/CAPTURE.md`) — found while promoting [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171) (measured-claims §7), MendixMau
-- new(extraction-report): **the Stage 1 surface now reads the validator's `extraction-quality*.json` — one row per dimension the file declares, a self-graded pass shown as a fault** ([#151](https://github.com/MendixMau/mxcli-project-toolkit/issues/151)). `extractor-quality-loop.md` makes that file the proof of the 95% gate, yet nothing read it: a field build scored its process-model extractor at 100% on 7 dimensions and the report showed "2 pass, 18 skipped" with no quality section. Found at `analysis/<src>/`, `analysis/<src>/extracted/` and the same two inside the KB; dimension keys come from the file. Faults only where the skill's rules show in the file: `selfGraded` + `passed`, `passed` under its own `threshold`, a 0/0 dimension absent from `confirmedZeros`, unparseable JSON. **Behaviour change for existing projects:** a code-extracted or mixed KB with no score file now carries one `fault` section (migration-pipeline.md does not start BRDs before the 95% gate, so an unscored extraction is unmeasured); documents KBs get `skipped`, the gate (`gate-check.sh`, presence of the page) and the exit code are unchanged. A score file inside `<kb>/extracted/` is no longer misread as an unparseable item file. No captured validator output exists in this repo (no pipeline ships a validator), so the fixture reads the skill's documented example at run time; `tests/wave2/test-extraction-quality-report.sh` — MendixMau
+- fix(token-burn): **usage per `message.id` is each counter's max over its records (in practice the last), not the first record's — subagent output was undercounted; a late empty record cannot erase real numbers.** The header claimed every streamed record of a message carries the same usage; in subagent transcripts the early records carry a partial `output_tokens`. On the captured fixture the subagent model's output went 60 → 1,559 (headline 59,858 → 61,357); on a 2026-10 multi-agent session 37,791 → 84,915 subagent output tokens; a field measurement on harness 2.1.296 saw up to 7×. Main-thread records were identical first to last, so main numbers do not move. **Every existing subagent-heavy token count rises after sync**; fixture expectations re-derived independently (`tests/wave2/fixtures/token-burn/CAPTURE.md`) — found while promoting [#171](https://github.com/MendixMau/mxcli-project-toolkit/issues/171) (measured-claims §7), MendixMau
+- new(extraction-report): **the Stage 1 surface now reads the validator's `extraction-quality*.json` — one row per dimension the file declares, a self-graded pass shown as a fault** ([#151](https://github.com/MendixMau/mxcli-project-toolkit/issues/151)). `extractor-quality-loop.md` makes that file the proof of the 95% gate, yet nothing read it: a field build scored its process-model extractor at 100% on 7 dimensions and the report showed "2 pass, 18 skipped" with no quality section. Found at `analysis/<src>/`, `analysis/<src>/extracted/` and the same two inside the KB; dimension keys come from the file. Faults only where the skill's rules show in the file: `selfGraded` + `passed`, `passed` under its own `threshold`, a 0/0 dimension absent from `confirmedZeros`, unparseable JSON. A code-extracted or mixed KB with no score file shows a `manual` section ("not produced yet — no shipped pipeline writes a validator"), not a fault: nothing mandatory produces the file yet; documents KBs get `skipped`; the gate (`gate-check.sh`, presence of the page) and the exit code are unchanged. A score file inside `<kb>/extracted/` is no longer misread as an unparseable item file. No captured validator output exists in this repo (no pipeline ships a validator), so the fixture reads the skill's documented example at run time; `tests/wave2/test-extraction-quality-report.sh` — MendixMau
 - new(token-burn): **`--rates`, `--windows`, `--effort`: cost at the project's own per-Mtok rates, agent working time, human prompt count, per-window attribution — aggregates only** ([#296](https://github.com/MendixMau/mxcli-project-toolkit/issues/296)). A field team had to answer "money and time per round and per feature" with ad-hoc transcript scripts. No price is built in (rates file, model globs, first match wins; an unmatched model is UNPRICED and the total marked incomplete, never 0); agent time = main-thread gaps <= `--gap` minutes (default 5) not ending at a human prompt; human prompts = `origin.kind == "human"` user records (task notifications, peer messages, tool results, meta and compact summaries excluded), once per uuid, text never printed. Without the new flags the new code adds nothing to screen, `--json` or `--brief` output (byte-identical to the previous script before the last-record fix below; fixture T9 asserts no new section or key). Field run on a real multi-day transcript: human prompts matched an independent count (89 = 89). The human-prompt fixture records are hand-built from a profile of real record shapes — committing a scrubbed real capture was refused; `tests/wave2/test-token-burn.sh` T9-T14 — jopterhorst
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/extraction-report.sh b/bin/extraction-report.sh
index 7117843b..62ea64a0 100755
--- a/bin/extraction-report.sh
+++ b/bin/extraction-report.sh
@@ -557,10 +557,13 @@ def analyse(kb):
             v = ('skipped', 'no extraction-quality*.json, and none is owed: a documents knowledge '
                             'base ran no extractor, so there is nothing for a validator to score.')
         elif prov in ('code-extracted', 'mixed'):
-            v = ('fault', f'an extractor produced this knowledge base ({prov}) but no '
-                          f'extraction-quality*.json was found ({QLOC}). extractor-quality-loop.md '
-                          f'makes that file the proof of the >=95% gate, and migration-pipeline.md '
-                          f'does not start BRDs before it — an unmeasured extraction, not a pass.')
+            # MANUAL, not fault: no shipped pipeline writes a validator, so nothing mandatory
+            # produces this file (CLAUDE.md "a producer for every consumer"). A present-but-wrong
+            # file stays a fault above.
+            v = ('manual', f'not produced yet — no shipped pipeline writes a validator; build one '
+                           f'per extractor-quality-loop.md, or waive the gate. An extractor produced '
+                           f'this knowledge base ({prov}) and no extraction-quality*.json was found '
+                           f'({QLOC}), so its quality is unmeasured, not passed.')
         else:
             v = ('manual', 'provenance undetermined — whether an extractor ran, and so whether a '
                            'score file is owed, needs a human.')
diff --git a/bin/token-burn.sh b/bin/token-burn.sh
index cc89e643..5a26321f 100755
--- a/bin/token-burn.sh
+++ b/bin/token-burn.sh
@@ -25,8 +25,9 @@
 # (2026-09-18, a 17,000-line toolkit session) and each one a silent miscount if ignored:
 #   1. The harness writes ONE RECORD PER STREAMED CONTENT BLOCK, all carrying the same
 #      `message.id` — that session had 4,336 assistant records for 1,989 messages, so summing
-#      records overcounts ~2×. Usage is summed ONCE per `message.id`, from that id's LAST
-#      record: the usage is NOT the same on every record. In subagent transcripts the early
+#      records overcounts ~2×. Usage is summed ONCE per `message.id`, taking each counter's
+#      MAX over that id's records (in practice the last record; a later record with an empty or
+#      zero usage cannot erase real numbers): the usage is NOT the same on every record. In subagent transcripts the early
 #      records carry a partial `output_tokens` (the captured fixture: 60 on the first record,
 #      1,559 on the last; a 2026-10 multi-agent session: 37,791 vs 84,915 subagent output
 #      tokens, first vs last). Keeping the first record undercounted subagent output by up to
@@ -245,7 +246,7 @@ day_model = defaultdict(lambda: defaultdict(int)) # day -> model -> headline
 sidechain = [0, 0]                                 # headline tokens: main, subagent
 n_files = n_records = n_synthetic = 0
 msgs = []                                          # (epoch, model, vals, is_sidechain) per message
-last, order = {}, []                               # message.id -> [first ts, model, LAST usage, sidechain]
+last, msg_order = {}, []                             # message.id -> [first ts, model, max usage, sidechain]
 human_seen = set()
 humans = []                                        # epoch per human prompt
 timeline = defaultdict(list)                       # main-thread file -> [(epoch, is_human)]
@@ -298,14 +299,16 @@ for d in dirs:
                 u = msg.get("usage") or {}
                 vals = [int(u.get(k) or 0) for k in KEYS]
                 if mid in seen:
-                    last[mid][2] = vals          # later record of the same message: its usage wins
+                    # later record of the same message: per-field max, so a later record's
+                    # larger (final) count wins but an empty/zero usage never erases real numbers
+                    last[mid][2] = [max(x, y) for x, y in zip(last[mid][2], vals)]
                     continue
                 seen.add(mid)
-                order.append(mid)
+                msg_order.append(mid)
                 last[mid] = [rec.get("timestamp") or "", model, vals, bool(rec.get("isSidechain"))]
 
-# one entry per message.id: first record's time, LAST record's usage (see header, fact 1)
-for mid in order:
+# one entry per message.id: first record's time, per-field max over its records (header, fact 1)
+for mid in msg_order:
     ts, model, vals, side = last[mid]
     day = ts[:10] or "????-??-??"
     for i, v in enumerate(vals):
@@ -431,12 +434,12 @@ if want_effort:
 win = None
 if windows:
     names = [BEFORE] + [w for _t, w, _r in windows]
-    order = []
+    win_names = []
     for n in names:
-        if n not in order:
-            order.append(n)
+        if n not in win_names:
+            win_names.append(n)
     win = {n: {"messages": 0, "usage": [0, 0, 0, 0], "cost": 0.0 if rates_file else None,
-               "unpriced": 0, "agent_seconds": 0, "human_prompts": 0} for n in order}
+               "unpriced": 0, "agent_seconds": 0, "human_prompts": 0} for n in win_names}
     starts = {}
     for t, n, raw in windows:
         starts.setdefault(n, raw)
@@ -453,15 +456,15 @@ if windows:
                 w["cost"] += c
     for t in humans:
         win[window_for(t)]["human_prompts"] += 1
-    for n in order:
+    for n in win_names:
         win[n]["agent_seconds"] = round(agent_seconds(lambda t, n=n: window_for(t) == n))
         if win[n]["cost"] is not None:
             win[n]["cost"] = round(win[n]["cost"], 4)
         win[n]["start"] = starts.get(n)
     if not any(win[BEFORE][k] for k in ("messages", "human_prompts", "agent_seconds")):
         del win[BEFORE]
-        order.remove(BEFORE)
-    win = {"order": order, "windows": win}
+        win_names.remove(BEFORE)
+    win = {"order": win_names, "windows": win}
 
 # --- output -------------------------------------------------------------------------------
 if mode == "json":
diff --git a/skills/extractor-quality-loop.md b/skills/extractor-quality-loop.md
index ae5ca148..bd45db53 100644
--- a/skills/extractor-quality-loop.md
+++ b/skills/extractor-quality-loop.md
@@ -151,6 +151,8 @@ Noting these as "BRD-only" in the quality report is correct and expected.
 
 ## Output Format: extraction-quality.json
 
+<!-- tests/wave2/test-extraction-quality-report.sh parses the json block below as its golden input — keep it valid JSON. -->
+
 ```json
 {
   "project": "ProjectName",
diff --git a/tests/wave2/fixtures/token-burn/CAPTURE.md b/tests/wave2/fixtures/token-burn/CAPTURE.md
index 4ea125bc..1b9f619e 100644
--- a/tests/wave2/fixtures/token-burn/CAPTURE.md
+++ b/tests/wave2/fixtures/token-burn/CAPTURE.md
@@ -91,7 +91,10 @@ The facts it encodes, each seen in that profile:
   wrappers whose text starts with `<`);
 - a human prompt record can be written twice with the same `uuid`.
 
-Plus one record whose `cwd` is outside the project and one `isSidechain: true` record.
+Plus one record whose `cwd` is outside the project, one `isSidechain: true` record, and a
+second `msg_e1` record at the same timestamp with all-zero usage (the instrument takes each
+counter's max per message id, so a late empty record cannot erase real numbers; day
+2026-09-20 totals stay 121 · 1500 · 30000 · 286 over 6 messages).
 Field proof is a run, not this file: on the real transcript profiled above the instrument
 counted the same number of human prompts (89) as an independent count of `origin.kind ==
 "human"`, non-meta, non-compact records.
diff --git a/tests/wave2/fixtures/token-burn/effort/s-3.jsonl b/tests/wave2/fixtures/token-burn/effort/s-3.jsonl
index 276bdf14..da1187c8 100644
--- a/tests/wave2/fixtures/token-burn/effort/s-3.jsonl
+++ b/tests/wave2/fixtures/token-burn/effort/s-3.jsonl
@@ -1,5 +1,6 @@
 {"type":"user","sessionId":"s-3","uuid":"h-1","parentUuid":null,"isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:00:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"human"},"promptSource":"sdk","message":{"role":"user","content":"[scrubbed]"}}
 {"type":"assistant","sessionId":"s-3","uuid":"a-1","parentUuid":"h-1","isSidechain":false,"timestamp":"2026-09-20T10:00:05.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e1","type":"message","role":"assistant","content":[{"type":"tool_use","id":"tu-1","name":"Tool","input":{}}],"usage":{"input_tokens":100,"cache_creation_input_tokens":1000,"cache_read_input_tokens":10000,"output_tokens":50}}}
+{"type":"assistant","sessionId":"s-3","uuid":"a-1b","parentUuid":"a-1","isSidechain":false,"timestamp":"2026-09-20T10:00:05.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e1","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0}}}
 {"type":"user","sessionId":"s-3","uuid":"t-1","parentUuid":"a-1","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:00:06.000Z","cwd":"/srv/example/proj","toolUseResult":"[scrubbed]","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"tu-1","content":"[scrubbed]"}]}}
 {"type":"assistant","sessionId":"s-3","uuid":"a-2","parentUuid":"t-1","isSidechain":false,"timestamp":"2026-09-20T10:01:06.000Z","cwd":"/srv/example/proj","message":{"model":"claude-fable-5-1","id":"msg_e2","type":"message","role":"assistant","content":[{"type":"text","text":"[scrubbed]"}],"usage":{"input_tokens":10,"cache_creation_input_tokens":0,"cache_read_input_tokens":20000,"output_tokens":200}}}
 {"type":"user","sessionId":"s-3","uuid":"n-1","parentUuid":"a-2","isSidechain":false,"userType":"external","timestamp":"2026-09-20T10:03:00.000Z","cwd":"/srv/example/proj","origin":{"kind":"task-notification"},"promptSource":"system","message":{"role":"user","content":"<scrubbed>"}}
diff --git a/tests/wave2/test-extraction-quality-report.sh b/tests/wave2/test-extraction-quality-report.sh
index 7da2f4e7..4a4bf375 100755
--- a/tests/wave2/test-extraction-quality-report.sh
+++ b/tests/wave2/test-extraction-quality-report.sh
@@ -14,7 +14,8 @@
 #       passed → `manual`; figures on the page (score, found/expected, gaps, confirmed zero)
 #   Q3  analysis/<src>/extracted/extraction-quality-<name>.json with the stack's OWN dimension
 #       keys, selfGraded + passed → `fault` "self-graded pass"
-#   Q4  code-extracted KB, no score file → `fault` (the loop is mandatory for an extractor)
+#   Q4  code-extracted KB, no score file → `manual` "not produced yet" (no shipped pipeline
+#       writes a validator, so nothing mandatory produces it — never green, never a fault)
 #   Q5  the score file inside <kb>/extracted/ is not counted as an unparseable item file
 #   Q6  a 0/0 dimension not in confirmedZeros → fault; the example's confirmed one is not
 #   Q7  passed:true under its own threshold → fault; broken JSON → fault, page still rendered
@@ -110,8 +111,10 @@ has "Q3 html stack's own key" "$H" ">labelRecall<"
 # --- Q4 / Q5 --------------------------------------------------------------------------------
 P4="$WORK/p4"; code_kb "$P4"
 J="$(run "$P4" --json)"
-[ "$(printf '%s' "$J" | jget 'b["sections"].get("extractionQuality")')" = fault ] \
-  && ok "Q4 code-extracted, no file → fault" || bad "Q4 code-extracted, no file → fault" "$J"
+[ "$(printf '%s' "$J" | jget 'b["sections"].get("extractionQuality")')" = manual ] \
+  && ok "Q4 code-extracted, no file → manual" || bad "Q4 code-extracted, no file → manual" "$J"
+O="$(run "$P4")"
+has "Q4 says not produced yet" "$O" "not produced yet — no shipped pipeline writes a validator"
 cp "$EXAMPLE" "$P4/analysis/src/knowledge-base/extracted/extraction-quality.json"
 J="$(run "$P4" --json)"
 hasnt "Q5 score file not read as an item array" "$J" "would not parse"
diff --git a/tests/wave2/test-token-burn.sh b/tests/wave2/test-token-burn.sh
index f815b083..19feb055 100755
--- a/tests/wave2/test-token-burn.sh
+++ b/tests/wave2/test-token-burn.sh
@@ -18,7 +18,8 @@
 #   T10 --rates: per-Mtok cost from a rates file, main vs subagent, a `*` catch-all
 #   T11 --rates with no line for a model: INCOMPLETE, total marked `+`, complete:false — never 0
 #   T12 --effort: agent working time and human prompt count over the captured main thread plus
-#       effort/s-3.jsonl (every user-record class); --gap changes the cut-off
+#       effort/s-3.jsonl (every user-record class); --gap changes the cut-off; a later
+#       record with zero usage for the same message.id leaves the real numbers intact
 #   T13 --windows: per-window messages, headline, agent time, prompts
 #   T14 malformed --rates / --windows file → exit 1 with the line number
 #
@@ -170,6 +171,7 @@ sed "s#/srv/example/proj#$P#g" "$FIX/effort/s-3.jsonl" > "$CFG12/projects/$(slug
 J12="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --json --effort 2>&1 | fold)"
 has "T12 4 human prompts (dup uuid once; meta, notification, peer, compact, tool result, <wrapper>, sidechain, foreign cwd excluded)" "$J12" '"human_prompts": 4'
 has "T12 agent seconds 591 (220 captured + 371)" "$J12" '"agent_seconds": 591'
+has "T12 a later zero-usage record of msg_e1 does not erase its usage (per-field max)" "$J12" '"2026-09-20": { "stage": "2", "usage": [121, 1500, 30000, 286, 6] }'
 S12="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --effort 2>&1)"
 has "T12 screen line" "$S12" "agent working time: 0h 10m (main thread, gaps <= 5 min, gaps ending at a human prompt excluded) · human prompts: 4"
 J12g="$(CLAUDE_CONFIG_DIR="$CFG12" bash "$SUT" "$P" --json --gap 1 2>&1 | fold)"

From 84dc6b6ade1e3d8e5c084289574cc7a77689df15 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:29:25 +0000
Subject: [PATCH 51/68] =?UTF-8?q?report:=20per-BRD=20conformance=20?=
 =?UTF-8?q?=E2=80=94=20any=20suffix,=20BRD-prefixed=20pointers,=20captured?=
 =?UTF-8?q?=20golden?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pickConformanceFiles accepts report-<date>-<any suffix>.tsv: the
  narrower class dropped "report-<date>-F003 shipping.tsv" (a BRD id with
  a space, which #307's own fixture writes) and fell back to an older
  base file — the stale-report bug again.
- collectConformance strips a leading "<BRD>:" from the pointer, so a
  per-BRD row keeps requirement "/x" (was null for every per-BRD row);
  the BRD stays in the check id, so one pointer in two BRDs stays two.
- Golden: tests/wave2/fixtures/conformance-per-brd/ is conformance-check.sh's
  real output (PR #307, 8fc7c6a) on that PR's per-BRD fixture layout;
  case 3 of test-report-normalize-two-tree.sh reads it (fails on master
  and on the previous commit). report-schema.md: any suffix of the newest
  date is joined.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 project-tests/e2e/report-normalize.js         | 23 +++++++++++++++++--
 skills/report-schema.md                       |  8 ++++---
 .../fixtures/conformance-per-brd/CAPTURE.txt  |  9 ++++++++
 .../report-2026-10-13-F001-orders.tsv         |  3 +++
 .../report-2026-10-13-F002-invoicing.tsv      |  3 +++
 .../report-2026-10-13-F003 shipping.tsv       |  3 +++
 tests/wave2/test-report-normalize-two-tree.sh | 20 +++++++++-------
 8 files changed, 57 insertions(+), 14 deletions(-)
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
 create mode 100644 tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f103734..c08dde8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date and aggregates every file of that date; single-file projects are unchanged (`--selftest` cases plus case 3 of `test-report-normalize-two-tree.sh`). Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
+- fix(journeys): **the #302 preflight no longer refuses a password the project set in `project.config.js`; only the template placeholder is refused.** As shipped, #302 refused every run whose `TEST_PASS`/`APP_PASS` was not in the environment unless `ALLOW_CONFIG_CREDENTIALS=1` was set. But `project.config.template.js` tells every project to put its real demo password in `DEFAULT_PASS`, nothing in the toolkit loads an env file before `verify-module.sh` runs the journeys, and `sync-project.sh` refreshes unedited runner/config copies. So after the next sync every journeys rung would have faulted with rc 2. Now `config.js` reports `passSource` (`env` / `project.config.js` / `template placeholder`) and only the template's placeholder (`Demo2025!`) is refused. The env still wins, and `ALLOW_CONFIG_CREDENTIALS=1` still overrides. **Verdict change to know about from #302:** a refused admin credential (HTTP 401/403) used to leave every data rung INVALID with exit 1; the suite now aborts before the first journey with exit 2. A SIGINT/SIGTERM now writes the findings slot as `aborted: "signal SIGINT"` instead of leaving the previous run's file there. `report-normalize.js` keeps `rung: 'setup'` rows as kind `setup` instead of folding them into `ui` (`report-schema.md` enum updated). It also honours `aborted` in a findings file: the report gets a top-level `aborted`, every kept journey row is flagged `notAResult`, and the journey-runner instrument is a fault, so an aborted run never reads as results. It also reads the per-BRD conformance reports `report-<date>-<BRD>.tsv` that conformance-check now writes ([#307](https://github.com/MendixMau/mxcli-project-toolkit/pull/307)). It used to keep only `report-<date>.tsv`, so per-BRD modules never reached report.json and a stale base file could show as measured. It now takes the newest date among `report-<date>[-<any suffix>].tsv` and aggregates every file of that date, including BRD ids that contain a space. A per-BRD pointer `<BRD>:`/x`` keeps its requirement `/x`. Single-file projects are unchanged. Golden input: conformance-check.sh's real per-BRD output on #307's own fixture layout (`tests/wave2/fixtures/conformance-per-brd/`), plus `--selftest` cases and case 3 of `test-report-normalize-two-tree.sh`. Fixtures: `test-journey-preflight.sh` 74 cases (9 new, all failing on the #302 code: project-set password runs, placeholder refuses, env wins, SIGINT writes aborted findings end to end) and `report-normalize.js --selftest` cases (setup kind, aborted run). Refs [#286](https://github.com/MendixMau/mxcli-project-toolkit/issues/286) — MendixMau
 - fix(e2e): **`helpers.js` reads OQL rows by SELECT alias, never by position.** `mxcli oql --direct --json` prints keys alphabetically, leaves out a column that is null in every row, and over a view entity adds `ID` beside the alias. `Object.values(r)` therefore shifted columns, and `oqlScalar` returned a view row's ID instead of its count; a string value holding `]` or `}` truncated the brace-counting slice, so a real answer read as "no measurement" ([#154](https://github.com/MendixMau/mxcli-project-toolkit/issues/154), card-disbursement build). Rows are now keyed by the parsed SELECT aliases in SELECT order with explicit nulls, `oqlScalar` reads the first alias (null rather than a guess when the list has no alias), new `oqlRows`, string-aware JSON slicing; the admin preflight uses the same parser. **Behaviour change to check in your project:** `oqlScalar` now returns the **first SELECT alias**, where it used to return the alphabetically-first key. A multi-column seed, scope capture or baseline query whose value flows into `{{vars}}` may now resolve to a different column. Put the column you mean first, or make the query single-column. Golden: the released mxcli v0.26.0 binary's verbatim stdout/stderr for four queries against a stub admin API (`tests/wave2/fixtures/oql-json/`); fixture `tests/wave2/test-oql-rows.sh` (15 cases, 0/15 on the old helper). No live-app field run yet — MendixMau
 - fix(e2e): **a negative-only span claim is judged against a liveness reference, and an app that dies mid-suite reads APP-DOWN, not FAIL.** A `mustNotFire`-only step (Cancel on a reset confirmation) captures zero spans, which also happens when Jaeger is down, so it was INVALID on every run and its control mutant was unsupported ([#150](https://github.com/MendixMau/mxcli-project-toolkit/issues/150)). Rung 2 now waits the full window and requires a declared `spans.liveness` span or any service span since the journey began (`otel.js liveness`; the window starts at the journey's own start with a 2 s clock-skew margin); no evidence stays INVALID. An `otel.js` older than the runner, i.e. a hand-edited copy kept by sync, reads INVALID naming the stale file instead of throwing a TypeError. The `trace-negative` mutant injects the forbidden name after that check. A `spans` block declaring neither `ordered` nor `mustNotFire` is now a loud INVALID instead of a silent skip; the array shape `[{mf,status}]` and `{}` are named as such. `examples/validate-journeys.js` accepts a negative-only claim, which it used to reject as "NEVER checked" (contradicting the runner). It also checks the new `spans.liveness` field (only read for a negative-only claim) and a `mustNotFire` that is not a valid regex. `skills/journey-examples.md` documents the liveness rule. Fixture `tests/wave2/test-validate-journeys-spans.sh` (12 cases, 8 fail on the old validator). The shipped `project-tests/e2e/example.journey.json` is rewritten into the shape the runner reads. Its `name`/`role`, `value` seed, `page`/`expectPage`/`expectText`/`click` steps, array-shaped `spans` and SQL-style `<module>$<entity>` queries had drifted from it: the validator reported 3 problems on it, now 0, and all 7 control mutants are supported on it. Between journeys the runner probes `baseUrl` (3 tries); down before a journey → `APP-DOWN` INVALID, not walked; down after one → its FAIL rows are flagged ([#285](https://github.com/MendixMau/mxcli-project-toolkit/issues/285) harness half; a watch rebuild took a runtime down mid-suite on 2026-10-12). `APP_PROBE=0` disables it. Fixture `tests/wave2/test-journey-liveness.sh` (36 cases over the captured Jaeger trace and a real local HTTP server); main-loop wiring not fixtured (needs a browser), no field run yet — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index 21b8e895..3082887b 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -1391,8 +1391,12 @@ function collectConformance(input, ctx) {
     // the decoration is reading it, not inventing it (rule 4). Anything that does not
     // start with "/" after stripping is NOT treated as a pointer — better null than a
     // synthesised one.
+    // Per-BRD reports prefix the pointer with its BRD: "F001-orders:`/microflows/0`" (a BRD id
+    // may hold a space). The prefix is stripped for the requirement and kept in the id, so the
+    // same pointer in two BRDs stays two checks.
     const cleaned = pointerRaw.replace(/`/g, '').replace(/\s*\(\d+\)\s*$/, '').trim();
-    const requirement = cleaned.startsWith('/') ? cleaned : null;
+    const pointer = cleaned.replace(/^[^/:]+:(?=\/)/, '');
+    const requirement = pointer.startsWith('/') ? pointer : null;
 
     let id = `conformance/${slug(mod)}/${slug(cleaned || pointerRaw)}`;
     let bump = 1;
@@ -1434,7 +1438,9 @@ function collectConformance(input, ctx) {
 // and report-<date>-<BRD>.tsv, and every file of that date (sorted). A per-BRD run and an
 // older single-file run never mix: only the newest date is read.
 function pickConformanceFiles(names) {
-  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-[A-Za-z0-9_.-]+)?\.tsv$/;
+  // Any suffix: a BRD id may hold a space (conformance-check writes report-<date>-F003 shipping.tsv);
+  // a narrower class dropped that file and the stale-report bug came back.
+  const re = /^report-(\d{4}-\d{2}-\d{2})(?:-.+)?\.tsv$/;
   const hits = names.map(n => [n, re.exec(n)]).filter(([, m]) => m);
   if (!hits.length) return { date: null, files: [] };
   const date = hits.map(([, m]) => m[1]).sort().pop();
@@ -2642,10 +2648,23 @@ function selftest() {
   t('per-BRD files of the newest date, all of them; a stale older base file is ignored',
     pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F002.tsv', 'report-2026-10-12-F001.tsv', 'report-2026-10-01-F001.tsv']),
     { date: '2026-10-12', files: ['report-2026-10-12-F001.tsv', 'report-2026-10-12-F002.tsv'] });
+  t('a BRD id with a space is a per-BRD file, never dropped for an older base file',
+    pickConformanceFiles(['report-2026-09-30.tsv', 'report-2026-10-12-F003 shipping.tsv']),
+    { date: '2026-10-12', files: ['report-2026-10-12-F003 shipping.tsv'] });
   t('no report files → none', pickConformanceFiles(['readme.txt']), { date: null, files: [] });
   const confMulti = normalize({ ...base, conformance: { status: 'ok', path: 'a, b',
     text: 'module\tpointer\tstored\tobserved\tverdict\nOrders\t/x\t1\t1\tOK\n' +
           '\nmodule\tpointer\tstored\tobserved\tverdict\nBilling\t/y\t2\t3\tSTALE\n' } });
+  const confBrd = normalize({ ...base, conformance: { status: 'ok', path: 'r.tsv',
+    text: 'module\tpointer\tstored\tobserved\tverdict\tcommand\n' +
+          'Shipping\tF003 shipping:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW S.A\n' +
+          'Orders\tF001-orders:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW O.A\n' +
+          'Orders\tF002-invoicing:`/microflows/0`\tbuilt\tPRESENT\tOK\tDESCRIBE MICROFLOW O.B\n' } });
+  const brdChecks = confBrd.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance');
+  t('a per-BRD pointer "<BRD>:`/x`" keeps its requirement (/x), BRD id with a space included',
+    brdChecks.map(c => c.requirement), ['/microflows/0', '/microflows/0', '/microflows/0']);
+  t('the same pointer in two BRDs stays two distinct checks (BRD kept in the id)',
+    new Set(brdChecks.map(c => c.id)).size === 3 && brdChecks.every(c => !/~/.test(c.id)), true);
   t('concatenated per-BRD reports yield both modules',
     confMulti.checks.filter(c => c.instrument === 'conformance' && c.kind === 'conformance').map(c => c.module).sort(), ['Billing', 'Orders']);
 
diff --git a/skills/report-schema.md b/skills/report-schema.md
index 29365c6f..890d5ccd 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -143,9 +143,11 @@ any real project. The **Deriving the values** section says where each one actual
     { "name": "positive-control", "verdict": "fault",   "reason": "not requested (--positive-control absent)" },
     { "name": "monkey",           "verdict": "skipped", "reason": "--skip-monkey" },
     { "name": "conformance",      "verdict": "pass",    "log": "docs/conformance/report-<date>.tsv" }
-      // conformance reads the NEWEST date among report-<date>.tsv and the per-BRD
-      // report-<date>-<BRD>.tsv files, and every file of that date (rows concatenated;
-      // "log" then lists them comma-separated). An older date is never mixed in.
+      // conformance reads the NEWEST date among report-<date>.tsv and report-<date>-<suffix>.tsv
+      // (any suffix — conformance-check writes one per BRD, and a BRD id may hold a space), and
+      // joins EVERY file of that date (rows concatenated; "log" lists them comma-separated). An
+      // older date is never mixed in. A per-BRD pointer "<BRD>:`/x`" gives requirement "/x";
+      // the BRD stays in the check id.
   ],
 
   // Rollups have denominators, so they are not checks.
diff --git a/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt b/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
new file mode 100644
index 00000000..61afad9c
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/CAPTURE.txt
@@ -0,0 +1,9 @@
+Captured 2026-10-13, verbatim: the three report-<date>-<BRD>.tsv files that
+project-bin/conformance-check.sh writes on PR #307's branch (fix/graph-sweep-conformance,
+commit 8fc7c6a), run unscoped (`conformance-check.sh --quiet`, rc 0, "measured 6") on the
+single-tree layout that PR's own fixture builds (tests/wave2/test-conformance-per-brd-ledger.sh,
+setup single: Orders with per-BRD ledgers F001-orders and F002-invoicing, Shipping with
+"F003 shipping" — a BRD id with a space). The ledgers and the mxcli stub there are that
+fixture's; the TSVs are conformance-check.sh's real output. Pointers are written
+<BRD>:`/json/pointer`. Read by tests/wave2/test-report-normalize-two-tree.sh case 3.
+Re-capture when conformance-check.sh's report format changes.
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
new file mode 100644
index 00000000..4653011f
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F001-orders.tsv
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Orders	F001-orders:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Orders.Order
+Orders	F001-orders:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Orders.ACT_Order_Save
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
new file mode 100644
index 00000000..bda59b28
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F002-invoicing.tsv
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Orders	F002-invoicing:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Orders.Invoice
+Orders	F002-invoicing:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Orders.ACT_Invoice_Send
diff --git a/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv
new file mode 100644
index 00000000..ef161808
--- /dev/null
+++ b/tests/wave2/fixtures/conformance-per-brd/report-2026-10-13-F003 shipping.tsv	
@@ -0,0 +1,3 @@
+module	pointer	stored	observed	verdict	command
+Shipping	F003 shipping:`/domainEntities/0`	built	PRESENT	OK	DESCRIBE ENTITY Shipping.Parcel
+Shipping	F003 shipping:`/microflows/0`	built	PRESENT	OK	DESCRIBE MICROFLOW Shipping.ACT_Parcel_Send
diff --git a/tests/wave2/test-report-normalize-two-tree.sh b/tests/wave2/test-report-normalize-two-tree.sh
index 203581ae..6438c14e 100644
--- a/tests/wave2/test-report-normalize-two-tree.sh
+++ b/tests/wave2/test-report-normalize-two-tree.sh
@@ -93,18 +93,22 @@ else
 fi
 
 # --- 3. per-BRD conformance reports (conformance-check writes report-<date>-<BRD>.tsv) ---------
-# The newest date wins and every BRD file of that date is read; an older single-file report is
-# not mixed in (it used to be the ONLY file read, shown as measured although stale).
+# Golden: fixtures/conformance-per-brd/ — conformance-check.sh's real output on PR #307's own
+# per-BRD fixture layout (see its CAPTURE.txt), including a BRD id with a space. The newest date
+# wins and every file of that date is read; the older single-file report is not mixed in (it
+# used to be the ONLY file read, shown as measured although stale).
+GOLD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fixtures/conformance-per-brd"
 P="$WORK/perbrd"; lay_out "$P" "$P"
 rm -f "$P/docs/conformance/"report-*.tsv
-printf 'module\tclaim\tstored\tobserved\tverdict\nStale\t/old\t1\t1\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
-printf 'module\tclaim\tstored\tobserved\tverdict\nOrders\t/useCases\t3\t3\tOK\n' > "$P/docs/conformance/report-2026-10-12-F001.tsv"
-printf 'module\tclaim\tstored\tobserved\tverdict\nBilling\t/pages\t2\t4\tUNDERSTATED\n' > "$P/docs/conformance/report-2026-10-12-F002.tsv"
+cp "$GOLD"/report-*.tsv "$P/docs/conformance/"
+printf 'module\tpointer\tstored\tobserved\tverdict\nStale\t`/old`\tbuilt\tPRESENT\tOK\n' > "$P/docs/conformance/report-2026-09-26.tsv"
 ( cd "$P/tests/e2e" && node report-normalize.js --out docs/report.json ) >"$WORK/out3" 2>&1
 if [ -s "$P/docs/report.json" ]; then
-  mods="$(node -e 'const r=require(process.argv[1]); console.log(r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance").map(c=>c.module).sort().join(","))' "$P/docs/report.json")"
-  [ "$mods" = "Billing,Orders" ] && ok "per-BRD reports of the newest date are all read (Billing, Orders); the older single file is not" \
-    || bad "per-BRD conformance reports not aggregated" "$mods"
+  got="$(node -e 'const r=require(process.argv[1]); const c=r.checks.filter(c=>c.instrument==="conformance"&&c.kind==="conformance");
+    console.log([c.length, [...new Set(c.map(x=>x.module))].sort().join(","), c.every(x=>x.requirement && x.requirement.startsWith("/")), c.some(x=>/shipping/i.test(x.id))].join("|"))' "$P/docs/report.json")"
+  [ "$got" = "6|Orders,Shipping|true|true" ] \
+    && ok "all 3 per-BRD reports of the newest date read (6 rows, incl. 'F003 shipping'); every row keeps its /pointer requirement; the stale file is not read" \
+    || bad "per-BRD conformance reports not read as captured (rows|modules|requirements set|space BRD read)" "$got"
 else
   bad "per-BRD: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out3" | cut -c1-300)"
 fi

From 530b2171a3a567e6f6acea11338f06f8dfd532ac Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:30:28 +0000
Subject: [PATCH 52/68] fix(routing): pipefail + grep -q false negatives (CI
 flake)

`grep -q` exits on its first match; a producer still writing into the pipe
then dies of SIGPIPE (141), and under `set -o pipefail` the pipeline reports
failure, so "found" reads as "not found". render-routing.sh --check runs
routing_unrouted_skills under `set -euo pipefail` and pipes a ~4.8 KB
routed-path list (two stdio writes) into `grep -qxF`; the race made it
report routed skills as UNROUTED at random.

Measured on the real table: 15/100 calls of routing_unrouted_skills named
a routed skill on master, 0/100 after.

Replace every `producer | grep -q` that runs under pipefail (directly, or
sourced by a pipefail script) in the non-owned scripts with a here-string,
which bash writes in full before grep starts: 28 sites in 12 scripts.
gate-check's `find_artifact ... | grep -q .` lines are left: find_artifact
ends in `-print -quit`, one line, no race.

New fixture tests/wave2/test-pipefail-grep-q.sh puts the match first and
1 MB after it, making the race deterministic: fails 10/10 on master,
passes after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |   1 +
 bin/check-portability.sh                |   4 +-
 bin/gate-check.sh                       |  10 +--
 bin/lib/obligation-check.sh             |   8 +-
 bin/lib/skill-routing.sh                |   4 +-
 bin/lib/triage-template.sh              |   3 +-
 project-bin/_common.sh                  |   2 +-
 project-bin/app-restart.sh              |   2 +-
 project-bin/check-design-portability.sh |  16 ++--
 project-bin/check-page-shell.sh         |   2 +-
 project-bin/check-sp-health.sh          |   2 +-
 project-bin/close-task.sh               |   2 +-
 project-bin/test-stack-up.sh            |   2 +-
 tests/wave2/test-pipefail-grep-q.sh     | 100 ++++++++++++++++++++++++
 14 files changed, 129 insertions(+), 29 deletions(-)
 create mode 100755 tests/wave2/test-pipefail-grep-q.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20342404..f1a67c62 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(routing, gate-check, obligation-check, project-bin): **`render-routing.sh --check` no longer reports a routed skill as UNROUTED at random — every `producer | grep -q` under `set -o pipefail` in the non-owned scripts is now a here-string.** `grep -q` exits on its first match; a producer still writing gets SIGPIPE (141) and pipefail turns "found" into "not found". The routed-path list is ~4.8 KB, two stdio writes, so the race was live: 15 of 100 calls of `routing_unrouted_skills` on the real table named a routed skill before the fix, 0 of 100 after. 28 sites in 12 scripts (skill-routing, obligation-check, triage-template, gate-check stage-0 sign-off and stage-4 closing rows, check-portability, `_common.sh` version match, design-portability, page-shell, close-task, check-sp-health, app-restart/test-stack-up `tasklist` probe). New fixture `tests/wave2/test-pipefail-grep-q.sh` makes the race deterministic (match first, 1 MB after it): fails 10 of 10 runs on master, passes after. CI flake seen in review — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/check-portability.sh b/bin/check-portability.sh
index 5ab3a874..444dee0f 100755
--- a/bin/check-portability.sh
+++ b/bin/check-portability.sh
@@ -131,7 +131,7 @@ while IFS= read -r f; do
     case "$txt" in
       *'$('*'<<'*)
         _pc="$(printf '%s' "$txt" | sed -e 's/<<<//g' -e 's/\$(([^)]*))//g')"
-        if printf '%s' "$_pc" | grep -Eq '\$\([^)]*<<[^<]'; then
+        if grep -Eq -- '\$\([^)]*<<[^<]' <<<"$_pc"; then
           report "$f" "$ln" "heredoc opened inside \$(...) — unparseable on bash 3.2" \
             "Read the heredoc into a variable first (IFS= read -r -d '' var <<EOF ... EOF), then use \"\$var\" inside \$(...)."
         fi ;;
@@ -151,7 +151,7 @@ while IFS= read -r f; do
       *awk*)
         # A backslash inside a $(...) substitution is the shell's, not the value's (e.g.
         # -v ok="$(... | tr '\n' ' ')"): strip substitutions before looking.
-        if printf '%s' "$txt" | sed 's/\$([^)]*)//g' | grep -Eq -- '-v [A-Za-z_][A-Za-z_0-9]*="[^"]*\\'; then
+        if grep -Eq -- '-v [A-Za-z_][A-Za-z_0-9]*="[^"]*\\' <<<"$(printf '%s' "$txt" | sed 's/\$([^)]*)//g')"; then
           report "$f" "$ln" "backslash inside an awk -v value (gawk rewrites escapes, mawk does not)" \
             'Pass patterns without backslashes: [|] for a literal pipe, [.] for a dot, or read the regex from ENVIRON["re"].'
         fi ;;
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index d24a021c..2880592e 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -825,13 +825,13 @@ check_stage_0() {
     }' "$f")
   if [ -z "$signer" ]; then
     echo "FAIL|no non-empty 'Confirmed by:' line inside the '## Sign-off' section of $f — anything the user actually said is enough (\"confirmed in chat\", \"agreed, move on\"); it only has to not be the shipped placeholder"
-  elif printf '%s' "$signer" | grep -q '\[' && [ "$ENTRY_MODE" = "existing-app-change" ] \
+  elif grep -q '\[' <<<"$signer" && [ "$ENTRY_MODE" = "existing-app-change" ] \
        && [ -s "$PROJECT_DIR/analysis/app-report.json" ]; then
     # Mapped and waiting for a change is a normal state in this mode (existing-app-change.md
     # §"Map the app first"): there is nothing to sign off yet, so this is not-started, not wrong.
     # Without it a parked project read "needs attention" forever (existing-app field run, 2026-09-22).
     echo "PENDING|app mapped (analysis/app-report.html), waiting on the change — triage.md is signed off at Stage 0b, once the user says what to work on and what it touches is written ($f, ## Sign-off)"
-  elif printf '%s' "$signer" | grep -q '\['; then
+  elif grep -q '\[' <<<"$signer"; then
     echo "FAIL|'Confirmed by:' still holds the shipped placeholder: \"$signer\" — replace it with whatever the user actually said (\"confirmed in chat 2026-08-20\" is fine; a full name is not required) ($f, ## Sign-off)"
   else
     echo "PASS|triage.md signed off by \"$signer\" [$f]"
@@ -1208,7 +1208,7 @@ stage4_closing_rows() {
   rows="$(tr -d '\r' < "$plan" | grep -E '^\|[[:space:]]*[0-9]+[A-Za-z.]*[[:space:]]*\|')"
   # Rows with a Kind cell are the plan's steps; a numbered question or decision table elsewhere
   # in the file is not. Plans written before the Kind column keep every numbered row.
-  printf '%s\n' "$rows" | grep -qE '\|[[:space:]]*`?(BRIEF|BUILD|PROVE|RUN|HARNESS)`?[[:space:]]*\|' \
+  grep -qE -- '\|[[:space:]]*`?(BRIEF|BUILD|PROVE|RUN|HARNESS)`?[[:space:]]*\|' <<<"$rows" \
     && rows="$(printf '%s\n' "$rows" | grep -E '\|[[:space:]]*`?(BRIEF|BUILD|PROVE|RUN|HARNESS)`?[[:space:]]*\|')"
   if [ -z "$rows" ]; then
     echo "OK|no numbered rows (closing rows not counted)"
@@ -1221,7 +1221,7 @@ stage4_closing_rows() {
             | sed -nE 's/.*verify-module\.sh[`"[:space:]]+([A-Za-z0-9_]+).*/\1/p' | sort -u)"
   if [ -n "$declared" ]; then
     for m in $declared; do
-      printf '%s\n' "$rows" | grep 'verify-module\.sh' | grep -qw -- "$m" || missing="$missing $m"
+      grep -qw -- "$m" <<<"$(grep 'verify-module\.sh' <<<"$rows")" || missing="$missing $m"
     done
     n="$(printf '%s\n' "$declared" | wc -l | tr -d ' ')"
   else
@@ -1235,7 +1235,7 @@ stage4_closing_rows() {
   local why=""
   [ -n "$missing" ] && why="no \`verify-module.sh <Module>\` close row for:$missing"
   [ "$ncoh" -lt "$need" ] && why="${why:+$why; }$ncoh of $need coherence-pass row(s) for $n modules"
-  printf '%s' "$last" | grep -qE 'gate-check\.sh[^|]*[[:space:]]5([^0-9]|$)' \
+  grep -qE -- 'gate-check\.sh[^|]*[[:space:]]5([^0-9]|$)' <<<"$last" \
     || why="${why:+$why; }the last numbered row is not \`gate-check.sh <project> 5\`"
   if [ -n "$why" ]; then
     echo "FAIL|build-plan.md is missing its closing rows (brd-to-build-plan.md, \"three closing rows\"): $why — add them; nothing that walks the plan does a step it does not list"
diff --git a/bin/lib/obligation-check.sh b/bin/lib/obligation-check.sh
index af7b25ac..1370417a 100755
--- a/bin/lib/obligation-check.sh
+++ b/bin/lib/obligation-check.sh
@@ -225,8 +225,8 @@ _ob_find() {
 # A denominator is a first line that counts something out of something: "12 of 12 pages reviewed".
 # Deliberately loose — the wording belongs to the skill, only the shape is mechanical.
 _ob_has_denominator() {
-  head -c 4000 "$1" 2>/dev/null | tr -d '\r' \
-    | grep -qiE '[0-9]+[[:space:]]+of[[:space:]]+[0-9]+|[0-9]+[[:space:]]*/[[:space:]]*[0-9]+'
+  grep -qiE -- '[0-9]+[[:space:]]+of[[:space:]]+[0-9]+|[0-9]+[[:space:]]*/[[:space:]]*[0-9]+' \
+    <<<"$(head -c 4000 "$1" 2>/dev/null | tr -d '\r')"
 }
 
 # _ob_stale <project-root> <artifact>  → prints "<hash>+<n>" and returns 0 if the mark has
@@ -501,8 +501,8 @@ mxtk_obligations_reverse_check() {
     # skills — an MDL cookbook and a datagrid note among them — and a warning listing 46
     # names is one nobody reads, which is the same as no check at all.
     [ "$group" = "verify" ] || continue
-    printf '%s\n' "$named" | grep -qxF "$path" && continue
-    printf '%s' "$MXTK_OBLIGATIONS_NOROUTE" | awk '{print $1}' | grep -qxF "$name" && continue
+    grep -qxF -- "$path" <<<"$named" && continue
+    grep -qxF -- "$name" <<<"$(awk '{print $1}' <<<"$MXTK_OBLIGATIONS_NOROUTE")" && continue
     unnamed="$unnamed $name"
   done < "$tsv"
   if [ -n "$unnamed" ]; then
diff --git a/bin/lib/skill-routing.sh b/bin/lib/skill-routing.sh
index 5dac2636..c0f3dbd8 100644
--- a/bin/lib/skill-routing.sh
+++ b/bin/lib/skill-routing.sh
@@ -472,7 +472,7 @@ routing_unrouted_skills() {
     rel="${f#"$root"/}"
     # Exact line match — a substring test would let skills/foo.md hide behind a routed
     # skills/x-foo.md.
-    printf '%s\n' "$routed" | grep -qxF "$rel" && continue
+    grep -qxF -- "$rel" <<<"$routed" && continue
     _routing_is_exempt "$rel" || echo "$rel"
   done
 }
@@ -491,7 +491,7 @@ routing_stale_exemptions() {
       *)
         if [ ! -e "$root/$ex" ]; then
           echo "$ex — exempted file no longer exists"
-        elif printf '%s\n' "$routed" | grep -qxF "$ex"; then
+        elif grep -qxF -- "$ex" <<<"$routed"; then
           echo "$ex — exempted AND routed; drop the exemption"
         fi
         ;;
diff --git a/bin/lib/triage-template.sh b/bin/lib/triage-template.sh
index 75d4f85d..c26084bb 100644
--- a/bin/lib/triage-template.sh
+++ b/bin/lib/triage-template.sh
@@ -229,6 +229,5 @@ mxtk_triage_is_pristine() {
   # more robust than pairing it with the comment opener.
   #
   # awk rather than `sed '/a/,/b/d'`: sed's range would not close on a one-line header.
-  awk '/MXTK-TRIAGE-STUB/{skip=1} skip{if(/-->/){skip=0}; next} {print}' "$f" \
-    | grep -q '{{[^}]*}}'
+  grep -q '{{[^}]*}}' <<<"$(awk '/MXTK-TRIAGE-STUB/{skip=1} skip{if(/-->/){skip=0}; next} {print}' "$f")"
 }
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 3a58af7a..6393967f 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -398,7 +398,7 @@ mxtk_version_in_name() {
   v3=$(printf '%s' "$2" | cut -d. -f1-3)
   [ -n "$v3" ] || return 1
   re=$(printf '%s' "$v3" | sed 's/\./\\./g')
-  printf '%s\n' "$base" | grep -Eq "(^|[^0-9.])${re}(\.[0-9]+)?([^0-9.]|\.[^0-9]|\$)"
+  grep -Eq -- "(^|[^0-9.])${re}(\.[0-9]+)?([^0-9.]|\.[^0-9]|\$)" <<<"$base"
 }
 
 # mxtk_mxbuild_for_version <version> — an executable mxbuild whose install (Studio Pro
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index b18ffe19..6e509929 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -91,7 +91,7 @@ hs_str()  { sed -n "s/^  \"$1\": *\"\(.*\)\",\{0,1\} *$/\1/p" "$2" 2>/dev/null |
 pid_alive() {
   [ -n "${1:-}" ] || return 1
   case "$(mxtk_platform)" in
-    windows) tasklist //FI "PID eq $1" //NH 2>/dev/null | grep -q " $1 " ;;   # mxcli.exe records a Windows pid
+    windows) grep -q " $1 " <<<"$(tasklist //FI "PID eq $1" //NH 2>/dev/null)" ;;   # mxcli.exe records a Windows pid
     *)       kill -0 "$1" 2>/dev/null || return 1
              # a zombie answers kill -0 until something reaps it; on Linux /proc says Z
              case "$(sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f1)" in Z) return 1 ;; esac ;;
diff --git a/project-bin/check-design-portability.sh b/project-bin/check-design-portability.sh
index 1bbacb70..010fcf65 100755
--- a/project-bin/check-design-portability.sh
+++ b/project-bin/check-design-portability.sh
@@ -92,7 +92,7 @@ if [ -z "$ROOT_DECL" ]; then
   printf '  check below is measured against an assumed 10px Atlas root rather than yours.\n\n'
   ROOT_DECL="10px (ASSUMED — no deployment/web/theme.compiled.css)"
   ROOT_IS_16=0
-elif printf '%s' "$ROOT_DECL" | grep -qE '^ *(16px|100%|1rem|1em)'; then
+elif grep -qE -- '^ *(16px|100%|1rem|1em)' <<<"$ROOT_DECL"; then
   ROOT_IS_16=1
 else
   ROOT_IS_16=0
@@ -116,7 +116,7 @@ for f in $TARGETS; do
     case "$txt" in *design-portability-ok:*) continue ;; esac
 
     # 1. rem, against a root that is not 16px.
-    if [ "$ROOT_IS_16" -eq 0 ] && printf '%s' "$txt" | grep -qE '[0-9.]+rem'; then
+    if [ "$ROOT_IS_16" -eq 0 ] && grep -qE -- '[0-9.]+rem' <<<"$txt"; then
       report "$f" "$ln" "rem unit, but the app root font-size is $ROOT_DECL" \
         'Every rem here renders at that fraction of a 16px-root design. Author component sizes in px, or restate the root in the app stylesheet.'
     fi
@@ -140,28 +140,28 @@ for f in $TARGETS; do
     #    a DOM fact you measured in a running app, recorded next to the tag.
     case "$txt" in *'{'*)
       sel="${txt%%\{*}"
-      if printf '%s' "$sel" | grep -qE '(^|[[:space:]>+~,])(b|i|table|thead|tbody|th|td|tr|ul|ol|li)([[:space:].:,>+~]|$)'; then
+      if grep -qE -- '(^|[[:space:]>+~,])(b|i|table|thead|tbody|th|td|tr|ul|ol|li)([[:space:].:,>+~]|$)' <<<"$sel"; then
         report "$f" "$ln" "selector styles through an HTML element Mendix does not emit" \
           'Mendix emits div/span/button. table|th|td|tr never appear (DataGrid2 is role="grid" divs). Restate as a class-only rule and give the class a widget carrier.'
       fi
       # 2b. A child-tag selector that DOES match, by accident, and outranks its own class.
       #     `.foo span` is 0-1-1 and beats the class-only `.foo-value` at 0-1-0, so the caption
       #     rule paints the headline. This is worse than a dead rule: it renders, wrongly.
-      if printf '%s' "$sel" | grep -qE '\.[A-Za-z_-][A-Za-z0-9_-]*[[:space:]]+(span|div|button)([[:space:].:,]|$)'; then
+      if grep -qE -- '\.[A-Za-z_-][A-Za-z0-9_-]*[[:space:]]+(span|div|button)([[:space:].:,]|$)' <<<"$sel"; then
         report "$f" "$ln" "class-descendant-tag selector outranks your own class rules" \
           'DYNAMICTEXT emits <span>, so this matches by accident at 0-1-1 and beats a class-only rule at 0-1-0. Give the inner widget its own class.'
       fi
       # 3. Row alternation driven from the DOM.
       #    Each listview row is wrapped in its own div.mx-dataview > div.mx-dataview-content,
       #    so EVERY row is :nth-of-type(1) in its own parent. Alternation must come from data.
-      if printf '%s' "$sel" | grep -qE ':nth-(of-type|child|last-child|last-of-type)'; then
+      if grep -qE -- ':nth-(of-type|child|last-child|last-of-type)' <<<"$sel"; then
         report "$f" "$ln" "positional selector on Mendix-generated rows" \
           'Each listview row sits in its own div.mx-dataview wrapper, so every row is :nth-of-type(1). Drive alternation from data via DynamicClasses.'
       fi
       # WARN: background without colour on a non-state selector.
-      if printf '%s' "$txt" | grep -qE 'background(-color)?[[:space:]]*:' \
-         && ! printf '%s' "$txt" | grep -qE '(^|[;{[:space:]])color[[:space:]]*:' \
-         && ! printf '%s' "$sel" | grep -qE ':(hover|focus|active|disabled|visited)'; then
+      if grep -qE -- 'background(-color)?[[:space:]]*:' <<<"$txt" \
+         && ! grep -qE -- '(^|[;{[:space:]])color[[:space:]]*:' <<<"$txt" \
+         && ! grep -qE -- ':(hover|focus|active|disabled|visited)' <<<"$sel"; then
         warn "$f" "$ln" "paints a background but not a text colour" \
           'Text colour is then inherited from whatever widget carries the class. A rule that paints a background should paint its text.'
       fi
diff --git a/project-bin/check-page-shell.sh b/project-bin/check-page-shell.sh
index 54221a2c..54c416b9 100755
--- a/project-bin/check-page-shell.sh
+++ b/project-bin/check-page-shell.sh
@@ -289,7 +289,7 @@ for f in $TARGETS; do
     # it, and nothing in a default page tree does.
     col="$(grep -oE 'main\{[^}]*max-width:[0-9]+px' "$wf" | grep -oE '[0-9]+px' | head -1)"
     if [ -n "$col" ]; then
-      if ! printf '%s' "$body" | grep -qE "Class:[^)]*(page-column|page-body|kt-page|container|max-w|measure)"; then
+      if ! grep -qE -- "Class:[^)]*(page-column|page-body|kt-page|container|max-w|measure)" <<<"$body"; then
         report "$f:$ln" "page $page is built full-bleed; its wireframe draws a $col column" \
           "Wrap the page body in the project's page-column container (ds.css supplies 'margin: 0 auto'; the wireframe narrows it to $col). Uncapped, this renders at the full layout region — measured at 1360px on a 900px design."
       fi
diff --git a/project-bin/check-sp-health.sh b/project-bin/check-sp-health.sh
index fd7c279c..9ac674b1 100755
--- a/project-bin/check-sp-health.sh
+++ b/project-bin/check-sp-health.sh
@@ -84,7 +84,7 @@ if [[ -z "$HEAVY_LINE" ]]; then
   exit 3
 fi
 
-if echo "$HEAVY_LINE" | grep -qE "$IDLE_PATTERN"; then
+if grep -qE -- "$IDLE_PATTERN" <<<"$HEAVY_LINE"; then
   echo "healthy: idle, parked in a normal wait call — not hung"
   echo "  $HEAVY_LINE"
   rm -f "$SAMPLE_FILE"
diff --git a/project-bin/close-task.sh b/project-bin/close-task.sh
index 3aae8430..378597a1 100755
--- a/project-bin/close-task.sh
+++ b/project-bin/close-task.sh
@@ -86,7 +86,7 @@ echo
 DRIFT_SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/done-drift-check.sh"
 if [ -x "$DRIFT_SCRIPT" ]; then
   drift_out=$("$DRIFT_SCRIPT" "$ROOT" 2>/dev/null)
-  if printf '%s\n' "$drift_out" | grep -qE '^- `|may be stale'; then
+  if grep -qE -- '^- `|may be stale' <<<"$drift_out"; then
     printf '%s\n' "$drift_out" | tail -n +3
     echo
     owed=1
diff --git a/project-bin/test-stack-up.sh b/project-bin/test-stack-up.sh
index 17af56ad..69316327 100755
--- a/project-bin/test-stack-up.sh
+++ b/project-bin/test-stack-up.sh
@@ -256,7 +256,7 @@ pid_alive() {
   [ -n "$1" ] || return 1
   case "$(mxtk_platform)" in
     # mxcli.exe records a Windows pid; Git Bash's kill only knows MSYS pids.
-    windows) tasklist //FI "PID eq $1" //NH 2>/dev/null | grep -q " $1 " ;;
+    windows) grep -q " $1 " <<<"$(tasklist //FI "PID eq $1" //NH 2>/dev/null)" ;;
     *)       kill -0 "$1" 2>/dev/null ;;
   esac
 }
diff --git a/tests/wave2/test-pipefail-grep-q.sh b/tests/wave2/test-pipefail-grep-q.sh
new file mode 100755
index 00000000..15088bcb
--- /dev/null
+++ b/tests/wave2/test-pipefail-grep-q.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Fixture for the `producer | grep -q` + `set -o pipefail` false negative.
+#
+# usage: test-pipefail-grep-q.sh /path/to/bin/lib/skill-routing.sh
+#
+# The defect: `grep -q` exits on its first match. If the producer on the left of the pipe
+# still has output to write, that write hits a closed pipe, the producer dies of SIGPIPE
+# (status 141), and under `set -o pipefail` the PIPELINE reports failure — so "found it"
+# reads as "not found". Whether the producer had finished writing before grep exited is a
+# scheduling race, which is why `bin/render-routing.sh --check` intermittently reported
+# `UNROUTED skills/iterative-build-loop.md` although its row exists (the routed-path list is
+# ~4.8 KB, more than one stdio buffer, so `printf` writes it in two chunks). Measured on the
+# real table before the fix: 15 of 100 calls of routing_unrouted_skills named a routed skill.
+#
+# The fix is a here-string (`grep -q -- "$x" <<<"$list"`): bash writes the whole input
+# before grep starts, so nothing can be killed mid-write. This fixture makes the race
+# deterministic instead of probabilistic: the matching line comes FIRST and is followed by
+# ~1 MB of padding — far beyond the 64 KB pipe buffer — so on the old code the producer is
+# always still writing when grep exits.
+#
+# T1  routing_unrouted_skills: a routed skill must not be reported unrouted.
+# T2  routing_stale_exemptions: an exempted-AND-routed file must still be reported.
+# T3  static guard: the scripts fixed alongside (all run under pipefail, directly or via the
+#     script that sources them) carry no `... | grep -q` pipeline again.
+
+set -uo pipefail
+
+LIB="${1:?usage: test-pipefail-grep-q.sh /path/to/bin/lib/skill-routing.sh}"
+case "$LIB" in /*) ;; *) LIB="$PWD/$LIB" ;; esac
+TK="$(cd "$(dirname "$LIB")/../.." && pwd)"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/pipefail-grepq.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/  FAIL-detail: /'; }
+
+# A scratch root with one skill, and a routing table whose FIRST row routes it, then ~16,000
+# padding rows (about 1 MB of routed paths).
+ROOT="$WORK/root"
+mkdir -p "$ROOT/skills"
+printf '# Early\n' > "$ROOT/skills/early.md"
+TSV="$WORK/skill-routing.tsv"
+{
+  printf 'Early skill\tskills/early.md\tany\tall\t5\tsituational\tverify\n'
+  i=0
+  while [ "$i" -lt 16000 ]; do
+    printf 'Padding row %d\tskills/padding/a-long-padding-path-to-overflow-the-pipe-buffer-%05d.md\tany\tall\t5\tsituational\tverify\n' "$i" "$i"
+    i=$((i+1))
+  done
+} > "$TSV"
+EMPTY_EX="$WORK/exempt-empty.tsv"; : > "$EMPTY_EX"
+STALE_EX="$WORK/exempt-stale.tsv"; printf 'skills/early.md\tfixture: exempted and routed\n' > "$STALE_EX"
+
+# Sourced in a subshell with pipefail on, as bin/render-routing.sh runs it (set -euo pipefail).
+run_lib() { # <exempt-file> <function>
+  ( set -o pipefail
+    MXTK_ROUTING_TSV="$TSV" MXTK_ROUTING_EXEMPT="$1"
+    # shellcheck source=/dev/null
+    . "$LIB"
+    "$2" "$ROOT" )
+}
+
+echo "== T1: a routed skill is not reported UNROUTED (match first, 1 MB after it) =="
+bad1=0
+for n in 1 2 3; do
+  out="$(run_lib "$EMPTY_EX" routing_unrouted_skills 2>&1)"
+  [ -z "$out" ] || { bad1=1; bad "run $n: routed skill reported unrouted" "$out"; break; }
+done
+[ "$bad1" = 0 ] && ok "routing_unrouted_skills is empty on 3 of 3 runs"
+
+echo "== T2: an exempted-AND-routed file is still reported (same race, opposite sign) =="
+out="$(run_lib "$STALE_EX" routing_stale_exemptions 2>&1)"
+case "$out" in
+  *'skills/early.md — exempted AND routed'*) ok "stale exemption reported" ;;
+  *) bad "stale exemption missed" "$out" ;;
+esac
+
+echo "== T3: no '| grep -q' pipeline left in the scripts fixed for this defect =="
+# gate-check.sh's `find_artifact ... | grep -q .` lines are exempt: find_artifact ends in
+# `-print -quit`, so its producer writes at most one line and is finished before grep exits.
+hits=""
+for f in bin/lib/skill-routing.sh bin/lib/obligation-check.sh bin/lib/triage-template.sh \
+         bin/gate-check.sh bin/check-portability.sh \
+         project-bin/_common.sh project-bin/check-design-portability.sh project-bin/check-page-shell.sh \
+         project-bin/close-task.sh project-bin/check-sp-health.sh project-bin/app-restart.sh \
+         project-bin/test-stack-up.sh; do
+  [ -f "$TK/$f" ] || { hits="$hits
+$f: missing"; continue; }
+  h="$(grep -nE '(^|[^|])\|[[:space:]]*grep[[:space:]]+(-[A-Za-z]*q|[^|]*[[:space:]]-[A-Za-z]*q)' "$TK/$f" \
+       | grep -vE '^[0-9]+:[[:space:]]*#' | grep -v 'find_artifact' | sed "s|^|$f:|")"
+  [ -n "$h" ] && hits="$hits
+$h"
+done
+if [ -z "$hits" ]; then ok "0 pipelines into grep -q across 12 scripts"
+else bad "pipeline into grep -q found (use a here-string: grep -q -- PAT <<<\"\$x\")" "${hits#?}"; fi
+
+echo
+echo "pipefail-grep-q: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

From 687c974af4f684a2cdb8e772d2e099f323785b60 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:30:33 +0000
Subject: [PATCH 53/68] docs: extraction-quality wording matches
 MANUAL-when-absent; token-burn capture notes

Confirmation review of #325: the skill paragraph still said a missing score file
shows as a fault; capture notes said "last record" where the code takes the
per-field max. Wording applied as the reviewer specified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 skills/extractor-quality-loop.md           | 4 ++--
 tests/wave2/fixtures/token-burn/CAPTURE.md | 2 +-
 tests/wave2/test-token-burn.sh             | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/skills/extractor-quality-loop.md b/skills/extractor-quality-loop.md
index bd45db53..b66e4e94 100644
--- a/skills/extractor-quality-loop.md
+++ b/skills/extractor-quality-loop.md
@@ -182,8 +182,8 @@ Noting these as "BRD-only" in the quality report is correct and expected.
 **Where it is read:** `bin/extraction-report.sh` (the Stage 1 surface) renders every
 `extraction-quality*.json` at `analysis/<Project>/` or `analysis/<Project>/extracted/` (also
 inside the knowledge base), one row per key of `dimensions`. A code-extracted knowledge base
-with no such file, a `selfGraded` pass, a pass under `threshold`, or a 0/0 dimension missing
-from `confirmedZeros` shows there as a fault.
+with no such file shows as MANUAL ('not produced yet'); a `selfGraded` pass, a pass under
+`threshold`, or a 0/0 dimension missing from `confirmedZeros` shows as a fault.
 
 ### A score without a second mechanism is self-graded — label it, never let it pass alone
 
diff --git a/tests/wave2/fixtures/token-burn/CAPTURE.md b/tests/wave2/fixtures/token-burn/CAPTURE.md
index 1b9f619e..0156348d 100644
--- a/tests/wave2/fixtures/token-burn/CAPTURE.md
+++ b/tests/wave2/fixtures/token-burn/CAPTURE.md
@@ -11,7 +11,7 @@ it was imagined:
   (the ~2× overcount if summed per record) — but NOT always the same `usage`: in the subagent
   transcript `msg` ids with a later record carry a larger `output_tokens` on that last record
   (60 on the first records of the 2026-09-17 messages, 1559 summed over last records). The
-  instrument takes each id's LAST record; the numbers below were recomputed that way;
+  instrument takes each id's per-field max (= its last record on this capture); the numbers below were recomputed that way;
 - `message.model` = `<synthetic>` on a harness-generated record (exactly one kept);
 - `cwd` is **per record**: a session launched in `~` spends records in `~`, `~/proj` and
   `~/proj/app`;
diff --git a/tests/wave2/test-token-burn.sh b/tests/wave2/test-token-burn.sh
index 19feb055..0c00db4a 100755
--- a/tests/wave2/test-token-burn.sh
+++ b/tests/wave2/test-token-burn.sh
@@ -4,7 +4,7 @@
 # scrubbed, and the expected sums computed independently of the instrument.
 #
 #   T1  no transcript tree → NOT AVAILABLE in brief, screen and json (available:false), exit 0
-#   T2  --json: per-model arrays to the token, usage from each id's LAST record; 52 records dedupe to 22 messages; 1 synthetic
+#   T2  --json: per-model arrays to the token, usage from each id's per-field max (= last record on this capture); 52 records dedupe to 22 messages; 1 synthetic
 #       skipped; 2 files; subagent headline 61357
 #   T3  the two-tree layout: records whose cwd is <root>/app count — moving them out of the
 #       project drops the message count from 22 to 21
@@ -73,7 +73,7 @@ has "T1 json available:false" "$OUT" '"available": false'
 J="$(CLAUDE_CONFIG_DIR="$CFG" bash "$SUT" "$P" --json 2>&1 | tr -d '\n' | tr -s ' ' | sed 's/\[ /[/g; s/ \]/]/g')"
 has "T2 fable-5-1 array" "$J" '"claude-fable-5-1": [288, 31365, 2607781, 15524, 9]'
 # the subagent model's array, matched by its numbers (the model id is the captured one, see CAPTURE.md)
-echo "$J" | grep -Eq '"claude-[a-z]+-5": \[26, 59772, 998476, 1559, 13\]' && ok "T2 subagent-model array (LAST record per id: output 1559, the first record says 60)" || bad "T2 subagent-model array" "$J"
+echo "$J" | grep -Eq '"claude-[a-z]+-5": \[26, 59772, 998476, 1559, 13\]' && ok "T2 subagent-model array (per-field max (= last record on this capture) per id: output 1559, the first record says 60)" || bad "T2 subagent-model array" "$J"
 has "T2 22 messages"     "$J" '"messages": 22'
 has "T2 52 records (dedupe)" "$J" '"records": 52'
 has "T2 1 synthetic"     "$J" '"synthetic_skipped": 1'

From 267281113c7696e47abb783c5ce49608be940519 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:31:40 +0000
Subject: [PATCH 54/68] =?UTF-8?q?fix:=20review=20follow-ups=20on=20#320=20?=
 =?UTF-8?q?=E2=80=94=20restore=20failure=20examples,=20intake=20Q13,=20PRO?=
 =?UTF-8?q?OF-OF-LOOK=20addenda?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- testing-shape.md: the #274 box keeps its failure examples (other
  modules' journeys, reviewer re-runs, full mxcli test at batch close; a
  caption change owes one journey and one look) and names the unset Unit
  default, so §2's pointer lands on it; module close again names "the
  module's whole journey set".
- intake Q13 (bin/lib/intake-template.sh): the anecdote is one clause
  pointing at #274. --repair-intake matches the question by its heading,
  unchanged; test-bug12-sync.sh passes.
- skills/ui-loop.md: the restart pointer names dispatching.md.
- module-review.md: PROOF-OF-LOOK addenda rule (nearest stamp above, stale
  only past the newest stamp by commit time) and the final LOOK's
  VALID AT / per-page proof / derived-stage-6 requirements, matching
  PR #321's obligation-check.sh.

Refs #274 #288

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md               | 2 +-
 bin/lib/intake-template.sh | 8 +++-----
 skills/module-review.md    | 8 +++++++-
 skills/testing-shape.md    | 8 +++++---
 skills/ui-loop.md          | 2 +-
 5 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5edba06b..b96c30d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(testing-shape, module-review, dispatching): **follow-ups to #290 and #292 — subject set reaches embedders, reviewers never re-run, dispatch guidance is its own small baseline file.** A UI-only change now re-runs the journeys of every page it reaches (pages embedding a changed snippet or layout, in any module), not "no other module's journeys"; `module-review.md`'s Prove row and "nothing grandfathers" line no longer say "re-run after any change" (implementer re-runs the subject set once, reviewer verifies the artifact, per `testing-shape.md` §3); the #274 cost anecdote appears once in `testing-shape.md` instead of three times (−186 words). `agent-roles.md`'s Dispatching section moved to `skills/dispatching.md` (981 words, with a note that forks/resumes/per-call models are Claude Code concepts — elsewhere, one fresh session per task); the lead loads that at P–6 and `agent-roles.md` returns to its pre-#292 setup row (P,4,5). Lead load at stages 1/2/3/6: −2,059 words each; baseline 76,259 → 76,191 ([#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274), [#288](https://github.com/MendixMau/mxcli-project-toolkit/issues/288)) — MendixMau
+- fix(testing-shape, module-review, dispatching): **follow-ups to #290 and #292 — subject set reaches embedders, reviewers never re-run, dispatch guidance is its own small baseline file.** A UI-only change now re-runs the journeys of every page it reaches (pages embedding a changed snippet or layout, in any module), not "no other module's journeys"; `module-review.md`'s Prove row and "nothing grandfathers" line no longer say "re-run after any change" (implementer re-runs the subject set once, reviewer verifies the artifact, per `testing-shape.md` §3); the #274 cost anecdote appears once in `testing-shape.md` and is one clause in intake Q13, instead of told three times in full; `module-review.md` states the PROOF-OF-LOOK addenda rule and the final LOOK's `VALID AT:`/per-page proof/Stage-6 requirements that #321's checker enforces. `agent-roles.md`'s Dispatching section moved to `skills/dispatching.md` (981 words, with a note that forks/resumes/per-call models are Claude Code concepts — elsewhere, one fresh session per task); the lead loads that at P–6 and `agent-roles.md` returns to its pre-#292 setup row (P,4,5). Lead load at stages 1/2/3/6: −2,059 words each; baseline 76,259 → 76,191 ([#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274), [#288](https://github.com/MendixMau/mxcli-project-toolkit/issues/288)) — MendixMau
 - chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/bin/lib/intake-template.sh b/bin/lib/intake-template.sh
index 0cee0f66..863c1dce 100644
--- a/bin/lib/intake-template.sh
+++ b/bin/lib/intake-template.sh
@@ -140,11 +140,9 @@ shows what is in effect.
 ## 13. Unit tests (`.test.mdl`): project default `no` (default) or `yes`?
 
 _Not yet asked._ How to verify: ask the user; default is `no`. Every module already gets UI
-journeys and data assertions. Unit tests cost a closed Studio Pro and a snapshot per run, and with
-the default unset agents ran them everywhere: in a 20-task UX-fix run, 143 minutes of microflow
-tests found stale strings and credential problems, not logic bugs (toolkit issue #274). With
-`no`, a module still flips to `yes` in its brief when it has calculation, mapping or date/money
-logic, calls Java or REST, or had a bug fixed in that flow (`testing-shape.md` §2). Record it as
+journeys and data assertions. Unit tests cost a closed Studio Pro and a snapshot per run, and
+agents ran them everywhere when no default was set (toolkit issue #274). With `no`, a module
+still flips to `yes` in its brief when it has calculation, mapping or date/money logic, calls Java or REST, or had a bug fixed in that flow (`testing-shape.md` §2). Record it as
 `Unit tests default:` in PROJECT.md.
 MXTK_INTAKE_EOF
 }
diff --git a/skills/module-review.md b/skills/module-review.md
index e68c3518..4b8c1683 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -320,6 +320,10 @@ of KB — a blank render or a placeholder is not); every file newer than the `VA
 exactly like no report.** A CSS export, a `getComputedStyle` dump, or a DOM snapshot can never
 satisfy it — which is the point: the 2026-08-22 escape (verdicts written from declared CSS while
 the render was broken) becomes mechanically impossible to repeat, not just prohibited in prose.
+A report may carry addenda: each re-look adds its own `VALID AT:` and its own `PROOF-OF-LOOK:`
+lines below it. Each citation is checked against the nearest stamp above it, and the report is
+stale only when the model has been built past its newest stamp (by commit time). Keep earlier
+sections; do not delete their proof lines.
 Reports dated before 2026-08-23 predate the rule and are left alone.
 
 **A LOOK report expires when the module changes.** Any BUILD/GATE commit that touches the module
@@ -395,7 +399,9 @@ last model commit. It is owed as the `final-look` row in `bin/lib/obligations.ts
 - **Report:** `design/ui-reviews/final-look-<YYYY-MM-DD>.html`, same format as stage 5: the
   headline's denominator ("38 of 38 pages, 4 of 4 roles"), `VALID AT:`, PROOF-OF-LOOK lines.
   Any model commit after `VALID AT` makes it stale, and the obligation is owed again. That is how
-  "final" is checked mechanically.
+  "final" is checked mechanically. It needs `VALID AT:` (an unstamped final LOOK is FAULT) and one
+  `PROOF-OF-LOOK:` line per page, same rules as stage 5. It is not owed until gate-check's derived
+  `## Current stage` readout reaches 6; a hand-written stage line keeps it owed.
 - **Reads, beyond stage 4:** every `Displayed fact:` row in `PROJECT.md`, against every page that
   shows the fact (`process-coherence-pass.md` pass 5). Every microflow a later script redefined,
   diffed before and after, to make sure no earlier fix was dropped.
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 7e28ec3a..925a7f48 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -95,7 +95,7 @@ written by `bin/init-project.sh`, appended to older projects by `bin/sync-projec
 - **Unit flips to yes per module** only when the module has calculation, mapping, or date/money
   logic; calls a Java action or a REST service; or a bug was fixed in that flow (the unit test pins
   the fix). Otherwise Unit stays **no**. With no default set, agents read "optional" as "yes"
-  (what that cost: §3).
+  (what that cost: §3, "Why scoped").
 - **Trace may be added** by a module that **calls out** to something external, even when the
   project default is off. That is where swallowed failures live, and it is the only place Trace
   reliably earns its setup cost.
@@ -156,7 +156,7 @@ screenshots, the journey report — and **never re-run** what the implementer al
 recorded. A reviewer who doubts an artifact says which claim it fails to prove; that is a finding,
 not a second run.
 
-**The full suite runs on the last three rows below only** — **never at batch close**, never after
+**The full suite (and the module's whole journey set) runs on the last three rows below only** — **never at batch close**, never after
 an individual fix, never because the change "felt wide". The e2e instruments are unchanged; only
 their trigger is.
 
@@ -170,7 +170,9 @@ their trigger is.
 | The user asks for a full run | Run it, that message is the trigger. |
 
 > **Why scoped (#274):** the old unscoped "re-run the suite as regression" re-proved each UI-only
-> change 5–10× and spent **143 minutes** of microflow tests finding stale strings, not one logic bug.
+> change 5–10× (other modules' journeys, the reviewer re-running them, a full `mxcli test` at every
+> batch close), and with no Unit default set, **143 minutes** of microflow tests found stale strings,
+> not one logic bug. A caption change owes one journey and one look.
 
 So the authoring conversation happens **once per module**; everything after is a scoped re-run.
 That is what makes this affordable on a module under active development.
diff --git a/skills/ui-loop.md b/skills/ui-loop.md
index 9c89980d..dffa6d4b 100644
--- a/skills/ui-loop.md
+++ b/skills/ui-loop.md
@@ -237,7 +237,7 @@ is no record, when the record belongs to another project (a copied project carri
 original's), or when it cannot recover the start command. On Windows, pass `--cmd '<how you
 started it>'` once; it is remembered after that. `--dry-run` says what it would do. A Docker-hosted
 app uses `bin/test-stack-up.sh --restart` instead. This is the one restart an implementer may run
-without the lead (`agent-roles.md` → Dispatching).
+without the lead (`dispatching.md`).
 
 ## When it finds something — which side is actually wrong
 

From a09109b2f1e45fded3c40123b83bf310470bc66e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:33:23 +0000
Subject: [PATCH 55/68] test-stack-up: --track normalises the pid (01 no longer
 bypasses the pid-1 refusal); --reap never signals pid <= 1

Confirmation review of PR #319: `--track 01` passed the string compare against
0/1/self/caller, and a later --reap would TERM it. T_PID is normalised with
$((10#...)) right after the digit check; bg_scan drops any pid <= 1 line and
--reap refuses one again before signalling (hand-edited records).
Fixture: --track 01 -> exit 2; an aged pid-1 line with init's real start
time is never signalled and is pruned (both fail on the previous head).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 project-bin/test-stack-up.sh       | 4 ++++
 tests/wave2/test-stack-up-local.sh | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/project-bin/test-stack-up.sh b/project-bin/test-stack-up.sh
index 31bc94ad..f4cf41bc 100755
--- a/project-bin/test-stack-up.sh
+++ b/project-bin/test-stack-up.sh
@@ -472,6 +472,7 @@ bg_scan() {
   now="$(date +%s)"
   while IFS='	' read -r pid ep ls lab; do
     case "$pid" in ''|*[!0-9]*) continue ;; esac
+    [ "$((10#$pid))" -gt 1 ] || { echo "gone|$pid|0|$lab"; continue; }   # init / own group: never a target
     case "$ep" in ''|*[!0-9]*) ep="$now" ;; esac
     if ! kill -0 "$pid" 2>/dev/null || [ "$(pid_lstart "$pid")" != "$ls" ]; then
       echo "gone|$pid|0|$lab"
@@ -495,6 +496,7 @@ bg_prune() {
 if [ "$MODE" = "track" ]; then
   T_PID="${2:-}"; T_LABEL="${3:-process}"
   case "$T_PID" in ''|*[!0-9]*) echo "usage: $0 --track <pid> [label]" >&2; exit 2 ;; esac
+  T_PID=$((10#$T_PID))   # "01" / "001" must not slip past the refusal below as strings
   # Never pid 1, this script, or the shell that called it: --reap would later stop the caller itself.
   case "$T_PID" in 0|1|"$$"|"$PPID") echo "test-stack-up: refusing to track pid $T_PID (init, this script, or the calling shell) — pass the background process's pid (\$! after starting it)" >&2; exit 2 ;; esac
   [ "$(mxtk_platform)" = windows ] && { echo "test-stack-up: --track is not supported on Git Bash (no process start time to check a reused pid against); nothing recorded"; exit 0; }
@@ -523,6 +525,8 @@ if [ "$MODE" = "reap" ]; then
   REAPED=0
   while IFS='|' read -r st pid age lab; do
     [ "$st" = stale ] || continue
+    # A hand-edited line can say anything: pid 0 or 1 is never signalled (kill 0 = our own group).
+    [ "$((10#$pid))" -gt 1 ] || { warn "pid $pid in ${BG_PIDS#$ROOT/} — never signalled"; continue; }
     # Re-checked at the moment of the kill: the scan above may be seconds old.
     _ls="$(awk -F'\t' -v p="$pid" '$1 == p { print $3; exit }' "$BG_PIDS")"
     [ -n "$_ls" ] && [ "$(pid_lstart "$pid")" = "$_ls" ] || { warn "pid $pid changed since the scan — not touched"; continue; }
diff --git a/tests/wave2/test-stack-up-local.sh b/tests/wave2/test-stack-up-local.sh
index 0159a8b2..5dec473b 100755
--- a/tests/wave2/test-stack-up-local.sh
+++ b/tests/wave2/test-stack-up-local.sh
@@ -317,6 +317,7 @@ bash -c "exec -a 'node journey-runner.js' sleep 600" & DECOY14=$!; PIDS="$PIDS $
 # Tracked under another time zone: --track and --reap must spell the start time alike (LC_ALL=C TZ=UTC0).
 ( cd "$P" && TZ=XYZ-14 LC_ALL=C bash bin/test-stack-up.sh --track "$YOUNG" monitor ) >/dev/null 2>&1
 ( cd "$P" && bash bin/test-stack-up.sh --track 1 init ) >/dev/null 2>&1; [ $? -eq 2 ] && ok "--track refuses pid 1" || bad "--track accepted pid 1"
+( cd "$P" && bash bin/test-stack-up.sh --track 01 init ) >/dev/null 2>&1; [ $? -eq 2 ] && ok "--track refuses 01 (normalised, not string-compared)" || bad "--track accepted 01"
 ( cd "$P" && bash bin/test-stack-up.sh --track "$BASHPID" me ) >/dev/null 2>&1; [ $? -eq 2 ] && ok "--track refuses the calling shell" || bad "--track accepted the calling shell"
 ( cd "$P" && bash bin/test-stack-up.sh --track "$DEAD_PID" gone ) >/dev/null 2>&1 && bad "--track accepted a dead pid" || ok "--track refuses a dead pid"
 BG="$P/.claude/loop/bg-pids.tsv"
@@ -328,7 +329,10 @@ printf '%s' "$OUT" | grep -q "pid $OLDRUN — journey-runner" && ok "--check lis
 printf '%s' "$OUT" | grep -qE "pid ($YOUNG|$REUSED|$DECOY14) " && bad "listed a young/reused/untracked pid" "$OUT" || ok "young, reused and untracked pids not listed"
 printf '%s' "$OUT" | grep -q -- "--reap" && ok "names the --reap command" || bad "no remedy named" "$OUT"
 [ "$(wc -l < "$BG" | tr -d ' ')" = 4 ] && ok "--check left the record unchanged" || bad "--check wrote the record"
+# A hand-edited line for pid 1, aged and with init's real start time: --reap must still never signal it.
+printf '1\t1000000000\t%s\tinit\n' "$(LC_ALL=C TZ=UTC0 ps -o lstart= -p 1 2>/dev/null | sed 's/  */ /g; s/^ //; s/ $//')" >> "$BG"
 OUT="$(cd "$P" && bash bin/test-stack-up.sh --reap 2>&1)"; RC=$?
+printf '%s' "$OUT" | grep -q "stopped pid 1 " && bad "--reap signalled pid 1" "$OUT" || ok "--reap never signals a hand-edited pid-1 line"
 sleep 0.5
 [ "$RC" -eq 0 ] && ok "--reap exits 0" || bad "--reap rc=$RC" "$OUT"
 kill -0 "$OLDRUN" 2>/dev/null && bad "stale tracked pid survived --reap" || ok "stale tracked pid stopped"

From 5bf8048f9b6fe38c4de6897034795cd742f7256e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:34:18 +0000
Subject: [PATCH 56/68] learn(build-loop): kept writes and PARTIAL rows in the
 refusal and phase-close text

Confirmation review of #323: "the change is not in the model" was false for
LINT ROSE/BLIND and PARTIAL (the write is kept) and could lead an agent to
re-apply a non-idempotent script; PARTIAL rows now count as coverage and are
finished, not re-run; the print-only list is exact. Wording as the reviewer specified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 skills/iterative-build-loop.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 5cf1d88a..07cf98e7 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -322,9 +322,9 @@ Every MDL script, and every one-off model patch (`--patch`), is applied with `./
 A raw `./mxcli exec` writes no BUILD-LOG row, takes no snapshot and runs no gate, so the change
 shows as "not recorded" to everything that reads the build log (status, done-drift, proof views).
 
-When a guard refuses, the script's change is not in the model. Most refusals also write a
+When a guard refuses, the script's change is not in the model, unless exec.sh says the write is kept (LINT ROSE/BLIND, ⚠️ PARTIAL) — then do not re-apply it. Most refusals also write a
 BUILD-LOG row (uncommitted model, `--commit-first`, a failed pre-exec check, a gate that could
-not run, PRE-EXISTING errors, a NEW gate error); the Studio Pro and lock refusals only print.
+not run, PRE-EXISTING errors, a NEW gate error); the plain Studio Pro refusal, the lock refusal and argument errors only print.
 Your move is one of three — **commit, wait, or stop and report** — never an override:
 
 | Refusal | Do this |
@@ -349,12 +349,12 @@ is the commit you make before the next exec (the pre-exec sequence below, step 2
 message that starts `MCP:` and names what changed.
 
 **Check before closing a phase:** every model-changing commit since the phase began is covered
-by one of three things — an `✅`/`⚠️ applied` BUILD-LOG row for the script it commits, a
+by one of three things — an `✅`/`⚠️ applied`/`⚠️ PARTIAL` BUILD-LOG row for the script it commits, a
 `--commit-first` commit (message `model: commit pending model changes before exec.sh …`), or an
 `MCP:` commit. Blocked and failed rows have no commit, so this is a coverage check, not an
 equality between counts. Done when all N model commits are covered, N of N. A commit covered by
 none of the three is a raw `mxcli exec` — re-run that script through exec.sh, or record why it
-cannot be.
+cannot be. After a `⚠️ PARTIAL` row, finish the script's remaining statements; never re-run the whole script.
 
 ### The gate checks the saved file — save, then check
 

From ab21867725f531243fe6e83d5dfef33b9a684b70 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:38:31 +0000
Subject: [PATCH 57/68] =?UTF-8?q?mxtest=20guard:=20review=20fixes=20?=
 =?UTF-8?q?=E2=80=94=20pipefail-safe=20reader,=20all=20candidate=20units,?=
 =?UTF-8?q?=20MxTest.=20prefilter,=20override?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent review of #322 at 333d435:
1. The reader ran under the callers' pipefail: awk exits at the first match, od dies of
   SIGPIPE, and the 141 discarded the answer — on a large v1 .mpr the guard did nothing.
   It is now a subshell function with pipefail off. Fixture: 2 MB v1 model after the setting.
2. `grep -rla … | head -1` took the first unit mentioning the name; a doc string elsewhere
   switched the guard off. Every candidate unit is read; only the BSON element counts.
   Fixture: doc-string units beside the injected settings unit.
3. Units without the bytes "MxTest." are not scanned (an 8 MB v1 .mpr took 8 s).
4. MXTK_SKIP_MXTEST_GUARD=1 skips the check, printed loudly (both fixtures).
5. test-app-restart.sh alive() is zombie-aware (3/10 flakes; now 5/5 clean).
6. in_our_tree's comment is back above it; set-after-startup.js cites the real fixture.
7. test-scratch's remedy for a live --test-endpoint app: test a copy whose settings unit
   comes from HEAD (#244's workaround) before stopping the live app.

Refs #244

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                                  |  2 +-
 bug-logs/mxcli-bugs.md                        |  2 +-
 project-bin/app-restart.sh                    | 65 +++++++++++++------
 project-bin/test-scratch.sh                   | 63 +++++++++++++-----
 .../mxtest-guard/set-after-startup.js         |  2 +-
 tests/wave2/test-app-restart.sh               |  5 +-
 tests/wave2/test-test-scratch.sh              | 22 ++++++-
 7 files changed, 117 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 398efbf3..a4bab42d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(test-scratch, app-restart): **both refuse to start on a model whose after-startup is still an mxcli test injection (`MxTest.RegisterEndpoint` / `MxTest.TestRunner`), and print the repair** ([#244](https://github.com/MendixMau/mxcli-project-toolkit/issues/244), BUG-157). A `mxcli test` or `run --test-endpoint` stopped by a signal skips its restore, and the next injection chains `RegisterEndpoint` to itself: StackOverflowError, app down. It happened twice in one day on one machine, and again on a second project. The setting is read from the settings unit's bytes, so no mxcli is needed. The fixture uses a settings unit captured from mxcli's own test model. `test-scratch.sh` exits 3 before copying. `app-restart.sh` exits 3 before stopping, except for a live `--test-endpoint` app, which holds the injection legitimately; if stopping that app leaves the setting behind, it exits 5 (new): stopped, not started. Projects pick this up on sync; a clean model sees no change. — MendixMau, second case AlvinnYeo
+- fix(test-scratch, app-restart): **both refuse to start on a model whose after-startup is still an mxcli test injection (`MxTest.RegisterEndpoint` / `MxTest.TestRunner`), and print the repair** ([#244](https://github.com/MendixMau/mxcli-project-toolkit/issues/244), BUG-157). A `mxcli test` or `run --test-endpoint` stopped by a signal skips its restore, and the next injection chains `RegisterEndpoint` to itself: StackOverflowError, app down. It happened twice in one day on one machine, and again on a second project. The setting is read from the settings unit's bytes, so no mxcli is needed. Every unit holding the BSON element is checked, not just the first one that mentions the name. A unit without the bytes `MxTest.` is skipped, so an 8 MB v1 model costs one grep. The reader runs with pipefail off, so a large v1 `.mpr` cannot switch the guard off. `MXTK_SKIP_MXTEST_GUARD=1` skips the check and says so. The fixture uses a settings unit captured from mxcli's own test model. `test-scratch.sh` exits 3 before copying. `app-restart.sh` exits 3 before stopping, except for a live `--test-endpoint` app, which holds the injection legitimately; if stopping that app leaves the setting behind, it exits 5 (new): stopped, not started. Projects pick this up on sync; a clean model sees no change. — MendixMau, second case AlvinnYeo
 - fix(app-restart): **the recorded pid is verified to still be an `mxcli run` before anything is stopped** (review of #304). With `--cmd` / `MXTK_APP_START_CMD`, the identity check read the override, not the process. A record left by a SIGKILL whose pid the OS had reused sent TERM/KILL to that unrelated process and its children. The pid's own command line (`/proc`, `ps`; on Windows the image name `mxcli.exe`) must now name mxcli and `run`. Otherwise the app counts as not running and the process is not touched. — MendixMau
 - fix(test-scratch): **taking over a stale lock is serialised with exactly exec.sh's protocol, so test-scratch and exec.sh never both hold the shared `.exec.lock`** (review of #304). The old takeover moved the lock aside with `mv -f`. It now uses the same O_EXCL `<lock>.takeover` file and rules as exec.sh in #324: stale when its pid is dead or after 10s, re-read under it, remove only the exact stale line, put back a wrongly moved takeover file with `ln`. The port lock uses the same protocol. A new cross-script fixture, `test-shared-lock-takeover.sh`, runs 5 exec.sh + 5 test-scratch contenders on a dead holder's lock: two holders at once on the old code, never on the new. — MendixMau
 - learn(lint-that-actually-runs): **lint a copy of the model only after copying `.claude/lint-rules` (and `lint-config.yaml`) beside it, and compare rule counts before diffing** ([#240](https://github.com/MendixMau/mxcli-project-toolkit/issues/240), BUG-158). A snapshot in `/tmp` gave 51 findings from 8 rules, against 721 from 29 for the project: no notice, exit 0. mxcli's source also shows `lint-config.yaml` is read only from beside the `.mpr`, so an in-repo snapshot loses it as well. — MendixMau
diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md
index 6e80b6e0..29d640bc 100644
--- a/bug-logs/mxcli-bugs.md
+++ b/bug-logs/mxcli-bugs.md
@@ -6885,7 +6885,7 @@ setting from the model bytes before starting. The setting is the BSON string `Af
 in the project-settings unit (`mprcontents/4e/70/4e70063d-….mxunit`, or inside a v1 `.mpr`). This
 needs no mxcli. When the value is `MxTest.RegisterEndpoint` or `MxTest.TestRunner`, both scripts
 refuse and print the repair. `app-restart.sh` lets a live `--test-endpoint` app through, because it
-holds the injection legitimately, and checks again after the stop.
+holds the injection legitimately, and checks again after the stop. `MXTK_SKIP_MXTEST_GUARD=1` skips the check out loud, so a false refusal never blocks.
 
 **Repair** (any one of):
 - `git checkout -- mprcontents/4e/70/<settings unit>`, then `git status`: the run may also have left an `MxTest` module.
diff --git a/project-bin/app-restart.sh b/project-bin/app-restart.sh
index c9529a51..442f05e7 100755
--- a/project-bin/app-restart.sh
+++ b/project-bin/app-restart.sh
@@ -187,16 +187,20 @@ blocked() {
   echo "  Record this run as INSTRUMENT BLOCKED, not as a test failure." >&2
   exit 4
 }
-# in_our_tree <pid> — the recorded pid itself, or a descendant of it (the runtime mxcli started).
 # ── After-startup left on an mxcli test injection (#244, BUG-157) ───────────
 # `mxcli test` and `mxcli run --test-endpoint` point the model's after-startup microflow at
 # MxTest.RegisterEndpoint (MxTest.TestRunner for a plain test run) and chain the original; only a
 # clean exit puts it back. A run stopped by a signal leaves it, and the next injection then chains
 # RegisterEndpoint to itself: StackOverflowError in the after-startup, the runtime never starts.
 # Read straight from the model bytes — no mxcli, no running app: the setting is the BSON string
-# element "AfterStartupMicroflow" of the project-settings unit (mprcontents/**/*.mxunit; inside the
-# .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own test models).
-mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+# element 0x02 "AfterStartupMicroflow" 0x00 of the project-settings unit (mprcontents/**/*.mxunit;
+# inside the .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own
+# test models). A unit or .mpr without the bytes "MxTest." anywhere is not scanned at all (an 8 MB
+# v1 .mpr costs a grep, not an 8 s od). MXTK_SKIP_MXTEST_GUARD=1 skips the check, out loud.
+mxtest_after_startup() (  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+  # A subshell with pipefail OFF: awk exits at the first match and od then dies of SIGPIPE; under
+  # the caller's pipefail that 141 would hide the answer and switch the guard off on a large .mpr.
+  set +o pipefail
   { if [ "$1" = - ]; then od -An -v -tx1; else od -An -v -tx1 "$1"; fi; } 2>/dev/null | awk '
     BEGIN { for (i = 0; i < 256; i++) hv[sprintf("%02x", i)] = i
             for (i = 32; i < 127; i++) { c = sprintf("%c", i); ch[sprintf("%02x", i)] = c; hx[c] = sprintf("%02x", i) }
@@ -210,27 +214,41 @@ mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = no
                             if (++n == 4) { if (L < 1 || L > 1024) { st = 0; k = 0 } else if (L == 1) { found = 1; exit } else { st = 2; n = 0 } } }
         else { if (++n < L) v = v ((b in ch) ? ch[b] : "?"); else { found = 1; exit } } } }
     END { if (!found) exit 1; print v }'
-}
+)
 MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
 mxtest_left() {  # $1 = model dir, $2 = .mpr. 0 = after-startup is an mxcli test injection (sets MXTEST_*)
-  local unit val
+  local unit val cands
   MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+  if [ "${MXTK_SKIP_MXTEST_GUARD:-0}" = 1 ]; then
+    echo "  ! MXTK_SKIP_MXTEST_GUARD=1 — NOT checking for a leftover mxcli test after-startup (#244). If the app" >&2
+    echo "    then dies with StackOverflowError in MxTest.RegisterEndpoint, that is what this check was for." >&2
+    return 1
+  fi
   if [ -d "$1/mprcontents" ]; then
-    unit="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null | head -1)"
-  else unit="$2"; fi
-  [ -n "$unit" ] && [ -f "$unit" ] || return 1
-  val="$(mxtest_after_startup "$unit")" || return 1
-  case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) return 1 ;; esac
-  MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
-  case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
-    MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
-  *) MXTEST_HEAD="?" ;; esac
-  return 0
+    cands="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null)"
+  else cands="$2"; fi
+  # Every unit holding the text, not the first: a doc string elsewhere can mention the setting by
+  # name. Only the BSON element counts, and only a unit that contains "MxTest." can hold the value.
+  while IFS= read -r unit; do
+    [ -n "$unit" ] && [ -f "$unit" ] || continue
+    LC_ALL=C grep -qa 'MxTest\.' "$unit" 2>/dev/null || continue
+    val="$(mxtest_after_startup "$unit")" || continue
+    case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) continue ;; esac
+    MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
+    case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
+      MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
+    *) MXTEST_HEAD="?" ;; esac
+    return 0
+  done <<CANDS
+$cands
+CANDS
+  return 1
 }
 mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stderr.
   local was="$MXTEST_HEAD" rel="${MXTEST_UNIT#"$PROJECT_ROOT"/}"
   echo "✗ $1: this model's after-startup microflow is $MXTEST_LEFT — left behind by an mxcli test or" >&2
-  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)." >&2
+  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)," >&2
+  echo "  or held right now by a live run --test-endpoint of this project." >&2
   echo "  Starting on it recurses (the next injection chains $MXTEST_LEFT to itself: StackOverflowError)," >&2
   echo "  or fails the build with CE1613 if the MxTest module is already gone. Either way the app never starts." >&2
   echo "  set in: $rel" >&2
@@ -238,15 +256,24 @@ mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stder
                       echo "  HEAD: not readable (no git, or the unit is untracked)" >&2 ;;
                  '')  echo "  HEAD: no after-startup microflow" >&2 ;;
                  *)   echo "  HEAD: $was" >&2 ;; esac
-  echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
-  echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  if [ "$1" = test-scratch ]; then
+    echo "  → If this project's app runs with --test-endpoint right now (skills/cloud-dev-environment.md), the" >&2
+    echo "    live model is fine as it is — test a copy whose settings unit comes from HEAD instead (#244's" >&2
+    echo "    workaround): git worktree add <dir> HEAD, copy the units under test into it, run mxcli test there" >&2
+    echo "    on free ports. Or stop the live app with Ctrl+C in its own terminal (a clean stop restores it)." >&2
+  else
+    echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
+    echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  fi
   echo "  → Otherwise restore it, then retry:" >&2
   echo "      git checkout -- '$rel'      (then git status: the run may have left an MxTest module too)" >&2
   echo "    or through ./bin/exec.sh (an ALTER SETTINGS — say so in chat; it is what mxcli's own cleanup runs):" >&2
   echo "      mdl 1;" >&2
   echo "      alter settings runtime (AfterStartupMicroflow: '$was');" >&2
   echo "    or Studio Pro: App Settings → Runtime → After startup." >&2
+  echo "  A false refusal? MXTK_SKIP_MXTEST_GUARD=1 skips this check (and says so)." >&2
 }
+# in_our_tree <pid> — the recorded pid itself, or a descendant of it (the runtime mxcli started).
 in_our_tree() {
   local p="$1" i=0
   [ "$ALIVE" = 1 ] || return 1
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index 413a2292..f9ae8f2f 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -66,9 +66,14 @@ else echo "✗ test-scratch: no mxcli (project root or PATH)." >&2; exit 3; fi
 # clean exit puts it back. A run stopped by a signal leaves it, and the next injection then chains
 # RegisterEndpoint to itself: StackOverflowError in the after-startup, the runtime never starts.
 # Read straight from the model bytes — no mxcli, no running app: the setting is the BSON string
-# element "AfterStartupMicroflow" of the project-settings unit (mprcontents/**/*.mxunit; inside the
-# .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own test models).
-mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+# element 0x02 "AfterStartupMicroflow" 0x00 of the project-settings unit (mprcontents/**/*.mxunit;
+# inside the .mpr itself on a v1 model). Layout checked against real settings units (mxcli's own
+# test models). A unit or .mpr without the bytes "MxTest." anywhere is not scanned at all (an 8 MB
+# v1 .mpr costs a grep, not an 8 s od). MXTK_SKIP_MXTEST_GUARD=1 skips the check, out loud.
+mxtest_after_startup() (  # $1 = file, or - for stdin. Prints the value ('' = none); 1 = no such element
+  # A subshell with pipefail OFF: awk exits at the first match and od then dies of SIGPIPE; under
+  # the caller's pipefail that 141 would hide the answer and switch the guard off on a large .mpr.
+  set +o pipefail
   { if [ "$1" = - ]; then od -An -v -tx1; else od -An -v -tx1 "$1"; fi; } 2>/dev/null | awk '
     BEGIN { for (i = 0; i < 256; i++) hv[sprintf("%02x", i)] = i
             for (i = 32; i < 127; i++) { c = sprintf("%c", i); ch[sprintf("%02x", i)] = c; hx[c] = sprintf("%02x", i) }
@@ -82,27 +87,41 @@ mxtest_after_startup() {  # $1 = file, or - for stdin. Prints the value ('' = no
                             if (++n == 4) { if (L < 1 || L > 1024) { st = 0; k = 0 } else if (L == 1) { found = 1; exit } else { st = 2; n = 0 } } }
         else { if (++n < L) v = v ((b in ch) ? ch[b] : "?"); else { found = 1; exit } } } }
     END { if (!found) exit 1; print v }'
-}
+)
 MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
 mxtest_left() {  # $1 = model dir, $2 = .mpr. 0 = after-startup is an mxcli test injection (sets MXTEST_*)
-  local unit val
+  local unit val cands
   MXTEST_LEFT=""; MXTEST_UNIT=""; MXTEST_HEAD=""
+  if [ "${MXTK_SKIP_MXTEST_GUARD:-0}" = 1 ]; then
+    echo "  ! MXTK_SKIP_MXTEST_GUARD=1 — NOT checking for a leftover mxcli test after-startup (#244). If the app" >&2
+    echo "    then dies with StackOverflowError in MxTest.RegisterEndpoint, that is what this check was for." >&2
+    return 1
+  fi
   if [ -d "$1/mprcontents" ]; then
-    unit="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null | head -1)"
-  else unit="$2"; fi
-  [ -n "$unit" ] && [ -f "$unit" ] || return 1
-  val="$(mxtest_after_startup "$unit")" || return 1
-  case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) return 1 ;; esac
-  MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
-  case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
-    MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
-  *) MXTEST_HEAD="?" ;; esac
-  return 0
+    cands="$(LC_ALL=C grep -rla --include='*.mxunit' 'AfterStartupMicroflow' "$1/mprcontents" 2>/dev/null)"
+  else cands="$2"; fi
+  # Every unit holding the text, not the first: a doc string elsewhere can mention the setting by
+  # name. Only the BSON element counts, and only a unit that contains "MxTest." can hold the value.
+  while IFS= read -r unit; do
+    [ -n "$unit" ] && [ -f "$unit" ] || continue
+    LC_ALL=C grep -qa 'MxTest\.' "$unit" 2>/dev/null || continue
+    val="$(mxtest_after_startup "$unit")" || continue
+    case "$val" in MxTest.RegisterEndpoint|MxTest.TestRunner) ;; *) continue ;; esac
+    MXTEST_LEFT="$val"; MXTEST_UNIT="$unit"
+    case "$unit" in *.mxunit)   # what HEAD has, so the repair can name it; "?" = not tracked / no git
+      MXTEST_HEAD="$(git -C "$(dirname "$unit")" show "HEAD:./$(basename "$unit")" 2>/dev/null | mxtest_after_startup -)" || MXTEST_HEAD="?" ;;
+    *) MXTEST_HEAD="?" ;; esac
+    return 0
+  done <<CANDS
+$cands
+CANDS
+  return 1
 }
 mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stderr.
   local was="$MXTEST_HEAD" rel="${MXTEST_UNIT#"$PROJECT_ROOT"/}"
   echo "✗ $1: this model's after-startup microflow is $MXTEST_LEFT — left behind by an mxcli test or" >&2
-  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)." >&2
+  echo "  run --test-endpoint that did not exit cleanly (stopped by a signal or killed; BUG-157)," >&2
+  echo "  or held right now by a live run --test-endpoint of this project." >&2
   echo "  Starting on it recurses (the next injection chains $MXTEST_LEFT to itself: StackOverflowError)," >&2
   echo "  or fails the build with CE1613 if the MxTest module is already gone. Either way the app never starts." >&2
   echo "  set in: $rel" >&2
@@ -110,14 +129,22 @@ mxtest_refusal() {  # $1 = tool name. Prints the refusal and the repair to stder
                       echo "  HEAD: not readable (no git, or the unit is untracked)" >&2 ;;
                  '')  echo "  HEAD: no after-startup microflow" >&2 ;;
                  *)   echo "  HEAD: $was" >&2 ;; esac
-  echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
-  echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  if [ "$1" = test-scratch ]; then
+    echo "  → If this project's app runs with --test-endpoint right now (skills/cloud-dev-environment.md), the" >&2
+    echo "    live model is fine as it is — test a copy whose settings unit comes from HEAD instead (#244's" >&2
+    echo "    workaround): git worktree add <dir> HEAD, copy the units under test into it, run mxcli test there" >&2
+    echo "    on free ports. Or stop the live app with Ctrl+C in its own terminal (a clean stop restores it)." >&2
+  else
+    echo "  → If this project's app is running with --test-endpoint right now, this is its live injection:" >&2
+    echo "    stop it with Ctrl+C in its own terminal (a clean stop restores the setting), then retry." >&2
+  fi
   echo "  → Otherwise restore it, then retry:" >&2
   echo "      git checkout -- '$rel'      (then git status: the run may have left an MxTest module too)" >&2
   echo "    or through ./bin/exec.sh (an ALTER SETTINGS — say so in chat; it is what mxcli's own cleanup runs):" >&2
   echo "      mdl 1;" >&2
   echo "      alter settings runtime (AfterStartupMicroflow: '$was');" >&2
   echo "    or Studio Pro: App Settings → Runtime → After startup." >&2
+  echo "  A false refusal? MXTK_SKIP_MXTEST_GUARD=1 skips this check (and says so)." >&2
 }
 
 # A model whose after-startup is an mxcli test injection must not be copied and tested: the copy
diff --git a/tests/wave2/fixtures/mxtest-guard/set-after-startup.js b/tests/wave2/fixtures/mxtest-guard/set-after-startup.js
index 83182623..807a18a1 100644
--- a/tests/wave2/fixtures/mxtest-guard/set-after-startup.js
+++ b/tests/wave2/fixtures/mxtest-guard/set-after-startup.js
@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // set-after-startup.js — fixture helper: re-encode a captured Mendix settings unit (BSON) with
 // AfterStartupMicroflow = <value>, every enclosing length rewritten. Re-encoding with the original
-// value ('') reproduces the capture byte for byte (checked by test-mxtest-guard.sh).
+// value ('') reproduces the capture byte for byte (checked by tests/wave2/test-test-scratch.sh).
 const fs = require('fs');
 const [inp, out, value] = process.argv.slice(2);
 const buf = fs.readFileSync(inp);
diff --git a/tests/wave2/test-app-restart.sh b/tests/wave2/test-app-restart.sh
index c99ee3dd..847216fc 100755
--- a/tests/wave2/test-app-restart.sh
+++ b/tests/wave2/test-app-restart.sh
@@ -102,7 +102,8 @@ start_app() {  # $1 = project dir, $2 = extra run flags (optional); waits for th
   local i; for i in $(seq 1 50); do [ -f "$1/.mxcli/run-local.json" ] && return 0; sleep 0.2; done; return 1
 }
 hs_pid() { sed -n 's/^  "pid": *\([0-9]*\).*/\1/p' "$1/.mxcli/run-local.json" 2>/dev/null; }
-alive() { [ -n "${1:-}" ] && kill -0 "$1" 2>/dev/null; }
+# Zombie-aware: a stopped child nobody has reaped yet still answers kill -0 (3/10 flakes on "was not stopped").
+alive() { [ -n "${1:-}" ] && kill -0 "$1" 2>/dev/null || return 1; case "$(ps -o stat= -p "$1" 2>/dev/null)" in Z*) return 1 ;; esac; }
 restart() { ( cd "$1" && shift && FAKE_GOLDEN="$GOLDEN" LOGDIR="$WORK" ./bin/app-restart.sh "$@" ) 2>&1; }
 
 PORT=$(( 20000 + RANDOM % 20000 ))
@@ -193,6 +194,8 @@ has "names the leftover" "$OUT" "after-startup microflow is MxTest.RegisterEndpo
 has "prints the MDL repair" "$OUT" "alter settings runtime (AfterStartupMicroflow:"
 has "says nothing was stopped" "$OUT" "Nothing was stopped"
 alive "$CUR" && ok "the app was left running" || bad "the app was stopped"
+OUT="$(MXTK_SKIP_MXTEST_GUARD=1 restart "$P" --dry-run)"; RC=$?
+[ "$RC" -eq 0 ] && has "MXTK_SKIP_MXTEST_GUARD=1 lets it through, out loud" "$OUT" "NOT checking" || bad "override exit $RC"
 cp "$GU" "$UNIT"
 
 echo "-- #244: a live --test-endpoint app holds the injection legitimately; a stop that does not restore it → exit 5"
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 830d1c62..1850d108 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -150,11 +150,27 @@ if command -v node >/dev/null 2>&1; then
   OUT="$(run l -- tests/a.test.mdl)"; RC=$?
   [ "$RC" -eq 3 ] && ok "MxTest.TestRunner → refused (exit 3)" || bad "TestRunner exit $RC"
   cp "$GU" "$UNIT"
-  echo "-- #244 on a v1 model (settings inside the .mpr itself)"
+  echo "-- #244: another unit that merely MENTIONS the setting (a doc string) does not switch the guard off"
+  D1="$P/mprcontents/00/00/00000000-doc.mxunit"; D2="$P/mprcontents/ff/ff/ffffffff-doc.mxunit"; mkdir -p "$(dirname "$D1")" "$(dirname "$D2")"
+  printf 'Documentation\0Set AfterStartupMicroflow to MxTest.Setup for tests\0' | tee "$D1" > "$D2"
+  node "$SETAS" "$GU" "$UNIT" "MxTest.RegisterEndpoint"
+  OUT="$(run n -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 3 ] && ok "doc-string units beside the injected settings unit → still refused" || bad "doc-string unit hid the injection (exit $RC)"
+  echo "-- #244: MXTK_SKIP_MXTEST_GUARD=1 lets a run through, out loud"
+  OUT="$(MXTK_SKIP_MXTEST_GUARD=1 run o -- tests/a.test.mdl)"; RC=$?
+  [ "$RC" -eq 0 ] && has "skipped, and says so" "$OUT" "MXTK_SKIP_MXTEST_GUARD=1 — NOT checking" || bad "override exit $RC"
+  rm -f "$D1" "$D2"
+  echo "-- #244 on a v1 model (settings inside the .mpr itself), 2 MB of model after the setting"
+  # Large on purpose: the reader stops at the first match, od then dies of SIGPIPE, and under the
+  # script's pipefail that once discarded the answer — the guard silently did nothing on a real .mpr.
   V="$WORK/v1"; mkdir -p "$V/bin"; cp "$P/bin/"*.sh "$V/bin/"; cp "$P/mxcli" "$V/"
-  { printf 'SQLite format 3\0'; node "$SETAS" "$GU" /dev/stdout "MxTest.RegisterEndpoint"; printf '\0\0trailing'; } > "$V/Fixture.mpr"
+  node "$SETAS" "$GU" "$WORK/inj.mxunit" "MxTest.RegisterEndpoint"
+  { printf 'SQLite format 3\0'; cat "$WORK/inj.mxunit"; head -c 2000000 /dev/zero; } > "$V/Fixture.mpr"
   OUT="$( cd "$V" && REC="$WORK/rec.m" ./bin/test-scratch.sh -- x.test.mdl 2>&1 )"; RC=$?
-  [ "$RC" -eq 3 ] && has "v1 .mpr → refused, git repair degrades to a placeholder" "$OUT" "HEAD: not readable" || bad "v1 exit $RC: $(printf '%s' "$OUT" | tail -3)"
+  [ "$RC" -eq 3 ] && has "large v1 .mpr → refused, git repair degrades to a placeholder" "$OUT" "HEAD: not readable" || bad "v1 exit $RC: $(printf '%s' "$OUT" | tail -3)"
+  { printf 'SQLite format 3\0'; cat "$GU"; head -c 2000000 /dev/zero; } > "$V/Fixture.mpr"
+  OUT="$( cd "$V" && REC="$WORK/rec.p" ./bin/test-scratch.sh -- x.test.mdl 2>&1 )"; RC=$?
+  [ "$RC" -eq 0 ] && ok "large clean v1 .mpr → runs" || bad "clean v1 exit $RC: $(printf '%s' "$OUT" | tail -3)"
 else
   echo "  [skip] node missing — the injected settings units are built from the capture with node"
 fi

From b6b8d10b2e838dee3015b91086ddbc5316bfcc30 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:39:20 +0000
Subject: [PATCH 58/68] fix: review follow-ups on #327 (owners single source,
 pointers, core failure line)

- change-intake.md: its Owners section is the single source (now
  carrying the inline-edit / no-UNSYNCED rule); the detail file's Owners
  table says it only expands it. conversion-runbook.md and agent-roles.md
  pointers reworded to name that section.
- gate-check.sh and change-log.sh comments point the "when does this
  block" question at change-intake-detail.md "The mechanical check".
- Core gains the failure line: "Sure, adding it now" -> MDL, no row
  (12 of 12 field changes). Core 299 -> 331 words; baseline tier
  78,492 -> 78,524 (budget 80,000).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                   | 2 +-
 bin/gate-check.sh              | 2 +-
 bin/lib/change-log.sh          | 2 +-
 skills/agent-roles.md          | 2 +-
 skills/change-intake-detail.md | 2 +-
 skills/change-intake.md        | 6 ++++--
 skills/conversion-runbook.md   | 2 +-
 7 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe0fb04d..30f396af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(process): **follow-ups to the change log (#306): baseline cost, CRLF registers, gate wording.** (1) `skills/change-intake.md` went baseline for lead+ba at Stages 2–7 at 1,804 words without paying for it, against `render-routing.sh`'s "a new baseline row is paid for elsewhere" rule. It is now a 299-word core (trigger, row columns, class → entry artifact, size → ask, owners, Done when); the why-table, the wrong-vs-right example, the full tables, apply/prove steps, the owners table and the gate-check explanation moved verbatim to new on-demand `skills/change-intake-detail.md` (lead, ba, architect; Stages 2–7). Baseline tier 79,997 → 78,492 words (`render-routing.sh --check`, `LC_ALL=C`). (2) A `PROJECT.md` saved with CRLF line endings hid the section: `mxtk_change_log_has_section` never matched `## Change log\r`, so gate-check warned "no section", `sync-project.sh` appended a second empty one, and the scan counted 0 rows. Both readers in `bin/lib/change-log.sh` now drop a trailing `\r`; new fixture case T9 in `tests/wave2/test-change-log.sh` (CRLF copy scans, gates and syncs identically to the LF one; 5 of its cases fail on the previous code). The fixture also drops `pipefail`, which let an early-matching `grep -q` SIGPIPE its `printf` and fail T7 intermittently. (3) The skill's "Done when" expected `0 of M … not yet applied`, a string gate-check never prints; it now names the `PASS` line gate-check actually prints — MendixMau
+- fix(process): **follow-ups to the change log (#306): baseline cost, CRLF registers, gate wording.** (1) `skills/change-intake.md` went baseline for lead+ba at Stages 2–7 at 1,804 words without paying for it, against `render-routing.sh`'s "a new baseline row is paid for elsewhere" rule. It is now a 331-word core (trigger plus its one-line failure case, row columns, class → entry artifact, size → ask, Owners — now the single source the runbook and `agent-roles.md` point to, with the inline-edit/no-`UNSYNCED` rule — and Done when); the why-table, the wrong-vs-right example, the full tables, apply/prove steps, the owners table and the gate-check explanation moved verbatim to new on-demand `skills/change-intake-detail.md` (lead, ba, architect; Stages 2–7). Baseline tier 79,997 → 78,524 words (`render-routing.sh --check`, `LC_ALL=C`). (2) A `PROJECT.md` saved with CRLF line endings hid the section: `mxtk_change_log_has_section` never matched `## Change log\r`, so gate-check warned "no section", `sync-project.sh` appended a second empty one, and the scan counted 0 rows. Both readers in `bin/lib/change-log.sh` now drop a trailing `\r`; new fixture case T9 in `tests/wave2/test-change-log.sh` (CRLF copy scans, gates and syncs identically to the LF one; 5 of its cases fail on the previous code). The fixture also drops `pipefail`, which let an early-matching `grep -q` SIGPIPE its `printf` and fail T7 intermittently. (3) The skill's "Done when" expected `0 of M … not yet applied`, a string gate-check never prints; it now names the `PASS` line gate-check actually prints — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index 8095c342..3c7e26e1 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -2333,7 +2333,7 @@ fi
 # never written once, and a gate cannot see a marker nobody wrote. A change log makes the ask
 # countable; whether its counts are right on real projects is not yet known, and a blocking
 # guard built on an unproven count is how this repo has shipped false FAILs before.
-# change-intake.md names the condition under which this becomes blocking.
+# change-intake-detail.md "The mechanical check" names the condition under which this becomes blocking.
 CR_STATUS="PASS"; CR_NOTE=""; CR_ROWS=""
 if [ "$REG_AMBIGUOUS" = "1" ] || [ -z "$REGISTER" ] || [ ! -f "$REGISTER" ]; then
   CR_STATUS="MANUAL"
diff --git a/bin/lib/change-log.sh b/bin/lib/change-log.sh
index bd2b5a8a..783dc1d8 100644
--- a/bin/lib/change-log.sh
+++ b/bin/lib/change-log.sh
@@ -17,7 +17,7 @@
 # toolkit pull) — both mandatory chain steps. Rows are written by the lead per change-intake.md.
 #
 # WARN-ONLY. gate-check.sh reports what mxtk_change_log_scan counts as a WARN line and never
-# blocks on it. change-intake.md says when that changes, and why not yet.
+# blocks on it. change-intake-detail.md "The mechanical check" says when that changes, and why not yet.
 #
 # Sourced, never executed. Callers are `set -euo pipefail`, so keep this side-effect free.
 
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index 01ba7ba4..c730f06e 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -111,7 +111,7 @@ A single do-everything agent has no natural place to stop before mutating the re
 | **test-agent** | Walk UI test scenarios against the running app, cross-check against the database | No | No — read-only/verification-only |
 | **review-agent** | Owns `module-review.md` — the one pass that closes a module. Stage 3's model-side instruments (`bin/review-module.sh`: conformance + graph sweep) **and stage 4, the LOOK**: every page in the module assessed against wireframe, design system and plain design judgement. Diagnostic only — never fixes what it finds | No — never | Yes, but only its own report under `design/ui-reviews/`, via `Bash` |
 
-**Who records a change, who flushes it.** A mid-build change or decision is *marked* by the lead: the `PROJECT.md` `## Change log` row, the decision row, any `[sync:]` marker. `mdl-agent` and `gate-agent` report it and never write `PROJECT.md`. `ba-agent` flushes BRDs and module briefs, and `architect-agent` flushes wireframes and `architecture/`. The single source is the Owners table in `change-intake.md`.
+**Who records a change, who flushes it.** A mid-build change or decision is *marked* by the lead: the `PROJECT.md` `## Change log` row, the decision row, any `[sync:]` marker. `mdl-agent` and `gate-agent` report it and never write `PROJECT.md`. `ba-agent` flushes BRDs and module briefs, and `architect-agent` flushes wireframes and `architecture/`. The single source is the Owners section in `change-intake.md`.
 
 **The one rule that matters more than any other: only the main session (the one talking to the user) ever runs the command that mutates the real `.mpr`.** All six subagents get `tools: Read, Grep, Glob, Bash` — never `Write`/`Edit`. Agents that need to produce files (`ba-agent`, `architect-agent`, `mdl-agent`) do so via `Bash` (shell redirection/heredoc), not the `Write` tool — that keeps "can this agent silently overwrite something outside its lane" a visible, auditable choice in its tool list rather than an assumption.
 
diff --git a/skills/change-intake-detail.md b/skills/change-intake-detail.md
index a05b0fcf..fca1c690 100644
--- a/skills/change-intake-detail.md
+++ b/skills/change-intake-detail.md
@@ -104,7 +104,7 @@ A row the user rejects is kept, with Status `rejected — <reason>`. A rejected
 3. Then write the MDL and run it with `./bin/exec.sh --cr CR-NN <script>`. The tag lands in the BUILD-LOG detail cell, and that BUILD-LOG row is the evidence for Step 5.
 4. Set the status to `applied` and fill Closed-by with the commit that holds the artifact edit.
 
-**Owners** (this replaces the split that `agent-roles.md` lanes contradicted):
+**Owners**, expanded. The source is `change-intake.md` → Owners; this table only spells it out (it replaces the split that `agent-roles.md` lanes contradicted):
 
 | Duty | Owner |
 |---|---|
diff --git a/skills/change-intake.md b/skills/change-intake.md
index 39f7e4b3..dc39eb30 100644
--- a/skills/change-intake.md
+++ b/skills/change-intake.md
@@ -5,6 +5,8 @@
 
 **Trigger:** the user, or a relayed stakeholder, asks for anything to differ from artifacts or build. Not a gate answer or review finding.
 
+Wrong: "Sure — adding it now" → MDL, no row (12 of 12 field changes).
+
 ## Row first, in `PROJECT.md` `## Change log`
 
 Columns: CR-NN (never reused), Date, Source, Verbatim ask (`\|` for a pipe), Class, Size, Entry artifact, Status, Closed-by. One ask, one row. Status: open → refined → agreed → applied → proven, or `rejected — reason` (kept).
@@ -24,9 +26,9 @@ Columns: CR-NN (never reused), Date, Source, Verbatim ask (`\|` for a pipe), Cla
 - **L** (new feature or module, or contradicts `CONFIRMED`): ask now (two options, a recommendation); re-enter the owning stage.
 - **Relayed**: `open` until the next gate asks. **Ambiguous**: one "A or B?".
 
-## Owners
+## Owners (single source)
 
-Lead: all CR/decision rows, S edits; helpers never write `PROJECT.md`. ba-agent: BRDs, briefs. architect-agent: wireframes, `design/`, `architecture/`.
+Lead: all CR/decision rows, S edits; helpers never write `PROJECT.md`. ba-agent: BRDs, briefs. architect-agent: wireframes, `design/`, `architecture/`. When the lead edits inline, no `UNSYNCED` marker is needed; use one only for a deferred flush.
 
 ## Done when
 
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index cc80daa8..32b07cdc 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -805,7 +805,7 @@ stale assertion. This is a real, observed failure mode, not a hypothetical — s
 `iterative-build-loop.md` → "Requirements Drift-Sync Rule" (where the detection mechanics — which
 BRD fields count as "asserted" — live).
 
-**Ownership is split, on purpose** (the table in `change-intake.md` → Owners is the single source):
+**Ownership is split, on purpose** (`change-intake.md` → Owners is the single source; `change-intake-detail.md` expands it):
 - **The lead** (the session talking to the user) **marks**: it writes the decision row and its
   marker. A helper that hits a BRD-touching decision reports it to the lead, because `mdl-agent`
   writes only `.mdl` and `gate-agent` is read-only (`agent-roles.md`).

From 4785a8c5dd8c722d723225c4d1e1a6e645d34562 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:40:13 +0000
Subject: [PATCH 59/68] test-scratch take_over: -mmin +1 and own-file-only
 removal (in step with #324's review)

`find -mmin +0` treats a fresh empty takeover file as stale at once (GNU matches 0-2 s
old files, BSD rounds up), so a takeover in progress could be broken into: two holders
under load. Now -mmin +1 (empty for over a minute). The takeover file is removed only
when its content is what was judged stale (a moved-aside live one is put back with ln,
and kept if that fails), and a finished takeover removes the file only while it still
holds its own line. Fixture: a fresh empty takeover file blocks the takeover and is left
alone; one over a minute old (touch -t 2000) is stale. Fails on the previous body.

Keep in step with exec.sh's exec_lock_takeover (PR #324).

Refs #244

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                     |  2 +-
 project-bin/test-scratch.sh      | 21 +++++++++++++--------
 tests/wave2/test-test-scratch.sh | 12 ++++++++++++
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4bab42d..6532333e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 - fix(test-scratch, app-restart): **both refuse to start on a model whose after-startup is still an mxcli test injection (`MxTest.RegisterEndpoint` / `MxTest.TestRunner`), and print the repair** ([#244](https://github.com/MendixMau/mxcli-project-toolkit/issues/244), BUG-157). A `mxcli test` or `run --test-endpoint` stopped by a signal skips its restore, and the next injection chains `RegisterEndpoint` to itself: StackOverflowError, app down. It happened twice in one day on one machine, and again on a second project. The setting is read from the settings unit's bytes, so no mxcli is needed. Every unit holding the BSON element is checked, not just the first one that mentions the name. A unit without the bytes `MxTest.` is skipped, so an 8 MB v1 model costs one grep. The reader runs with pipefail off, so a large v1 `.mpr` cannot switch the guard off. `MXTK_SKIP_MXTEST_GUARD=1` skips the check and says so. The fixture uses a settings unit captured from mxcli's own test model. `test-scratch.sh` exits 3 before copying. `app-restart.sh` exits 3 before stopping, except for a live `--test-endpoint` app, which holds the injection legitimately; if stopping that app leaves the setting behind, it exits 5 (new): stopped, not started. Projects pick this up on sync; a clean model sees no change. — MendixMau, second case AlvinnYeo
 - fix(app-restart): **the recorded pid is verified to still be an `mxcli run` before anything is stopped** (review of #304). With `--cmd` / `MXTK_APP_START_CMD`, the identity check read the override, not the process. A record left by a SIGKILL whose pid the OS had reused sent TERM/KILL to that unrelated process and its children. The pid's own command line (`/proc`, `ps`; on Windows the image name `mxcli.exe`) must now name mxcli and `run`. Otherwise the app counts as not running and the process is not touched. — MendixMau
-- fix(test-scratch): **taking over a stale lock is serialised with exactly exec.sh's protocol, so test-scratch and exec.sh never both hold the shared `.exec.lock`** (review of #304). The old takeover moved the lock aside with `mv -f`. It now uses the same O_EXCL `<lock>.takeover` file and rules as exec.sh in #324: stale when its pid is dead or after 10s, re-read under it, remove only the exact stale line, put back a wrongly moved takeover file with `ln`. The port lock uses the same protocol. A new cross-script fixture, `test-shared-lock-takeover.sh`, runs 5 exec.sh + 5 test-scratch contenders on a dead holder's lock: two holders at once on the old code, never on the new. — MendixMau
+- fix(test-scratch): **taking over a stale lock is serialised with exactly exec.sh's protocol, so test-scratch and exec.sh never both hold the shared `.exec.lock`** (review of #304). The old takeover moved the lock aside with `mv -f`. It now uses the same O_EXCL `<lock>.takeover` file and rules as exec.sh in #324: stale when its pid is dead or after 10s (an empty one after over a minute, `find -mmin +1`: `+0` made a fresh one stale at once), re-read under it, remove only the exact stale line, put back a wrongly moved takeover file with `ln`. It removes only its own takeover file. The port lock uses the same protocol. A new cross-script fixture, `test-shared-lock-takeover.sh`, runs 5 exec.sh + 5 test-scratch contenders on a dead holder's lock: two holders at once on the old code, never on the new. — MendixMau
 - learn(lint-that-actually-runs): **lint a copy of the model only after copying `.claude/lint-rules` (and `lint-config.yaml`) beside it, and compare rule counts before diffing** ([#240](https://github.com/MendixMau/mxcli-project-toolkit/issues/240), BUG-158). A snapshot in `/tmp` gave 51 findings from 8 rules, against 721 from 29 for the project: no notice, exit 0. mxcli's source also shows `lint-config.yaml` is read only from beside the `.mpr`, so an in-repo snapshot loses it as well. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
diff --git a/project-bin/test-scratch.sh b/project-bin/test-scratch.sh
index f9ae8f2f..d20192cf 100755
--- a/project-bin/test-scratch.sh
+++ b/project-bin/test-scratch.sh
@@ -172,31 +172,36 @@ holder_live() {
 # that is not its own. WHY (independent review of #304): the old takeover here moved the lock
 # aside with `mv -f` — check-then-act — so two runs that judged the same dead holder could both
 # end up holding it. A takeover file left by a holder killed mid-takeover is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put
+# dead or it is older than 10 s (an EMPTY one once it is over a minute old: find -mmin +1); it is moved aside, and put
 # back with `ln` (fails if a new one exists — never clobbers) if what was moved is not the one
 # judged stale. The machine-wide port lock uses the same protocol.
 take_over() {  # $1 = lock file, $2 = the stale lock line. 0 iff it was removed (or already gone)
-  local _tk="$1.takeover" _t _tpid _tsince _tstale _now
-  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+  local _tk="$1.takeover" _t _tpid _tsince _tstale _now _mine
+  _mine="$$ $(date +%s)"
+  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
     _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
     case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
     _tstale=0
     if [ -n "$_t" ]; then
       { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
-      _tstale=1   # empty for a minute: its creator died between the create and the write
+    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
+      # -mmin +1, not +0: GNU find counts a 0-2 s old file as "+0" (and BSD rounds up), so +0 made a
+      # FRESH empty takeover file — its creator between the create and the write — stale at once.
+      _tstale=1   # empty for over a minute: its creator died between the create and the write
     fi
     if [ "$_tstale" = 1 ]; then
       if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
-        rm -f "$_tk.stale.$$"
+        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
+        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
+        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
+        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
       fi
     fi
     return 1
   fi
   _now="$(head -1 "$1" 2>/dev/null || true)"
   [ "$_now" = "$2" ] && rm -f "$1"
-  rm -f "$_tk"
+  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
   return 0
 }
 take_lock() {  # $1 = lock file, $2 = what it guards (for messages). 0 = taken, 1 = live holder
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 1850d108..4609943f 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -119,6 +119,18 @@ printf '999999 1 test-scratch.sh\n' > "$L"; printf '999998 1\n' > "$L.takeover"
 OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
 has "taken after clearing the dead marker" "$OUT" "rc=0"
 [ "$(cut -d' ' -f1 "$L" 2>/dev/null)" != 999999 ] && ok "the stale line is gone" || bad "stale line still there"
+echo "-- #324 review: a FRESH empty takeover file (its creator between create and write) is not stale"
+# find -mmin +0 counted a 0-2 s old file as old (GNU; BSD rounds up), so a takeover in progress was
+# treated as dead and two contenders could both take over. +1 = empty for over a minute.
+printf '999999 1 test-scratch.sh\n' > "$L"; : > "$L.takeover"
+OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
+has "not taken while a fresh empty takeover file exists" "$OUT" "rc=1"
+[ -e "$L.takeover" ] && [ ! -s "$L.takeover" ] && ok "the fresh takeover file was left alone" || bad "the fresh takeover file was removed or replaced"
+[ "$(cut -d' ' -f1 "$L" 2>/dev/null)" = 999999 ] && ok "the lock was not touched" || bad "the lock was taken over under a live takeover"
+touch -t 200001010000 "$L.takeover"
+OUT="$( L="$L" bash -c '. "$1"; holder_live() { return 1; }; take_lock "$L" "race lock"; echo "rc=$?"' _ "$H" 2>&1 )"
+has "an empty takeover file over a minute old is stale → taken" "$OUT" "rc=0"
+[ -e "$L.takeover" ] && bad "takeover file left behind" || ok "and no takeover file is left behind"
 kill -KILL "$LIVE" 2>/dev/null; wait "$LIVE" 2>/dev/null
 
 echo "-- #244: an after-startup left on an mxcli test injection is refused before anything is copied"

From d696b5b8d688edfb5ce75e0429dbd3857f412355 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:40:20 +0000
Subject: [PATCH 60/68] Lint Batch 4 review: SEC014 notice is a sync NOTE, not
 a counted warning

A pristine scaffold has not chosen its external roles yet, and test-bug12-sync.sh T0 requires
a pristine sync to exit 0 with no warning under --strict (61/61 with this change; the warn()
version failed T0). Wording aligned in the rule header, README, CHANGELOG and backlog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                               |  2 +-
 bin/lib/sec014-notice.sh                   |  5 +++--
 bin/sync-project.sh                        | 10 ++++------
 lint-rules/README.md                       |  8 ++++----
 lint-rules/sec014_external_role_write.star |  4 ++--
 process/lint-backlog.md                    |  2 +-
 tests/wave2/test-sec014-notice.sh          | 10 ++++++----
 7 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f2835d9..f806daa3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is blank or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. Each message is under 160 characters and names the place to fix it, because lint-gate prints only that much. An **absent** option is not a `_rule` finding, so it does not block every exec (the #229 pattern). Instead `bin/sync-project.sh` warns on every sync through new `bin/lib/sec014-notice.sh` until the option is set (fixture `tests/wave2/test-sec014-notice.sh`, 13 cases). `"none"` switches a security rule off, so it is set only on the user's answer in chat and recorded in `PROJECT.md`. Right after configuring, re-baseline with `lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, because the 0 → N jump would otherwise be blamed on the next script. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 32 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. CONV009's "every flow reports 0 objects" self-check now needs `activities_for()` to find a real object in a zero-count flow, so an early greenfield model with empty microflows is not reported blind. `lint-rules/README.md` and the TXT002 header now give the supported way to turn a toolkit rule off. ISO dates in particular are a toolkit opinion, so a project with a non-ISO display standard sets `rules: TXT002: enabled: false` in `lint-config.yaml` and records that in `PROJECT.md`. It must not delete the file, which sync would re-install. On mxcli 0.26.0, a rule with 1 finding gave 0 once disabled. — MendixMau
+- feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is blank or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. Each message is under 160 characters and names the place to fix it, because lint-gate prints only that much. An **absent** option is not a `_rule` finding, so it does not block every exec (the #229 pattern). Instead `bin/sync-project.sh` prints a NOTE on every sync through new `bin/lib/sec014-notice.sh` until the option is set. It is a NOTE rather than a counted warning, so a pristine scaffold still syncs clean under `--strict` (fixture `tests/wave2/test-sec014-notice.sh`, 14 cases; `test-bug12-sync.sh` 61/61). `"none"` switches a security rule off, so it is set only on the user's answer in chat and recorded in `PROJECT.md`. Right after configuring, re-baseline with `lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, because the 0 → N jump would otherwise be blamed on the next script. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 32 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. CONV009's "every flow reports 0 objects" self-check now needs `activities_for()` to find a real object in a zero-count flow, so an early greenfield model with empty microflows is not reported blind. `lint-rules/README.md` and the TXT002 header now give the supported way to turn a toolkit rule off. ISO dates in particular are a toolkit opinion, so a project with a non-ISO display standard sets `rules: TXT002: enabled: false` in `lint-config.yaml` and records that in `PROJECT.md`. It must not delete the file, which sync would re-install. On mxcli 0.26.0, a rule with 1 finding gave 0 once disabled. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/lib/sec014-notice.sh b/bin/lib/sec014-notice.sh
index 5fc6fa96..3d2fa678 100644
--- a/bin/lib/sec014-notice.sh
+++ b/bin/lib/sec014-notice.sh
@@ -7,8 +7,9 @@
 # the rule reports nothing on exec — a `_rule` blindness finding there would make lint-gate
 # exit PASS-BLIND on every exec of every synced project until someone edits a config file,
 # which is the #229 pattern (an unconfigured CONV020 logged 20 LINT BLIND rows in two apps).
-# The not-yet-decided state is said HERE instead, once per sync, as a sync warning, until the
-# option is set. A misconfigured value (a list, an unknown role) is still a `_rule` finding.
+# The not-yet-decided state is said HERE instead, on every sync, as a NOTE (not a counted
+# warning: a fresh scaffold has not decided yet, and a pristine sync must pass --strict), until
+# the option is set. A misconfigured value (a list, an unknown role) is still a `_rule` finding.
 #
 # Producer of the input: bin/sync-project.sh and bin/init-project.sh install the rule via
 # mxtk_install_lint_rules; lint-config.yaml is written by `mxcli init`.
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index 339849e8..edcfa7d3 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1444,14 +1444,12 @@ fi
 if [ "$WIRED" -eq 1 ]; then
   mxtk_install_lint_rules "$(cd "$SCRIPT_DIR/.." && pwd)" "$PROJECT_DIR" "$DRY_RUN" "$UPGRADE_LINT"
   CHANGES=$((CHANGES + ${MXTK_LINT_CHANGES:-0}))
-  # SEC014 says "not configured" here, once per sync, never on exec (bin/lib/sec014-notice.sh).
+  # SEC014 says "not configured" here, on every sync, never on exec (bin/lib/sec014-notice.sh).
+  # A NOTE, not warn(): a fresh scaffold has not decided yet, and a pristine sync must stay
+  # clean under --strict (tests/wave2/test-bug12-sync.sh T0).
   . "$SCRIPT_DIR/lib/sec014-notice.sh"
   if _sec014_msg=$(mxtk_sec014_notice "$PROJECT_DIR"); then
-    _old_ifs=$IFS; IFS='
-'
-    # shellcheck disable=SC2086
-    warn $_sec014_msg
-    IFS=$_old_ifs
+    echo "NOTE: $_sec014_msg" | sed '2,$s/^/      /'
   fi
 fi
 
diff --git a/lint-rules/README.md b/lint-rules/README.md
index b1e438b0..7a4c2934 100644
--- a/lint-rules/README.md
+++ b/lint-rules/README.md
@@ -21,7 +21,7 @@ and configure the marked constants — **after** running `mxcli init`, never bef
 | `txt001_build_words_in_user_text.star` | TXT001 — user-visible text (titles, captions, templates, messages, menu items) holding build-process words: `Stage N`, `BR-10`, `F004`, TODO, a version tag, "(local, …)" | `PROJECT_WORDS` (sibling-app and project code names); `LEAK_PATTERNS` if "Stage N" is a real domain word |
 | `txt002_non_iso_date_in_user_text.star` | TXT002 — user-visible text holding a non-ISO literal date (10/12/2026, 12 Oct 2026) or a day/month format pattern (dd MMM, MM/dd); blind to format strings inside expressions | no. ISO dates are a toolkit opinion, not a Mendix rule. A project whose display standard is not ISO turns it off in `.claude/lint-config.yaml` (`rules: TXT002: enabled: false`), never by deleting the file, which sync re-installs. See "Turning a toolkit rule off" below |
 | `ui001_widget_layout_traps.star` | UI001 — a list view inside a Data grid 2 column (its own "Load more" / "No items found" in every cell); an inline `width` on an Atlas input without `flex` (ignored) | `DATAGRID_TYPES`, `LISTVIEW_TYPES`, `INPUT_TYPES` (widget_type vocabulary: probe first) |
-| `sec014_external_role_write.star` | SEC014 — an external user role (partner, customer, portal) that can write every member, a state enumeration (`Status`, `State`, …), an audit attribute (`…At` / `…By`) or the association its own XPath uses for ownership: the client API lets it skip the approval microflow | **yes, required**, in `.claude/lint-config.yaml`: `rules: SEC014: options: external_roles: "Partner, Customer"` (one text, not a YAML list), or `"none"`. Until it is set the rule reports nothing and `bin/sync-project.sh` warns on every sync; a list, a blank value or an unknown role is a `_rule` finding |
+| `sec014_external_role_write.star` | SEC014 — an external user role (partner, customer, portal) that can write every member, a state enumeration (`Status`, `State`, …), an audit attribute (`…At` / `…By`) or the association its own XPath uses for ownership: the client API lets it skip the approval microflow | **yes, required**, in `.claude/lint-config.yaml`: `rules: SEC014: options: external_roles: "Partner, Customer"` (one text, not a YAML list), or `"none"`. Until it is set the rule reports nothing and `bin/sync-project.sh` prints a NOTE on every sync; a list, a blank value or an unknown role is a `_rule` finding |
 
 `err001` and `loop001` first field count (2026-10-12, mxcli 0.26.0, 21-module Mendix 11.12 model,
 876 microflows): ERR001 8 (3 true, 5 debatable — flows that return an error payload instead of
@@ -68,7 +68,7 @@ association its own XPath scopes on; a true positive by the rule's definition, t
 #268. Positive control with every user role configured: 7 findings across 6 entities, and a SQL
 replay of the same logic over `.mxcli/catalog.db` gives the same 7 (0 on the second model, which
 has no external role; `"none"` there gives 0 and no `_rule`). A list or a misspelt role each give
-exactly one `_rule` finding; an absent option gives nothing on exec and a sync warning instead. Both files also load and give the same counts on mxcli
+exactly one `_rule` finding; an absent option gives nothing on exec and a sync NOTE instead. Both files also load and give the same counts on mxcli
 0.17.0 and 0.24.0 (SEC014 avoids `associations()`, which does not exist before 0.25.0 and would
 make the file fail to load). Vocabulary landed in SEC014's header: `MEMBER_WRITE` rows carry
 qualified member and module-role names, attribute `data_type` for an enum is `Enumeration`.
@@ -146,13 +146,13 @@ survive `mxcli init` — and surviving matters, because init wipes every in-file
 which would otherwise make a genuine revert indistinguishable from a first install.
 
 **SEC014 needs two decisions from the user, not from an agent.** Until `external_roles` is
-set, SEC014 reports nothing on exec, and `bin/sync-project.sh` warns on every sync with the exact
+set, SEC014 reports nothing on exec, and `bin/sync-project.sh` prints a NOTE on every sync with the exact
 lines to add (`bin/lib/sec014-notice.sh`). It is not a `_rule` finding, because that would make
 lint-gate exit PASS-BLIND on every exec of every synced project until someone answered, which is
 the #229 pattern an unconfigured CONV020 caused. Which roles are external is the user's answer,
 asked in chat. `external_roles: "none"` switches off a security rule, so it is set only on the
 user's answer and recorded as a decision row in `PROJECT.md`. An agent never sets it to make the
-warning go away. The first run after configuring raises SEC014 from 0 to N at once, and lint-gate
+NOTE go away. The first run after configuring raises SEC014 from 0 to N at once, and lint-gate
 would blame that security-tier rise on whatever script ran next. So re-baseline in the same step:
 `bin/lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, after the
 user has seen the findings.
diff --git a/lint-rules/sec014_external_role_write.star b/lint-rules/sec014_external_role_write.star
index 6b07fec7..6df3c752 100644
--- a/lint-rules/sec014_external_role_write.star
+++ b/lint-rules/sec014_external_role_write.star
@@ -39,7 +39,7 @@
 # entities.
 #
 # NOT CONFIGURED YET (option absent): the rule returns nothing, and bin/sync-project.sh
-# says so instead, once per sync, as a sync warning (bin/lib/sec014-notice.sh). A `_rule`
+# prints a NOTE instead, on every sync (bin/lib/sec014-notice.sh). A `_rule`
 # finding here would make lint-gate exit PASS-BLIND on every exec of every synced project until
 # someone answers a question — the #229 pattern. The silence is not a pass: the sync names it.
 # After configuring, SEC014 jumps 0 -> N in one run; re-baseline right then
@@ -144,7 +144,7 @@ def _role_matches(perm_role, roles):
 def check():
     raw = get_option("external_roles", UNSET)
     if raw == UNSET:
-        # Not decided yet: sync-project.sh reports it once per sync (see header).
+        # Not decided yet: sync-project.sh prints a NOTE on every sync (see header).
         return []
     if raw == None or type(raw) != "string":
         # lint-gate prints message[:160] only, so the fix goes in the message.
diff --git a/process/lint-backlog.md b/process/lint-backlog.md
index 78a8ec68..c15eaead 100644
--- a/process/lint-backlog.md
+++ b/process/lint-backlog.md
@@ -137,7 +137,7 @@ says a role is external. Lint Batch 4 shipped both rows; the field-run counts ar
 
 | # | Rule | Category | Evidence | Needs | Status |
 |---|---|---|---|---|---|
-| 49 | External role (configured) can write all members, a state enumeration (`Status`/`State`/`Result`/`Stage`/`Phase`), an audit `…At`/`…By` attribute, or the association its own XPath scopes ownership on (SEC014) | security | #268: a partner role held `create, read *, write *` on two self-owned entities with a state attribute; lint showed only CONV006 +4, re-baselined; a manual review found it five days later | `permissions_for()` `MEMBER_WRITE` rows, `attributes_for().data_type` (`Enumeration`), `user_roles()` / `role_mappings()`; `external_roles` option, text not list; absent = sync warning, not a `_rule` finding. Probed 2026-10-13 | drafted (Batch 4) |
+| 49 | External role (configured) can write all members, a state enumeration (`Status`/`State`/`Result`/`Stage`/`Phase`), an audit `…At`/`…By` attribute, or the association its own XPath scopes ownership on (SEC014) | security | #268: a partner role held `create, read *, write *` on two self-owned entities with a state attribute; lint showed only CONV006 +4, re-baselined; a manual review found it five days later | `permissions_for()` `MEMBER_WRITE` rows, `attributes_for().data_type` (`Enumeration`), `user_roles()` / `role_mappings()`; `external_roles` option, text not list; absent = sync NOTE, not a `_rule` finding. Probed 2026-10-13 | drafted (Batch 4) |
 | 50 | CONV009 threshold read from `lint-config.yaml` (`maxObjects`, `countLoopBodies`) instead of the stock hard-coded 15 | quality | #267: the generated config's own example does nothing; three apps at 36 / 30 / 5 findings, one app split flows only to satisfy the 15 | `get_option()`; `total_activity_count` (mxcli >= 0.25.0) for loop bodies. Default kept at 15: raising it for every project is a maintainer call | drafted (Batch 4) |
 
 ## Cheap extras (one afternoon each, when a batch has room)
diff --git a/tests/wave2/test-sec014-notice.sh b/tests/wave2/test-sec014-notice.sh
index 6bfc30e8..90cd01c9 100644
--- a/tests/wave2/test-sec014-notice.sh
+++ b/tests/wave2/test-sec014-notice.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Fixture for bin/lib/sec014-notice.sh and its one caller, bin/sync-project.sh: an installed
-# SEC014 with no `external_roles` in .claude/lint-config.yaml is reported once per sync, as a
-# sync warning, instead of as a `_rule` blindness finding that would fail every exec (#229
+# SEC014 with no `external_roles` in .claude/lint-config.yaml is reported on every sync, as a
+# NOTE (not a counted warning), instead of as a `_rule` blindness finding that would fail every exec (#229
 # pattern; review of PR #312).
 #
 # Usage: bash test-sec014-notice.sh [path-to-sync-project.sh]
@@ -80,8 +80,10 @@ else bad "sync-project.sh does not call mxtk_sec014_notice"; fi
 # The call sits inside the WIRED lint block, after the rules are installed.
 blk=$(awk '/mxtk_install_lint_rules "\$\(cd/{f=1} f{print} f&&/^fi$/{exit}' "$SYNC")
 case "$blk" in *mxtk_sec014_notice*) ok "the call runs after mxtk_install_lint_rules, in the same WIRED block" ;; *) bad "the call is not in the lint install block" ;; esac
-# Its output goes through warn(), so the sync counts it and does not end "all up to date".
-case "$blk" in *"warn \$_sec014_msg"*) ok "the notice is a sync warning (counted, not just printed)" ;; *) bad "the notice bypasses warn()" ;; esac
+# A NOTE, not warn(): a pristine scaffold has not decided yet, and test-bug12-sync.sh T0
+# requires a pristine sync to exit 0 with no warning under --strict.
+case "$blk" in *'echo "NOTE: $_sec014_msg"'*) ok "the notice prints as a NOTE line" ;; *) bad "the notice is not printed as a NOTE" ;; esac
+case "$blk" in *"warn \$_sec014_msg"*|*'warn "$_sec014_msg"'*) bad "the notice goes through warn(): a pristine sync would fail --strict" ;; *) ok "the notice does not count as a sync warning" ;; esac
 bash -n "$SYNC" && ok "sync-project.sh parses" || bad "sync-project.sh does not parse"
 
 echo

From 2fa68837d9ebfb881075aff56d577496de62fce3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:44:51 +0000
Subject: [PATCH 61/68] status: review fixes for #326 (final-look filter, keep
 done-, Rounds heading)

- NEXT drops final-look only, and only when the stage line is gate-check's
  derived readout below its from-stage, reading the FIRST "Stage N" (mirrors
  #321's NOT YET DUE). Module passes owed under a lagging or hand-written
  line stay in NEXT.
- existing-app-change drops only the "agent slots unfilled" WATCH item;
  done- signals and the agent-stub NEXT rule stay (Stages 5-6 run the build
  loop unchanged in that mode).
- "## Rounds" heading anchored, so "## Rounds of review" is not read.

Fixture: 27/27; 11 fail on master, T9d fails on a last-Stage mutant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                            |  2 +-
 bin/status.sh                           | 50 +++++++++--------
 skills/existing-app-change.md           |  7 ++-
 tests/wave2/test-status-existing-app.sh | 75 ++++++++++++++++++-------
 4 files changed, 87 insertions(+), 47 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c5bd2ff9..1f09c5a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(status, existing-app-change): **existing-app-change mode reports the delivery round, not just the stage; agent-slot and done- noise is dropped in that mode only; a template for targeted manual Studio Pro steps, counted by `status.sh`** ([#301](https://github.com/MendixMau/mxcli-project-toolkit/issues/301), [#298](https://github.com/MendixMau/mxcli-project-toolkit/issues/298)). A field run delivered 11 backlog stories in 4 rounds on a 127-module app while `status.sh` still read "Stage 1 — Analysis", WATCH said "agent slots unfilled: 35 in 6 file(s)" and "done- stalled", and NEXT pointed at those. A `## Rounds` table in `PROJECT.md` (`| Round | Title | Stories | State |`, last row = round in flight) now gives a `ROUND   Round N: <title> — <state> · stories: … · D of N round(s) delivered` line in existing-app-change mode, and that mode drops the agent-slot and done- items from WATCH and NEXT. The same run needed six microflow edits mxcli could not round-trip (branches that rejoin early): new `templates/manual-steps.md` (document path, why mxcli cannot, depends-on, exact clicks with an anchor, a Check a person runs, one `- [ ] Done` line naming its evidence), and the rule that a step done by patch still goes through `exec.sh --patch`. `status.sh` prints `manual steps pending N of M` when `docs/manual-steps.md` exists. Also, from the review of #303: NEXT no longer names an obligation first owed at a later stage than the project is in (`final-look`, Stage 6, was sent to Stage 1–5 projects and hid gate-check's next-stage hint); the obligations-pending line still lists it. Apart from that NEXT fix, pipeline modes print byte-identical to before (fixture `tests/wave2/test-status-existing-app.sh`, 23 cases on real scaffolds; 13 fail on the old script) — jopterhorst
+- feat(status, existing-app-change): **existing-app-change mode reports the delivery round, not just the stage; agent-slot and done- noise is dropped in that mode only; a template for targeted manual Studio Pro steps, counted by `status.sh`** ([#301](https://github.com/MendixMau/mxcli-project-toolkit/issues/301), [#298](https://github.com/MendixMau/mxcli-project-toolkit/issues/298)). A field run delivered 11 backlog stories in 4 rounds on a 127-module app while `status.sh` still read "Stage 1 — Analysis", WATCH said "agent slots unfilled: 35 in 6 file(s)" and "done- stalled", and NEXT pointed at those. A `## Rounds` table in `PROJECT.md` (`| Round | Title | Stories | State |`, last row = round in flight) now gives a `ROUND   Round N: <title> — <state> · stories: … · D of N round(s) delivered` line in existing-app-change mode, and that mode drops the "agent slots unfilled" WATCH item (done- signals stay: Stages 5–6 run the build loop unchanged there). The same run needed six microflow edits mxcli could not round-trip (branches that rejoin early): new `templates/manual-steps.md` (document path, why mxcli cannot, depends-on, exact clicks with an anchor, a Check a person runs, one `- [ ] Done` line naming its evidence), and the rule that a step done by patch still goes through `exec.sh --patch`. `status.sh` prints `manual steps pending N of M` when `docs/manual-steps.md` exists. Also, from the review of #303: NEXT no longer sends a project to `final-look` (the Stage 6 whole-app LOOK) while gate-check's derived stage readout is below Stage 6 — it was sent to Stage 1–5 projects and hid gate-check's next-stage hint. `final-look` only, and only on a derived readout, the same rule as obligation-check's NOT YET DUE (#321): module passes owed under a lagging or hand-written stage line stay in NEXT; the obligations-pending line still lists `final-look`. Apart from that NEXT fix, pipeline modes print byte-identical to before (fixture `tests/wave2/test-status-existing-app.sh` on real scaffolds) — jopterhorst
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/bin/status.sh b/bin/status.sh
index 3a404150..fd11576d 100755
--- a/bin/status.sh
+++ b/bin/status.sh
@@ -121,7 +121,7 @@ if [ "$ENTRY" = "existing-app-change" ]; then
   ROUND_LINE="$(awk -F'|' '
     function trim(s) { gsub(/^[ \t*`]+|[ \t*`]+$/, "", s); return s }
     function cell(k) { return (k in col) ? trim($(col[k])) : "" }
-    /^## +Rounds/ { sec = 1; next }
+    /^## +Rounds *$/ { sec = 1; next }
     sec && /^## / { sec = 0 }
     !sec || !/^\|/ { next }
     !hdr { for (i = 2; i < NF; i++) col[tolower(trim($i))] = i; hdr = 1; next }
@@ -182,23 +182,25 @@ NEED_ATTN="$(printf '%s\n' "$GC" | awk '/^Needs attention/{f=1;next} /^Next up:|
 APPROVED_OVER="$(printf '%s\n' "$GC" | grep -m1 '^Approved over a failing gate:' | sed -E 's/^Approved over a failing gate: *//; s/ — .*$//')"
 N_ATTN="$(printf '%s\n' "$GC" | grep -oE '[0-9]+ need attention' | grep -oE '^[0-9]+' || echo 0)"
 OB_PENDING="$(printf '%s\n' "$GC" | grep -E '^Obligation ' | grep -E ' (PENDING|FAULT) ' | awk '{print $2": "$3}' | tr '\n' ',' | sed 's/,$//; s/,/, /g')"
-# NEXT only names obligations the project can discharge NOW. Each row in bin/lib/obligations.tsv
-# carries the stage it is first owed at (column 8); the gate-check line reports every one, so a
-# Stage 1 project was told "discharge: final-look" — the Stage 6 whole-app LOOK — and never saw
-# gate-check's "Next up:" hint behind it (review of #303). Above-stage obligations stay on the
-# screen's "obligations pending" line; they are only kept out of NEXT. A stage line we cannot read
-# keeps them all (louder, never quieter).
-CUR_STAGE="$(printf '%s\n' "$STAGE_LINE" | sed -nE 's/.*Stage ([0-9P]).*/\1/p' | head -1)"
+# NEXT never sends a project to final-look (the Stage 6 whole-app LOOK) before Stage 6: a Stage 1
+# project was told "discharge: final-look" and never saw gate-check's "Next up:" hint behind it
+# (review of #303). final-look ONLY, and only when the stage line is gate-check's own derived
+# readout — the same rule obligation-check.sh applies once it prints NOT YET DUE (#321), at which
+# point final-look never reaches OB_PENDING and this is a no-op. Every other obligation keeps its
+# place in NEXT whatever the stage line says: a hand-written or lagging line must not hide the
+# module passes a project with an opened module owes (review of #326). The FIRST "Stage N" on the
+# line is the stage; the screen's "obligations pending" line still lists final-look.
 OB_NEXT="$OB_PENDING"
-if [ -n "$OB_PENDING" ] && [ -n "$CUR_STAGE" ] && [ -f "$TOOLKIT_ROOT/bin/lib/obligations.tsv" ]; then
-  OB_NEXT="$(printf '%s\n' "$OB_PENDING" | tr ',' '\n' | sed -E 's/^ +//' | awk -v cur="$CUR_STAGE" -v tsv="$TOOLKIT_ROOT/bin/lib/obligations.tsv" '
-    function rank(x) { return (x == "P") ? -1 : x + 0 }
-    BEGIN { FS = "\t"; while ((getline l < tsv) > 0) { if (l ~ /^#/ || l == "") continue; split(l, c, "\t"); from[c[1]] = c[8] }; FS = " " }
-    { id = $1; sub(/:$/, "", id)
-      if ((id in from) && from[id] ~ /^[0-9P]$/ && rank(from[id]) > rank(cur)) next
-      out = out (out == "" ? "" : ", ") $0 }
-    END { print out }')"
-fi
+case "$STAGE_LINE" in *"(derived by gate-check"*)
+  CUR_STAGE="$(printf '%s\n' "$STAGE_LINE" | grep -oE 'Stage [0-9P]' | head -1 | sed 's/^Stage //')"
+  FL_FROM="$(awk -F'\t' '$1=="final-look"{print $8; exit}' "$TOOLKIT_ROOT/bin/lib/obligations.tsv" 2>/dev/null)"
+  case "$CUR_STAGE:$FL_FROM" in
+    P:[0-9]*) _behind=1 ;;
+    [0-9]:[0-9]*) [ "$CUR_STAGE" -lt "$FL_FROM" ] && _behind=1 || _behind=0 ;;
+    *) _behind=0 ;;
+  esac
+  [ "$_behind" = 1 ] && OB_NEXT="$(printf '%s\n' "$OB_PENDING" | tr ',' '\n' | sed -E 's/^ +//' | grep -v '^final-look:' | paste -s -d, - | sed 's/,/, /g')" ;;
+esac
 MOD_OPENED="$(printf '%s\n' "$GC" | grep -m1 -E '^Obligation look ' | grep -q 'no module has been opened' && echo 0 || echo '≥1')"
 GC_NEXT="$(printf '%s\n' "$GC" | grep -m1 '^Next up:' | sed 's/^Next up: *//')"
 TK_UPD="$(printf '%s\n' "$GC" | grep -m1 '^Toolkit updates:' | sed 's/^Toolkit updates: *//; s/\..*$//')"
@@ -208,12 +210,12 @@ if [ -x "$PROJECT_DIR/bin/coherence-cadence.sh" ]; then
   COH="coherence $COH_OUT"
 fi
 
-# existing-app-change: the agent-slot and done- signals are pipeline-build bookkeeping. A change
-# stream delivered in rounds left them reading "agent slots unfilled: 35 in 6 file(s)" and
-# "done- stalled" through four delivered rounds, and NEXT pointed at them (#301). In that mode
-# only, they are dropped from WATCH and NEXT; the round line above is the progress readout.
-# Every other mode prints exactly as before (tests/wave2/test-status-existing-app.sh, byte-diff).
-if [ "$EAC" = 1 ]; then DONE_STALL=""; NOT_DONE_PASS=""; PH_TOTAL=0; fi
+# existing-app-change: a change stream delivered in rounds does not fill the pipeline agent stubs,
+# and "agent slots unfilled: 35 in 6 file(s)" sat in WATCH through four delivered rounds (#301).
+# In that mode only, that one WATCH item is dropped; the round line above is the progress readout.
+# done- stays: Stage 5-6 run the build loop unchanged in this mode (existing-app-change.md), and
+# the stub NEXT rule stays because it still fires only at Stage 5-7. Every other mode prints
+# exactly as before (tests/wave2/test-status-existing-app.sh, byte-diff).
 
 # --- NEXT: ordered lookup, earliest wins. Owner skill in the right-hand comment. -------------
 next_action() {
@@ -259,7 +261,7 @@ TK="toolkit $TK_COMMIT_NOW"; [ -n "$TK_COMMIT_REG" ] && [ "$TK_COMMIT_REG" != "$
 [ -n "$TK_UPD" ] && TK="$TK · updates: $TK_UPD"
 WATCH=""
 for _w in "${APPROVED_OVER:+APPROVED OVER A FAILING GATE: $APPROVED_OVER}" "$DONE_STALL" "${BP_STALE%% (*}" \
-          "$( [ "${PH_TOTAL:-0}" -gt 0 ] && echo "agent slots unfilled: $PH_TOTAL in $PH_FILES file(s)" )" "$PACK_GAP"; do
+          "$( [ "${PH_TOTAL:-0}" -gt 0 ] && [ "$EAC" = 0 ] && echo "agent slots unfilled: $PH_TOTAL in $PH_FILES file(s)" )" "$PACK_GAP"; do
   [ -n "$_w" ] && WATCH="${WATCH:+$WATCH · }$_w"
 done
 if [ "$BRIEF" = 1 ]; then
diff --git a/skills/existing-app-change.md b/skills/existing-app-change.md
index aca2fb93..3ad624be 100644
--- a/skills/existing-app-change.md
+++ b/skills/existing-app-change.md
@@ -226,9 +226,10 @@ Record each round as one row in `PROJECT.md`, under a section you add when the f
   log rows in `PROJECT.md`). The per-story record — scope, touched units, decisions, test verdict,
   manual steps — stays there; this table does not copy it.
 
-In this entry mode `status.sh` drops the agent-slot and `done-` signals from WATCH and NEXT: a
-change stream delivered in rounds does not fill pipeline agent stubs or rename scripts to `done-`,
-so those lines measured nothing. The round line replaces them. Other modes print as before.
+In this entry mode `status.sh` drops the "agent slots unfilled" item from WATCH: a change stream
+delivered in rounds does not fill the pipeline agent stubs, so that line measured nothing, and the
+round line is the progress readout instead. The `done-` signals stay — Stages 5–6 run the build loop
+unchanged here, `done-` rename included. Other modes print as before.
 
 ---
 
diff --git a/tests/wave2/test-status-existing-app.sh b/tests/wave2/test-status-existing-app.sh
index 594468af..423391fd 100755
--- a/tests/wave2/test-status-existing-app.sh
+++ b/tests/wave2/test-status-existing-app.sh
@@ -16,13 +16,18 @@
 #       read in existing-app-change mode only)
 #   T3  existing-app-change, rounds recorded: ROUND line is the LAST row, with stories and the
 #       delivered count; full screen carries it too
-#   T4  existing-app-change: no "agent slots unfilled" / "done- stalled" in WATCH, NEXT does not
-#       point at done-; the baseline on the same project DID print them (so the case can fail)
+#   T4  existing-app-change: no "agent slots unfilled" in WATCH, but "done- stalled" stays (the
+#       build loop runs unchanged at Stages 5-6); the baseline DID print the slot item
 #   T5  existing-app-change, no Rounds section: the ROUND line says none recorded and where to add it
 #   T6  Rounds table without a Stories column: no stories part, no crash
+#   T6b a "## Rounds of review" section is not the Rounds table
 #   T7  docs/manual-steps.md: unticked Done lines counted, ticked ones in the total, the fenced
 #       example ignored — on --brief STATE and on the full screen
 #   T8  the shipped template copied as-is counts 0 of 0 (its example is fenced)
+#   T9  NEXT drops final-look ONLY, and only under gate-check's derived stage readout below its
+#       from-stage: (a) derived Stage P keeps every other pending pass; (b) a module opened under
+#       that lagging line keeps look/sweep/journeys; (c) a hand-written line filters nothing;
+#       (d) the FIRST "Stage N" on the line is the stage, not a later one
 
 export MXTK_LEAKGUARD_DENYFILE="${TMPDIR:-/tmp}/mxtk-fixture-denylist.$$"
 export MXTK_NO_GUIDE=1
@@ -107,7 +112,7 @@ printf '%s\n' "$b" | grep -qxF "$exp" && ok "T3 --brief ROUND line is the last r
 f="$("$NEW" "$E" 2>&1)"
 printf '%s\n' "$f" | grep -qF 'ROUND     Round 2: Approval rework — in test' && ok "T3 full screen carries the ROUND line" || bad "T3 full screen ROUND line" "$f"
 case "$b$f" in *"agent slots unfilled"*) bad "T4 agent-slot noise still printed in existing-app mode" "$b";; *) ok "T4 no agent-slot WATCH item";; esac
-case "$b$f" in *"done- stalled"*|*"not done-"*) bad "T4 done- noise still printed in existing-app mode" "$b";; *) ok "T4 no done- stall in WATCH or NEXT";; esac
+case "$b" in *"done- stalled"*) ok "T4 done- stall still reported (Stages 5-6 run the build loop unchanged in this mode)";; *) bad "T4 done- stall dropped in existing-app mode — it must stay" "$b";; esac
 if [ "$HAVE_BASE" = 1 ]; then
   o="$("$OLD" "$E" --brief 2>&1)"
   case "$o" in *"agent slots unfilled"*) ok "T4 control: the baseline printed the agent-slot noise on this same project";;
@@ -126,6 +131,11 @@ printf '%s\n' '| Round | Title | State |' '|---|---|---|' '| 1 | Login tweak | b
 b="$("$NEW" "$E3" --brief 2>&1)"
 printf '%s\n' "$b" | grep -qxF 'ROUND   Round 1: Login tweak — building · 0 of 1 round(s) delivered' && ok "T6 no Stories column: no stories part" || bad "T6 no-Stories-column ROUND line" "$b"
 
+# --- T6b: a "## Rounds of review" heading is a different section ------------------------------
+printf '\n## Rounds of review\n\n| Round | Title | State |\n|---|---|---|\n| 9 | Peer review | done |\n' >> "$E3/PROJECT.md"
+b="$("$NEW" "$E3" --brief 2>&1)"
+printf '%s\n' "$b" | grep -qxF 'ROUND   Round 1: Login tweak — building · 0 of 1 round(s) delivered' && ok "T6b \"## Rounds of review\" is not read as the Rounds table" || bad "T6b a look-alike heading was read" "$b"
+
 # --- T7: manual steps count ----------------------------------------------------------------
 cat > "$E/docs/manual-steps.md" <<'EOF'
 # Manual Studio Pro steps
@@ -152,10 +162,11 @@ cp "$W/tk/templates/manual-steps.md" "$E2/docs/manual-steps.md" 2>/dev/null
 b="$("$NEW" "$E2" --brief 2>&1)"
 printf '%s\n' "$b" | grep -qF 'manual steps pending 0 of 0' && ok "T8 template copied as-is: 0 of 0" || bad "T8 template count" "$b"
 
-# --- T9: NEXT never names an obligation owed only at a later stage (review of #303) ----------
+# --- T9: final-look leaves NEXT only on a derived readout below Stage 6 (reviews of #303, #326) --
 # A scaffold always has gate-check "Needs attention" items, which win NEXT before the obligation
 # rule is reached. tk2's gate-check.sh runs the REAL gate-check and drops only that block and its
-# count, so the obligation lines status.sh reads are real output, not typed here.
+# count, so the obligation lines status.sh reads are real output, not typed here. The stage line
+# is the one the real gate-check derives and writes (a fresh scaffold derives "Stage P").
 mkdir -p "$W/tk2"; (cd "$W/tk" && tar -cf - .) | (cd "$W/tk2" && tar -xf -)
 mv "$W/tk2/bin/gate-check.sh" "$W/tk2/bin/gate-check-real.sh"
 cat > "$W/tk2/bin/gate-check.sh" <<'WRAP'
@@ -165,26 +176,52 @@ cat > "$W/tk2/bin/gate-check.sh" <<'WRAP'
   | sed -E 's/[0-9]+ need attention/0 need attention/'
 WRAP
 chmod +x "$W/tk2/bin/gate-check.sh"
-P9="$W/ob"; mkdir -p "$P9"; : > "$P9/Fixture.mpr"; "$W/tk2/bin/init-project.sh" "$P9" >/dev/null 2>&1
-setstage() { awk -v st="$2" '/^## Current stage/{print; getline; print ""; getline; print st; next} {print}' "$1/PROJECT.md" > "$1/p.new" && mv "$1/p.new" "$1/PROJECT.md"
-             grep -q '^Entry mode:' "$1/PROJECT.md" || printf '\nEntry mode: migration\n' >> "$1/PROJECT.md"; }
+[ "$HAVE_BASE" = 1 ] && cp "$OLD" "$W/tk2/bin/status-baseline.sh"
 nextof() { "$1" "$2" --brief 2>/dev/null | sed -n 's/^NEXT    //p'; }
-setstage "$P9" "**Stage 3 — Architecture & Design**, in progress."
-grep -q '^\*\*Stage 3' "$P9/PROJECT.md" || bad "T9 setup: stage line not written" "$(sed -n '1,15p' "$P9/PROJECT.md")"
+stage_of() { awk '/^## Current stage/{f=1;next} f && /^\*\*Stage/{print;exit}' "$1/PROJECT.md"; }
+setline() { MXTK_L="$2" awk '/^## Current stage/{f=1} f && /^\*\*Stage/ && !d {print ENVIRON["MXTK_L"]; d=1; next} {print}' "$1/PROJECT.md" > "$1/p.new" && mv "$1/p.new" "$1/PROJECT.md"; }
+P9="$W/ob"; mkdir -p "$P9"; : > "$P9/Fixture.mpr"; "$W/tk2/bin/init-project.sh" "$P9" >/dev/null 2>&1
+printf '\nEntry mode: migration\n' >> "$P9/PROJECT.md"
+"$W/tk2/bin/gate-check-real.sh" "$P9" >/dev/null 2>&1   # writes the derived readout
+DERIVED="$(stage_of "$P9")"
+case "$DERIVED" in *"(derived by gate-check"*) ok "T9 setup: real gate-check wrote a derived readout";; *) bad "T9 setup: no derived readout" "$DERIVED";; esac
+
+# T9a derived Stage P, no module opened: final-look out of NEXT, the other pending passes stay.
 n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
-case "$n" in "discharge:"*) ok "T9 Stage 3: NEXT still discharges what is owed now";; *) bad "T9 Stage 3: expected a discharge NEXT" "$n";; esac
-case "$n" in *final-look*|*skeleton*|*coherence*) bad "T9 Stage 3: NEXT names an obligation first owed at Stage 5/6" "$n";; *) ok "T9 Stage 3: no Stage 5/6 obligation in NEXT";; esac
-case "$n" in *workflow-count*) ok "T9 Stage 3: a Stage 3 obligation stays in NEXT";; *) bad "T9 Stage 3: Stage 3 obligation dropped" "$n";; esac
+case "$n" in "discharge:"*) ok "T9a derived Stage P: NEXT still discharges what is pending";; *) bad "T9a expected a discharge NEXT" "$n";; esac
+case "$n" in *final-look*) bad "T9a derived Stage P: NEXT still names final-look" "$n";; *) ok "T9a derived Stage P: final-look not in NEXT";; esac
+case "$n" in *skeleton*) ok "T9a only final-look is filtered (skeleton, also above Stage P, stays)";; *) bad "T9a filter dropped more than final-look" "$n";; esac
 f="$("$W/tk2/bin/status.sh" "$P9" 2>/dev/null)"
-printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' && ok "T9 the screen still lists final-look under obligations pending" || bad "T9 obligations pending line lost final-look" "$f"
-setstage "$P9" "**Stage 1 — Analysis**, in progress."
-n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
-case "$n" in "discharge:"*) bad "T9 Stage 1: every pending obligation is above Stage 1, NEXT should fall through" "$n";; *) ok "T9 Stage 1: NEXT is not a discharge line (falls through to the later rules)";; esac
+printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' && ok "T9a the screen still lists final-look under obligations pending" || bad "T9a obligations pending line lost final-look"
 if [ "$HAVE_BASE" = 1 ]; then
-  cp "$OLD" "$W/tk2/bin/status-baseline.sh"
   o="$(nextof "$W/tk2/bin/status-baseline.sh" "$P9")"
-  case "$o" in *final-look*) ok "T9 control: the baseline told a Stage 1 project to discharge final-look";; *) bad "T9 control: baseline did not name final-look — case cannot fail" "$o";; esac
+  case "$o" in *final-look*) ok "T9a control: the baseline sent a Stage P project to final-look";; *) bad "T9a control: baseline did not name final-look — case cannot fail" "$o";; esac
 fi
 
+# T9b a module opened under the same lagging derived line: the module passes stay in NEXT.
+mkdir -p "$P9/.claude/loop/verify/Orders"
+n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
+case "$n" in *look*sweep*journeys*|*look*journeys*sweep*) ok "T9b module opened under a lagging line: look/sweep/journeys still in NEXT";; *) bad "T9b owed module passes hidden from NEXT" "$n";; esac
+rm -rf "$P9/.claude/loop/verify"
+
+# T9c a hand-written (non-derived) Stage 1 line: no filtering at all.
+setline "$P9" "**Stage 1 — Analysis**, in progress."
+n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
+case "$n" in *final-look*) ok "T9c hand-written stage line: final-look stays in NEXT";; *) bad "T9c a hand-written line must not filter" "$n";; esac
+
+# T9d the FIRST "Stage N" on the line decides: the real derived line with its stage set to 6 and a
+# later "Stage 2" in its text keeps final-look (owed from 6) in NEXT; reading the last one would
+# drop it. From Stage 5 the skeleton and agent-stub rules win NEXT first, so this case records a
+# proven skeleton and fills the stub slots — both are what a real Stage 6 project has.
+printf '\nSkeleton proven 2026-10-13\n' >> "$P9/PROJECT.md"
+for _f in "$P9"/.claude/agents/*.md "$P9/CLAUDE.local.md"; do
+  [ -f "$_f" ] && sed -E 's/\{\{[^}]*\}\}/filled/g' "$_f" > "$_f.new" && mv "$_f.new" "$_f"
+done
+setline "$P9" "$(printf '%s' "$DERIVED" | sed -E 's/Stage P — Kickoff/Stage 6 — Verify/; s/gates passed: [^(]*/gates passed: P-5, Stage 2 re-opened /')"
+case "$(stage_of "$P9")" in *"Stage 6"*"Stage 2"*"(derived by gate-check"*) : ;; *) bad "T9d setup" "$(stage_of "$P9")";; esac
+n="$(nextof "$W/tk2/bin/status.sh" "$P9")"
+case "$n" in "discharge:"*final-look*) ok "T9d first Stage N wins: Stage 6 keeps final-look despite a later Stage 2";;
+  *) bad "T9d expected final-look in a discharge NEXT (first Stage N is 6)" "$n";; esac
+
 echo "SCORE: $PASS/$((PASS+FAIL))"
 [ "$FAIL" -eq 0 ]

From d7804c5706eca95abe9fc9a9cc0f067d6ef29baa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:46:49 +0000
Subject: [PATCH 62/68] fix(doctor, sync-project): property-set check errors
 get their own exit code; sync announces its bound
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirmation review of #314:
1. Sync captures doctor's output, so it now prints "checking property
   sets (read-only, up to Ns)…" first. Sync uses its own shorter default:
   MXTK_PROPSETS_TIMEOUT=${MXTK_PROPSETS_TIMEOUT:-120}.
2. A check that could not run is exit 4 now, not exit 1. That covers an
   error, unclassified output, a crashed `fix --help` probe or no Mendix
   version. Exit 1 is only NEEDS/FAILED rows. On exit 4, sync prints a
   neutral "could not check property sets: <reason>" line, with no
   warning and no --fix-property-sets advice, because the repair would
   fail the same way.
3. When the probe crashed, --quick says "could not probe", not that the
   mxcli "predates" the command.
4. The fixture stub's slow state now execs sleep, so a timeout kills the
   process itself and leaves no child behind.

test-property-sets.sh: 61 passed. New cases: exit 4 for errors, --quick
on a crashed probe, sync's bound announcement, and sync's neutral line
on exit 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                      |  2 +-
 bin/doctor.sh                     | 21 ++++++++++++---------
 bin/sync-project.sh               | 17 ++++++++++++-----
 skills/platform-link.md           |  2 +-
 tests/wave2/test-property-sets.sh | 21 +++++++++++++++++----
 5 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6f720d0..69b53a04 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- feat(doctor, sync-project): **`mxcli fix property-sets` is wired into the upgrade path, report first: the Studio Pro merge break no gate could see.** mxcli up to v0.25 wrote units without Studio Pro's full property set. `mx check`, the build and the runtime stay green, and Studio Pro's merge/diff throws ("Objects with ID … do not have the same properties") once it has saved such a document. New `bin/doctor.sh --property-sets <project>` runs the read-only `--dry-run` and records the result with the mxcli version in `.claude/.property-sets-receipt` (machine-local, gitignored). It exits 0 clean, 1 needs repair or could not classify (never green by absence), 2 not run, 3 for an mxcli before v0.26.0. `sync-project.sh` runs it with `--if-stale`, which skips only a recorded clean or unsupported result for the installed mxcli (errors and timeouts are never recorded; the dry-run is bounded by `MXTK_PROPSETS_TIMEOUT`, default 300 s), and `doctor --quick` (which exec.sh runs when the mxcli version changes) warns while it is owed. The repair is `bin/doctor.sh --fix-property-sets <project>`, which runs `mxcli fix property-sets` only through `exec.sh --patch` (snapshot, mxbuild gate, restore). It refuses on an exec.sh without `--patch`. Support is probed from `mxcli fix --help`, because `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too, printing the parent's help. New row in `learned-detection-gaps.md`; `platform-link.md` gains "Before a Team Server merge", covering `fix property-sets`, `fix hashes` and `git note`. Golden input is captured from the v0.24.0/v0.25.0/v0.26.0 release binaries. The clean/NEEDS/FAILED reports follow mxcli's source format strings, because no model was run. `tests/wave2/test-property-sets.sh` (58 cases). Field run still owed. `fix hashes` as an `exec.sh --patch` post-step is pending (Refs #295) — jopterhorst
+- feat(doctor, sync-project): **`mxcli fix property-sets` is wired into the upgrade path, report first: the Studio Pro merge break no gate could see.** mxcli up to v0.25 wrote units without Studio Pro's full property set. `mx check`, the build and the runtime stay green, and Studio Pro's merge/diff throws ("Objects with ID … do not have the same properties") once it has saved such a document. New `bin/doctor.sh --property-sets <project>` runs the read-only `--dry-run` and records the result with the mxcli version in `.claude/.property-sets-receipt` (machine-local, gitignored). It exits 0 clean, 1 needs repair, 2 not run, 3 for an mxcli before v0.26.0, and 4 when the check itself failed or its output could not be classified (never green by absence; a repair would not help). `sync-project.sh` runs it with `--if-stale`, which skips only a recorded clean or unsupported result for the installed mxcli (errors and timeouts are never recorded; the dry-run is bounded by `MXTK_PROPSETS_TIMEOUT`, default 300 s, 120 s under sync, which announces the bound first), and `doctor --quick` (which exec.sh runs when the mxcli version changes) warns while it is owed. The repair is `bin/doctor.sh --fix-property-sets <project>`, which runs `mxcli fix property-sets` only through `exec.sh --patch` (snapshot, mxbuild gate, restore). It refuses on an exec.sh without `--patch`. Support is probed from `mxcli fix --help`, because `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too, printing the parent's help. New row in `learned-detection-gaps.md`; `platform-link.md` gains "Before a Team Server merge", covering `fix property-sets`, `fix hashes` and `git note`. Golden input is captured from the v0.24.0/v0.25.0/v0.26.0 release binaries. The clean/NEEDS/FAILED reports follow mxcli's source format strings, because no model was run. `tests/wave2/test-property-sets.sh` (61 cases). Field run still owed. `fix hashes` as an `exec.sh --patch` post-step is pending (Refs #295) — jopterhorst
 - fix(sync-project): **sync names a `bin/model-stamp.sh` that predates the worktree hook blind-spot fix.** `known_fix_note` gains the `model-stamp.sh` arm from the #236 patch, keyed on `GIT_WORK_TREE`, which the fixed script pins. The arm says to upgrade `model-stamp.sh` and `_common.sh` together. `tests/wave2/test-model-stamp.sh` T9 adds the unstaged worktree `commit -a` and `commit -- app` cases. The silent rc 1 half of #236 landed earlier. The new note is asserted by `test-property-sets.sh` P10, which fails on master. — MendixMau (card-disbursement requirements-driven build, field task 21)
 - chore(context): **baseline word budget freed — 79,997 → 76,259 words (−3,738) without dropping a rule.** The always-on tier sat 3 words under its 80,000 cap, so three open PRs could not all merge. Long incident narratives in `conversion-runbook.md`, `source-triage.md` and `interview-protocol.md` became one-line failure examples pointing at new on-demand `process/baseline-incident-history.md`, where the original text is kept verbatim per section (R1–R20, AR1, ST1–ST4, IP1–IP3); the runbook's copy of the open-questions status table now defers to `interview-protocol.md` §4; `agent-roles.md`'s six template shapes (setup-only, ~2,300 words) moved verbatim to `agents/README.md`, which the installers never copy (explicit `MXTK_AGENTS` list). Every STOP, rule, denominator and gate cell stays in place; files touched by open PRs were left alone. — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
diff --git a/bin/doctor.sh b/bin/doctor.sh
index 9151a9e6..703c2b3d 100755
--- a/bin/doctor.sh
+++ b/bin/doctor.sh
@@ -47,8 +47,10 @@
 #                                           # and records the result. Add --if-stale to skip
 #                                           # the run when it already ran for this mxcli
 #                                           # version (sync-project.sh does). Exit 0 clean,
-#                                           # 1 units need repair or the run failed, 2 not run,
-#                                           # 3 this mxcli predates the command (v0.26.0).
+#                                           # 1 units need repair (NEEDS/FAILED rows), 2 not run
+#                                           # (incl. timeout), 3 this mxcli predates the command
+#                                           # (v0.26.0), 4 could not check (error, unclassified
+#                                           # output, a crashed probe) — a repair would not help.
 #   bin/doctor.sh --fix-property-sets <dir> # the same check, then the repair — and only
 #                                           # through bin/exec.sh --patch (snapshot, mxbuild
 #                                           # gate, restore on failure). See "Property sets".
@@ -330,7 +332,7 @@ ps_apply() {
   ps_check
 }
 ps_exit_code() {
-  case "$PS_RESULT" in clean) echo 0 ;; not-run) echo 2 ;; unsupported) echo 3 ;; *) echo 1 ;; esac
+  case "$PS_RESULT" in clean) echo 0 ;; not-run) echo 2 ;; unsupported) echo 3 ;; needs|failed) echo 1 ;; *) echo 4 ;; esac
 }
 
 # --property-sets / --fix-property-sets: only this check, then exit. Stands alone so
@@ -1191,12 +1193,13 @@ if [ -n "$PROJECT_DIR" ]; then
     elif [ -n "${MPR:-}" ] && [ -n "${PMXCLI_PROBE:-}" ]; then
       PS_VER="$(ps_version "$PMXCLI_PROBE")"
       if ps_stale; then
-        if ps_supported "$PMXCLI_PROBE"; then
-          warn "property sets not checked for this mxcli (${PS_VER:-?}) — Studio Pro merge/diff can throw on units an older mxcli wrote"
-          note "read-only check: bin/doctor.sh --property-sets $PROJECT_DIR"
-        else
-          note "${PS_VER:-this mxcli} predates 'mxcli fix property-sets' (v0.26.0) — upgrade before a Team Server merge"
-        fi
+        _psq_rc=0; ps_supported "$PMXCLI_PROBE" || _psq_rc=$?
+        case "$_psq_rc" in
+          0) warn "property sets not checked for this mxcli (${PS_VER:-?}) — Studio Pro merge/diff can throw on units an older mxcli wrote"
+             note "read-only check: bin/doctor.sh --property-sets $PROJECT_DIR" ;;
+          1) note "${PS_VER:-this mxcli} predates 'mxcli fix property-sets' (v0.26.0) — upgrade before a Team Server merge" ;;
+          *) warn "property sets: could not probe this mxcli for 'fix property-sets' ('mxcli fix --help' failed)" ;;
+        esac
       else
         _psq="$(sed -n 1p "$(ps_receipt)")"
         case "$_psq" in
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index 296bef70..37b68966 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1464,10 +1464,14 @@ if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
     echo "Would run: bin/doctor.sh --property-sets --if-stale (read-only model check; skipped when it already ran for this mxcli)"
   else
     _ps_rc=0
-    _ps_out="$("$SCRIPT_DIR/doctor.sh" --property-sets --if-stale "$PROJECT_DIR" 2>&1)" || _ps_rc=$?
-    # rc 3 (an mxcli before v0.26 cannot check) is informational here, not a sync warning, so
-    # doctor's own WARN line for it is relabelled rather than shown as one.
-    if [ "$_ps_rc" -eq 3 ]; then
+    # Sync's own, shorter bound (doctor's default is 300 s): the output is captured, so say
+    # up front how long this may sit quiet.
+    _ps_t="${MXTK_PROPSETS_TIMEOUT:-120}"
+    echo "   checking property sets (read-only, up to ${_ps_t}s)…"
+    _ps_out="$(MXTK_PROPSETS_TIMEOUT="$_ps_t" "$SCRIPT_DIR/doctor.sh" --property-sets --if-stale "$PROJECT_DIR" 2>&1)" || _ps_rc=$?
+    # rc 3 (an mxcli before v0.26 cannot check) and rc 4 (the check itself failed) are not
+    # findings about the model, so doctor's WARN line for them is relabelled, not shown as one.
+    if [ "$_ps_rc" -eq 3 ] || [ "$_ps_rc" -eq 4 ]; then
       printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed -e 's/^  WARN  /  info  /' -e 's/^/   /'
     else
       printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed 's/^/   /'
@@ -1475,8 +1479,11 @@ if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
     case "$_ps_rc" in
       0|2) ;;
       3) echo "   (the project's mxcli predates 'fix property-sets', v0.26.0 — upgrade it before a Team Server merge)" ;;
-      *) warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
+      4) _ps_why="$(printf '%s\n' "$_ps_out" | sed -n 's/^  WARN  property sets: //p' | head -1)"
+         echo "   could not check property sets: ${_ps_why:-see above} — not recorded; the next sync re-checks" ;;
+      1) warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
               "bin/doctor.sh --fix-property-sets '$PROJECT_DIR'" ;;
+      *) echo "   property-set check exited $_ps_rc — see above" ;;
     esac
   fi
 fi
diff --git a/skills/platform-link.md b/skills/platform-link.md
index 50aff144..52039d05 100644
--- a/skills/platform-link.md
+++ b/skills/platform-link.md
@@ -473,7 +473,7 @@ so a project upgraded mid-flight still carries the old ones until the repair run
 for the installed mxcli. After that it runs again only when mxcli changes. Errors and timeouts
 are never recorded, so the next run re-checks. `doctor --quick`, which exec.sh runs when the mxcli
 version changes, warns while the check is owed. The check reads every unit, so it is bounded by
-`MXTK_PROPSETS_TIMEOUT` (default 300 s), and a timeout reports NOT RUN. A unit the
+`MXTK_PROPSETS_TIMEOUT` (default 300 s, 120 s under sync), and a timeout reports NOT RUN. A unit the
 check reports `FAILED` has a value in a key the project's Mendix version does not declare. mxcli
 leaves such units alone, and its exit 1 makes `exec.sh --patch` roll the whole repair back, so
 resolve those units first. An mxcli older than v0.26.0 cannot run this check: upgrade it first.
diff --git a/tests/wave2/test-property-sets.sh b/tests/wave2/test-property-sets.sh
index d240c9e4..21206b4f 100755
--- a/tests/wave2/test-property-sets.sh
+++ b/tests/wave2/test-property-sets.sh
@@ -79,7 +79,7 @@ case "${1:-}" in
                   echo "1 unit(s) could not be normalized and were left as they are."; exit 1 ;;
           notfound) cat "$F/dry-run-not-found-v0.26.0.txt"; exit 1 ;;
           noversion) echo "$b has no readable Mendix version; nothing is normalized without one."; exit 0 ;;
-          slow) sleep 6; echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."; exit 0 ;;
+          slow) exec sleep 6; echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."; exit 0 ;;
         esac ;;
     esac ;;
 esac
@@ -131,7 +131,8 @@ echo "== P4 failed / error / no version — never clean =="
 for st in failed notfound noversion; do
   P="$(mkproj st-$st)"; echo "$st" > "$P/.stub-state"
   OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
-  [ "$RC" -eq 1 ] && ! printf '%s' "$OUT" | grep -q "ok    property sets" && ok "$st: exit 1, no ok line" || bad "$st: rc=$RC" "$OUT"
+  want=4; [ "$st" = failed ] && want=1
+  [ "$RC" -eq "$want" ] && ! printf '%s' "$OUT" | grep -q "ok    property sets" && ok "$st: exit $want, no ok line" || bad "$st: rc=$RC (want $want)" "$OUT"
 done
 printf '%s' "$OUT" | grep -q "no Mendix version" && ok "noversion: says nothing was checked" || bad "noversion wording" "$OUT"
 for st in notfound noversion; do
@@ -141,8 +142,11 @@ P="$WORK/st-notfound"; "$DOCTOR" --property-sets --if-stale "$P" >/dev/null 2>&1
 [ "$(grep -c -- '--dry-run' "$P/.stub-log")" -eq 2 ] && ok "notfound: --if-stale re-checks after an error" || bad "notfound: --if-stale skipped after an error"
 P="$(mkproj helpfail)"; touch "$P/.stub-helpfail"
 OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
-[ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "support is unknown" && [ ! -f "$P/.claude/.property-sets-receipt" ] \
-  && ok "failed 'fix --help' probe: error (exit 1), not unsupported, not recorded" || bad "helpfail rc=$RC" "$OUT"
+[ "$RC" -eq 4 ] && printf '%s' "$OUT" | grep -q "support is unknown" && [ ! -f "$P/.claude/.property-sets-receipt" ] \
+  && ok "failed 'fix --help' probe: error (exit 4), not unsupported, not recorded" || bad "helpfail rc=$RC" "$OUT"
+OUT="$("$DOCTOR" --quick "$P" 2>&1)"
+printf '%s' "$OUT" | grep -q "could not probe this mxcli" && ! printf '%s' "$OUT" | grep -q "predates 'mxcli fix property-sets'" \
+  && ok "--quick, crashed probe: says 'could not probe', not 'predates'" || bad "quick helpfail" "$(printf '%s' "$OUT" | grep -i property)"
 
 echo "== P5 --if-stale: once per mxcli version =="
 P="$(mkproj stale)"; echo clean > "$P/.stub-state"
@@ -247,6 +251,15 @@ psl="$(printf '%s\n' "$OUT" | grep -i 'property' )"
 printf '%s' "$psl" | grep -q "info  property sets: .*arrived in v0.26.0" && ! printf '%s' "$psl" | grep -q "WARN  \|⚠️" \
   && ok "sync, mxcli < v0.26: informational line, no WARN, no sync warning" || bad "sync old mxcli" "$psl"
 
+printf '%s' "$OUT" | grep -q "checking property sets (read-only, up to 120s)" && ok "sync announces the check and its 120 s bound" || bad "no announcement" "$(printf '%s' "$OUT" | grep -i property)"
+S4="$WORK/syncerr"; mkdir -p "$S4"; : > "$S4/App.mpr"
+MXTK_NO_GUIDE=1 "$TK/bin/init-project.sh" "$S4" >/dev/null 2>&1
+mkstub "$S4"; echo notfound > "$S4/.stub-state"
+OUT="$("$SYNC" "$S4" 2>&1)"
+psl="$(printf '%s\n' "$OUT" | grep -i 'property')"
+printf '%s' "$psl" | grep -q "could not check property sets: could not classify" && ! printf '%s' "$psl" | grep -q "fix-property-sets\|⚠️\|WARN  " \
+  && ok "sync, check errored (exit 4): neutral line, no repair advice, no warning" || bad "sync error case" "$psl"
+
 echo "== P10 (#236) sync names a pre-fix bin/model-stamp.sh =="
 grep -v 'GIT_WORK_TREE' "$TK/project-bin/model-stamp.sh" > "$S/bin/model-stamp.sh"; chmod +x "$S/bin/model-stamp.sh"
 OUT="$("$SYNC" "$S" --dry-run --no-refresh 2>&1)"

From 79de40489a69a5fe68d9ad9d367838bd62bbd952 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:47:30 +0000
Subject: [PATCH 63/68] fix(exec): fresh empty takeover file is not stale
 (-mmin +1); align with test-scratch

Review of #324: `find -mmin +0` matched a takeover file created a second
ago, so a live contender's fresh empty file was moved aside and a third
contender got in (reviewer: 2-3 holders in 6/15 and 16/30 rounds with a
100 ms delay). Now -mmin +1; a moved-aside copy is deleted only if it is
what was judged stale, else restored with ln (left on disk if ln fails);
the holder removes the takeover file only while it holds its own line.
Body identical to test-scratch.sh take_over() in #322. Reviewer's delayed
harness against this body: 0/15 rounds with >1 holder.

Also: microflow-body verbs, CREATE FOLDER and MOVE ... TO FOLDER are
neutral for the watch verdict; agent-roles.md names the unknown verdict.

Refs #287 #289

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                        |  2 +-
 project-bin/exec.sh                 | 29 ++++++++++++++++++++---------
 skills/agent-roles.md               | 12 ++++++------
 tests/wave2/test-exec-lock-watch.sh | 17 +++++++++++++++++
 4 files changed, 44 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b34b9d9..8af21e83 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
+- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. A review of this PR found that an empty takeover file was judged stale by `find -mmin +0` within a second of its creation, so a live contender's fresh file could be moved aside and a third contender could get in. The threshold is now `-mmin +1`, the holder removes the takeover file only while it still holds its own line, and a fixture case checks that a fresh empty takeover file is respected. Microflow-body verbs, `CREATE FOLDER` and moves into a folder are neutral for the watch verdict. agent-roles.md names the `unknown` verdict. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 9fbe82ff..48802384 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -282,6 +282,11 @@ mxtk_watch_compat() {  # $1 = MDL script; prints "restart\t<reasons>" | "unknown
           # not on either column is UNKNOWN, never "watch can apply this".
           else if ((v == "ALTER" && (o1 == "PAGE" || o1 == "SNIPPET")) || (v == "CREATE" && o1 == "SNIPPET"))
             ;
+          # Neutral: microflow-body activities (their CREATE MICROFLOW head already decides),
+          # a folder, a move into a folder.
+          else if (v ~ /^(DECLARE|CHANGE|RETRIEVE|COMMIT|CALL)$/ || (v == "CREATE" && o1 == "FOLDER") \
+                   || (v == "MOVE" && toupper(t) ~ /[ \t]TO[ \t]+FOLDER([ \t]|$)/))
+            ;
           else if (nunk < 3) {
             h = t; if (length(h) > 50) h = substr(h, 1, 50) "..."
             unk = unk (nunk++ ? "; " : "") "line " NR ": " h
@@ -536,30 +541,36 @@ exec_lock_release() {  # the trap: remove the lock only while it is still ours
 # moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
 # A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
 # A takeover file left by a holder killed inside those few microseconds is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put back with `ln` (fails if a new one
-# exists — never clobbers) if what was moved is not the one judged stale.
+# dead or it is older than 10 s (an EMPTY one once it is over a minute old — `find -mmin +1`;
+# `+0` matched a file created a second ago, so a live contender's fresh takeover file was judged
+# stale and a third contender got in: review of #324). It is moved aside, and put back with `ln`
+# (never clobbers; left on disk if that fails) if what was moved is not the one judged stale.
+# The holder removes the takeover file only while it still holds the line it wrote.
 exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
-  _tk="$LOCK.takeover"
-  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+  _tk="$LOCK.takeover"; _mine="$$ $(date +%s)"
+  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
     _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
     case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
     _tstale=0
     if [ -n "$_t" ]; then
       { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
-      _tstale=1   # empty for a minute: its creator died between the create and the write
+    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
+      _tstale=1   # empty for over a minute: its creator died between the create and the write
     fi
     if [ "$_tstale" = 1 ]; then
       if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
-        rm -f "$_tk.stale.$$"
+        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
+        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
+        # Same body as test-scratch.sh's take_over() — keep the two in step (PR #322).
+        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
+        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
       fi
     fi
     return 1
   fi
   _now="$(head -1 "$LOCK" 2>/dev/null || true)"
   [ "$_now" = "$1" ] && rm -f "$LOCK"
-  rm -f "$_tk"
+  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
   return 0
 }
 LOCK_TAKEN=0
diff --git a/skills/agent-roles.md b/skills/agent-roles.md
index 01ba7ba4..938b8e5b 100644
--- a/skills/agent-roles.md
+++ b/skills/agent-roles.md
@@ -76,12 +76,12 @@ shows up in the bill:
    message to an agent that has already reported — that restarts it at its full context.
 
 **App restarts: the implementer restarts its own app, through one script only.** Write this into
-every implementer brief: "When `exec.sh` prints `restart needed`, run `./bin/app-restart.sh`
-yourself and carry on; never stop or start an app any other way (no kill by name, no `pkill`, no
-second `run --local`), and never touch another lane's app." The helper stops only the pid that
-`run --local` recorded for that project and refuses otherwise (`ui-loop.md` § "What watch picks
-up"). The old rule, that only the lead restarts apps, came from a broad kill in one lane that took
-down another lane's app; the helper cannot do that, and the rule cost 24 implementer
+every implementer brief: "When `exec.sh` prints `restart needed`, or `unknown — restart if
+behaviour looks stale` and it does, run `./bin/app-restart.sh` yourself and carry on; never
+stop or start an app another way (no `pkill`, no second `run --local`) or touch another lane's
+app." The helper stops only the pid that `run --local` recorded for that project and refuses
+otherwise (`ui-loop.md` § "What watch picks up"). The old lead-only rule came from a broad kill
+in one lane that took down another lane's app; the helper cannot do that, and the rule cost 24 implementer
 restart-resumes (41.6M tokens, 8.5% of subagent tokens) in the 2026-10-12 run (#289). If the
 helper refuses (exit 3) or the app does not come back (exit 1), the implementer reports
 `BLOCKED NEEDS_RESTART` with its output, as before.
diff --git a/tests/wave2/test-exec-lock-watch.sh b/tests/wave2/test-exec-lock-watch.sh
index 29c8c6c5..04f238eb 100755
--- a/tests/wave2/test-exec-lock-watch.sh
+++ b/tests/wave2/test-exec-lock-watch.sh
@@ -157,6 +157,17 @@ printf '%s 1700000000 old.mdl\n' "$(dead_pid)" > "$LOCK"
 OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
 [ "$RC" -eq 0 ] && ok "an empty takeover file older than a minute is stale too" || bad "empty old takeover file blocked (rc $RC)"
 rm -f "$LOCK.takeover"
+# A FRESH empty takeover file is a live contender between its create and its write, NOT stale.
+# `find -mmin +0` judged it stale within a second, so a third contender got in (review of #324).
+printf '%s 1700000000 old.mdl\n' "$(dead_pid)" > "$LOCK"
+: > "$LOCK.takeover"
+OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -ne 0 ] && ok "a fresh empty takeover file is respected: the run waits, then refuses (rc $RC)" \
+  || bad "a fresh empty takeover file was judged stale and the run went ahead"
+hasnt "  and it did not execute" "$OUT" "fake mxcli exec"
+[ -e "$LOCK.takeover" ] && [ ! -s "$LOCK.takeover" ] && ok "  and the contender's takeover file was left in place" \
+  || bad "the fresh takeover file was moved or replaced"
+rm -f "$LOCK" "$LOCK.takeover"
 
 echo "-- lock: old bare-pid format, dead pid"
 dead_pid > "$LOCK"
@@ -329,6 +340,12 @@ printf 'alter entity Shop.Order modify attribute Note: String(500);\n' > "$WORK/
 expect "$WORK/modattr.mdl" "$UNK" "modify attribute" "alter entity ... modify attribute (no ADD) is not watch-safe"
 printf "create constant Shop.ApiBase type String default 'https://example.invalid';\n" > "$WORK/const.mdl"
 expect "$WORK/const.mdl" "$UNK" "create constant" "create constant"
+# Neutral for the watch verdict: a move into a folder (verbatim from a pending issue) next to a
+# watch-safe page edit stays "watch can apply this".
+{ grep -m1 -E "^move page RenA\.Other to folder 'Pages/Same';" \
+    "$TOOLKIT/bug-logs/pending-github-issues/rename-page-renames-folder.md"; cat "$PFM/bind-contract-alter.mdl"; } > "$WORK/movefolder.mdl"
+grep -q '^move page' "$WORK/movefolder.mdl" && expect "$WORK/movefolder.mdl" "watch can apply this" "" "move page ... to folder + alter page is not 'unknown'" \
+  || bad "golden 'move page ... to folder' line not found"
 
 echo "-- watch-compat in a real run"
 cp "$GAL/05-demo-data.mdl" "$P/mdlsource/demo.mdl"

From 1cb70ad33f0c59f8e926f6680d940ea0013c8eec Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:48:46 +0000
Subject: [PATCH 64/68] fixture: re-copy exec.sh lock block from #324 @ 79de404

The aligned exec_lock_takeover (-mmin +1, own-file-only removal) now matches
test-scratch take_over() apart from signature and parameter names (diffed).

Refs #244

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 .../fixtures/mxtest-guard/exec-lock-block.sh  | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
index a6a31c34..b14b13a8 100644
--- a/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
+++ b/tests/wave2/fixtures/mxtest-guard/exec-lock-block.sh
@@ -1,5 +1,5 @@
 # exec-lock-block.sh — VERBATIM copy of project-bin/exec.sh's lock block (exec_lock_live .. the
-# LOCK_TAKEN check) from PR #324, branch fix/exec-followups @ ed4efbb. Used by
+# LOCK_TAKEN check) from PR #324, branch fix/exec-followups @ 79de404. Used by
 # test-shared-lock-takeover.sh until #324 is merged; that fixture prefers the real exec.sh's block
 # once it carries exec_lock_takeover. Do not edit by hand — re-copy.
 exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and plausibly exec.sh
@@ -26,30 +26,36 @@ exec_lock_release() {  # the trap: remove the lock only while it is still ours
 # moved A's fresh lock aside, C's noclobber write landed in the gap, B saw a lock and deleted
 # A's: 12 contenders gave up to 3 holders at once (tests/wave2/test-exec-lock-watch.sh).
 # A takeover file left by a holder killed inside those few microseconds is stale once its pid is
-# dead or it is older than 10 s (an EMPTY one once it is a minute old); it is moved aside, and put back with `ln` (fails if a new one
-# exists — never clobbers) if what was moved is not the one judged stale.
+# dead or it is older than 10 s (an EMPTY one once it is over a minute old — `find -mmin +1`;
+# `+0` matched a file created a second ago, so a live contender's fresh takeover file was judged
+# stale and a third contender got in: review of #324). It is moved aside, and put back with `ln`
+# (never clobbers; left on disk if that fails) if what was moved is not the one judged stale.
+# The holder removes the takeover file only while it still holds the line it wrote.
 exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
-  _tk="$LOCK.takeover"
-  if ! ( set -o noclobber; printf '%s %s\n' "$$" "$(date +%s)" > "$_tk" ) 2>/dev/null; then
+  _tk="$LOCK.takeover"; _mine="$$ $(date +%s)"
+  if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
     _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
     case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
     _tstale=0
     if [ -n "$_t" ]; then
       { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
-    elif [ -n "$(find "$_tk" -mmin +0 2>/dev/null)" ]; then
-      _tstale=1   # empty for a minute: its creator died between the create and the write
+    elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
+      _tstale=1   # empty for over a minute: its creator died between the create and the write
     fi
     if [ "$_tstale" = 1 ]; then
       if mv "$_tk" "$_tk.stale.$$" 2>/dev/null; then
-        [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ] || ln "$_tk.stale.$$" "$_tk" 2>/dev/null || true
-        rm -f "$_tk.stale.$$"
+        # Remove what was moved ONLY if it is what was judged stale; anything else is someone's
+        # live takeover file: put it back (ln never clobbers), and if that fails leave it be.
+        # Same body as test-scratch.sh's take_over() — keep the two in step (PR #322).
+        if [ "$(head -1 "$_tk.stale.$$" 2>/dev/null || true)" = "$_t" ]; then rm -f "$_tk.stale.$$"
+        else ln "$_tk.stale.$$" "$_tk" 2>/dev/null && rm -f "$_tk.stale.$$"; fi
       fi
     fi
     return 1
   fi
   _now="$(head -1 "$LOCK" 2>/dev/null || true)"
   [ "$_now" = "$1" ] && rm -f "$LOCK"
-  rm -f "$_tk"
+  [ "$(head -1 "$_tk" 2>/dev/null || true)" = "$_mine" ] && rm -f "$_tk"   # only our own takeover file
   return 0
 }
 LOCK_TAKEN=0

From 22d6f7eaf178aaca22f6dd827404981b0453e5fa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 15:55:53 +0000
Subject: [PATCH 65/68] test(status): T9a holds before and after #321 NOT YET
 DUE

When gate-check already reports final-look NOT YET DUE (#321), final-look
is no longer pending: assert it is absent from the obligations-pending line
and mark the baseline control not applicable. Pre-#321 assertions unchanged.
27/27 on this branch and on a scratch merge onto integration/2026-10-14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 tests/wave2/test-status-existing-app.sh | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/tests/wave2/test-status-existing-app.sh b/tests/wave2/test-status-existing-app.sh
index 423391fd..839fca91 100755
--- a/tests/wave2/test-status-existing-app.sh
+++ b/tests/wave2/test-status-existing-app.sh
@@ -192,10 +192,23 @@ case "$n" in "discharge:"*) ok "T9a derived Stage P: NEXT still discharges what
 case "$n" in *final-look*) bad "T9a derived Stage P: NEXT still names final-look" "$n";; *) ok "T9a derived Stage P: final-look not in NEXT";; esac
 case "$n" in *skeleton*) ok "T9a only final-look is filtered (skeleton, also above Stage P, stays)";; *) bad "T9a filter dropped more than final-look" "$n";; esac
 f="$("$W/tk2/bin/status.sh" "$P9" 2>/dev/null)"
-printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' && ok "T9a the screen still lists final-look under obligations pending" || bad "T9a obligations pending line lost final-look"
-if [ "$HAVE_BASE" = 1 ]; then
-  o="$(nextof "$W/tk2/bin/status-baseline.sh" "$P9")"
-  case "$o" in *final-look*) ok "T9a control: the baseline sent a Stage P project to final-look";; *) bad "T9a control: baseline did not name final-look — case cannot fail" "$o";; esac
+# Once obligation-check.sh itself reports final-look NOT YET DUE under an early derived readout
+# (#321), final-look is no longer pending at all: then it must be ABSENT from the pending line, and
+# the baseline control cannot apply (the old status.sh would not name it either). Before #321, the
+# pending line keeps listing it and the baseline control shows the old NEXT sent the project there.
+# Captured first: under pipefail, `gate-check | grep -q` reads as false when grep exits early.
+GC9="$("$W/tk2/bin/gate-check-real.sh" --no-html "$P9" 2>/dev/null)"
+if printf '%s\n' "$GC9" | grep -E '^Obligation final-look +NOT YET DUE' >/dev/null; then
+  printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' \
+    && bad "T9a final-look is NOT YET DUE in gate-check but still listed as pending" "$(printf '%s\n' "$f" | grep 'obligations pending')" \
+    || ok "T9a gate-check says final-look NOT YET DUE: absent from the obligations pending line"
+  ok "T9a control: not applicable — gate-check already reports final-look NOT YET DUE (#321)"
+else
+  printf '%s\n' "$f" | grep -q 'obligations pending:.*final-look' && ok "T9a the screen still lists final-look under obligations pending" || bad "T9a obligations pending line lost final-look"
+  if [ "$HAVE_BASE" = 1 ]; then
+    o="$(nextof "$W/tk2/bin/status-baseline.sh" "$P9")"
+    case "$o" in *final-look*) ok "T9a control: the baseline sent a Stage P project to final-look";; *) bad "T9a control: baseline did not name final-look — case cannot fail" "$o";; esac
+  fi
 fi
 
 # T9b a module opened under the same lagging derived line: the module passes stay in NEXT.

From 90a69574c29774cf060664da132fd1f7b509470e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 16:01:27 +0000
Subject: [PATCH 66/68] fix(exec): show lint-gate's SEC014 note on a clean run

PR #312 makes lint-gate.sh print a non-blocking `note: SEC014 not
configured` on stderr. run_lint_gate captured that output and showed it
only on failure, so the note never appeared on a clean exec. Always echo
that one line; exit code unchanged. Fixture: stub lint-gate with the
note on stderr and rc 0 -> exec output shows it (fails on the prior head).

Refs #287

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                        |  2 +-
 project-bin/exec.sh                 |  3 +++
 tests/wave2/test-exec-lock-watch.sh | 15 +++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8af21e83..c3b3a66d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
-- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. A review of this PR found that an empty takeover file was judged stale by `find -mmin +0` within a second of its creation, so a live contender's fresh file could be moved aside and a third contender could get in. The threshold is now `-mmin +1`, the holder removes the takeover file only while it still holds its own line, and a fixture case checks that a fresh empty takeover file is respected. Microflow-body verbs, `CREATE FOLDER` and moves into a folder are neutral for the watch verdict. agent-roles.md names the `unknown` verdict. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
+- fix(exec): **follow-ups from an independent review of #304/#306/#290: the stale-lock takeover is mutually exclusive, only watch-safe statements say "watch can apply this", `--cr` works after `--commit-first`, and the ui-only test lane names snippet/layout embedders** ([#287](https://github.com/MendixMau/mxcli-project-toolkit/issues/287), [#289](https://github.com/MendixMau/mxcli-project-toolkit/issues/289), [#274](https://github.com/MendixMau/mxcli-project-toolkit/issues/274)). (1) The takeover moved a stale lock aside and put back a fresh one with `mv -f`, which is check-then-act: with 12 contenders against one dead-pid lock, up to 3 held the lock at once. It is now serialised through an O_EXCL `.exec.lock.takeover` file (bounded by pid and age), and the lock is removed only if it still holds the stale line that was read. `tests/wave2/test-exec-lock-watch.sh` runs 10 rounds of 12 contenders and asserts at most one holder. On master 2 of 10 rounds had 2 or 3 holders; with the fix, 0. (2) `--watch-compat` said "watch can apply this" for any statement it did not classify: associations, enumerations, `ALTER ENTITY … MODIFY`, Java actions, constants and navigation. These now print `unknown — restart if behaviour looks stale`, and only statements on ui-loop.md's watch-safe list say watch can apply them. ui-loop.md now lists the third verdict. A review of this PR found that an empty takeover file was judged stale by `find -mmin +0` within a second of its creation, so a live contender's fresh file could be moved aside and a third contender could get in. The threshold is now `-mmin +1`, the holder removes the takeover file only while it still holds its own line, and a fixture case checks that a fresh empty takeover file is respected. Microflow-body verbs, `CREATE FOLDER` and moves into a folder are neutral for the watch verdict. agent-roles.md names the `unknown` verdict. A clean exec now also shows lint-gate's non-blocking `note: SEC014 not configured` line (#312), which was only visible on a failing lint run; the exit code is unchanged. (3) The fixture now also covers a two-tree checkout (`.mpr` under `app/`) for the lock and `--commit-first`. (4) Leading flags are parsed in one loop and can come in any order. The documented `--commit-first --cr CR-07 <script>` used to commit the model and then run "--cr" as the script. A script name starting with `--` is now refused before any commit or snapshot. (5) The ui-only lane now says "journeys of every page the change reaches (embedders of a changed snippet/layout)" instead of "no other module's journeys". — MendixMau
 - learn(testing-shape, test-result-audit): **three test-strength rules, each with a denominator: refusals probed on the server, every undeclared 4xx a failure, one clean-database final run** ([#172](https://github.com/MendixMau/mxcli-project-toolkit/issues/172)). A field comparison of two builds against one frozen spec found the toolkit build checked permission refusals only in the client (a hidden menu item), logged unexpected 400/422 responses as information, and reached 20/20 by stitching three runs. `testing-shape.md` §7 gains three report lines (`N of N restricted pairs probed server-side`, `undeclared 4xx/5xx: 0 of M requests — each fails its step`, `one clean-DB run <id>: N of N scenarios incl. timers, not stitched`); `test-result-audit.md` gains check 2e, which carries the reasons and the field evidence and asks for those numbers. Both baseline skills stay inside the 80,000-word baseline budget (79,997): the reasons live in the on-demand audit skill, and two redundant sentences in `testing-shape.md` §4's verdict paragraphs were folded (the empty-set corollary is stated in the Trace row, `harness-architecture.md` and `report-schema.md`). The backing inbox note is trimmed to its unpromoted "Keep" items. — MendixMau
 - learn(learned-detection-gaps, module-review): **two UI defects every model gate passes: a lazy-loaded combo box filter hides its preset, and a theme that pins row heights by position lets the next row cover an inserted widget** ([#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299)). Both passed check, mxbuild, lint and the scripted checks on a 127-module production app and were found only in the running app. Two register rows with the first oracle and the pre-build check (pluggable properties that change *when* data loads; grep the theme for fixed `height` on positional row classes before an insert), and two LOOK lines in `module-review.md` §4c with denominators (`N of N filters show their preset on first load`, `N of N widgets inserted into an existing container fully visible`). — jopterhorst
 - fix(app-restart, test-stack-up): **a port held by another process before `run --local` is named and reported as "instrument blocked" (exit 4), never killed** ([#262](https://github.com/MendixMau/mxcli-project-toolkit/issues/262)). Studio Pro had started its own runtime on the app/admin ports a restart needed; `mxcli run --local` then failed with "Authentication failed" (the admin API answering was Studio Pro's), the next journey ran against Studio Pro's runtime, and four more runs were NOT RUN. `app-restart.sh` now checks the app port and the admin port (record's `adminPort`, else app + 10) before stopping anything — a holder outside the recorded process tree exits 4 with its name, pid and parent — and again after the stop, where anything still holding a port is by definition not ours. `test-stack-up.sh` runs the same check wherever it would tell you to start `run --local` (`--no-docker`, no Docker daemon, `--check` with a leftover record), on the record's ports, `RUN_LOCAL_APP_PORT`/`RUN_LOCAL_ADMIN_PORT`, or mxcli's defaults 8080/8090. Holder lookup: lsof, then ss, then netstat + tasklist on Windows; unnamed holders still block when nothing of ours is running. Fixtures: `test-app-restart.sh` +2 cases (14 assertions, all fail on the old script), `test-stack-up-local.sh` T7 (4 of 6 fail on the old script). — AlvinnYeo
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 48802384..3e602957 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -824,6 +824,9 @@ run_lint_gate() {
   # row at all (measured on the first wired run in a real project, 2026-09-24). Capture explicitly.
   LINT_RC=0
   bash "$PROJECT_ROOT/bin/lint-gate.sh" >"$_lo" 2>&1 || LINT_RC=$?
+  # lint-gate's non-blocking SEC014 note (#312: rule installed, decision not made) is otherwise
+  # visible only on a failing run, because the capture above is shown only then. Always echo it.
+  [ -f "$_lo" ] && { grep '^note: SEC014' "$_lo" 2>/dev/null | sed 's/^/    /' || true; }
   case "$LINT_RC" in
     0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline" ;;
     1) # Rule ids are matched as [A-Z][A-Z0-9-]*[0-9]+, not [A-Z]+[0-9]+: mxcli's built-in
diff --git a/tests/wave2/test-exec-lock-watch.sh b/tests/wave2/test-exec-lock-watch.sh
index 04f238eb..0ceb6a7c 100755
--- a/tests/wave2/test-exec-lock-watch.sh
+++ b/tests/wave2/test-exec-lock-watch.sh
@@ -369,6 +369,21 @@ touch "$P/.mxcli/run-local.json"
 OUT="$(run "$P" mdlsource/page.mdl)"
 has "same script, SCSS older than the boot → watch applies it" "$OUT" "→ Watch: watch can apply this"
 
+echo "-- lint-gate's SEC014 note reaches a clean exec (#312)"
+# The note line is lint-gate.sh's own text in PR #312 (project-bin/lint-gate.sh, stderr, rc 0).
+cat > "$P/bin/lint-gate.sh" <<'LG'
+#!/usr/bin/env bash
+echo "note: SEC014 not configured — set .claude/lint-config.yaml rules: SEC014: options: external_roles (ask the user; 'none' is their decision)" >&2
+echo "PASS: no rule rose vs baseline"
+exit 0
+LG
+chmod +x "$P/bin/lint-gate.sh"
+OUT="$(run "$P" mdlsource/test.mdl)"; RC=$?
+[ "$RC" -eq 0 ] && ok "clean lint run still exits 0" || bad "lint note changed the exit code (rc $RC)"
+has "the SEC014 note is shown on a clean run" "$OUT" "    note: SEC014 not configured"
+has "  and the run still reports lint clean" "$OUT" "lint: no rule rose"
+rm -f "$P/bin/lint-gate.sh"
+
 echo ""
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

From 2827a6d5e226be48e5df62d55448140c5ca7f598 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 17:12:35 +0000
Subject: [PATCH 67/68] test(run-all): resolve fixture subjects under bin/lib/

test-pipefail-grep-q.sh declares bin/lib/skill-routing.sh as its subject;
run-all.sh only searched bin/, project-bin/, skills/, hooks and the root,
so CI reported "declares subject 'skill-routing.sh', which is not in the
toolkit". bin/lib/ is searched right after bin/; no file name exists in
both bin/lib/ and any later candidate, so no other fixture's subject moves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 tests/wave2/run-all.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/wave2/run-all.sh b/tests/wave2/run-all.sh
index ac6627f9..14f2bc8a 100755
--- a/tests/wave2/run-all.sh
+++ b/tests/wave2/run-all.sh
@@ -54,7 +54,7 @@ for t in "$DIR"/test-*.sh; do
 
   subject=""
   if [ -n "$subj_name" ]; then
-    for cand in "$TOOLKIT/bin/$subj_name" "$TOOLKIT/project-bin/$subj_name" \
+    for cand in "$TOOLKIT/bin/$subj_name" "$TOOLKIT/bin/lib/$subj_name" "$TOOLKIT/project-bin/$subj_name" \
                 "$TOOLKIT/skills/$subj_name" "$TOOLKIT/claude-hooks/hooks/$subj_name" \
                 "$TOOLKIT/$subj_name"; do
       [ -f "$cand" ] && { subject="$cand"; break; }

From 40814fcce22101e01a80a1205271b3c12bd27813 Mon Sep 17 00:00:00 2001
From: MendixMau <55099313+MendixMau@users.noreply.github.com>
Date: Wed, 14 Oct 2026 10:17:03 +0800
Subject: [PATCH 68/68] fix: review follow-ups for the 2026-10-14 integration
 batch (#330)

dispatching.md names app-restart exits 4 and 5; test-test-scratch.sh drops ls|grep -q under pipefail; sync step 4d survives empty doctor output; _ob_has_denominator strips NUL bytes. The stale-lock takeover re-check was dropped after review (it opened a new ~6 s refusal).

Review: independent review (MERGE-AFTER-FIX) of efc60f8; both fixes applied in 0a4522c (takeover change dropped, exit-4 wording corrected). CI green on 0a4522c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md                     | 1 +
 bin/lib/obligation-check.sh      | 2 +-
 bin/sync-project.sh              | 4 ++--
 skills/dispatching.md            | 4 +++-
 tests/wave2/test-test-scratch.sh | 8 ++++----
 5 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cdadb8b2..4c6faaca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 
+- fix(dispatching, sync-project, obligation-check): **review follow-ups for the 2026-10-14 integration batch.** `dispatching.md` names app-restart exits 4 and 5 beside 3 and 1. `test-test-scratch.sh` drops `ls | grep -q` under pipefail for here-strings; sync step 4d no longer aborts on empty doctor output; `_ob_has_denominator` strips NUL bytes so bash stops warning. — integration 2026-10-14 reviews
 - feat(lint): **Lint Batch 4 — SEC014 external role can write state, audit or ownership members; CONV009 reads its `maxObjects` option.** SEC014 ([#268](https://github.com/MendixMau/mxcli-project-toolkit/issues/268)): a partner role with `create, read *, write *` on self-owned entities passed every stock rule, so it could set its own record's status through the client API. Lint showed only CONV006 +4, which was re-baselined, and a manual review found it five days later. The new rule flags an external role (named in `lint-config.yaml` as `external_roles: "A, B"`, or `"none"`) that writes all members, a `Status`/`State`/`Result`/`Stage`/`Phase` enumeration, an `…At`/`…By` attribute, or the association its own XPath uses for ownership. It is a warning in the security tier. A `_rule` finding marks the rule blind when the option is blank or given as a YAML list (mxcli passes a list as `None`), when a role name does not exist, or when the catalog is not FULL. Each message is under 160 characters and names the place to fix it, because lint-gate prints only that much. An **absent** option is not a `_rule` finding, so it does not block every exec (the #229 pattern). Instead `bin/sync-project.sh` prints a NOTE on every sync through new `bin/lib/sec014-notice.sh` until the option is set. It is a NOTE rather than a counted warning, so a pristine scaffold still syncs clean under `--strict` (fixture `tests/wave2/test-sec014-notice.sh`, 14 cases; `test-bug12-sync.sh` 61/61). `"none"` switches a security rule off, so it is set only on the user's answer in chat and recorded in `PROJECT.md`. Right after configuring, re-baseline with `lint-gate.sh --update-baseline --reason "SEC014 configured" --approved-in-chat`, because the 0 → N jump would otherwise be blamed on the next script. CONV009 ([#267](https://github.com/MendixMau/mxcli-project-toolkit/issues/267)): the stock rule hard-codes 15, so the `maxObjects: 20` example in the config `mxcli init` writes did nothing. The toolkit copy reads `maxObjects` and `countLoopBodies`, with the **default kept at 15** (raising it is a maintainer call). It replaces the stock file through `STOCK-HASHES.txt`, which gains conv009 hashes for v0.17.0/0.24.0/0.25.0 and a full v0.26.0 set, captured by `mxcli init` from the official release assets; `test-stock-hashes.sh` T4 passes live on all four. `lint-that-actually-runs.md` now says `options:` reaches only rules that call `get_option()`. 32 cases in `tests/lint-rules/test-batch4-rules.sh`; the harness gained `get_option`, `permissions_for`, `attributes_for`, `user_roles` and `role_mappings`. Field run (official mxcli 0.26.0, two model copies): stock CONV009 stayed at 5 with `maxObjects: 20`, while the toolkit copy gave 5 at 15, 10 at 10 and 6 at 20 with loop bodies counted. SEC014 gave 1 true finding with the model's external role configured, and 7 with every role configured, matched by a SQL replay. Both rules load on 0.17.0 and 0.24.0 too. CONV009's "every flow reports 0 objects" self-check now needs `activities_for()` to find a real object in a zero-count flow, so an early greenfield model with empty microflows is not reported blind. `lint-rules/README.md` and the TXT002 header now give the supported way to turn a toolkit rule off. ISO dates in particular are a toolkit opinion, so a project with a non-ISO display standard sets `rules: TXT002: enabled: false` in `lint-config.yaml` and records that in `PROJECT.md`. It must not delete the file, which sync would re-install. On mxcli 0.26.0, a rule with 1 finding gave 0 once disabled. After #308, there is one opt-out story, always the user's decision (asked in chat, recorded in `PROJECT.md`), and it never deletes a `.star` file. `enabled: false` in `lint-config.yaml` stops a rule reporting; this is preferred. `.claude/lint-rules-disabled.txt` with a `# reason:` stops sync installing a toolkit rule, and refuses stock-seeded rules, a list that now includes conv009. `rules: SEC014: enabled: false` is the same decision as `external_roles: "none"`. While SEC014 is undecided, `project-bin/lint-gate.sh` also prints one uncounted `note: SEC014 not configured …` line on stderr on every run (no exit-code change, no lint row). Both it and the sync NOTE now count `external_roles` only when it sits under the `SEC014` key. `test-sec014-notice.sh` has 24 cases. — MendixMau
 - fix(lint-gate): **rules that `mxcli init` reverted to stock now stop the lint run as BLIND instead of showing up as a rise on the next script** ([#264](https://github.com/MendixMau/mxcli-project-toolkit/issues/264)). `bin/lint-gate.sh` reads `.claude/.mxtk-lint-receipt` (written by `bin/lib/install-lint-rules.sh`) before linting: a stock-seeded rule (the file names `mxcli init` writes, now marked `stock` in the receipt) whose md5 no longer matches and whose `# mxtk-lint-rule:` header is gone, or any receipt-listed rule that is missing, is named, the remedy `bin/sync-project.sh <project>` (fallback `--upgrade-lint-rules all`) is printed, and the run exits 1 with `BLIND — lint rules reverted to stock` (exec.sh logs `LINT BLIND`, not `LINT ROSE`); `--update-baseline` is refused over reverted rules, also under the `LINT_RULES_REVERTED_OK=1` look-anyway override. Field cases: CONV010 26 -> 169 blamed on a pages-only exec, and a re-seed that sat five days while the baseline absorbed stock counts. So the remedy always clears it, `bin/lib/install-lint-rules.sh` restores such a stock-seeded rule even when its body matches no known stock hash (a newer mxcli's seed, or a hand edit that also lost the header: it was reported LOCALLY MODIFIED and never written), labelled `header missing — restored from toolkit, your copy kept as <rule>.reseeded-<ts>` with the newest 3 copies kept; a headerless toolkit-only or configurable rule is still a local edit, never overwritten. The installer also writes each receipt row's kind, prunes rows for rules no longer shipped, and honours `.claude/lint-rules-disabled.txt`: one line per rule with `# reason: …` (`#\s*reason:` in both tools), a user decision recorded in `PROJECT.md`; a line with no reason, or naming a stock-seeded rule, is ignored with a warning (`lint-rules/README.md` had told projects to just delete txt002). Fixture `tests/wave2/test-lint-receipt-revert.sh` builds its receipt with the real installer and uses a genuine v0.25.0 stock body: 55/55 here, 28 fail on master's lint-gate and installer. — AlvinnYeo
 - learn(learned-mdl-preflight): **a microflow change near a `return` in a dense flow is planned as drop + create after `show access`; `check -p --references` does not run exec's free-room test** ([#263](https://github.com/MendixMau/mxcli-project-toolkit/issues/263)). STOP row 28 and BUG-156: on v0.25.0 `check` printed "no flow change exec would refuse" and exec then refused "there is no free room for the fragment". Upstream issue drafted, not filed. — AlvinnYeo
diff --git a/bin/lib/obligation-check.sh b/bin/lib/obligation-check.sh
index b449c6dd..af0c17ba 100755
--- a/bin/lib/obligation-check.sh
+++ b/bin/lib/obligation-check.sh
@@ -253,7 +253,7 @@ _ob_find() {
 # Deliberately loose — the wording belongs to the skill, only the shape is mechanical.
 _ob_has_denominator() {
   grep -qiE -- '[0-9]+[[:space:]]+of[[:space:]]+[0-9]+|[0-9]+[[:space:]]*/[[:space:]]*[0-9]+' \
-    <<<"$(head -c 4000 "$1" 2>/dev/null | tr -d '\r')"
+    <<<"$(head -c 4000 "$1" 2>/dev/null | tr -d '\r\0')"
 }
 
 # _ob_stale <project-root> <artifact>  → prints "<hash>+<n>" and returns 0 if the mark has
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index 95fad085..97ba2fc4 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1479,9 +1479,9 @@ if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
     # rc 3 (an mxcli before v0.26 cannot check) and rc 4 (the check itself failed) are not
     # findings about the model, so doctor's WARN line for them is relabelled, not shown as one.
     if [ "$_ps_rc" -eq 3 ] || [ "$_ps_rc" -eq 4 ]; then
-      printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed -e 's/^  WARN  /  info  /' -e 's/^/   /'
+      printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed -e 's/^  WARN  /  info  /' -e 's/^/   /' || true
     else
-      printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed 's/^/   /'
+      printf '%s\n' "$_ps_out" | grep -v '^[[:space:]]*$' | sed 's/^/   /' || true
     fi
     case "$_ps_rc" in
       0|2) ;;
diff --git a/skills/dispatching.md b/skills/dispatching.md
index a720e313..93211ae8 100644
--- a/skills/dispatching.md
+++ b/skills/dispatching.md
@@ -56,7 +56,9 @@ app." The helper stops only the pid that `run --local` recorded for that project
 otherwise (`ui-loop.md` § "What watch picks up"). The old lead-only rule came from a broad kill
 in one lane that took down another lane's app; the helper cannot do that, and the rule cost 24 implementer
 restart-resumes (41.6M tokens, 8.5% of subagent tokens) in the 2026-10-12 run (#289). If the
-helper refuses (exit 3) or the app does not come back (exit 1), the implementer reports
+helper refuses (exit 3), the app does not come back (exit 1), a process it did not record
+holds the app or admin port (exit 4, nothing started; the recorded app may already be stopped), or the stop left a live
+MxTest after-startup in place (exit 5, nothing started), the implementer reports
 `BLOCKED NEEDS_RESTART` with its output, as before.
 
 **Prefix you do not control.** Every subagent turn also carries the harness's skill listing,
diff --git a/tests/wave2/test-test-scratch.sh b/tests/wave2/test-test-scratch.sh
index 4609943f..19db6b92 100755
--- a/tests/wave2/test-test-scratch.sh
+++ b/tests/wave2/test-test-scratch.sh
@@ -53,8 +53,8 @@ printf '%s' "$R" | grep -qx '.mxcli' && bad "the live run --local record was cop
 printf '%s' "$R" | grep -qx 'deployment' && bad "deployment/ was copied" || ok "deployment/ not copied"
 [ "$(printf '%s' "$R" | tail -1)" = 1 ] && ok "port lock held during the run" || bad "no port lock during the run"
 [ "$(cat "$P/Fixture.mpr")" = model ] && ok "live .mpr untouched" || bad "live .mpr was written"
-ls "$WORK/tmp" | grep -q 'mxtk-test-ports' && bad "port lock left behind" || ok "port lock released"
-ls "$WORK/tmp" | grep -q 'Fixture-test' && bad "scratch copy left behind" || ok "scratch copy deleted"
+grep -q 'mxtk-test-ports' <<<"$(ls "$WORK/tmp")" && bad "port lock left behind" || ok "port lock released"
+grep -q 'Fixture-test' <<<"$(ls "$WORK/tmp")" && bad "scratch copy left behind" || ok "scratch copy deleted"
 [ -f "$P/.mpr-snapshots/.exec.lock" ] && bad "exec lock left behind" || ok "exec lock released"
 
 echo "-- exit code passes through"
@@ -72,7 +72,7 @@ has "names the holder" "$OUT" "held by PID $H"
 kill -KILL "$H" 2>/dev/null; wait "$H" 2>/dev/null
 
 echo "-- dead holder's port lock is taken over (the SIGKILL above left it)"
-ls "$WORK/tmp" | grep -q 'mxtk-test-ports' && ok "[setup] stale port lock present" || bad "[setup] no stale lock"
+grep -q 'mxtk-test-ports' <<<"$(ls "$WORK/tmp")" && ok "[setup] stale port lock present" || bad "[setup] no stale lock"
 rm -f "$P/.mpr-snapshots/.exec.lock"
 OUT="$(run e -- tests/a.test.mdl)"; RC=$?
 [ "$RC" -eq 0 ] && has "taken over out loud" "$OUT" "taking it over" || bad "stale port lock blocked (exit $RC)"
@@ -157,7 +157,7 @@ if command -v node >/dev/null 2>&1; then
   has "prints the git repair" "$OUT" "git checkout -- 'mprcontents/4e/70/4e70063d-53e1-477a-ab92-6b763330c293.mxunit'"
   has "prints the MDL repair with HEAD's value" "$OUT" "alter settings runtime (AfterStartupMicroflow: 'Orders.ASU_Startup');"
   [ -f "$WORK/rec.k" ] && bad "mxcli ran on the injected model" || ok "mxcli not run"
-  ls "$WORK/tmp" | grep -q 'Fixture-test' && bad "a copy was made" || ok "nothing copied"
+  grep -q 'Fixture-test' <<<"$(ls "$WORK/tmp")" && bad "a copy was made" || ok "nothing copied"
   node "$SETAS" "$GU" "$UNIT" "MxTest.TestRunner"
   OUT="$(run l -- tests/a.test.mdl)"; RC=$?
   [ "$RC" -eq 3 ] && ok "MxTest.TestRunner → refused (exit 3)" || bad "TestRunner exit $RC"