diff --git a/CHANGELOG.md b/CHANGELOG.md
index 622e3ac..40eb79c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,50 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
 - chore(inbox): **triage of `contrib/inbox/`: removed 15 promoted/obsolete files, gave the rest neutral names and scrubbed identifiers.** Gone: the ten machine-diff `*-patches.md` files from 2026-09-14, the 2026-09-27 field-project patch file, the built company-brain idea, and three already-promoted or superseded bug dumps. Kept for now: `2026-09-27-mxcli-upstream-issues.md`, because five drafts under `bug-logs/pending-github-issues/` cite it as their source. Four remaining files were renamed to `field-project-{a,b,c}` names; project and app names, home-style paths and personal names inside the 17 remaining entries were replaced with neutral labels or placeholders (technical content unchanged). — MendixMau
+- learn(learned-mdl-preflight, learned-detection-gaps, microflow-preflight, testing-shape, learned-mdl-cannot-express, learned-page-patterns, rest-integration-first-time-right, journey-proof, learned-datagrid-customcontent-binding): **the skills side of BUG-142 to BUG-154.** STOP row 12 rewritten shorter for v0.24.0 — `ContentParams` takes a bare attribute or a quoted literal only, and the `toString(Attr)` fix it taught no longer builds; row 14 notes a narrowing `grant` merges, row 23 that `diff` prints false `-`/`~` lines. Detection gaps: the ContentParams row now covers any object-bound `dynamictext` and says check passes `if … then … else`; reserved words cover entities; new CE1870 row. microflow-preflight: CONV013 false positive and doc-comment round-trip resolved from "Not verified"; error handler without `return` is the second merge-overlap shape. testing-shape: `--test-endpoint` writes into the working model until a clean stop; `run --local` starts with scheduled events off (new register row). Also: five cannot-express rows (tab badge, validate-while-typing, AppTitle, always-open nav groups, sidebar toggle / page-load / Marketplace layout) and the DG2 `emptyplaceholder` correction; control-bar attributes, nested list view `Editable` and REPLACE-not-re-run-safe in page patterns; v0.24.0 REST bullets; two OQL journey traps. Triages three inbox notes (ContentParams, REST/JSON/page field notes, scheduled events) — card-disbursement requirements-driven build
+- learn(bug-logs): **thirteen new ledger entries (BUG-142 to BUG-154) and five retests from mxcli v0.24.0 / Mendix 11.13.0.** New: `ContentParams` builds only from a bare attribute or a quoted literal, and `if … then … else` passes check and fails CE1613 (supersedes the BUG-23 fix); theme seeder and Atlas-map gaps; `create user role` omits `CheckSecurity`/`GUID`; a narrowing `grant` merges; `diff` false modifications; check/exec disagreeing on same-script documents; E007 on a last quoted enum literal; a table of check/lint misfires and check-green/mxbuild-red constructs; DG2 and filter definition gaps; `rest call … body $Var` sends the literal text; published-REST, mapping and Java action gaps; OQL `HAVING` and date aggregates; MDL surface gaps. Retests: BUG-08 (REPLACE still collides, and on reused child names), BUG-77 reproduced with its trigger isolated, BUG-92 and BUG-117 field instances, BUG-122 on a snippet list view; the layout-merge draft gains the error-handler shape. Each from a `check`/exec/mxbuild A/B or a BSON read on a scratch copy — card-disbursement requirements-driven build
+- learn(learned-dg2-patterns, learned-css-that-never-applied, testing-shape, learned-db-assertions, module-review): **five UI and test-harness notes.** DG2 column sizing at phone width: shrink only the wrapper around text that may ellipsize and floor ids/pills/headers at `max-content` (a blanket `min-width: 0` spilled 20 of 20 pills at 390px); Atlas base properties with no knob (`.btn` font-weight, `.form-group` row layout above 767px) survive a port that trusts the knobs; a gate build while `run --local` serves drops `dist/` and hangs every login (runtime.log shows the 404); `mx.data.get` is disabled in the React client, so data probes go through `mxcli oql --direct`; measure text alignment on glyph ranges, not element boxes — card-disbursement requirements-driven build
+- learn(learned-detection-gaps, learned-microflow-patterns, learned-workflow-patterns): **four new detection-gap rows and one closed gap, from mxcli v0.24.0 / Mendix 11.13.0.** An `if` with no `else` inside `on error { }` passes check and fails mxbuild (CE0079/CE0773); a Java action parameter named with a Mendix-reserved word (`Case`) is CE7247 at mxbuild only; a data widget on a page a no-read role can open passed a scratch `mx check` and failed exec's gate with CE2729; `[%CurrentUser%]` in a microflow a REST or scheduled path reaches passes every static rung and every UI journey, then fails in the system session (look the account up by login instead — pattern added). CE7410 (a task page without `System.WorkflowUserTask`) is now refused at `check --references`. The `calculated by` row no longer tells you to verify with `mx.data.get`, which the React client disables — card-disbursement requirements-driven build
+- learn(workflow-structure-rules, learned-workflow-patterns, module-folder-convention, learned-mdl-preflight, bug-logs): **five workflow rules re-probed on mxcli v0.24.0 / Mendix 11.13.0.** A forward `JUMP TO` builds clean (the CE6681 row taught direction as a platform rule; it was the jump-named-after-its-target defect, fixed upstream in v0.21.0); an interrupting boundary timer ending in `jump to` or `end workflow` builds clean (BUG-109 stamped no-longer-reproduces); BUG-76 splits — the bare-enum `DECISION` is now refused by `MDL-WF03` and still corrupts when forced, a Boolean `true`/`false` decision builds at 0 errors; `create or modify workflow … folder` places the workflow. New: one interrupting boundary per activity (`MDL-WF15`/CE6697) and no `end workflow` on a non-interrupting path (`MDL-WF08`/CE1844); `SET TASK OUTCOME` needs a signed-in named user ("Only named users can complete user task"), with the run-as-session Java action pattern. Evidence: a six-probe, four-control construct run (check, exec, native `mx check`, describe read-back) and a live proof test — card-disbursement requirements-driven build
+- fix(project-tests/e2e/otel.js): **`capture()` pages back to t0 instead of reading only the newest 400 traces.** Jaeger answers the newest `limit` traces and says nothing about the rest; with timers running, 400 traces were two minutes, so a capture with t0 15 minutes back reported 0 errors over 24 real ERROR spans. It now pages by `end` while a page is full and still after t0, dedupes by trace, caps at `OTEL_MAX_PAGES` (25) and marks the result `.truncated` when the cap stops it short. Field run against the live Jaeger: t0 −15 min, 462 spans / 0 errors → 15,439 spans / 24 errors in 11 pages; a step's own capture stays one page — card-disbursement requirements-driven build
+- fix(project-bin/constants-audit.sh): **a `__SET_ME__`-style sentinel default reports `SENTINEL`, not `MODEL-SECRET`.** The audit only knew SET vs EMPTY, so the placeholder `learned-constants-and-secrets.md` Step 3 prescribes for a must-override secret got the same verdict as a real password in git and needed a waiver. The test reads the value's shape (`__[A-Za-z0-9_]+__`) and still prints nothing; the skill's verdict table gains the row. Field run on a copy of the model: 4 findings → 3, the hub password constant SENTINEL — card-disbursement requirements-driven build
+- fix(review-report.js, coverage-check-all.sh): **a module with one coverage ledger per BRD no longer carries a permanent coverage FAULT over a clean count.** `coverage-check-all.sh` keeps `leaves:` on each per-BRD line, and `review-report.js` sums the counters across those lines (null, never zero, when a BRD line is FAULT / NO LEDGER, lacks a counter, or the lines miss the stated BRD count); an old installed copy without `leaves:` is named in the fault. Field run on two real ledgers: FAULT → pass, leaves 337 / 610, 947 summed over both — card-disbursement requirements-driven build
+- fix(project-bin/check-page-shell.sh): **the page-body scan skips quoted strings and block comments.** An unbalanced brace inside a string literal (a JSON payload preview `Content: '{{ … }'`) left the depth up, the scan ran on into the next pages and a page with one H1 was reported as declaring 3; a `--` inside a string cut the line and did the same. Field run: 18 pages across 87 scripts, 1 violation (the false positive) → 0 — card-disbursement requirements-driven build
+- learn(skills/testing-shape.md): **`mxcli test --attach` moves the `.mpr` mtime even when every unit comes back identical**, so the catalog reads stale and `verify-module.sh`'s graph sweep FAULTs — run `REFRESH CATALOG FULL` between a seeding test run and the verify — card-disbursement requirements-driven build
+- learn(skills/rest-integration-first-time-right.md): **a custom `on error { … }` block on a `rest call` is accepted now; the "CE6035" row was stale.** Probed on a copy of the field model (mxcli v0.24.0, Mendix 11.13.0): `on error { … }` and `on error without rollback { … }` on a REST call outside a loop add no `mx check` error; the same handler inside a `while` is CE0644 ("must be 'Rollback' inside a looped activity"), which the row now says, pointing at the existing per-row-isolation lesson — card-disbursement requirements-driven build
+- fix(project-tests/e2e/report-normalize.js): **`--selftest` pins its own walkthrough declarations instead of depending on the project's.** Its cases exercise `full-app-walkthrough` and `mobile-fieldscan`, but `WALKTHROUGHS` came from `project.config.js`, so the selftest failed on the template config (2 FAIL, then a TypeError) and on a project declaring none (4 FAIL, then `canExpressFault` of undefined). Field run in scratch: old 60 / 41 ok and rc 1; new 139 ok, `all ok`, on both the template config and the field project's config. (It still needs a `.mpr` above it: `INPUTS.mpr` reads the config's `mprName` at load.) — card-disbursement requirements-driven build
+- fix(project-bin/render-improvement-register.sh): **the skill's Corrections table renders in its own section instead of as blank OPEN findings.** Its header (`# | Date | Claim … | Measurement … | Where the old claim still stands …`) mapped no cell to finding or disposition, so every correction read as an empty finding, OPEN, severity `(none)`, inflating the open count. A header with a Claim column and no Finding/Disposition column is now read as the corrections table. Field run on the project's register: before, 45 rows, open 10, `(none)`=7; after, 38 findings, open 3, 7 corrections listed apart — card-disbursement requirements-driven build
+- fix(project-tests/e2e/project.config.template.js): **on a two-tree checkout `id` is the `.mpr`'s name, not `app`.** ROOT resolves to `app/` there, so `id` (and the default `otelService`) read `app`, and every trace assertion queried a service that does not exist; `mxcli run --local --trace` names the service after the `.mpr`. Single-tree projects keep the directory name; a two-tree project with no model yet falls back to the repo directory's name, still without throwing on require. Field run: the installed copy printed `id app`, and the project carried a hand `NAME_OVERRIDE` — card-disbursement requirements-driven build
+- learn(bug-logs): **BUG-141 now has a proven fix: condition outcomes go from 0/30 to 30/30 with a `PersistentId`, and a paused instance survives a restart and runs to `Completed`.** `bug-logs/pending-github-issues/bug141-fix.patch` is the upstream commit (three `addFreshPersistentID` lines plus a regression test that fails on all three outcome types without them), `git am`-ready on mxcli `main`. The ledger's open question is also answered by measurement: re-running `create or replace workflow` does not re-mint IDs (54/54, then 84/84 kept, via upstream's `CarryPersistentIDs`), so adopting the fix re-IDs outcomes once and never again. Issue draft updated to match; still to be filed by a maintainer — card-disbursement requirements-driven build
+- fix(project-bin/check-design-reaches-app.sh): **tokens are compared by VALUE as well as by name, and the defaults find a two-tree `app/`.** The `mxcli new` 11.13 template ships its own `--mxt-*` token bridge, so a design system on the same vocabulary read "41 of 62 tokens arrived" with the template's teal brand in place of the designed indigo; a new `tokens valued K of M` line and a WARN (with built-vs-designed samples) now say so. The built sheet, `theme/web` and `themesource/` defaults probe `app/` when the `.mpr` lives there (they exited 2 before; `$use-css-variables` read `unknown`). Field run on the pre-port build: 8 of 62 valued, matching the project's hand count — card-disbursement requirements-driven build
+- fix(project-bin/conformance-check.sh): **a probe mxcli rejects is `UNRUNNABLE`, never `ABSENT`.** A `Parse error:` or "no describable document named" reply exits non-zero like a genuine miss, so a malformed probe on a not-built row scored `ABSENT` → OK — a false green (`DESCRIBE DEMOUSER ops1` read ABSENT/OK while `DESCRIBE DEMO USER 'ops1'` read PRESENT on the same model). Field run on a copy of the field model with a four-row ledger: before, 4 OK; after, 2 OK + 2 UNRUNNABLE, while a genuine `constant not found` stays ABSENT/OK — card-disbursement requirements-driven build
+- fix(project-bin/verify-module.sh): **the coverage rung finds the toolkit's `coverage-check.sh`: `MXTK_ROOT` is now exported once derived.** verify-module read the toolkit root from `CLAUDE.local.md` but never exported it, so the child `coverage-preflight.sh` could not see it and the rung read INSTRUMENT FAULT "coverage-check.sh not found" with the clone resolved a few lines above. With the same one-line export in its installed copy, the field project's coverage rung read `LEVEL 1 · MEASURED` on all four modules. (The other half of the finding, doctor naming `sqlite3`, was already in `bin/doctor.sh`.) — card-disbursement requirements-driven build
+- fix(project-tests/e2e/helpers.js): **`navTo()` also clicks top-bar menus (`.mx-navbar a`), not only the navigation tree.** The `mxcli new` template's home page renders its menu as `.mx-navbar` with the same `a[title]` shape, so tree-only found nothing and every journey died at step 1 with "never appeared". Field run: the same one-line widening in the installed copy took J-00 from NOT-REACHED at step 1 to green, 15/15 — card-disbursement requirements-driven build
+- fix(project-bin/lint-gate.sh): **lint-gate finds the model in the two-tree layout (`app/*.mpr`).** It probed only `$ROOT/*.mpr`, so on a two-tree project it exited 2 ("no .mpr found") on every exec, `exec.sh` logged "lint could not run", and the lint ratchet was silently off for the whole build. It now probes `app/` next, the same as `_common.sh` `find_mpr` (F-020/F-042 class). Harvested from the field project's patched copy, whose next exec reported "✓ lint: no rule rose vs baseline"; scratch probe on both layouts — card-disbursement requirements-driven build
+- learn(skills/brd-to-build-plan.md Step 7, learned-mdl-preflight.md): **demo users get a password: the grammar requires one.** Both skills said to create demo users with no password, using `create demo user "name" with roles "Module"."Role";`. On mxcli v0.24.0 that form does not parse, and neither does `CREATE DEMO USER '<name>' (<UserRole>)` (`mismatched input '(' expecting PASSWORD`). The pattern is now `create demo user '<name>' password '<project demo password>' (<UserRole>);`, with one throwaway policy-compliant value per project, recorded in the build plan. Verified with `mxcli check` on both forms and `mxcli syntax security demo-user` — card-disbursement requirements-driven build
+- learn(skills/architecture-blueprint.md): **Step 5's register rows are numbered `OI-n`, not `1`, `2`, `3`.** `gate-check.sh` reads the first cell of every table row in `PROJECT.md` as a Stage field, so the skill's own numbered example made a `| 7 | Behaviour change … |` row count as the cutover decision: Stage 7 reported FAIL on a project that had not reached Stage 4, and a `CONFIRMED` `| 3 | … |` row could pass the Stage 3 ✋ gate. Renumbering the rows `OI-n` cleared it in the field; scoping the gate's parse to the Decisions table is filed separately — card-disbursement requirements-driven build
+- fix(bin/gate-check.sh): **the dashboard is named after the resolved project directory, so `gate-check.sh . --html` no longer titles it ". — Conversion Dashboard".** The name was `basename` of the argument as typed. Field run: a scratch project checked with `.` — old title ".", new title the directory name — card-disbursement requirements-driven build
+- learn(skills/brd-validation.md, brd-generation.md): **a use case with no code and no document behind it gets `status: proposed`, owed a sign-off.** The status vocabulary was `code-inferred` / `doc-confirmed` / `doc-conflict`, which has no honest value for a use case that is the build's own design: `code-inferred` claims a code source that does not exist. Check 6 now names the case and requires an `openQuestions` entry or a cited `CONFIRMED` register row; `brd-report.sh` already counts only `doc-confirmed` as corroboration, so no script change (21 of 45 use cases on the field BRD) — card-disbursement requirements-driven build
+- fix(bin/images-to-md.sh): **a `--out <dir>` run now prints guidance that names `<dir>`, not the default root.** The "write …/<id>.md, then --check" hint and every owed `bin/source-ledger.sh mark … --artifact …/manifest.json` line were hard-coded to `analysis/knowledge-base/images/`, so after `--out` the ledger marks cited a manifest that does not exist and the re-check hint dropped the `--out` it needs. Both now use the directory the run wrote, and the hint carries `--out` when it is not the default. Field run: the field project's sources + knowledge base copied to scratch, `--out <kb>/images --check` — old printed `--artifact analysis/knowledge-base/images/manifest.json` (described 15 of 15), new prints the `--out` path. Default-root output is unchanged (`tests/wave2/test-images-to-md.sh`) — card-disbursement requirements-driven build (FINDINGS T-6)
+- learn(skills/conversion-runbook.md): **the runbook now says which `bin/` a bare `bin/<script>` means.** It names toolkit scripts as `bin/source-sufficiency.sh`, `bin/status.sh` and so on, but a project's own `bin/` holds only the installed `project-bin/*` copies, so a Stage 0 session ran them from the project root and found nothing. New line under the header: bare `bin/<script>` is the toolkit's, run as `<Toolkit root>/bin/<script>` from the `CLAUDE.local.md` wiring table; `./bin/<script>` is right only for `project-bin/*` — card-disbursement requirements-driven build (FINDINGS T-5)
+- learn(skills/extractor-quality-loop.md): **a source that is not code-shaped gets its own scored dimensions; the contract stays.** The six dimensions are code-shaped, and the skill never said they may be replaced, so a process-model source either scored code dimensions it does not have (0/0 = 100, padding the average) or went off-contract. New subsection: declare the stack's dimensions in the validator header and as the `dimensions` keys of `extraction-quality.json`; expected counts come from the source, and the 95% gate, the Suspicious-Zero Gate and the self-graded rule are unchanged. Worked case: an EA XMI/BPEL process model scored on nodes, transitions, guards, documentation, diagram membership and diagram-image label recall — card-disbursement requirements-driven build (FINDINGS T-4)
+- fix(project-bin/check-root-clean.sh): **the root-clean check no longer calls the toolkit's own root artifacts strays.** Its default allowlist omitted `intake.md` (scaffolded at the root by `init-project.sh`) and `triage.md` (owed at exactly that path by `artifact-manifest.tsv`), so every scaffolded project failed it from Stage 0 on; and `mxcli init`'s generated CLAUDE.md tells agents to "Append to `FINDINGS.md`" at the root while this check refused that file. All three are now on the default allowlist. Field run (read-only, the field project root): `✗ Stray docs in project root: intake.md triage.md` exit 1 before, `✓ Project root clean` after. No fixture covers this script — card-disbursement requirements-driven build (FINDINGS T-3)
+- fix(bin/lib/closeout.sh): **the close-out block and the "In plain words" paragraph now honour the manifest's entry-mode column, as `artifact-check.sh` already did.** A requirements-driven Stage 0 PASS said "still missing for this stage: app-report" and the close-out listed `app-report` as ⬜ PENDING with its producer, though that row is owed only by existing-app-change and the artifact check on the same run called it N/A. The artifacts list now shows such a row as `⏭ N/A: entry mode <mode> does not owe it`; the missing list and the next stage's opt-in offers skip it; an unknown mode still owes every row. Field run: the field project's register, intake and triage copied to scratch — `mxtk_plain_verdict 0` printed "still missing for this stage: app-report" before, "Nothing is holding it." after. `tests/wave2/test-closeout.sh` gains T9 — card-disbursement requirements-driven build (FINDINGS T-2)
+- fix(project-bin/model-stamp.sh, _common.sh): **the model-verification pre-commit hook no longer refuses every commit on a project with no model yet, and no longer waves an unverified model through from a `git worktree` or `git --git-dir=…` on a two-tree checkout.** (1) `check` ended on `find_mpr`'s "no .mpr found", so a requirements-driven project could not commit its Stage P intake without `MODEL_UNVERIFIED_OK=1` on every commit (T-1); `check` now passes when no `.mpr` exists at the root or under `app/` and no `*.mpr`/`mprcontents/` path is staged — a staged model with no `.mpr`, and two `.mpr` files, still refuse. (2) With `GIT_DIR` exported (a worktree commit exports the absolute `.git/worktrees/<name>`; `--git-dir` a relative one), `git -C app` treated `app/` as the work-tree top, the pathspecs matched nothing, and `check --staged` reported "no model files staged" — the script now pins `GIT_WORK_TREE`/`GIT_DIR`/`GIT_INDEX_FILE` to absolute paths first. (3) `_common.sh`'s root resolution (tiers 2/3) now probes `app/*.mpr` like `find_mpr`, so a two-tree checkout with no root `.mpr` stops at the project instead of climbing to the first stray `.mpr` in an ancestor directory. Field run: on the two-tree field project, `model-stamp.sh paths` with `GIT_DIR` exported returned `<Model>.mpr mprcontents` (old) vs `app/<Model>.mpr app/mprcontents` (new); a scratch probe of plain / `--git-dir` / `GIT_DIR` / worktree commits, single-tree and two-tree, refuses every unverified model and accepts the verified one (old: `--git-dir` and worktree accepted unverified, worktree refused verified); a pre-model repo commits its intake (old: refused). `tests/wave2/test-model-stamp.sh` gains T9/T10 — card-disbursement requirements-driven build (FINDINGS T-1)
+- new(bug-logs): **BUG-141, workflow condition outcomes are written without a `PersistentId`, so every instance paused after a branch point turns `Incompatible` on the next deploy — including a restart with no model change.** mxcli's `conditionOutcomeToGen()` gives no persistent ID to Boolean, enumeration or void outcomes (a `DECISION`, or a call-microflow task with outcomes). Activities and user-task outcomes do get one. The runtime therefore re-identifies those outcomes on every load, and any instance that already took one fails with "A selected outcome has been replaced in the already executed path". Every static rung is clean, and so is every journey that stays inside one deploy. Field evidence (mxcli v0.24.0, still on upstream `main` 9509176; Mendix 11.13.0): three live reproductions (a no-change restart, an unrelated-page redeploy, a one-line page redeploy), a BSON dump showing the ID missing only on condition outcomes, and the runtime metamodel's `ModelBooleanConditionOutcome(…, persistentId, …)` constructor. Upstream fix: one `addFreshPersistentID(g)` per case. The paste-ready issue is `bug-logs/pending-github-issues/bug141-condition-outcome-no-persistent-id.md`, not yet filed. No MDL workaround: the app's workflow admin must handle `Incompatible` instances until upstream ships it — card-disbursement requirements-driven build (build-plan row 6.12)
+- learn(skills/learned-detection-gaps.md): **new row: a workflow branch point is green on rungs 1–4, lint and every live run inside one deploy, and is caught only by a live run across a restart.** The row gives the one-instance restart probe, and notes that the defect sits between two deploys, which no single rung can see (BUG-141) — card-disbursement requirements-driven build
+- fix(project-tests/e2e/helpers.js): **`logout()` now actually ends the session on Mendix 11.** It read the CSRF token from `mx.session.getCSRFToken()`, which Mendix 11 does not have, so it posted the xas `logout` action with an empty token. The server still answers 200 `{}` to that and keeps the session, so every journey (the runner calls `H.logout` at the end of a walk) and every probe that "logged out" held a session until the timeout. On a trial licence the session cap then refuses the next sign-in ("Maximum number of sessions exceeded"), which reads as a broken login rather than a leak. The token now falls back to `mx.session.sessionData.csrftoken`, and a missing token returns `false` instead of posting. Field run (mxcli v0.24.0, Mendix 11.13.0): 13 sessions had leaked from runs that all "logged out"; after the fix, `System.Session` per role read 1 before sign-in, 2 while signed in and 1 after logout for three roles, where before it grew by one per run. No new fixture: the call runs in the browser, and the session count above is its red/green. New inbox note `contrib/inbox/2026-09-26-review-report-multi-ledger-coverage.md`: `review-report.js` cannot parse `coverage-check-all.sh`'s one-line-per-BRD output, so every multi-ledger module carries a permanent coverage FAULT over a clean count — card-disbursement requirements-driven build (build-plan row 5.7)
+- fix(project-tests/e2e/journey-runner.js): **a `click` on a covered widget now fails and names the cover, instead of reading as done.** The click is forced (`{force: true}`), which skips Playwright's actionability check, so whatever sits on top receives it. On the field project a success toast at the top right lay over the next page's header actions, the journey's Check now landed on the toast, and the loss surfaced two steps later as a missing data row. Before the forced click the runner now hit-tests the widget's centre with `elementFromPoint`, up to 5 × 250 ms so an animating overlay can clear. If the point still belongs to something else, the action throws `.mx-name-<w> is covered by .<class>`. Field run (mxcli v0.24.0, Mendix 11.13.0), a 3-step journey that opens a popup and then clicks a page button behind it: the previous runner scored it 4 PASS 0 FAIL, this one fails step 3 with `covered by .mx-underlay`. In the same project the identical block ran 71 + 30 + 14 checks across three role journeys with no false cover. No new fixture: the check runs in the browser, and the field run above is its red/green. New inbox note `contrib/inbox/2026-09-26-run-local-scheduled-events-off.md`: `run --local` starts with scheduled events off, and proof needs `--runtime-setting ScheduledEventExecution=ALL` — card-disbursement requirements-driven build (build-plan row 5.6)
+- fix(project-tests/e2e/journey-runner.js): **two positive-control mutants no longer report a working assertion as unproven.** The `outcome` mutant only broke an `atLeast` floor, so a journey whose outcome declares an exact `expect` (the stronger claim) had the rung reported UNPROVEN ("declares nothing this mutant can break"). An exact `expect` is now mutated to 999999 too. The `data-target` mutant wrote a text sentinel into `mustPointAt`; on a numeric key (Long/Integer) that is an OQL error, so the targeted check read INVALID instead of FAIL and the rung could never be proven. A numeric value now gets the numeric sentinel `-424242`. `skills/journey-proof.md`'s mutant table says both. Field runs (mxcli v0.24.0, Mendix 11.13.0): Integration `--positive-control` 5 → 6 of 7 rungs, `outcome` caught by the journey's `expect: 2` end-state check (the seventh, data-target, is unproven because that journey declares no `mustPointAt`); MockServices data-target INVALID → caught on a Long package key. No new fixture: the mutant builder is not exported, and the existing `test-journey-control-exit.sh` reads only verdicts, which this does not change — card-disbursement requirements-driven build (build-plan rows 3.8 and 4.8)
+- fix(project-tests/e2e/journey-runner.js): **a `--positive-control` run now exits 0 when every rung's mutant was caught.** The walk's exit rule — exit 1 on any FAIL or INVALID row — was applied to the control run too. But a control's FAIL rows are its mutants being caught, so a control that proved 7 of 7 rungs exited 1, `verify-module.sh` graded the rung FINDING, and the module read INCOMPLETE on every run: a rung that could not go green, and so said nothing when it went red. `runExitCode()` keeps the walk's rule. A control now passes only when every `control` row is PASS, proven equals expected, and at least one rung ran. The summary now prints a `control verdict:` line that says which rows are the mutants'. Field run: MockServices `--positive-control` exited 0 with `control verdict: PASS`, 7 of 7 rungs (PASS 468, FAIL 7, INVALID 1 — unchanged, now read correctly). New fixture `tests/wave2/test-journey-control-exit.sh` over that run's captured findings (`fixtures/journey-control/`): 7 assertions, 7 green on the fix, red against the previous runner (no `runExitCode`) — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-tests/e2e/monkey.js): **a round that leaves the app is no longer scored as an app crash, and the monkey no longer signs itself out.** A `backAfterSubmit` round clicked a control that pushes no history entry (a theme toggle), so Back left the app for `login.html` and then `about:blank`. The oracle scored each of those pages "blank page", every later round on the target scored the same page again, and the next target was never reached. Now, when Back leaves the app, the round returns with Forward and says so. Buttons labelled sign out / log off are no longer clicked. A round that leaves no page behind re-lands on its target, or reports `lost` with the number of rounds left unfuzzed. Requiring the file no longer runs main, and it exports `leftApp` / `SIGN_OUT`. Field run (seed 410855898, 2 targets): 13 observations with 10 crash-class and one target never reached → 26 observations, 0 crash-class, both targets fuzzed. New fixture `tests/wave2/test-monkey-left-app.sh` over the URLs and labels captured in that run: 11 assertions, 11 green on the fix, red against the previous monkey (no exports; it ran main on require) — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-bin/conformance-check.sh): **a module built after the first conformance run is now regression-guarded, and `--update-baseline --module X` no longer wipes the other modules' baseline rows.** The baseline is written by the first run. A row it had never seen was compared with "", so it could never regress — silently and permanently for every module built later. That project's committed baseline held 1 of its 4 modules (127 of 246 rows). Separately, `--module` scoped the measurement but not the write, so a scoped `--update-baseline` replaced the whole file with one module's rows. Rows with no baseline line are now baselined when first seen, and the run prints `newly baselined N`. A `--module` rewrite keeps every other module's rows. An unscoped `--update-baseline` still rewrites the whole file. New fixture `tests/wave2/test-conformance-baseline-scope.sh` (stubbed mxcli; the assertions are about the baseline file, not the DESCRIBE parser): 7 assertions, 7 green on the fix, 5 red against the previous script. Field run on that project (mxcli v0.24.0, 4 modules, 291 ledger rows): from its committed 127-row baseline, a plain run measured 246 OK and printed `newly baselined 119`, leaving a 246-row baseline. `--module MockServices --update-baseline` then rewrote only that module's 39 rows and kept the other 207 — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-tests/e2e/otel.js, journey-runner.js): **rung 2 now waits for the claimed microflow spans, not just the first span of any kind.** Before, `capture(t0, { min: 1 })` stopped at the first poll that held any span. The batch exporter routinely flushes a step's HTTP/xas spans before its microflow spans, so `spans.ordered` claims failed "actual (none)" over sequences Jaeger held a second later. `capture()` now takes `until(spans)`, and rung 2 passes "every claimed microflow is present". A claim that never holds still fails, after the normal retry window. Field run (Mendix 11.13.0 → Jaeger v1.76 over OTLP, 6 ordered claims, 3 of them with `mustNotFire`): 2 of 6 red before the fix, the same journey 79/0/0 after, and `--positive-control` 7 of 7 rungs proven (trace-order and trace-negative were UNPROVEN before, because no journey declared a span claim). New fixture `tests/wave2/test-otel-capture-until.sh` over a real Jaeger `/api/traces` capture: 4 assertions, 4 green on the fix, 3 red against the previous code — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-tests/e2e/report-normalize.js): **the report now reads its inputs and writes `docs/report.json` in the two-tree layout (model under `app/`).** Every input resolved against project.config's ROOT, which is `app/` there, so `verify-module.sh`'s report step marked 8 of 9 instruments FAULT ("design-audit.json does not exist", "no coverage-ledger.md under architecture/modules/*/") over files that were on disk, and wrote the report into a stray `app/docs/report.json`, which left the render step with nothing to render. Inputs now try ROOT first (the `.mpr`, `deployment/model/*` and `.mxcli/catalog.db` live there), then the repo root; outputs go to the repo root. This is the same fix as `project.config.js` `designPath()` and design-audit's `nearRoot()` (F-042). `JOURNEY_DIR` is now honoured and re-expressed relative to the project, so reproduce commands carry no machine path. `meta.projectId` uses the config's `id`, not `basename(ROOT)`, which was `app`. Field run (Mendix 11.13.0, 4 modules): 0 → 205 checks read, instrument FAULTs 8 → 2, and those 2 are real (no deferrals or run-ledger file). The report is back at the repo root. New fixture `tests/wave2/test-report-normalize-two-tree.sh` (two-tree plus a single-tree regression): 8 assertions, 8 green on the fix, 6 red against the previous script. `--selftest` fails identically before and after (it expects a `mobile-fieldscan` walkthrough the template config does not declare); it was not touched here — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-tests/e2e/design-audit.js): **rung 7 (a11y, overflow, structure) now finds the menu route of every page that has an icon.** The navigation parser anchored on `;` straight after the page name, but real `describe navigation` output puts `icon <ref>` there (and before a group's `(`), so no item with an icon was routed and every page reported FAULT "no navigation route — this check never ran". Parsing is now `parseNavigation(txt)`, matching up to the terminator. Field run (mxcli v0.24.0, Mendix 11.13.0): routed pages 0 → 4 of 4 menu pages; rung 7 measured 4 of 7 in-scope pages instead of 0, and immediately found color-contrast, missing landmarks and an aria-required-children critical that had been invisible. The other 3 are NewEdit pages opened from another page, still FAULT by design. New fixture `tests/wave2/test-design-audit-nav-map.sh` over a verbatim capture: 6 assertions, 6 green on the fix, 5 red against the previous regexes — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-tests/e2e/design-audit.js): **the defined-class corpus now reads rules nested in `@media` / `@supports` / `@layer`, not just depth 0.** Before, `classesInCss` harvested selectors only at brace depth 0. Atlas emits `spacing-outer-bottom-large` only inside three breakpoint `@media` blocks, so rungs 6-7 called it `invented-class` / `unmatched-class` on every page that used it — the class `skills/design-spacing.md` prescribes for section rhythm — and the run ended INSTRUMENT FAULT. The harvester now strips comments and string literals, then takes the selector prelude before every `{` that is not an at-rule. Field run on a real mxbuild `theme.compiled.css` (Mendix 11.13.0, Atlas): corpus 2768 → 3349 classes, the spacing class now present. New fixture `tests/wave2/test-design-audit-css-corpus.sh` over a verbatim capture of that stylesheet (`@media`, `@supports`, `@font-face` url, `@keyframes`): 7 assertions, 7 green on the fix, 4 red against the previous script — card-disbursement requirements-driven build (build-plan row 3.9)
+- fix(project-bin/coverage-preflight.sh): **LEVEL 1 now finds the per-BRD ledger directory `architecture/modules/<Module>/coverage-ledger/<BRDID>.md` and measures each BRD against its own file.** Before, discovery tested for files only: a module that splits its ledger per BRD (the `coverage-check-all.sh` convention) keeps `coverage-ledger.md` beside the directory as an index, so the preflight found the index and ran every BRD in the project against it — `verify-module.sh`'s coverage rung read 9 of 9 BRDs UNCLAIMED (2,300+ leaves) for a module that owns one, while `coverage-check-all.sh` reported all 9 clean from the same files. The directory now wins over the file beside it; the run states its denominator ("1 of 9 BRD(s) measured", the rest named as another module's), a ledger file named after no BRD faults, a directory matching no BRD faults instead of reading clean, and an empty directory falls through to the file shapes. Field run on all 4 modules of that project: 9 of 9 BRDs measured once each, all clean. Fixture `tests/wave2/test-coverage-preflight-ledger-dir.sh`, 10 assertions, 7 of them red against the previous script — a card-disbursement requirements-driven build (build-plan row 3.9)
+- process(contrib): **`learned-mdl-preflight.md` row 12 is outdated on mxcli v0.24 — queued in `contrib/inbox/`.** A dynamictext's ContentParams builds only with a bare attribute or a quoted literal: `toString(Attr)` (the row's own fix) and `if … then … else` both fail CE1613 at mxbuild, and `check --references` refuses the first but passes the second. Five-form probe on mx check 11.13.0 — card-disbursement requirements-driven build (gallery row 2.14a)
 - log(bug-logs/mxcli-bugs.md, bug-logs/pending-github-issues/marketplace-install-not-grouped-in-studio-pro.md, bug-logs/submitted-prs/mxcli/2026-09-28-marketplace-install-fromappstore/, skills/learned-mdl-preflight.md row 27): **a module installed by `mxcli marketplace install` shows up in Studio Pro among the app's own modules, not under "Marketplace modules".** The installer stamps 3 of the 5 marketplace identity fields on the module (`AppStoreVersionGuid` and `AppStorePackageIdString` stay empty) and `--file` stamps none; Studio Pro reads all five. Measured on a fresh Mendix 11.13.0 probe (`--file`: `FromAppStore` false, four empty strings) against a real project's Studio Pro-installed Encryption module (all five set). Ledger entry, paste-ready issue draft (NOT YET FILED), a fix patch for upstream on `main` 95091765 (content id threaded into the stamp, all five fields written, 3 unit tests, marketplace + cmd packages green; Studio Pro regrouping not yet proven), preflight STOP row 27 (install by content id, then read the `SHOW MODULES` Source column) and a fifth trap on the #879 entry. — Maurits Visser, field report 2026-09-28
 - fix(tests/wave2/test-mxbuild-version-match.sh): **master CI had been red since 2026-09-28 on one check-portability violation** — the test probed `python3`/`python` by name; it now sources `bin/lib/portable.sh` and uses `resolve_py`, keeping its SKIP when no Python 3 with sqlite3 is found. check-portability: 1 violation -> clean (164 files). The test's own PASS=15 FAIL=3 on a Mac with a Studio Pro 11.12.2 Beta in /Applications is unchanged by this and is a fixture-isolation gap (find_mxbuild sees the real /Applications), not a regression.
 - process(privacy): scrubbed a customer name and an internal project name that reached master through GitHub-merged PRs, where the pre-commit leak guard never runs (bin/check-no-client-data.sh: 32 files hit on master, 0 after). The customer is now "a customer" in prose and the placeholder `acme` in eval identifiers and grader patterns (the graders say to substitute the real prefix before regrading); the project is "a field project", and its inbox patch file is now `contrib/inbox/2026-09-27-field-project-patches.md`. Git history still holds the old text.
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index 4ac3734..c87d6c7 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -2690,7 +2690,9 @@ fi
 # the board shows the Sync/Drift FAIL rows, so it does not lie). Nothing overrides 2. A flag
 # must not be able to destroy a file this script did not write.
 INDEX="$PROJECT_DIR/index.html"
-PROJECT_NAME="$(basename "$PROJECT_DIR")"
+# Name the board after the resolved directory: `gate-check.sh . 2` from inside the project
+# titled it ". — Conversion Dashboard" (card-disbursement requirements-driven build, 2026-09-25).
+PROJECT_NAME="$(basename "$(cd "$PROJECT_DIR" 2>/dev/null && pwd -P || printf '%s' "$PROJECT_DIR")")"
 GC_SENTINEL="<!-- generated-by: mxcli-project-toolkit/bin/gate-check.sh -->"
 
 WRITE_HTML=1
diff --git a/bin/lib/closeout.sh b/bin/lib/closeout.sh
index 84c4b6e..9d1399e 100755
--- a/bin/lib/closeout.sh
+++ b/bin/lib/closeout.sh
@@ -201,6 +201,16 @@ _co_plain_gate_needs() {
     *) echo "" ;;
   esac
 }
+# _co_owed <manifest modes> <entry mode> — does this project's entry mode owe the row? The same
+# test as artifact-check.sh's second pass, and the same rule: an unknown mode (young register, no
+# `Entry mode:` line yet) owes every row — louder, never quieter.
+#
+# WHY (2026-09-25, card-disbursement requirements-driven build). The three manifest loops below
+# ignored the modes column, so a requirements-driven Stage 0 PASS still said "still missing for
+# this stage: app-report" — a row only existing-app-change owes, which artifact-check.sh itself
+# reported as N/A on the same run.
+_co_owed() { [ -z "$2" ] && return 0; case ",$1," in *",$2,"*) return 0 ;; esac; return 1; }
+
 # mxtk_plain_verdict <stage> <verdict text> <project-dir> [register]
 # The "In plain words" paragraph under a gate line: status first, then every reason the
 # technical text carries that has a known plain translation, then what is still missing on
@@ -244,11 +254,13 @@ mxtk_plain_verdict() {
   case "$low" in *"unanswered"*|*"no blanks"*|*"blank"*)
     _co_say "a kickoff question is still blank" ;; esac
   # Missing mandatory artifacts for this stage, in plain names.
-  local id stage paths producer consumers modes absence miss=""
+  local id stage paths producer consumers modes absence miss="" mode
+  mode="$(_art_entry_mode "$reg" 2>/dev/null || true)"
   if [ -f "$ARTIFACT_TSV" ]; then
     while IFS=$'\t' read -r id stage paths producer consumers modes absence; do
       case "$id" in ''|'#'*|artifact) continue ;; esac
       [ "$stage" = "$st" ] && [ "$absence" != "optin" ] || continue
+      _co_owed "$modes" "$mode" || continue
       _art_waiver "$reg" "$id" "$stage" >/dev/null 2>&1 && continue
       _art_find "$root" "$paths"
       [ -z "$ART_HIT" ] && miss="$miss${miss:+; }$(_co_plain_artifact "$id")"
@@ -274,11 +286,16 @@ mxtk_closeout_report() {
 
   # ── Artifacts produced ──────────────────────────────────────────────────
   printf '**Artifacts produced** (rows of `bin/lib/artifact-manifest.tsv` for stage %s; presence only, never quality)\n' "$st"
-  local id stage paths producer consumers modes absence reason n_art=0 optin
+  local id stage paths producer consumers modes absence reason n_art=0 optin mode
+  mode="$(_art_entry_mode "$reg" 2>/dev/null || true)"
   if [ -f "$ARTIFACT_TSV" ]; then
     while IFS=$'\t' read -r id stage paths producer consumers modes absence; do
       case "$id" in ''|'#'*|artifact) continue ;; esac
       [ "$stage" = "$st" ] || continue
+      if ! _co_owed "$modes" "$mode"; then
+        [ "$absence" = "optin" ] || printf -- '- ⏭ `%s` — N/A: entry mode %s does not owe it\n' "$id" "$mode"
+        continue
+      fi
       optin=""
       if [ "$absence" = "optin" ]; then
         optin="$(_art_field "$reg" "opt-in artifact $id" 2>/dev/null || true)"
@@ -418,6 +435,7 @@ mxtk_closeout_report() {
     while IFS=$'\t' read -r id stage paths producer consumers modes absence; do
       case "$id" in ''|'#'*|artifact) continue ;; esac
       [ "$stage" = "$next" ] && [ "$absence" = "optin" ] || continue
+      _co_owed "$modes" "$mode" || continue
       n_opt=$((n_opt+1))
       optin="$(_art_field "$reg" "opt-in artifact $id" 2>/dev/null || true)"
       if [ -n "$optin" ]; then
diff --git a/bin/lib/images-to-md.py b/bin/lib/images-to-md.py
index ebf24c2..0b194ac 100644
--- a/bin/lib/images-to-md.py
+++ b/bin/lib/images-to-md.py
@@ -564,6 +564,11 @@ def main(argv):
     def rel_project(p):
         return os.path.relpath(p, project).replace(os.sep, '/')
 
+    # A --out run must be re-checked with the same --out, or --check reads the default root.
+    default_out = os.path.join(project, 'analysis', 'knowledge-base', 'images')
+    out_flag = '' if os.path.normpath(images_out) == os.path.normpath(default_out) \
+        else ' --out %s' % rel_project(images_out)
+
     manifest_path = os.path.join(images_out, 'manifest.json')
     sha_to_id = {} if force else load_old_manifest(manifest_path)
     used_numbers = set(int(v.split('-')[1]) for v in sha_to_id.values())
@@ -756,8 +761,9 @@ def ingest(occ):
     print('  worklist: %s' % rel_project(worklist_path))
     print('Images to describe: %d%s' % (
         n_content,
-        (' — write analysis/knowledge-base/images/<id>.md per the template in '
-         'skills/image-transcription.md, then: bin/images-to-md.sh <p> --check') if n_content else ''))
+        (' — write %s/<id>.md per the template in '
+         'skills/image-transcription.md, then: bin/images-to-md.sh <p>%s --check'
+         % (rel_project(images_out), out_flag)) if n_content else ''))
 
     if do_check or do_inline:
         return run_check(project, images_out, entries, order, do_inline=(do_inline or do_check))
@@ -804,12 +810,16 @@ def run_check(project, images_out, entries, order, do_inline):
     for sha, ent in content:
         for loc in ent.locations:
             owners.setdefault(loc['source'], set()).add(ent.id)
+    # The --artifact path is the manifest this run actually wrote — under --out when one was
+    # given. It used to be the default root, hard-coded, so a `--out` run printed ledger marks
+    # citing a manifest that did not exist (2026-09-25, card-disbursement requirements-driven build).
+    rel_manifest = os.path.relpath(os.path.join(images_out, 'manifest.json'), project).replace(os.sep, '/')
     if owners:
         print('')
         print('  Coverage complete. Ledger marks owed, per source file:')
         for owner in sorted(owners):
-            print('    bin/source-ledger.sh mark <p> \'%s\' --artifact analysis/knowledge-base/images/manifest.json '
-                  '--evidence "<fill in>" --media %d --by <who>' % (owner, len(owners[owner])))
+            print('    bin/source-ledger.sh mark <p> \'%s\' --artifact %s '
+                  '--evidence "<fill in>" --media %d --by <who>' % (owner, rel_manifest, len(owners[owner])))
     return 0
 
 
diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md
index defa14c..0e8db79 100644
--- a/bug-logs/mxcli-bugs.md
+++ b/bug-logs/mxcli-bugs.md
@@ -196,6 +196,20 @@ The old widget (and its name) is dropped; the new widget takes its place in the
 
 **Discovered:** 2026-05-21, an OS 11 reference migration script 34 (fixing CE0720 on lblHdrAction).
 
+### Retest on v0.24.0 (2026-09-27) — still open, and wider than above
+
+Found on a card-disbursement requirements-driven build (Mendix 11.13.0), `alter page` and
+`alter layout`. The whole replacement subtree is built while the old widget and **its children**
+still hold their names, so renaming only the replaced widget does not help: any **child** name the
+replacement reuses collides. The natural case, the same grid with one column added, fails on
+`duplicate widget name txtSearchGlyph` (a glyph nested in the grid). A script that ran once
+therefore fails on its second run, so a `REPLACE` hook in a re-runnable script is never safe.
+
+**Workaround that re-runs:** `drop widget X;` then `insert into <parent> { … }` (or `insert after
+<sibling>`) in the same `alter page`, anchored on a widget the owning script never renames. It
+passed `mx check` and ran twice on a probe and twice on the model. A grid whose `DATABASE` source
+changes goes the same route (`SET DataSource` cannot write that form, see BUG-11).
+
 ---
 
 ## BUG-09: Gallery `filter {}` block cannot express association-path filter attributes
@@ -792,6 +806,8 @@ Then restart SP.
 
 **RESOLVED (v0.21.0) — retested and archived 2026-09-14, see [archive-resolved-2026-09-14.md](archive-resolved-2026-09-14.md) and [mxlabs-v0.21.0-retest-2026-09-14.md](mxlabs-v0.21.0-retest-2026-09-14.md).**
 
+**v0.24.0: see BUG-142** — the `toString(Attr)` form this entry's fix taught no longer builds; only a bare attribute or a quoted literal does.
+
 ---
 
 ## `marketplace install` fails on modules that ship `themesource/` styling (exit 112, "Importing theme module is not supported")
@@ -2695,6 +2711,8 @@ before touching the live one.
 
 ## BUG-76: `DECISION` activities in a native `WORKFLOW` are unconditionally storage-corrupted — mxcli writes the outcome label as a raw string into a field that must be a real `EnumerationValueIdentifier`, on every DECISION regardless of the underlying expression's type
 
+> **RETESTED on v0.24.0 / Mendix 11.13.0, 2026-09-26 (a card-disbursement requirements-driven build) — the entry has split in two.** (1) **Enum half: guarded, not fixed.** A `DECISION` on an enumeration attribute with bare outcome labels is now refused before the write by `MDL-WF03` ("decision outcome '…' is not fully qualified"); `exec` refuses too. Forced with `exec --no-check` it still writes the unloadable model — native `mx check` rc 1, `StorageLoadException`. (2) **Boolean half: clean for the keyword form.** `decision N '$WorkflowContext/Attr = ''X''' outcomes true -> { … } false -> { };` passes `check --references`, `exec` and native `mx check` at 0 errors, and `DESCRIBE WORKFLOW` reads the expression and both arms back. **Not re-run on v0.24.0:** the string-labelled `decision '1 = 1' outcomes 'OutcomeA' … 'OutcomeB'` repro below — keep the STOP rule for that shape until someone runs it. Skills updated: `learned-workflow-patterns.md` §8, `workflow-structure-rules.md` §11.
+
 > **CONFIRMED STILL OPEN on v0.21.0 — CRITICAL, verified 2026-09-14 with the byte-exact original signature: `StorageLoadException … The text 'OutcomeA' is not a valid EnumerationValueIdentifier`, project unloadable by mxbuild. Keep the STOP rule: no DECISION activities in CREATE WORKFLOW via mxcli.** See [mxlabs-v0.21.0-retest-2026-09-14.md](mxlabs-v0.21.0-retest-2026-09-14.md).
 
 > **CONFIRMED STILL OPEN on v0.20.0 — CRITICAL, verified 2026-08-31 with the byte-exact original signature: `StorageLoadException … The text 'OutcomeA' is not a valid EnumerationValueIdentifier`, project unloadable by mxbuild. Keep the STOP rule: no DECISION activities in CREATE WORKFLOW via mxcli.** See [mxlabs-v0.20.0-retest-2026-08-31.md](mxlabs-v0.20.0-retest-2026-08-31.md).
@@ -2838,6 +2856,16 @@ spelling; (2) give `DECISION` an expression clause.
 
 **NOT REPRODUCED (mxcli v0.21.0) — retested and archived 2026-09-14, see [archive-resolved-2026-09-14.md](archive-resolved-2026-09-14.md) and [mxlabs-v0.21.0-retest-2026-09-14.md](mxlabs-v0.21.0-retest-2026-09-14.md).**
 
+> **REPRODUCED on v0.24.0 (2026-09-26), with one trigger isolated.** A card-disbursement
+> requirements-driven build (Mendix 11.13.0) hit CE0117 at mxbuild, `check` green, twice. (1) A
+> quoted member in an expression, `$Req/"ClientId"`: CE0117 "the '"<Attr>' part is incomplete",
+> the quote surviving into the expression text; unquoted it built. (2) A `change $X ( … )` whose **closing paren stood on a line of
+> its own**: only the **last** assignment kept its quoted names verbatim, every other assignment in
+> the statement was stored clean, and moving the paren up onto the last assignment's line built at
+> 0 errors. Line layout alone explains this entry's "two of three activities failed" and the clean
+> v0.21.0 blank-app probe, though only the change form was isolated. The rule stands: never quote a
+> segment of `$Var/Attr`, in any statement.
+
 ## BUG-78: CE0161 on a reference-set-to-string-literal retrieve WHERE clause (`where [Assoc = 'Value']`) — fixed by comparing the association to a retrieved object instead
 
 **Project:** PROJECT-A, script 64 (`Approval.ACT_ApprovalWorkflow_TargetEngineering`, same Phase
@@ -3072,6 +3100,15 @@ refuses elsewhere.
 
 > **NOT RETESTED this round (v0.21.0, 2026-09-14) — the multi-trap repro (customContent-column anchor, empty-caption drop, then a 5-retry sequence to expose orphaned duplicates via native mxbuild CE0495) needs more fixture-building time than this round had.** See [mxlabs-v0.21.0-retest-2026-09-14.md](mxlabs-v0.21.0-retest-2026-09-14.md).
 
+> **v0.24.0 (2026-09-27): a wrong column name now fails loudly and names the rule (Trap 1's
+> addressing half).** On a card-disbursement requirements-driven build (Mendix 11.13.0),
+> `alter page … on colCase` against a Data grid 2 column was refused with: *"widget "colCase" not
+> found. DataGrid2 columns are addressed by a derived name (the bound attribute, or the caption),
+> not the name written in MDL — available columns: Case, Client, Package___channel, State,
+> Deadline, Updated (run DESCRIBE PAGE to confirm)"*. Spaces and slashes in a caption become `_`
+> runs (`Package / channel` → `Package___channel`). Address the column by a name from that list.
+> Traps 2 and 3 were not retested.
+
 **Severity:** High — the actually-costly failure mode is not the no-op itself but that repeated
 retries against it leave orphaned duplicate widgets invisible to `DESCRIBE PAGE`, which native
 `mx check` then rejects
@@ -3746,6 +3783,8 @@ free-text outcomes are unaffected; only the enumeration path is wrong.
 
 ## BUG-109: `JUMP TO` inside a boundary-event body writes a Jump with no Target, named after its own target
 
+> **NO LONGER REPRODUCES on v0.24.0 / Mendix 11.13.0 — retested 2026-09-26 (a card-disbursement requirements-driven build).** An **interrupting** boundary timer whose body calls a microflow and then does `jump to <earlier activity>;` passes `check --references`, `exec` and native `mx check` at 0 errors, and `DESCRIBE WORKFLOW` reads back a real jump to that activity — not a jump named after it. The same boundary ending in `end workflow comment '…';` also builds clean. Upstream `825873d6` (in v0.21.0) fixed the jump-named-after-its-target defect (`learned-workflow-patterns.md` §25); v0.21.0–v0.23.x were not retested for this shape. The dangling-target half (#1005) is a separate shape and was not part of this retest. Skills updated: `workflow-structure-rules.md` §11, `learned-workflow-patterns.md` §19.
+
 **Severity:** High — the only legal terminator for an interrupting boundary event is unusable
 **mxcli version:** v0.20.0 (2026-08-28)
 **Mendix version:** 11.14.0
@@ -4326,6 +4365,21 @@ working copies) is additionally needed, and only for SDK-driven model edits.
 
 > **STILL OPEN (narrowed) on v0.21.0 — verified 2026-09-14: v0.21.0 fixed only the two properties this ledger's own upstream note named (`editable`/`contentparams` — MDL-WIDGET20/21). The general case is unfixed: a LISTVIEW with `PageSize: 1, Pagination: buttons, PagingPosition: bottom` still drops `Pagination`/`PagingPosition` silently — only `PageSize` (a real LISTVIEW property) survives `DESCRIBE PAGE`, with no MDL-WIDGET07 warning at check time.** See [mxlabs-v0.21.0-retest-2026-09-14.md](mxlabs-v0.21.0-retest-2026-09-14.md).
 
+> **v0.24.0 field instances (2026-09-26, a card-disbursement requirements-driven build, Mendix
+> 11.13.0).** Accepted by `check` and `exec`, absent after the write:
+> - pluggable **Gallery** `ShowPagingButtons: 'auto'` (the key as `describe` prints it) — the
+>   widget's BSON still says `always`, so an empty gallery draws "Currently showing 0 to 0 of 0"
+>   and four page buttons. Silent at every rung. The schema's camelCase key
+>   (`showPagingButtons: 'auto'`) passes `check` and then fails mxbuild with CE0463 "The
+>   definition of this widget has changed". Read the value back from the unit before believing it.
+> - **image** `imageIcon`, **text box** `ReadOnlyStyle: Text` (renders a disabled input instead),
+>   **combobox** `clearable: false` — these three at least raise lint **MDL-WIDGET06** after exec.
+>   An icon-only image widget cannot be written at all: without an image it is MDL-WIDGET22.
+>
+> Workarounds used: hide the empty gallery's footer from the theme
+> (`.widget-gallery:has(> .widget-gallery-empty) > .widget-gallery-footer`); read-only-as-text is a
+> label over a `form-control-static` text; the icon is a CSS mask on a class.
+
 **Severity:** High — a silent drop that passes `check --references`, `exec` AND native `mx check`; only the running app shows it
 **mxcli version:** a pre-v0.20.0 build (discovered 2026-08-25; v0.20.0 shipped 2026-08-28) — **NOT RETESTED on v0.20.0; retest before filing**
 **Discovered:** 2026-08-25, an exam-prep app project
@@ -5091,6 +5145,10 @@ never applied. A one-line property tweak therefore leaves a two-page script half
 
 **Also note:** `DESCRIBE PAGE` does not round-trip `PageSize` at all — the property is absent from
 the dump — so you cannot read the current value back out of the model to confirm what you set.
+Same on v0.24.0 for a **list view inside a snippet**: `describe snippet` omits `PageSize: 20`
+although the unit's BSON holds it (int32 20) and the page renders 11 of 11 items with no "Load
+more" (a card-disbursement requirements-driven build, 2026-09-25). Confirm from the unit or by
+counting rendered items.
 
 **Workaround:** re-emit the whole page with `create or modify page`, changing only the one value.
 That is what `87b` does, and why a two-value edit is a 190-line script.
@@ -5499,6 +5557,456 @@ and render it in `DESCRIBE MICROFLOW` so the round trip does not silently flip i
 callee's flag is readable in the model.
 ---
 
+## BUG-141: workflow condition outcomes are written without a `PersistentId` — every instance paused after a decision turns `Incompatible` on the next deploy, even one that changes nothing
+
+> **NOT YET FILED** — paste-ready draft in `bug-logs/pending-github-issues/bug141-condition-outcome-no-persistent-id.md`; the fix and its test, proven on a live restart, are in `bug-logs/pending-github-issues/bug141-fix.patch`.
+
+**Severity:** High for anything going live. It is silent on every static rung, and it strands
+real work in production: the in-flight instances stop and need an admin. It does not block a
+demo, because a demo stays inside one deploy.
+**mxcli version when found:** v0.24.0. Still open on upstream `main` at 9509176 (2026-09-26).
+**Mendix version:** 11.13.0
+**Discovered:** 2026-09-26, a card-disbursement requirements-driven build. The case workflow
+had two call-microflow tasks with outcomes (one Boolean, one enumeration) ahead of its user tasks.
+Both those and a workflow `DECISION` go through the same outcome writer.
+**Reproducible:** yes, three times in one day on the same model, with three different deploys
+(below).
+
+### Summary
+
+`conditionOutcomeToGen()` in `mdl/backend/modelsdk/workflow_write.go` writes
+`Workflows$BooleanConditionOutcome`, `Workflows$EnumerationValueConditionOutcome` and
+`Workflows$VoidConditionOutcome` with no `PersistentId`. The same file gives one to every
+activity, to `UserTaskOutcome` (`userTaskOutcomeToGen`) and to `ParallelSplitOutcome` through
+`addFreshPersistentID(g)`. The runtime's workflow metamodel builds
+`ModelBooleanConditionOutcome(id, value, persistentId, flow, container)`, so it needs one. With
+none stored, the outcome gets a new identity every time the model loads.
+
+A running instance records which outcome it took. After the next deploy that outcome no longer
+exists under the recorded identity, so the engine marks the instance **`Incompatible`**:
+*"A selected outcome has been replaced in the already executed path."* That hits every instance
+paused **after** a decision, which in most workflows is every instance waiting at a user task.
+
+### What it takes to see it
+
+Nothing on the static ladder sees it. `check --references`, `exec`, `DESCRIBE WORKFLOW`, lint,
+mxbuild and native `mx check` are all clean, and every journey passes, because a journey starts
+and finishes its instances inside one run. It shows only when an instance **outlives a
+restart**.
+
+### Evidence
+
+1. **Three live reproductions** (`mxcli run --local`, HSQLDB, Mendix 11.13.0). Each case was
+   started, left `InProgress` at the user task after the decision, and then:
+   - the app was **restarted with no model change at all** (workflow unit byte-identical). The
+     case came back `Incompatible`;
+   - a second case went through a redeploy that **changed only unrelated page documents**. It
+     came back `Incompatible`;
+   - a third went through a redeploy whose only change was **one date format on a dashboard page**. It came back
+     `Incompatible`.
+2. **The stored unit.** A BSON dump of the workflow document shows `PersistentId` on every
+   activity and on every `UserTaskOutcome`, and on **none** of the condition outcomes.
+3. **The runtime needs it.** `com.mendix.workflows-metamodel.jar` (11.13.0 runtime bundle)
+   constructs `ModelBooleanConditionOutcome(id, value, persistentId, flow, container)`.
+4. **The writer.** `workflow_write.go` on `main` 9509176: `conditionOutcomeToGen()` (line 649)
+   returns all three outcome elements without calling `addFreshPersistentID(g)`. Its neighbours
+   do call it: `userTaskOutcomeToGen` (line 639) and the `ParallelSplitOutcome` loop in
+   `parallelSplitToGen` (line 573). The helper is at line 778.
+
+### Fix (upstream)
+
+Add one line in each of the three cases, before `return g`:
+
+```go
+addFreshPersistentID(g)
+```
+
+`Workflows$BooleanConditionOutcome.PersistentID` is already declared in
+`generated/metamodel/types.go`, so no metamodel change is needed.
+
+**Patch proven, 2026-09-27.** The ready-to-apply commit, with a regression test, is
+`bug-logs/pending-github-issues/bug141-fix.patch` (`git am` on `main` 95091765). The test fails
+on all three outcome types without the fix and passes with it; the `modelsdk` and
+`modelsdk/canon` packages stay green. Field run, on the same card-disbursement model, with
+v0.24.0 plus the three lines:
+- **Stored unit:** condition outcomes carrying a `PersistentId` went from 0/30 to 30/30. Native
+  `mx check`: 0 errors.
+- **Runtime:** an instance paused at a user task after the decisions stayed `InProgress` across a
+  restart with no model change. The released binary turns the same instance `Incompatible`
+  (Evidence 1). After the restart it took its next REST call and ran to `Completed`
+  (`NewOpening` → `AccountsOpened` → `ContractPrinted`).
+
+**Re-running a workflow script does not re-mint IDs.** This was the open question; it is now
+measured. Upstream's `canon.CarryPersistentIDs` pairs the rewritten unit with the stored one and
+keeps the existing IDs. `create or replace workflow` with the patched binary kept all 54 IDs the
+released binary had written and added the 30 new ones. A second re-run kept 84/84. So adopting
+the fix costs one re-ID of the condition outcomes, on its first write: instances already past a
+decision at that deploy go `Incompatible` once. The IDs are stable from then on.
+
+### Workaround
+
+None in MDL. There is no syntax that sets a `PersistentId`. Do not hand-patch the unit either:
+that bypasses `exec.sh`'s gate, and the next `create or replace workflow` drops the patch. A
+project may build mxcli with `bug141-fix.patch` and write its workflow scripts with that binary,
+but only while no instances need to survive the one re-ID described above.
+
+Until upstream ships the fix, plan for it:
+- the app's workflow admin page lists **`Incompatible`** instances and gives an admin a way to
+  handle them (abort, restart, or move them on with a jump-to);
+- every screen that routes to an instance's task handles an instance that has no open task
+  (open the case, not a dead end);
+- a go-live plan either drains in-flight instances before each deploy or accepts the admin step.
+
+Detection-gap register: `skills/learned-detection-gaps.md` (the row that cites BUG-141).
+
+---
+
+## BUG-142: `ContentParams` on v0.24.0 — any value other than a bare attribute or a quoted literal is stored as an attribute path (CE1613 at mxbuild); `check` refuses the parenthesised forms and passes `if … then … else`
+
+**mxcli:** v0.24.0 (f18c307) · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-26, a card-disbursement requirements-driven build: twice on a list-view
+snippet, then again on a form's payload preview, each time `check` green and exec.sh's mxbuild
+gate red.
+**Reproducible:** yes. A five-form probe on a scratch copy of the model, `mx check`.
+**Supersedes the fix BUG-23 taught.** BUG-23's v0.21.0 retest covered only the `$currentObject/`
+prefix. The `toString(Attr)` form it prescribed now fails both check and mxbuild.
+
+| `ContentParams` value | `mxcli check --references` | mxbuild |
+|---|---|---|
+| `CaseRef` (bare attribute) | clean | clean |
+| `'literal'` | clean | clean |
+| `toString(CreditLimit)` | error: "looks like an expression, and MDL cannot author an expression-typed template parameter yet — an unquoted value is stored as an attribute" | CE1613 |
+| `toString($currentObject/CreditLimit)` | error (same) | CE1613 |
+| `if IsUrgent then 'x' else 'y'` | **clean** | CE1613 "The selected attribute '<Module>.<Entity>.ifIsUrgentthen'x'else'y'' no longer exists." |
+
+**Cause, from source.** `mdl/visitor/visitor_page_v3.go:1232` takes `expr.GetText()`, and ANTLR
+joins the tokens with no whitespace. Then `mdl/executor/cmd_pages_builder_v3_widgets.go:836-846`
+sends every unquoted value to `resolveTemplateAttributePathFull`. So no parameter is ever typed as
+an expression. The refusal in `check` is a heuristic that looks for a parenthesis. The one tell
+before mxbuild: `describe` prints the stored value with its spaces stripped.
+
+**A Boolean bound bare builds, but it renders the runtime's display text** ("Yes"/"No"), not
+`true`/`false`. So no single text can print a JSON boolean.
+
+**Workaround.** Make the per-row label data: a stored or derived String attribute, bound bare.
+Tone variants go in `DynamicClasses`, which does take an expression. For a literal boolean, use two
+texts holding `true` and `false`, each shown by visibility on the attribute. This is
+`learned-mdl-preflight.md` STOP row 12.
+
+---
+
+## BUG-143: `theme` tooling on v0.24.0 — the seeder reads class-scoped tokens, and the generated Atlas map leaves five things for a design port to fix by hand
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25, a card-disbursement requirements-driven build. Found at the
+StyleGallery LOOK by comparing computed styles pairwise with the design system.
+**Reproducible:** yes. Row 1 is an A/B seed on a scratch app. Rows 2–6 are reads of the
+generated `_mxcli-atlas-map.scss` plus computed-style probes.
+
+| # | Where | What happens | Workaround |
+|---|---|---|---|
+| 1 | `theme create --from <css>` | Reads `--mxt-*` declarations **anywhere** in the file, class-scoped blocks included (`.density-compact { --mxt-row-height: 34px }`), and the last one wins. A compact-density recipe reseeded the row height from 44px to 34px. With that line removed, the re-seed gave 44px and 0 mismatches over 71 tokens, light and dark. | Declare `--mxt-*` only in `:root {}` and `:root.theme-dark {}`. Recipes use Atlas variables or the design system's own prefix. |
+| 2 | Atlas map | `--topbar-bg` and `--topbar-border-color` are sent to the rail token, and there is no `--mxt-topbar`. A light topbar over a dark rail cannot be expressed through tokens. | Override the two Atlas variables in the project stylesheet. |
+| 3 | Atlas map, "Atlas fixups" block | Paints the topbar language selector with the rail's ink (`--mxt-rail-ink-active`) at specificity (0,3,0), assuming a dark topbar. On a light topbar it is white on white: `.current-language-text` computed `rgb(255,255,255)` on `#ffffff`. The rule sits inside the generated fence. | Override outside the fence at (0,4,0). |
+| 4 | Atlas map | Binds `--btn-primary-bg` to `--mxt-brand` but leaves `--btn-danger-bg` (and success/warning) on Atlas's derived shade. A Danger button rendered `#971b1f` against the token's `#b91c1c` while every token read correct. | Bind `--btn-<intent>-bg`, `-border-color` and `-bg-hover` to the token in all three scopes. |
+| 5 | map and recipes | No knob for button geometry. `.btn`, `.btn-sm` and `.btn-lg` stay Bootstrap 3: 40/34/45px tall, 12px text on sm, 3px radius. 9 of 9 gallery buttons differed from the wireframe, and 9 of 9 matched after porting. | Port `.btn`, `.btn.btn-sm` and `.btn.btn-lg` by hand. |
+| 6 | `theme switcher install` | Ships no execute grants, so the button renders disabled or hidden for a role that cannot run the nanoflow. Nothing re-applies the stored choice on page load, so a reload returns to the OS theme (the tool's own note says so). | Grant the nanoflows. Apply the stored choice from a pre-boot script in the theme's `index.html`. |
+
+**Upstream fix.** Seed only from the root and dark blocks. Derive the fixup ink from the topbar
+token. Bind every `--btn-<intent>-*` the map has a token for. Add a topbar token.
+
+---
+
+## BUG-144: `create user role` writes a role without `CheckSecurity`, `GUID` and three other keys — mxbuild then skips that role's security consistency check
+
+**mxcli:** v0.24.0 (`mdl/backend/modelsdk/security_write.go`, `AddUserRole`) · **Mendix:** 11.13.0 ·
+**Not filed upstream.**
+**Discovered:** 2026-09-25, a card-disbursement requirements-driven build.
+**Reproducible:** yes. BSON decode of the project security unit, comparing the template's
+`Administrator` with five mxcli-created roles, plus `SHOW USER ROLES` before and after a patch.
+
+A new user role is written with `$ID`, `$Type`, `Name`, `ModuleRoles` and `ManageAllRoles` only.
+Studio Pro also writes `CheckSecurity`, `GUID`, `Description`, `ManageableRoles` and
+`ManageUsersWithoutRoles`. The missing keys have three effects:
+
+1. `SHOW USER ROLES` reads "Check Security: No", and mxbuild skips the per-role consistency check.
+   A "role has no access" error cannot appear for any role mxcli created, so a clean build proves
+   less than it seems to.
+2. The role has no `GUID`, and the runtime keys `System.UserRole` on it.
+3. `drop` + `create` gives the role a new identity. A re-runnable script must use
+   `create or modify user role`.
+
+**Workaround used.** A post-exec fixup adds the missing keys, using `GUID = $ID` (mxcli's convention
+for elements it creates). It is idempotent and never touches a role that already has the keys.
+After it ran, mxbuild reported 0 errors, a second exec kept the patch, and sign-in was proven per
+role at runtime. A unit patch sits outside exec.sh's gate, so run the fixup's check after every
+exec that touches security. The fix belongs upstream in `AddUserRole`.
+
+---
+
+## BUG-145: entity-access `grant` merges into an existing rule, so a narrowing grant narrows nothing — and `(read *)` writes no member access for the audit system members
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25, a card-disbursement requirements-driven build.
+**Reproducible:** (a) yes, `SHOW SECURITY MATRIX` before and after. (b) yes, a BSON count of
+`MemberAccesses` per access rule against `SHOW ENTITIES`.
+
+**(a) Merge.** Start with a role that holds `(create, read *, write *)` on an entity. Running
+`grant R on M.E (read *)` leaves CREATE and WRITE in place: the matrix still reads CRW, and lint
+CONV006 stays raised. After `revoke R on M.E;` and the same grant, the matrix reads R. A
+re-runnable script that narrows access must revoke first. The safe pattern in
+`learned-mdl-preflight.md` STOP row 14 (revoke every role, then re-grant every role) already does
+this.
+
+**(b) System members.** `*` writes one member access for each user attribute and each owned
+association, and none for `Owner`, `ChangedBy`, `CreatedDate` or `ChangedDate`. mx check and
+mxbuild report 0 errors. **Unproven:** whether the runtime then denies a non-admin read of those
+members. Before binding one for a non-admin role, prove the read in that page's LOOK. If it is
+denied, grant the member explicitly and update this entry.
+
+---
+
+## BUG-146: `mxcli diff` reports false modifications on an already-applied script, and a multi-line doc comment can read as a dropped attribute
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25, a card-disbursement requirements-driven build, re-running `diff`
+right after a script's first exec.
+**Reproducible:** yes. The line diff, `SHOW STRUCTURE` and `DESCRIBE` after a second exec all show
+the model unchanged.
+
+`learned-mdl-preflight.md` STOP row 23 says to read the `-` lines of `diff --format struct` before
+every exec. On v0.24.0, the following show up on a model the script has already produced:
+
+- Every `String(unlimited)` attribute is shown as changed, because the script side prints plain
+  `String`.
+- An unchanged enumeration shows `~ Modified`, because the current side prints its name without
+  the module (`create enumeration .Kind`).
+- An entity whose only difference is a model-side `@Position` shows `~ Modified`.
+- The four audit system members print as `Unknown` on the script side, although exec writes them
+  correctly.
+- Grant statements are "not compared" at all.
+- **A `/** … */` entity doc comment whose second line has no leading ` * ` is parsed as an
+  attribute.** A script that dropped nothing showed `- Attribute Named X, not Y`, which is a false
+  STOP-23 alarm. The line diff and a post-exec `DESCRIBE` both listed every attribute.
+
+The real changes (two added validation rules) were in the same list. So: read the line diff
+(`diff` without `--format struct`) before trusting a `~ Modified`. Check every `- Attribute` name
+against `DESCRIBE ENTITY` before either trusting or dismissing it. Verify grants with
+`SHOW SECURITY MATRIX` after exec. Write doc comments on one line, or with ` * ` on every line.
+
+---
+
+## BUG-147: `check --references` and `exec` disagree about documents the same script creates — a forward `call microflow` passes check and half-applies at exec; an `ALTER PAGE` naming something created earlier in the script is refused before exec
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25 and 2026-09-26, a card-disbursement requirements-driven build. Each
+direction was hit three times.
+**Reproducible:** yes.
+
+**(a) A forward call passes check and fails part-way through exec.** Take a microflow that calls
+one defined **later** in the same script. `check --references` passes it. `exec` writes every
+statement before the caller, then refuses the caller with "defined later in this script — move
+its create statement before this one" or "microflow not found in the project". On one run the
+partial application then failed mxbuild with CE0117 ×8. exec.sh's snapshot restored the model; a
+bare `mxcli exec` leaves the partial model in place. **Rule: callees before callers, in every
+script.**
+
+**(b) An `ALTER PAGE` that names something the same script creates is refused before exec.**
+`check --references` resolves an `ALTER PAGE`'s target page, and the microflow or nanoflow behind
+a re-pointed action, against the model **before the script runs**. So a script that creates page
+B (or microflow M) and then alters page A to link to it is refused, although exec would apply it.
+exec.sh runs that check first, so the whole script is refused. **Rule: split it into a create
+script and an alter script.** The second depends on the first, and its header says so.
+
+**Expected.** `check` should resolve references in script order, against the model plus
+everything created earlier in the script. `exec` should validate forward calls before writing
+anything.
+
+---
+
+## BUG-148: a quoted enumeration literal as the LAST member of a `create` member list draws E007 at `check`
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25 and 2026-09-26, a card-disbursement requirements-driven build. Three
+hits: an enumeration default in a `create entity` attribute list, and two microflow
+`create <Entity> ( … )` member lists.
+**Reproducible:** yes. Three scratch scripts that differ only in the member's position and quoting
+gave 1 warning, 0 and 0.
+
+A fully quoted literal as the last member, such as `"Owner" = "Mod"."Enum"."Value"`, draws "Unrecognised
+tokens at this position. The parser skipped to the next safe boundary so the rest of the
+expression could be parsed … [E007]". The same literal earlier in the list is clean. So is the
+literal unquoted in the last position (`Mod.Enum.Value`).
+
+- In a microflow `create`, E007 is a **warning printed above "Check passed!"**, and exec writes
+  the right value.
+- In a `create entity` attribute list it failed the check.
+
+**Workaround.** Write the literal unquoted, or put another member last. Also, a warning printed
+under a passing check is not necessarily about your script's logic.
+
+---
+
+## BUG-149: `check` and `lint` rules that misfire on v0.24.0, and four constructs `check` passes that mxbuild refuses
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25 to 2026-09-26, a card-disbursement requirements-driven build.
+**Reproducible:** each row was measured on its own, either as the lint delta of one exec or as a
+check/mxbuild A/B.
+**Why these are collected in one place.** `exec.sh` runs the lint ratchet after every clean
+mxbuild. A false positive therefore surfaces as `LINT ROSE`, and the only way past it is a
+baseline entry with a reason. This list is where that reason comes from.
+
+**False positives and misses:**
+
+| Rule | What happens | Do this |
+|---|---|---|
+| **E001** (check) | An enum attribute assigned from `if $Raw = '9999' then Mod.Enum.A else …` is reported once per string literal, as "comparing or assigning an Enumeration attribute against a string literal". The comparison is String against String. | Map the string to an Integer first (`declare $Kind Integer = if $Raw = '9999' then 1 else …`), then branch on it in the enum assignment. That passed check, exec and mxbuild with 0 errors. |
+| **E006** (check) | Refuses `parseDateTime(value, pattern, default)` as a wrong argument count. Mendix supports the three-argument form. | Guard the input with `isMatch`, then use the two-argument parse. |
+| check, reference stage, on a `.test.mdl` | Flags every test as "module not found: MxTest", because `mxcli test` creates that module at run time. 19 of 19 statements were flagged, so a real reference error would hide among them. | For test files, read only the syntax and lint stages of `check`. Those stages still caught a real MDL063 duplicate variable. |
+| **CONV013** (lint) | A Java action call or a `rest call` with a custom handler (`on error without rollback { … }`) is reported as "uses '' error handling instead of Custom". The unit holds `ErrorHandlingType: CustomWithoutRollBack`. | Add a baseline entry that cites this row. |
+| **MPR002** (lint) | A microflow whose whole body is one `return <expression>` is reported as an empty stub. This is often deliberate, for example a route that stands in for a workflow `DECISION` (BUG-76). | Add a baseline entry, with the reason in the script header. |
+| **MDL-WIDGET15** (lint, info) | Adjacent inline dynamictexts are flagged as "text concatenates" even inside a flex row with a gap (`hstack`), where they cannot touch. The rule does not read the parent's class. | None needed. Measure the gap in the LOOK. |
+| **MDL-WIDGET31** (lint) | Flags inputs in a read-only container, but checks only native inputs. It missed a pluggable Switch. | Also see the platform half: a list view that is not `Editable` (mxcli's default) makes every input inside it read-only, including inputs in a **nested** list view whose own `Editable` is true. Set `Editable: true` on every list view on the path to the input. |
+| **MPR006** + **MDL-WIDGET03** | An empty CONTAINER lints MPR006 ("will crash at runtime"). Moving its inline `Style` onto a child Text fails MDL-WIDGET03, because a dynamictext cannot carry an inline Style. That leaves exactly one legal shape for a styled empty element (a colour chip, a rule line). | Use a container that carries the class and Style and holds one Text with empty content. In one field run, 43 specimens took lint from +37 back to baseline and rendered correctly. |
+
+**`check` passes, mxbuild refuses (exec.sh's gate catches these; a bare exec does not):**
+
+| Construct | mxbuild | Do this |
+|---|---|---|
+| `get workflows for $X` on an entity that no workflow yet uses as its context | CE1870 "the selected workflow context is not used by any workflow" | Stub the helper, and write its body in the same step as the workflow. |
+| `millisecondsBetween(…)` assigned to an Integer attribute | CE0117 (the function returns Decimal) | Wrap it in `round()`. |
+| An **entity** named with a Mendix reserved word (`Case`), quoted or not | CE7247 "The name 'Case' is a reserved word" | Qualify the name. `mxcli syntax domain-model keywords` lists MDL's parser keywords, not Mendix's reserved names. See the reserved-word row in `learned-detection-gaps.md`. |
+| A JSON structure key named `CONTEXT` | CE9524 at `mx check` only | `custom name map ('CONTEXT' as 'ApprovalContext')`; the wire key stays `CONTEXT`. Only `CONTEXT` was probed. Other reserved-looking keys may behave the same way. |
+
+---
+
+## BUG-150: bundled Data grid 2 and filter widget definitions on v0.24.0 — fixed values that break slots and filters, a project override that `refresh catalog` reverts, and control-bar attributes resolved against the grid's entity
+
+**mxcli:** v0.24.0 (`datagrid.def.json` and the text and drop-down filter definitions) ·
+**Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25, a card-disbursement requirements-driven build, building one Data
+grid 2 for the StyleGallery.
+**Reproducible:** yes, through exec.sh's mxbuild gate, `describe page`, and the rendered DOM.
+
+1. **`RowClass`** is listed as a known property but is not mapped. `check` accepts it, exec drops
+   it, and rows get no dynamic class (no risk, flag or selected-row states). The native
+   `DATAGRID`'s `DynamicRowClass` is a separate gap, covered in `learned-dg2-patterns.md`.
+2. **`showEmptyPlaceholder`** is fixed to `none`, so an `emptyplaceholder` slot fails mxbuild
+   with CE0463. **`showNumberOfRows`** must stay unset under button paging, because the property
+   is hidden there and any set value is CE0463.
+3. The **text and drop-down filters** fix `attrChoice` to `auto`, which only resolves inside a
+   grid column. A filter in the grid's control bar needs `linked`. The drop-down filter definition
+   also maps an `attributes` key the widget does not declare, so no attribute reaches it. It leaves
+   `emptySelectionCaption` unmapped, so the closed picker says "Select".
+4. **Project widget definitions** (`.mxcli/widgets/`):
+   - (a) Every file needs a `generatorVersion` at least as high as mxcli's own. Otherwise mxcli
+     regenerates the whole folder on every run.
+   - (b) An mpk-generated `<name>.def.json` patched in place is silently reverted by
+     `refresh catalog`, which exec.sh's lint pass runs.
+   - Put the patch in a **sibling** file instead (`datagrid_project.def.json`, which sorts after
+     the stock file; the same `mdlName` wins). Rebuild it from the stock file with a staleness
+     check, so a stock update cannot go unnoticed.
+5. **A bare attribute name in a widget in the grid's control bar** is resolved against the
+   **grid's** entity, although at runtime the context there is the enclosing data view's object.
+   mxbuild fails with CE1613. Inside the control bar, name the data view's attributes fully
+   qualified. For buttons there, see `learned-page-patterns.md` → control-bar buttons.
+
+---
+
+## BUG-151: `rest call … body $Var` sends the literal text `$Var`, not the variable's value
+
+**Severity:** High. The payload is wrong and nothing says so: `check`, exec and mxbuild are green.
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-26, a card-disbursement requirements-driven build, on an outbound
+integration.
+**Reproducible:** yes. On a scratch copy, a BSON read of the `RestCallAction` body template after
+each form, plus `DESCRIBE`.
+
+The bare-expression body form writes a StringTemplate whose text is `$Var` and whose parameter
+list is empty. The endpoint therefore receives the characters `$Var`.
+`body '{1}' with ({1} = $Var)` round-trips correctly. **Write the template form only.**
+
+---
+
+## BUG-152: published REST services, mappings and Java actions on v0.24.0 — an auth property that is ignored, a resource list that is replaced, doc comments that never land, and a `check` crash
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-26, a card-disbursement requirements-driven build, building a mock
+service and its callers.
+**Reproducible:** yes, on scratch copies (`describe` read-back, BSON reads, lint deltas).
+
+1. **No authentication clause.** `create published rest service` has none. An `Authentication:`
+   property passes `check` and is silently ignored: the service is written without auth, and
+   every call reaches the operation microflow unauthenticated. `describe` shows no auth.
+   Authenticate inside the operation microflow instead. Then prove it at runtime: no credentials
+   and a wrong password must each answer 401.
+2. **SIGSEGV in `check`.** An UNQUOTED value on an auth-like service property crashes `check`
+   instead of raising a parse error. Quote every property value.
+3. **`create or modify published rest service` REPLACES the resource list.** A second run that
+   names only resource B leaves the service with B alone, and A is unpublished without a warning.
+   Two scripts that each declare their own resources on one service undo each other. One script
+   owns the service and names every resource.
+4. **Doc comments** (`/** */`) set documentation on microflows, entities and Java actions. Before an
+   import or export mapping, or a published REST service, they are silently ignored
+   ("already in sync"). Before a Java action parameter they are a syntax error. QUAL002 therefore
+   cannot be cleared for those from MDL. Add a baseline entry with the reason.
+5. **`import from mapping … ($Call/ResponseBody)` is a parse error** ("mismatched input '/'"). The
+   source must be a variable: `declare $Body String = $Call/ResponseBody;` then `($Body)`.
+6. **Import mappings, re-run.**
+   - `drop import mapping` on a mapping that does not exist stops the script, and there is no
+     `if exists`.
+   - `create or modify import mapping` over a JSON array with a nested
+     `create Assoc/Child = DATA { … }` is idempotent: two runs leave one mapping, and callers
+     still point at it. The nested child needs the `create` keyword.
+   - Drop + recreate orphans every import activity that calls the mapping (BUG-99). Extend the
+     mapping with `create or modify` instead.
+7. **Java action `Integer` parameter.** `create java action` generates it as `java.lang.Integer`.
+   Studio Pro's integer parameter arrives as `java.lang.Long`. The Integer form was not exercised
+   at runtime; declare `Long` until it is proven.
+
+---
+
+## BUG-153: `mxcli oql --direct` — `HAVING` without `GROUP BY` does not parse, and a date aggregate comes back in a form OQL cannot read back
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-26, a card-disbursement requirements-driven build, in journey-runner seeds
+and data-rung queries.
+**Reproducible:** yes. Both failures made a journey rung report INVALID.
+
+1. **`HAVING` without `GROUP BY`.** `SELECT COUNT(…) … HAVING COUNT(…) = 2` fails with
+   "mismatched input 'HAVING'". For a seed that should return a row only when a precondition
+   holds, put the condition in the WHERE as a scalar subquery:
+   `… WHERE … AND (SELECT COUNT(x.ID) FROM M.E AS x) = 2`. That returns no row when the condition
+   fails, so the seed reports INVALID and never a feature FAIL.
+2. **Date aggregates.** `SELECT MAX(createdDate)` returns a Java `Date.toString()` string, which OQL
+   cannot parse back as a literal ("could not be parsed"). A "rows newer than the baseline"
+   watermark on a date therefore fails. Put the watermark on `ID` instead: it is numeric, monotonic
+   and round-trips.
+
+With `--json`, the array goes to stdout and the alpha banner to stderr, so parse stdout alone.
+`project-tests/e2e/helpers.js` already does.
+
+---
+
+## BUG-154: MDL surface gaps on v0.24.0 — missing `if exists` forms, and spellings the syntax reference does not state
+
+**mxcli:** v0.24.0 · **Mendix:** 11.13.0 · **Not filed upstream.**
+**Discovered:** 2026-09-25 to 2026-09-26, a card-disbursement requirements-driven build.
+**Reproducible:** yes. Each row is a `check` or exec result.
+
+| Written | What happens | Use |
+|---|---|---|
+| `drop enumeration if exists X` | Parse error. (`drop user role if exists` and `drop demo user if exists` do exist.) | Put the drop in a one-shot script. |
+| `drop snippet if exists X` | Parse error. `drop snippet X` works. There is no rename, and CONV005 wants the `SNIPPET_` prefix. | Create the new name, then drop the old one in a one-shot script. |
+| `drop import mapping X` when X is missing | Error; the script stops. There is no `if exists`. | Never drop a mapping that has callers (BUG-152 item 6). |
+| `DataSource: MICROFLOW Mod.DS_Name()` | Parse error at `(`. | `DataSource: MICROFLOW Mod.DS_Name` |
+| `max(a, b, c)` | "Provide 2 argument(s) for max()" | `max(max(a, b), c)` |
+| A backslash in a `'…'` literal | Escapes are processed: `\\` → `\`, `\n` → newline, `\t` → tab. | Spell a literal backslash as `urlDecode('%5C')`. |
+| A variable first assigned inside a `while` loop | "variable is not declared" at exec | `declare` it before the loop. |
+| `alter page … { set Url = '…'; }` | Works: check, exec and mxbuild pass, and the page opens at that URL. But `syntax page.alter` does not list `Url`. | Use it. The listing is incomplete, not the command. |
+
+---
 ## BUG-155: `alter page … set RenderMode` is refused on a dynamic text, though `create page` writes it — fix ready on a fork branch
 
 **Severity:** Low — loud refusal, clean workaround; costs a full widget restatement per heading-level change
@@ -5806,6 +6314,14 @@ gate-agent's "do not accept the rise with `--update-baseline`" rule needs this e
 two apart: an MPR008 whose two elements are a merge and the activity after a loop in an `if`
 branch is this bug, and the fix is the workaround above, not a baseline bump.
 
+### Second shape, same defect (v0.24.0, Mendix 11.13.0, 2026-09-26)
+
+Seen in a card-disbursement requirements-driven build. An error handler (`on error without
+rollback { … }`) that does **not** end in `return` merges back into the main flow, and the merge
+is placed on top of the next activity: lint MPR008 on a correct script. It showed up on exec 4
+of one script. After every handler was given its own `return`, the next exec had a clean mxbuild
+and MPR008 back at baseline. **Workaround: end every error handler with its own `return`**, so
+there is no merge to place.
 ## BUG-DRAFT-mpr012-assumes-react-client: lint MPR012 reports every legacy dynamic image as a React-client error (CE0582) on a Mendix 11 project that still builds for the Dojo client (2026-09-26)
 
 > **NOT YET FILED.**
diff --git a/bug-logs/pending-github-issues/bug141-condition-outcome-no-persistent-id.md b/bug-logs/pending-github-issues/bug141-condition-outcome-no-persistent-id.md
new file mode 100644
index 0000000..536704b
--- /dev/null
+++ b/bug-logs/pending-github-issues/bug141-condition-outcome-no-persistent-id.md
@@ -0,0 +1,81 @@
+**Repo:** `mendixlabs/mxcli`
+**Source:** `bug-logs/mxcli-bugs.md`, `## BUG-141`. Observed 2026-09-26 on a card-disbursement
+requirements-driven build (Mendix 11.13.0, mxcli v0.24.0).
+**Status:** NOT YET FILED. Before filing, check the issue tracker for a duplicate and re-read
+`conditionOutcomeToGen()` on current `main`. The fix and a regression test are ready as one
+commit: `bug141-fix.patch` next to this file (`git am` on `main` 95091765). Open it as a PR that
+references the issue, or attach it to the issue.
+**Suggested labels:** bug, workflow, silent-corruption
+
+---
+
+**Title:** Workflow condition outcomes are written without a `PersistentId`, so in-flight
+instances go `Incompatible` on every deploy
+
+**Body:**
+
+## Summary
+
+`conditionOutcomeToGen()` in `mdl/backend/modelsdk/workflow_write.go` writes
+`Workflows$BooleanConditionOutcome`, `Workflows$EnumerationValueConditionOutcome` and
+`Workflows$VoidConditionOutcome` without a `PersistentId`. Activities, `UserTaskOutcome` and
+`ParallelSplitOutcome` all get one through `addFreshPersistentID(g)`.
+
+The runtime identifies an outcome by its persistent ID. The 11.13.0 workflow metamodel builds
+`ModelBooleanConditionOutcome(id, value, persistentId, flow, container)`. With none stored, the
+outcome is a new outcome after every load. So every workflow instance that has already passed a
+decision is marked **`Incompatible`** on the next deploy, with
+*"A selected outcome has been replaced in the already executed path"*. That includes a restart
+with no model change at all.
+
+## Reproduction
+
+1. `create workflow` with a call-microflow task that has Boolean or enumeration outcomes (or a
+   `DECISION`; both reach `conditionOutcomeToGen()`, lines 511 and 556), followed by a user
+   task.
+2. `mxcli run --local`, start an instance, and let it stop at the user task (`InProgress`).
+3. Stop the app and start it again without changing the model.
+4. The instance is now `Incompatible`.
+
+Reproduced three times on one model: across a no-change restart, across a redeploy that
+changed only unrelated pages, and across a one-line page change. A BSON dump of the workflow
+unit shows `PersistentId` on every activity and user-task outcome and on none of the condition
+outcomes.
+
+## Why nothing catches it
+
+`check`, `exec`, `describe workflow`, `lint`, mxbuild and `mx check` are all clean. Any test that
+starts and finishes an instance within one run passes. It only shows when an instance outlives
+a restart, which means in production.
+
+## Fix
+
+One line in each of the three `case` arms of `conditionOutcomeToGen()`, before `return g`:
+
+```go
+addFreshPersistentID(g)
+```
+
+`WorkflowsBooleanConditionOutcome.PersistentID` is already in `generated/metamodel/types.go`.
+The attached commit adds that and `TestConditionOutcomeToGen_HasPersistentID`, which fails on all
+three outcome types without the fix and passes with it. `go test ./mdl/backend/modelsdk/
+./modelsdk/canon/` is green, and gofmt and vet are clean.
+
+## Verified on a real model
+
+This was v0.24.0 plus the three lines, on the model that reproduced the bug (Mendix 11.13.0):
+
+- Condition outcomes carrying a `PersistentId` went from 0/30 to 30/30. `mx check` reports 0
+  errors.
+- An instance paused at a user task after the decisions stayed `InProgress` across a restart
+  with no model change. The released binary turns it `Incompatible`. After the restart the
+  instance ran on to `Completed`.
+
+## Re-running `create or replace workflow`
+
+We worried that `addFreshPersistentID` ("a fresh GUID on every save") would re-mint the IDs
+each time a workflow script is re-run. It does not. `canon.CarryPersistentIDs` keeps the stored
+IDs. The patched `create or replace` kept all 54 IDs the released binary had written, and a
+second re-run kept 84/84. So the fix re-IDs condition outcomes once, on the first write after
+upgrading, and the IDs are stable from then on. The release notes might say so: instances paused
+past a decision at that one deploy still go `Incompatible`.
diff --git a/bug-logs/pending-github-issues/bug141-fix.patch b/bug-logs/pending-github-issues/bug141-fix.patch
new file mode 100644
index 0000000..5e7d14c
--- /dev/null
+++ b/bug-logs/pending-github-issues/bug141-fix.patch
@@ -0,0 +1,108 @@
+From d6133533a8d8c6575f8d11f76faafc09727251eb Mon Sep 17 00:00:00 2001
+From: Claude <noreply@anthropic.com>
+Date: Sun, 27 Sep 2026 08:17:23 +0000
+Subject: [PATCH] fix(workflow): give condition outcomes a PersistentId
+
+conditionOutcomeToGen() wrote Boolean, EnumerationValue and Void
+condition outcomes without a PersistentId. Activities, UserTaskOutcome
+and ParallelSplitOutcome all get one via addFreshPersistentID.
+
+The runtime identifies an outcome an instance has taken by its
+persistent ID, so an outcome stored without one is a new outcome on
+every load. Every instance already past a decision (or past a
+call-microflow task with outcomes) turned Incompatible on the next
+deploy, a restart with no model change included: "A selected outcome
+has been replaced in the already executed path".
+
+Field-proven on v0.24.0 + this change, Mendix 11.13.0: a workflow
+with 30 condition outcomes went from 0/30 to 30/30 carrying an ID,
+mx check 0 errors; an instance paused at a user task after the
+decisions stayed InProgress across a no-change restart and then ran
+to Completed. Re-running create or replace workflow kept all 84 IDs
+(CarryPersistentIDs), so the fix costs one re-ID on first write only.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N
+---
+ .../workflow_condition_outcome_test.go        | 41 +++++++++++++++++++
+ mdl/backend/modelsdk/workflow_write.go        |  3 ++
+ 2 files changed, 44 insertions(+)
+ create mode 100644 mdl/backend/modelsdk/workflow_condition_outcome_test.go
+
+diff --git a/mdl/backend/modelsdk/workflow_condition_outcome_test.go b/mdl/backend/modelsdk/workflow_condition_outcome_test.go
+new file mode 100644
+index 00000000..857073a4
+--- /dev/null
++++ b/mdl/backend/modelsdk/workflow_condition_outcome_test.go
+@@ -0,0 +1,41 @@
++// SPDX-License-Identifier: Apache-2.0
++
++package modelsdkbackend
++
++import (
++	"testing"
++
++	"github.com/mendixlabs/mxcli/modelsdk/element"
++	"github.com/mendixlabs/mxcli/sdk/workflows"
++)
++
++// TestConditionOutcomeToGen_HasPersistentID guards the outcome of a decision or
++// of a call-microflow task. The runtime identifies an outcome an instance has
++// taken by its PersistentId; an outcome written without one is a new outcome on
++// every load, so every instance already past it turns Incompatible on the next
++// deploy ("A selected outcome has been replaced in the already executed path").
++func TestConditionOutcomeToGen_HasPersistentID(t *testing.T) {
++	outcomes := map[string]workflows.ConditionOutcome{
++		"Workflows$BooleanConditionOutcome":          &workflows.BooleanConditionOutcome{Value: true},
++		"Workflows$EnumerationValueConditionOutcome": &workflows.EnumerationValueConditionOutcome{Value: "MyFirstModule.Colour.Red"},
++		"Workflows$VoidConditionOutcome":             &workflows.VoidConditionOutcome{},
++	}
++	for typeName, outcome := range outcomes {
++		g, ok := conditionOutcomeToGen(outcome).(*element.Base)
++		if !ok || g == nil {
++			t.Fatalf("%s: conditionOutcomeToGen returned %T", typeName, conditionOutcomeToGen(outcome))
++		}
++		if g.TypeName() != typeName {
++			t.Errorf("type = %q, want %q", g.TypeName(), typeName)
++		}
++		found := false
++		for _, p := range g.Properties() {
++			if p.Name() == "PersistentId" {
++				found = true
++			}
++		}
++		if !found {
++			t.Errorf("%s written without a PersistentId", typeName)
++		}
++	}
++}
+diff --git a/mdl/backend/modelsdk/workflow_write.go b/mdl/backend/modelsdk/workflow_write.go
+index e3587917..c039280b 100644
+--- a/mdl/backend/modelsdk/workflow_write.go
++++ b/mdl/backend/modelsdk/workflow_write.go
+@@ -654,6 +654,7 @@ func conditionOutcomeToGen(outcome workflows.ConditionOutcome) element.Element {
+ 		if o.Flow != nil {
+ 			addPart(g, "Flow", flowToGen(o.Flow))
+ 		}
++		addFreshPersistentID(g)
+ 		return g
+ 	case *workflows.EnumerationValueConditionOutcome:
+ 		g := newElem("Workflows$EnumerationValueConditionOutcome", outcomeID(o.ID))
+@@ -661,12 +662,14 @@ func conditionOutcomeToGen(outcome workflows.ConditionOutcome) element.Element {
+ 		if o.Flow != nil {
+ 			addPart(g, "Flow", flowToGen(o.Flow))
+ 		}
++		addFreshPersistentID(g)
+ 		return g
+ 	case *workflows.VoidConditionOutcome:
+ 		g := newElem("Workflows$VoidConditionOutcome", outcomeID(o.ID))
+ 		if o.Flow != nil {
+ 			addPart(g, "Flow", flowToGen(o.Flow))
+ 		}
++		addFreshPersistentID(g)
+ 		return g
+ 	default:
+ 		return nil
+-- 
+2.43.0
+
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 940b63d..3a58af7 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -29,14 +29,19 @@
 _mxtk_resolve_root() {
   local self_parent d
   self_parent=$(cd "$(dirname "${BASH_SOURCE[2]:-${BASH_SOURCE[1]:-${BASH_SOURCE[0]}}}")/.." 2>/dev/null && pwd)
-  # tier 2: the script sits in a real project's bin/
-  if [ -n "$self_parent" ] && ls "$self_parent"/*.mpr >/dev/null 2>&1; then
+  # tier 2: the script sits in a real project's bin/ (model at the root, or under app/ on a
+  # two-tree checkout — the same one-level probe find_mpr makes)
+  if [ -n "$self_parent" ] && { ls "$self_parent"/*.mpr >/dev/null 2>&1 || ls "$self_parent"/app/*.mpr >/dev/null 2>&1; }; then
     printf '%s\n' "$self_parent"; return 0
   fi
-  # tier 3: walk up from $PWD looking for the .mpr
+  # tier 3: walk up from $PWD looking for the .mpr (root or app/).
+  # WHY app/ (2026-09-26, card-disbursement requirements-driven build): on a two-tree checkout
+  # with no root .mpr, tiers 2 and 3 used to find nothing AT the project and kept climbing — and
+  # the first stray .mpr in any ancestor directory became PROJECT_ROOT. A scratch copy under a
+  # folder holding one unrelated .mpr pointed model-stamp.sh at that file and its hook passed.
   d=$(pwd)
   while [ "$d" != "/" ]; do
-    if ls "$d"/*.mpr >/dev/null 2>&1; then printf '%s\n' "$d"; return 0; fi
+    if ls "$d"/*.mpr >/dev/null 2>&1 || ls "$d"/app/*.mpr >/dev/null 2>&1; then printf '%s\n' "$d"; return 0; fi
     d=$(dirname "$d")
   done
   # nothing found: keep the old behaviour so the caller's own error is the one seen
diff --git a/project-bin/check-design-reaches-app.sh b/project-bin/check-design-reaches-app.sh
index a466b80..e37149c 100755
--- a/project-bin/check-design-reaches-app.sh
+++ b/project-bin/check-design-reaches-app.sh
@@ -62,6 +62,7 @@
 #
 #   1  knobs bound        N of M framework knobs point at a design-system token.  0 = VIOLATION
 #   2  tokens arrived     N of M design-system tokens exist in the built sheet.   0 = VIOLATION
+#      tokens valued      K of M carry the DESIGN's value there (not just its name). K < N = WARN
 #   3  classes arrived    N of M design-system classes exist in the built sheet.  0 = VIOLATION
 #   4  dead SCSS bridge   `$x: var(--y)` while the theme runs on custom properties. any = VIOL
 #
@@ -83,20 +84,28 @@ set -uo pipefail
 DESIGN="${1:-}"
 BUILT="${2:-}"
 
+# Where the model lives. The design system and mdlsource/ sit at the repo root either way; the
+# built sheet, theme/ and themesource/ sit beside the .mpr — the root on a single-tree checkout,
+# app/ on a two-tree one (repo at the root, `mxcli new` app under app/, the same one-level probe
+# _common.sh's find_mpr makes). Root-relative defaults alone exited 2 on every two-tree project
+# (field run, card-disbursement requirements-driven build, 2026-09-25).
+MP=""
+if ! ls ./*.mpr >/dev/null 2>&1 && ls app/*.mpr >/dev/null 2>&1; then MP="app/"; fi
+
 if [ -z "$DESIGN" ]; then
   for c in design/ds.css design/design-system.css; do
     [ -f "$c" ] && { DESIGN="$c"; break; }
   done
 fi
 if [ -z "$BUILT" ]; then
-  for c in deployment/web/theme.compiled.css deployment/web/theme.css; do
+  for c in "${MP}deployment/web/theme.compiled.css" "${MP}deployment/web/theme.css"; do
     [ -f "$c" ] && { BUILT="$c"; break; }
   done
 fi
 
 # The framework's own customization surface. Atlas has called this file the same thing since
 # Atlas 2; a project that renamed it passes it as a third argument via CUSTOM_VARS.
-CUSTOM_VARS="${CUSTOM_VARS:-theme/web/custom-variables.scss}"
+CUSTOM_VARS="${CUSTOM_VARS:-${MP}theme/web/custom-variables.scss}"
 
 if [ -z "$DESIGN" ] || [ ! -f "$DESIGN" ]; then
   printf 'check-design-reaches-app: no design system stylesheet found.\n' >&2
@@ -106,7 +115,7 @@ if [ -z "$DESIGN" ] || [ ! -f "$DESIGN" ]; then
 fi
 if [ -z "$BUILT" ] || [ ! -f "$BUILT" ]; then
   printf 'check-design-reaches-app: no BUILT stylesheet found.\n' >&2
-  printf '  Searched: deployment/web/theme.compiled.css, deployment/web/theme.css\n' >&2
+  printf '  Searched: %sdeployment/web/theme.compiled.css, %sdeployment/web/theme.css\n' "$MP" "$MP" >&2
   printf '  Run a build first. "Did the design system reach the app" cannot be answered from\n' >&2
   printf '  source, and answering it from source is how this defect shipped.\n' >&2
   printf '  This is NOT a pass.\n' >&2
@@ -212,6 +221,31 @@ done <<EOF
 $TOKENS
 EOF
 
+# ── Pass 2b: did they arrive WITH THE DESIGN'S VALUE? ───────────────────────────────────────
+# A name in the built sheet is not the design in the built sheet. The `mxcli new` template for
+# Mendix 11.13 ships its own `--mxt-*` token bridge with its own values; a design system
+# authored on the same vocabulary read "40 of 40 tokens arrived" while 8 of 40 carried the
+# design's value (brand designed #4f46e5, built #0f6e6b — the template's teal). Field run,
+# card-disbursement requirements-driven build, 2026-09-25. So: for each token, compare the
+# design's value with the WINNING value in a bare `:root` of the built sheet (the same reading
+# as pass 1), case- and whitespace-insensitive.
+norm_val() { printf '%s' "$1" | tr -d ' \t' | tr 'A-Z' 'a-z'; }
+TOKENS_VALUED=0
+VALUE_MISS_SAMPLE=""
+VALUE_MISS_N=0
+while IFS="$(printf '\t')" read -r tname tval; do
+  [ -z "$tname" ] && continue
+  bval="$(printf '%s\n' "$BUILT_ROOT" | awk -F'\t' -v k="$tname" '$1 == k { v = $2 } END { print v }')"
+  if [ -n "$bval" ] && [ "$(norm_val "$bval")" = "$(norm_val "$tval")" ]; then
+    TOKENS_VALUED=$((TOKENS_VALUED + 1))
+  elif [ -n "$bval" ] && [ "$VALUE_MISS_N" -lt 4 ]; then
+    VALUE_MISS_N=$((VALUE_MISS_N + 1))
+    VALUE_MISS_SAMPLE="$VALUE_MISS_SAMPLE $tname (built $bval, designed $tval);"
+  fi
+done <<EOF
+$TOKENS
+EOF
+
 # ── Pass 3: did the classes arrive? ─────────────────────────────────────────────────────────
 CLASSES_ARRIVED=0
 MISSING_CLASS_SAMPLE=""
@@ -227,15 +261,15 @@ done
 # Only dead where the theme actually runs on custom properties. Where it does not, assigning a
 # framework SCSS variable is the CORRECT bridge and must not be reported.
 CSS_VARS_MODE="unknown"
-if grep -rqE '^[[:space:]]*\$use-css-variables[[:space:]]*:[[:space:]]*true' theme/web/ 2>/dev/null; then
+if grep -rqE '^[[:space:]]*\$use-css-variables[[:space:]]*:[[:space:]]*true' "${MP}theme/web/" 2>/dev/null; then
   CSS_VARS_MODE="true"
-elif grep -rqE '^[[:space:]]*\$use-css-variables[[:space:]]*:[[:space:]]*false' theme/web/ 2>/dev/null; then
+elif grep -rqE '^[[:space:]]*\$use-css-variables[[:space:]]*:[[:space:]]*false' "${MP}theme/web/" 2>/dev/null; then
   CSS_VARS_MODE="false"
 fi
 if [ "$CSS_VARS_MODE" = "true" ]; then
-  for f in theme/web/*.scss themesource/*/web/*.scss; do
+  for f in "${MP}"theme/web/*.scss "${MP}"themesource/*/web/*.scss; do
     [ -f "$f" ] || continue
-    case "$f" in themesource/atlas_*|themesource/atlas_*/*) continue ;; esac
+    case "${f#"$MP"}" in themesource/atlas_*|themesource/atlas_*/*) continue ;; esac
     while IFS= read -r hit; do
       [ -z "$hit" ] && continue
       ln="${hit%%:*}"
@@ -279,6 +313,11 @@ if [ "$TOKENS_ARRIVED" -eq 0 ] && [ "$TOKEN_COUNT" -gt 0 ]; then
     'The port did not reach the build at all. Check that the theme module directory name matches a real module.'
 fi
 
+if [ "$TOKENS_ARRIVED" -gt 0 ] && [ "$TOKENS_VALUED" -lt "$TOKENS_ARRIVED" ]; then
+  warn "$TOKENS_ARRIVED of $TOKEN_COUNT design-system tokens exist in $BUILT by name, $TOKENS_VALUED carry the design's value" \
+    "Differing:${VALUE_MISS_SAMPLE:- (none in a bare :root)} — a name the framework or app template also defines is not the design arriving. Read the values, not the count."
+fi
+
 if [ "$CLASS_COUNT" -gt 0 ] && [ "$CLASSES_ARRIVED" -eq 0 ]; then
   report "0 of $CLASS_COUNT design-system classes exist in $BUILT" \
     'Every class the pages reference resolves to nothing. Port the component rules, not only the tokens.'
@@ -297,6 +336,7 @@ printf 'design system   %s\n' "$DESIGN"
 printf 'built stylesheet %s\n' "$BUILT"
 printf 'knobs bound     %s of %s framework knobs point at a design-system token\n' "$KNOB_BOUND" "$KNOB_TOTAL"
 printf 'tokens arrived  %s of %s\n' "$TOKENS_ARRIVED" "$TOKEN_COUNT"
+printf 'tokens valued   %s of %s carry the design value in a bare :root\n' "$TOKENS_VALUED" "$TOKEN_COUNT"
 printf 'classes arrived %s of %s\n' "$CLASSES_ARRIVED" "$CLASS_COUNT"
 printf 'model classes   %s of %s asked for by the model are undefined\n' "$MODEL_CLASS_MISSING" "$MODEL_CLASS_TOTAL"
 printf 'css-vars mode   $use-css-variables: %s\n' "$CSS_VARS_MODE"
diff --git a/project-bin/check-page-shell.sh b/project-bin/check-page-shell.sh
index a115607..54221a2 100755
--- a/project-bin/check-page-shell.sh
+++ b/project-bin/check-page-shell.sh
@@ -219,8 +219,11 @@ for f in $TARGETS; do
     # That is the worse kind of false positive: it fires on correct code, it names a real
     # rule, and the fix it asks for (delete four H1s) would have broken four pages. A check
     # that cannot bound its own input tells you nothing about the input.
-    # Known limit: the counter does not skip quoted strings, so an UNBALANCED brace inside a
-    # string literal truncates the body early. Balanced placeholders ({1} of {2}) are fine.
+    # Quoted strings are skipped, across lines: an UNBALANCED brace inside a string literal
+    # used to move the depth. Measured on the card-disbursement requirements-driven build,
+    # 2026-09-26: a payload preview `Content: '{{ … }'` (a JSON template, `{{` being the
+    # escaped literal brace) left the depth at +1 per preview, the scan ran on through the
+    # next pages, and a page with one H1 was reported as declaring 3.
     body="$(awk -v start="$ln" '
       # The page body: from the declaration to the brace that MATCHES the body opening
       # one, counted per CHARACTER, with parens tracked so a brace inside the
@@ -242,15 +245,24 @@ for f in $TARGETS; do
       # correct RenderMode: H1 as having none. A per-line "started only when depth > 0"
       # reading never starts on a one-line body, where the braces balance within the line.
       # Only the paren state separates the two, so the paren state is tracked.
+      #
+      # A single-quoted MDL string is skipped whole: it may span lines, and a doubled quote
+      # inside it is an escaped quote, which two toggles handle (octal 047 = the quote). A `--` note ends the line only OUTSIDE
+      # a string (stripping it first would cut a string holding `--` and desync the quotes),
+      # and a block comment is skipped too, so an apostrophe in its prose opens no string.
       NR < start { next }
       { print $0 }
       done { exit }
       {
         line = $0
-        sub(/--.*$/, "", line)          # a trailing -- note must not move the depth
         n = length(line)
         for (i = 1; i <= n; i++) {
           c = substr(line, i, 1)
+          if (inblk) { if (c == "*" && substr(line, i + 1, 1) == "/") { inblk = 0; i++ }; continue }
+          if (c == "\047") { inq = !inq; continue }
+          if (inq) continue
+          if (c == "/" && substr(line, i + 1, 1) == "*") { inblk = 1; i++; continue }
+          if (c == "-" && substr(line, i + 1, 1) == "-") break   # a trailing -- note must not move the depth
           if (!started) {
             if (c == "(") pd++
             else if (c == ")") { if (pd > 0) pd-- }
diff --git a/project-bin/check-root-clean.sh b/project-bin/check-root-clean.sh
index 8ce3d50..40e9fde 100755
--- a/project-bin/check-root-clean.sh
+++ b/project-bin/check-root-clean.sh
@@ -24,7 +24,14 @@ cd "$PROJECT_ROOT" || { echo "cannot cd to project root" >&2; exit 1; }
 #
 # AGENTS.md is allowed as a POINTER to CLAUDE.md, never as a copy: two copies of the instructions
 # drift, and the one the agent reads is whichever its harness happens to prefer.
-ALLOWED="${ROOT_ALLOWED:-AGENTS.md CLAUDE.md CLAUDE.local.md PROJECT.md README.md index.html} ${ROOT_ALLOWED_EXTRA:-}"
+#
+# intake.md and triage.md are allowed because the toolkit itself puts them there: init-project.sh
+# scaffolds intake.md at the root, and bin/lib/artifact-manifest.tsv (read by gate-check.sh) owes
+# both at exactly those root paths. FINDINGS.md is allowed because `mxcli init`'s generated
+# CLAUDE.md tells every agent to "Append to FINDINGS.md" — a root path. (2026-09-25, card-
+# disbursement requirements-driven build: this check reported the project's own Stage P/0
+# artifacts as strays, and contradicted the mxcli instruction sitting in the same CLAUDE.md.)
+ALLOWED="${ROOT_ALLOWED:-AGENTS.md CLAUDE.md CLAUDE.local.md PROJECT.md README.md index.html intake.md triage.md FINDINGS.md} ${ROOT_ALLOWED_EXTRA:-}"
 
 STRAY=""
 for f in *.md *.html; do
diff --git a/project-bin/conformance-check.sh b/project-bin/conformance-check.sh
index e916b35..9ad591e 100755
--- a/project-bin/conformance-check.sh
+++ b/project-bin/conformance-check.sh
@@ -15,6 +15,8 @@
 # Failure policy: regressions only. A row that was OK in the baseline and is no longer OK
 # fails the run. Pre-existing mismatches are reported but do not fail — the lesson from lint,
 # which was made optional because day-one noise made it unusable, and now never runs at all.
+# A row with no baseline line yet (a module built after the baseline was written) is baselined
+# on first sight and said so; `--module` scopes a baseline rewrite to that module's rows.
 #
 # When there is no ledger
 #
@@ -58,7 +60,7 @@ while [ $# -gt 0 ]; do
     --module)          MODULE="${2:-}"; shift 2 ;;
     --update-baseline) UPDATE_BASELINE=1; shift ;;
     --quiet)           QUIET=1; shift ;;
-    -h|--help)         sed -n '2,43p' "$0"; exit 0 ;;
+    -h|--help)         sed -n '2,45p' "$0"; exit 0 ;;
     *) echo "unknown argument: $1" >&2; exit 2 ;;
   esac
 done
@@ -251,6 +253,16 @@ probe() {
   if ! runnable "$cmd"; then echo "UNRUNNABLE"; return; fi
   out="$(run_guarded "$cmd")"; rc=$?
   if [ $rc -ge 128 ]; then echo "TIMEOUT"; return; fi
+  # A probe mxcli cannot run says nothing about the model, so it is UNRUNNABLE, never ABSENT.
+  # Scored as ABSENT it was a false OK on every not-built row with a malformed probe: on a
+  # card-disbursement requirements-driven build `DESCRIBE DEMOUSER ops1` read ABSENT/OK while
+  # `DESCRIBE DEMO USER 'ops1'` read PRESENT on the same model. Both strings are verbatim
+  # mxcli v0.24.0 output (rc 1): "Parse error: line 1:64 extraneous input '.' …" and
+  # "Error: no describable document named "DEMOUSER" found in the project; specify the type
+  # explicitly, …". A genuine miss stays ABSENT: "Error: constant not found: Nope.X".
+  case "$out" in
+    *"Parse error:"*|*"no describable document named"*) echo "UNRUNNABLE"; return ;;
+  esac
   if [ $rc -ne 0 ]; then echo "ABSENT"; return; fi
   if [ -z "$(printf '%s' "$out" | tr -d '[:space:]')" ]; then echo "ABSENT"; return; fi
   case "$out" in
@@ -268,7 +280,7 @@ while IFS=$'\t' read -r kind mod ptr status cmd; do
   [ "$QUIET" -eq 1 ] || printf '\r  measuring %d/%d ' "$n" "$MEASURABLE" >&2
   observed="$(probe "$cmd")"
   case "$observed" in
-    UNRUNNABLE) verdict="UNRUNNABLE" ;;   # acceptance cell looks executable but is not
+    UNRUNNABLE) verdict="UNRUNNABLE" ;;   # prose, or a command mxcli refused to parse/resolve
     TIMEOUT)    verdict="TIMEOUT" ;;      # never treated as a pass
     *)
       case "$status:$observed" in
@@ -287,23 +299,43 @@ RESULTS="$(printf '%s' "$RESULTS" | sed '/^$/d' | sort)"
 # --- baseline / regression --------------------------------------------------------------
 KEYED="$(printf '%s\n' "$RESULTS" | awk -F'\t' '{print $1"\t"$2"\t"$5}')"
 
+# `--module` measures one module, so it may rewrite only that module's rows. Writing $KEYED
+# whole dropped every other module's baseline, and their regressions went unmeasured with
+# nothing said (card-disbursement build, 2026-09-26: `--update-baseline --module MockServices`
+# dropped the 127 Disbursement rows).
 if [ "$UPDATE_BASELINE" -eq 1 ] || [ ! -f "$BASELINE" ]; then
-  printf '%s\n' "$KEYED" > "$BASELINE"
+  if [ -n "$MODULE" ] && [ -f "$BASELINE" ]; then
+    { awk -F'\t' -v m="$MODULE" '$1!=m' "$BASELINE"; printf '%s\n' "$KEYED"; } \
+      | sed '/^$/d' | sort > "$BASELINE.tmp" && mv "$BASELINE.tmp" "$BASELINE"
+  else
+    printf '%s\n' "$KEYED" > "$BASELINE"
+  fi
   WROTE_BASELINE=1
 else
   WROTE_BASELINE=0
 fi
 
+# A row the baseline has never seen (a module built after the first run wrote it) used to be
+# compared with "" — never a regression, forever, with nothing said. Its first measurement is
+# its baseline, exactly as the first run's were; the count is printed below.
 REGRESSIONS=""
+SEEDED=""
 if [ "$WROTE_BASELINE" -eq 0 ]; then
   while IFS=$'\t' read -r mod ptr verdict; do
     [ -n "$mod" ] || continue
-    was="$(awk -F'\t' -v m="$mod" -v p="$ptr" '$1==m && $2==p {print $3}' "$BASELINE")"
-    if [ "$was" = "OK" ] && [ "$verdict" != "OK" ]; then
+    was="$(awk -F'\t' -v m="$mod" -v p="$ptr" '$1==m && $2==p {print $3; exit}' "$BASELINE")"
+    if [ -z "$was" ]; then
+      SEEDED+="$mod	$ptr	$verdict"$'\n'
+    elif [ "$was" = "OK" ] && [ "$verdict" != "OK" ]; then
       REGRESSIONS+="$mod	$ptr	was OK, now $verdict"$'\n'
     fi
   done <<< "$KEYED"
+  if [ -n "$SEEDED" ]; then
+    { cat "$BASELINE"; printf '%s' "$SEEDED"; } | sed '/^$/d' | sort > "$BASELINE.tmp" \
+      && mv "$BASELINE.tmp" "$BASELINE"
+  fi
 fi
+NSEED=$(printf '%s' "$SEEDED" | grep -c . || true)
 
 # --- report ------------------------------------------------------------------------------
 STAMP="$(date +%Y-%m-%d)"
@@ -321,10 +353,11 @@ echo "  ledger rows            $TOTAL   (measured $MEASURABLE · prose-only $PRO
 echo "  OK                     $OK"
 echo "  STALE                  $STALE   (claims built/partial, model says absent)"
 echo "  UNDERSTATED            $UNDER"
-[ "$UNRUN" -gt 0 ] && echo "  UNRUNNABLE             $UNRUN   (backticked prose, not a command)"
+[ "$UNRUN" -gt 0 ] && echo "  UNRUNNABLE             $UNRUN   (backticked prose, or a probe mxcli rejects — fix the probe; see the report)"
 [ "$TMO" -gt 0 ]   && echo "  TIMEOUT                $TMO   (>${TIMEOUT_S}s — never counted as a pass)"
 [ "$UNK" -gt 0 ]   && echo "  UNKNOWN-STATUS         $UNK"
 echo "  report                 $REPORT"
+[ "$NSEED" -gt 0 ] && echo "  newly baselined        $NSEED   (no baseline row yet — regressions measured from the next run)"
 
 if [ "$STALE" -gt 0 ] || [ "$UNDER" -gt 0 ]; then
   echo
@@ -334,7 +367,11 @@ fi
 
 if [ "$WROTE_BASELINE" -eq 1 ]; then
   echo
-  echo "  baseline written to $BASELINE ($MEASURABLE rows). Regressions are measured from here."
+  if [ -n "$MODULE" ]; then
+    echo "  baseline rows for $MODULE rewritten in $BASELINE ($MEASURABLE rows; other modules' rows kept)."
+  else
+    echo "  baseline written to $BASELINE ($MEASURABLE rows). Regressions are measured from here."
+  fi
   exit 0
 fi
 
diff --git a/project-bin/constants-audit.sh b/project-bin/constants-audit.sh
index 108ef5b..bf0637b 100755
--- a/project-bin/constants-audit.sh
+++ b/project-bin/constants-audit.sh
@@ -34,6 +34,13 @@
 #                  anything holding real data. Waive it with a reason, or override per
 #                  environment and empty the default.
 #
+# Reported, not a finding:
+#   SENTINEL       the model default is a `__NAME__` sentinel (`__SET_ME__`) — the shape
+#                  learned-constants-and-secrets.md Step 3 prescribes for a secret every
+#                  environment must override: it fails fast, naming the constant. Before
+#                  2026-09-27 it read MODEL-SECRET, the same verdict as a real password in git
+#                  (card-disbursement requirements-driven build, a hub password constant).
+#
 # Waivers live in the project's own register, one line each, anywhere in docs/constants-register.md:
 #   Waived constant <Qualified.Name>: <reason>
 # A waiver is a decision on the record, not a mute button — the run reports WAIVED and its reason.
@@ -63,7 +70,7 @@ JSON=0
 for a in "$@"; do
   case "$a" in
     --json) JSON=1 ;;
-    -h|--help) sed -n '2,45p' "${BASH_SOURCE[0]}"; exit 0 ;;
+    -h|--help) sed -n '2,53p' "${BASH_SOURCE[0]}"; exit 0 ;;
     *) echo "constants-audit: unknown argument '$a'" >&2; exit 2 ;;
   esac
 done
@@ -114,7 +121,7 @@ done
 # register is what makes the classification real.
 SECRET_RE='[Kk][Ee][Yy]$|[Ss]ecret|[Pp]assword|[Pp]wd|[Tt]oken|[Cc]redential|ApiKey|APIKey|[Pp]assphrase|PrivateKey'
 
-FINDINGS=0; WAIVED=0; TOTAL=0; EMPTIES=0; SECRETS=0
+FINDINGS=0; WAIVED=0; TOTAL=0; EMPTIES=0; SECRETS=0; SENTINELS=0
 ROWS=""; JROWS=""
 
 # Read the body rows. The `---|---` separator and the header are skipped by the Qualified-Name
@@ -135,21 +142,26 @@ while IFS= read -r line; do
 
   # $dflt is used ONLY for this emptiness test and is never echoed, never stored in a variable
   # that reaches output, and never written to the JSON.
-  if [ -z "$dflt" ]; then state=EMPTY; EMPTIES=$((EMPTIES + 1)); else state=SET; fi
+  # The sentinel test reads the value's SHAPE only — `__` + [A-Za-z0-9_] + `__` — and prints
+  # nothing: a value of that shape is a placeholder by construction, never a secret.
+  if [ -z "$dflt" ]; then state=EMPTY; EMPTIES=$((EMPTIES + 1))
+  elif printf '%s' "$dflt" | grep -Eq '^__[A-Za-z0-9_]+__$'; then state=SENTINEL; SENTINELS=$((SENTINELS + 1))
+  else state=SET; fi
   if printf '%s' "$qname" | grep -Eq "$SECRET_RE"; then secret=yes; SECRETS=$((SECRETS + 1)); else secret=no; fi
   case "$expo" in [Yy]es|true|True) client=yes ;; *) client=no ;; esac
 
   verdict=OK
   [ "$state" = EMPTY ] && verdict=EMPTY
   [ "$secret" = yes ] && [ "$state" = SET ] && verdict=MODEL-SECRET
+  [ "$state" = SENTINEL ] && verdict=SENTINEL
   [ "$secret" = yes ] && [ "$client" = yes ] && verdict=CLIENT-SECRET
 
   reason=""
-  if [ "$verdict" != OK ] && [ -n "$REGISTER" ]; then
+  if [ "$verdict" != OK ] && [ "$verdict" != SENTINEL ] && [ -n "$REGISTER" ]; then
     reason=$(grep -m1 "^Waived constant $qname:" "$REGISTER" 2>/dev/null | sed "s/^Waived constant $qname: *//")
     if [ -n "$reason" ]; then verdict=WAIVED; WAIVED=$((WAIVED + 1)); fi
   fi
-  [ "$verdict" != OK ] && [ "$verdict" != WAIVED ] && FINDINGS=$((FINDINGS + 1))
+  [ "$verdict" != OK ] && [ "$verdict" != WAIVED ] && [ "$verdict" != SENTINEL ] && FINDINGS=$((FINDINGS + 1))
 
   # The table shows the first line of the reason only. A waiver is prose — one real waiver's runs to
   # four sentences — and printing it whole turns a 30-row table into a wall. The register is
@@ -169,15 +181,15 @@ EOF
 [ "$TOTAL" -gt 0 ] || { echo "constants-audit: parsed 0 constants from a table that had a header — the row format moved." >&2; exit 2; }
 
 if [ "$JSON" = 1 ]; then
-  printf '{\n  "instrument": "constants-audit",\n  "model": "%s",\n  "total": %d,\n  "empty": %d,\n  "secretNamed": %d,\n  "findings": %d,\n  "waived": %d,\n  "constants": [\n%s  ]\n}\n' \
-    "$(basename "$MPR")" "$TOTAL" "$EMPTIES" "$SECRETS" "$FINDINGS" "$WAIVED" "$(printf '%s' "$JROWS" | sed '$ s/,$//')"
+  printf '{\n  "instrument": "constants-audit",\n  "model": "%s",\n  "total": %d,\n  "empty": %d,\n  "sentinel": %d,\n  "secretNamed": %d,\n  "findings": %d,\n  "waived": %d,\n  "constants": [\n%s  ]\n}\n' \
+    "$(basename "$MPR")" "$TOTAL" "$EMPTIES" "$SENTINELS" "$SECRETS" "$FINDINGS" "$WAIVED" "$(printf '%s' "$JROWS" | sed '$ s/,$//')"
 else
   echo "Constants audit — $(basename "$MPR") · $TOTAL constants · no values are printed"
   echo ""
   printf '%-13s %-44s %-10s %-8s %s\n' VERDICT CONSTANT TYPE DEFAULT WAIVER
   printf '%s' "$ROWS" | grep -v '^OK  ' | sort
   echo ""
-  echo "  $TOTAL constants · $EMPTIES with no model default · $SECRETS secret-named · $WAIVED waived"
+  echo "  $TOTAL constants · $EMPTIES with no model default · $SENTINELS sentinel default(s) · $SECRETS secret-named · $WAIVED waived"
   if [ "$FINDINGS" -gt 0 ]; then
     echo "  ✗ $FINDINGS finding(s). EMPTY = blank in any environment that cannot set constants"
     echo "    (free node, Docker run, fresh clone). MODEL-SECRET = the value is in git."
diff --git a/project-bin/coverage-check-all.sh b/project-bin/coverage-check-all.sh
index 595986e..b518d91 100755
--- a/project-bin/coverage-check-all.sh
+++ b/project-bin/coverage-check-all.sh
@@ -67,7 +67,10 @@ for brd in "${brds[@]}"; do
   fi
   out="$("$COV" --summary "$brd" "$ledger" 2>&1)"
   rc=$?
-  line="$(printf '%s\n' "$out" | grep -E 'CLAIMED|LEDGERED|UNCLAIMED|PHANTOM|DOUBLE-CLAIMED|COUNT-MISMATCH' | tr '\n' ' ' | sed 's/  */ /g')"
+  # `leaves:` is kept on the line: it is the BRD's total, and review-report.js sums each
+  # counter across these lines — without it every multi-ledger module read "total unmeasured"
+  # (card-disbursement requirements-driven build, 2026-09-26).
+  line="$(printf '%s\n' "$out" | grep -E 'leaves:|CLAIMED|LEDGERED|UNCLAIMED|PHANTOM|DOUBLE-CLAIMED|COUNT-MISMATCH' | tr '\n' ' ' | sed 's/  */ /g')"
   case "$rc" in
     0) echo "$bid: CLEAN — $line" ;;
     1) echo "$bid: FINDINGS — $line"; FAIL=1 ;;
diff --git a/project-bin/coverage-preflight.sh b/project-bin/coverage-preflight.sh
index bee29c5..329ba08 100755
--- a/project-bin/coverage-preflight.sh
+++ b/project-bin/coverage-preflight.sh
@@ -37,12 +37,23 @@
 # engine's own verdict through unchanged; every other level is strictly *less* severe than
 # today's FAULT. Every level states what it knows, what it does not, and what would upgrade it.
 #
-# Ledger path shapes — all three are read, the first is canonical:
+# Ledger path shapes — all four are read, in this order:
+#   architecture/modules/<Module>/coverage-ledger/      one ledger per BRD, <BRDID>.md each
+#                                                       (project-bin/coverage-check-all.sh's form)
 #   architecture/modules/<Module>/coverage-ledger.md    canonical (per-module, scales)
 #   architecture/modules/<Module>-coverage-ledger.md    flat module layout (PROJECT-A's shape)
 #   architecture/coverage-ledger.md                     single-BRD project (sanctioned by
 #                                                       skills/coverage-ledger.md's header)
-# When none exists the message names all three, so an operator can act without reading source.
+# When none exists the message names all four, so an operator can act without reading source.
+#
+# The directory wins over the .md beside it: a module that splits its ledger per BRD keeps
+# coverage-ledger.md as an index, and measuring BRDs against the index is a false red. Real
+# case (card-disbursement requirements-driven build, 2026-09-26): 9 BRDs, 4 module ledger
+# directories holding 9 per-BRD files, every one clean under coverage-check-all.sh — and this
+# script found each module's index file, ran all 9 BRDs against it, and printed 9 of 9
+# UNCLAIMED (2,300+ leaves) for a module that owns one BRD. In the directory form each BRD is
+# measured against its own <BRDID>.md; a BRD with no file there belongs to another module and
+# is counted, named, and not measured.
 #
 # Usage:
 #   project-bin/coverage-preflight.sh [--summary] [--module <Name>] [<brd.json> [<ledger.md>]]
@@ -130,17 +141,30 @@ find_engine() {
 # ---------------------------------------------------------------------------
 # Discovery
 # ---------------------------------------------------------------------------
+LEDGER_DIR=""
 LEDGER_CANON=""
 LEDGER_FLAT=""
 LEDGER_PROJECT="architecture/coverage-ledger.md"
 if [ -n "$MODULE" ]; then
+  LEDGER_DIR="architecture/modules/$MODULE/coverage-ledger"
   LEDGER_CANON="architecture/modules/$MODULE/coverage-ledger.md"
   LEDGER_FLAT="architecture/modules/$MODULE-coverage-ledger.md"
 fi
 
+# A ledger directory counts only when it holds at least one per-BRD file — an empty directory
+# is not a ledger, and falling through to the file shapes is the honest reading of it.
+ledger_dir_ok() {
+  [ -n "$1" ] && [ -d "$1" ] || return 1
+  ls "$1"/*.md >/dev/null 2>&1
+}
+
 find_ledger() {
   local c
-  for c in "$ARG_LEDGER" "${LEDGER_FILE:-}" "$LEDGER_CANON" "$LEDGER_FLAT" "$LEDGER_PROJECT"; do
+  for c in "$ARG_LEDGER" "${LEDGER_FILE:-}"; do
+    [ -n "$c" ] && { [ -f "$c" ] || ledger_dir_ok "$c"; } && { printf '%s\n' "$c"; return 0; }
+  done
+  ledger_dir_ok "$LEDGER_DIR" && { printf '%s\n' "$LEDGER_DIR"; return 0; }
+  for c in "$LEDGER_CANON" "$LEDGER_FLAT" "$LEDGER_PROJECT"; do
     [ -n "$c" ] && [ -f "$c" ] && { printf '%s\n' "$c"; return 0; }
   done
   return 1
@@ -228,6 +252,7 @@ WHERE="${MODULE:-this project}"
 # The paths tried, printed verbatim so "not found" is actionable rather than a riddle.
 print_paths_tried() {
   echo "  looked for a ledger at:"
+  [ -n "$LEDGER_DIR" ]   && printf '    %-50s (one <BRDID>.md per BRD)\n' "$LEDGER_DIR/"
   [ -n "$LEDGER_CANON" ] && printf '    %-50s (canonical, per-module)\n' "$LEDGER_CANON"
   [ -n "$LEDGER_FLAT" ]  && printf '    %-50s (flat module layout)\n' "$LEDGER_FLAT"
   printf '    %-50s (single-BRD project)\n' "$LEDGER_PROJECT"
@@ -392,10 +417,49 @@ if [ "$NBRD" -eq 0 ]; then
 fi
 
 RC=0
-for b in $BRDS; do
-  # shellcheck disable=SC2086
-  "$ENGINE" $ENGINE_ARGS "$b" "$LEDGER" || RC=$?
-done
+if [ -d "$LEDGER" ]; then
+  # Directory form: each BRD against its own <BRDID>.md. The denominator is stated both ways —
+  # BRDs measured here, and BRDs that have no ledger here (another module's) — so "1 measured"
+  # can never be read as "1 exists".
+  NMEAS=0; OTHERS=""
+  for b in $BRDS; do
+    bid="$(basename "$b" .brd.json)"
+    if [ -f "$LEDGER/$bid.md" ]; then
+      NMEAS=$((NMEAS + 1))
+      # shellcheck disable=SC2086
+      "$ENGINE" $ENGINE_ARGS "$b" "$LEDGER/$bid.md" || RC=$?
+    else
+      OTHERS="$OTHERS $bid"
+    fi
+  done
+  NOTHERS=0; [ -n "$OTHERS" ] && NOTHERS=$(printf '%s\n' $OTHERS | grep -c .)
+  # A ledger file named after no BRD is only knowable when every BRD was discovered — with a
+  # single BRD passed in, the directory's other files are simply not this run's business.
+  ORPHANS=""
+  if [ -z "$ARG_BRD" ] && [ -z "${BRD_FILE:-}" ]; then
+    for l in "$LEDGER"/*.md; do
+      lid="$(basename "$l" .md)"; hit=0
+      for b in $BRDS; do [ "$(basename "$b" .brd.json)" = "$lid" ] && { hit=1; break; }; done
+      [ "$hit" -eq 1 ] || ORPHANS="$ORPHANS $lid"
+    done
+  fi
+  echo ""
+  echo "  per-BRD ledgers: $NMEAS of $NBRD BRD(s) measured against $LEDGER/<BRDID>.md;"
+  echo "  $NOTHERS BRD(s) have no ledger here (another module's, not measured):${OTHERS:- none}"
+  if [ -n "$ORPHANS" ]; then
+    echo "  FAULT: ledger file(s) with no matching BRD:$ORPHANS — named after a BRD id that does not exist." >&2
+    [ "$RC" -lt 2 ] && RC=2
+  fi
+  if [ "$NMEAS" -eq 0 ]; then
+    echo "FAULT: $LEDGER holds no ledger matching any of the $NBRD BRD(s) — cannot evaluate, which is not a pass." >&2
+    RC=2
+  fi
+else
+  for b in $BRDS; do
+    # shellcheck disable=SC2086
+    "$ENGINE" $ENGINE_ARGS "$b" "$LEDGER" || RC=$?
+  done
+fi
 
 if [ "$LEVEL" -eq 2 ]; then
   echo ""
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index e741da7..a2e7069 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -64,9 +64,16 @@ require_py
 if [ -z "${MPR:-}" ]; then
   MPR="$(ls "$ROOT"/*.mpr 2>/dev/null | head -1)"
   MPR="$(basename "${MPR:-}")"
+  # Two-tree layout (.mpr under app/): the same one-level-down probe as _common.sh find_mpr.
+  # Without it lint-gate exited 2 ("no .mpr found") on every exec of a two-tree project and
+  # exec.sh logged "lint could not run" — the ratchet was silently off for a whole build
+  # (card-disbursement requirements-driven build, 2026-09-25; F-020/F-042 class).
+  if [ -z "$MPR" ] && ls "$ROOT"/app/*.mpr >/dev/null 2>&1; then
+    MPR="app/$(basename "$(ls "$ROOT"/app/*.mpr | head -1)")"
+  fi
 fi
 if [ -z "$MPR" ] || [ ! -f "$ROOT/$MPR" ]; then
-  echo "lint-gate: no .mpr found in $ROOT — set MPR=<name>.mpr" >&2
+  echo "lint-gate: no .mpr found in $ROOT or $ROOT/app — set MPR=<name>.mpr" >&2
   exit 2
 fi
 if [ "$(ls "$ROOT"/*.mpr 2>/dev/null | wc -l | tr -d " ")" -gt 1 ] && [ -z "${MPR_EXPLICIT:-}" ]; then
diff --git a/project-bin/model-stamp.sh b/project-bin/model-stamp.sh
index 3636c1f..e002788 100755
--- a/project-bin/model-stamp.sh
+++ b/project-bin/model-stamp.sh
@@ -48,6 +48,53 @@ _real() {  # resolve symlinks by hand (GNU-only resolvers are absent on older ma
   printf '%s/%s\n' "$(cd "$(dirname "$p")" && pwd -P)" "$(basename "$p")"
 }
 
+# Pin git's view of the repository before any `git -C "$MODEL_DIR"` below.
+#
+# WHY (2026-09-26, card-disbursement requirements-driven build). A commit made from a
+# `git worktree` runs this hook with GIT_DIR exported (the absolute .git/worktrees/<name>),
+# and so does `git --git-dir=… commit` (a RELATIVE GIT_DIR). Git's rule for GIT_DIR without
+# GIT_WORK_TREE is "the current directory is the top of the work tree" — so on a two-tree
+# checkout `git -C app …` saw app/ as the top with an empty prefix, the pathspecs
+# `App.mpr mprcontents` matched nothing in an index that holds `app/App.mpr`, and
+# `check --staged` said "no model files staged" and passed a model nobody had verified
+# (a relative GIT_DIR instead made `git -C app` fail, `in_git` false, exit 0: same pass).
+# Resolving the top once from the caller's cwd and exporting absolute paths makes every
+# later `git -C` agree with the git that invoked the hook.
+_mxtk_abs() { case "$1" in /*) printf '%s\n' "$1" ;; *) printf '%s/%s\n' "$(pwd -P)" "$1" ;; esac; }
+case "${GIT_INDEX_FILE:-}" in ''|/*) ;; *) GIT_INDEX_FILE="$(_mxtk_abs "$GIT_INDEX_FILE")"; export GIT_INDEX_FILE ;; esac
+if [ -n "${GIT_DIR:-}" ]; then
+  _gtop="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+  GIT_DIR="$(_mxtk_abs "$GIT_DIR")"; export GIT_DIR
+  if [ -n "${GIT_WORK_TREE:-}" ]; then GIT_WORK_TREE="$(_mxtk_abs "$GIT_WORK_TREE")"; export GIT_WORK_TREE
+  elif [ -n "$_gtop" ]; then GIT_WORK_TREE="$_gtop"; export GIT_WORK_TREE; fi
+fi
+
+# A project with no model yet (requirements-driven Stages P-4) has nothing to verify.
+#
+# WHY (2026-09-25, same build). `find_mpr` failing used to end every command here, `check`
+# included — so the pre-commit hook refused the Stage P intake commit with "no .mpr found"
+# although nothing model-related was staged, and each pre-model commit needed the override.
+# `check` now passes when no .mpr exists at the root or under app/ AND no model path
+# (*.mpr, mprcontents/) is staged; a staged model that no .mpr resolves still refuses, and
+# two .mpr files still refuse (find_mpr's "refusing to guess"). Every other command still
+# needs a model: a stamp or fingerprint over no model would be a constant.
+_mxtk_any_mpr() { local f; for f in "$PROJECT_ROOT"/*.mpr "$PROJECT_ROOT"/app/*.mpr; do [ -e "$f" ] && return 0; done; return 1; }
+if [ "${1:-}" = "check" ] && [ -z "${MPR_FILE:-}" ] && ! _mxtk_any_mpr; then
+  _q=0; for a in "$@"; do case "$a" in -q|--quiet) _q=1 ;; esac; done
+  _staged=""
+  if git -C "$PROJECT_ROOT" rev-parse --git-dir >/dev/null 2>&1; then
+    _staged="$(git -C "$PROJECT_ROOT" diff --cached --name-only --diff-filter=d 2>/dev/null \
+      | grep -E '(^|/)[^/]+\.mpr$|(^|/)mprcontents/' || true)"
+  fi
+  if [ -z "$_staged" ]; then
+    [ "$_q" = 1 ] || echo "  no model in this project yet (no .mpr at the root or under app/) — nothing to verify"
+    exit 0
+  fi
+  echo "  ✗ model files are staged, but no .mpr resolves under $PROJECT_ROOT (root or app/):" >&2
+  printf '%s\n' "$_staged" | head -5 | sed 's/^/      /' >&2
+  exit 1
+fi
+
 MPR="$(find_mpr)" || exit 1
 MPR="$(_real "$MPR")"
 MODEL_DIR="$(dirname "$MPR")"
diff --git a/project-bin/render-improvement-register.sh b/project-bin/render-improvement-register.sh
index a29a914..34e9920 100755
--- a/project-bin/render-improvement-register.sh
+++ b/project-bin/render-improvement-register.sh
@@ -96,9 +96,32 @@ def map_header(hdr_cells):
         # itself still parses — an extra column must not eat the whole row
     return m
 
+# The skill's second table — Corrections (`# | Date | Claim … | Measurement that overturned it …
+# | Where the old claim still stands …`) — is not a findings table. Mapped as one, no header
+# cell reached finding or disposition, so each correction rendered as a blank finding read OPEN
+# and the counts overstated open work by the number of corrections (field run, card-
+# disbursement requirements-driven build, 2026-09-25: 4 findings + 2 corrections read as 6 rows,
+# open 3 with 1 real). A header with a Claim column and no Finding/Disposition column is that
+# table; its rows are listed in their own section and never enter the findings counts.
+def is_corrections_header(hdr_cells):
+    names = [c.lower().strip("*` ") for c in hdr_cells]
+    return (any(n.startswith("claim") for n in names)
+            and not any("finding" in n or "disposition" in n for n in names))
+
+def map_corrections_header(hdr_cells):
+    m = {}
+    for i, name in enumerate(hdr_cells):
+        n = name.lower().strip("*` ")
+        if n in ("#", "id"):                               m[i] = "id"
+        elif "date" in n:                                  m[i] = "date"
+        elif n.startswith("claim"):                        m[i] = "claim"
+        elif "measurement" in n or "overturn" in n:        m[i] = "measurement"
+        elif "still stands" in n or "flush" in n:          m[i] = "where"
+    return m
+
 lines = raw.splitlines()
-rows, unparsed = [], []
-header_map, header_len = None, 0
+rows, unparsed, corrections = [], [], []
+header_map, header_len, header_kind = None, 0, "findings"
 in_comment = False
 i = 0
 while i < len(lines):
@@ -117,7 +140,11 @@ while i < len(lines):
     cs = cells(line)
     nxt = lines[i + 1] if i + 1 < len(lines) else ""
     if SEP_ROW.match(nxt):                          # header row: next line is |---|---|
-        header_map, header_len = map_header(cs), len(cs)
+        if is_corrections_header(cs):
+            header_map, header_kind = map_corrections_header(cs), "corrections"
+        else:
+            header_map, header_kind = map_header(cs), "findings"
+        header_len = len(cs)
         i += 2; continue
     if header_map is None:
         unparsed.append(line.strip())
@@ -125,6 +152,12 @@ while i < len(lines):
     if len(cs) != header_len:
         unparsed.append(line.strip())
         i += 1; continue
+    if header_kind == "corrections":
+        c = {f: "" for f in ("id", "date", "claim", "measurement", "where")}
+        for idx, field in header_map.items():
+            if idx < len(cs): c[field] = cs[idx]
+        corrections.append(c)
+        i += 1; continue
     row = {f: "" for f in ("id", "date", "module", "source", "defect_class",
                            "severity", "finding", "disposition")}
     for idx, field in header_map.items():
@@ -132,7 +165,7 @@ while i < len(lines):
     rows.append(row)
     i += 1
 
-if not rows and not unparsed:
+if not rows and not unparsed and not corrections:
     print(f"FAULT: {REG} exists but contains no table rows this parser recognises.", file=sys.stderr)
     print( "       The register format is skills/improvement-register.md's markdown table —", file=sys.stderr)
     print( "       nothing was written; an empty-but-green page is not a pass.", file=sys.stderr)
@@ -307,6 +340,16 @@ for r in rows:
         f"<span class=\"muted\">{esc(strip_md(r['disposition']))}</span></td></tr>\n")
 parts.append("</table>\n")
 
+if corrections:
+    parts.append(f"<h2>Corrections — {len(corrections)} row(s), not counted as findings</h2>\n")
+    parts.append("<table><tr><th>#</th><th>Date</th><th>Claim</th><th>Measurement that overturned it</th>"
+                 "<th>Where the old claim still stands</th></tr>\n")
+    for c in corrections:
+        parts.append(f"<tr><td>{esc(c['id'])}</td><td>{esc(c['date'])}</td>"
+                     f"<td>{esc(strip_md(c['claim']))}</td><td>{esc(strip_md(c['measurement']))}</td>"
+                     f"<td>{esc(strip_md(c['where']))}</td></tr>\n")
+    parts.append("</table>\n")
+
 parts.append(f"""<div class="footer">
 Rendered from <code>{esc(reg_rel)}</code>. The register is append-only and stays the authority —
 this page is a disposable render. Regenerate: <code>bin/render-improvement-register.sh</code>.
@@ -321,6 +364,8 @@ with open(OUT, "w", encoding="utf-8") as f:
 
 print(f"improvement-register → {OUT}")
 print(f"  rows      {len(rows)} parsed" + (f", {len(unparsed)} UNPARSED (shown on the page)" if unparsed else ""))
+if corrections:
+    print(f"  corrections {len(corrections)} (listed separately, not counted as findings)")
 print(f"  status    " + "  ".join(f"{k}={v}" for k, v in status_counts.items()))
 print(f"  severity  " + "  ".join(f"{k}={v}" for k, v in sev_counts.items()))
 if trend:
diff --git a/project-bin/verify-module.sh b/project-bin/verify-module.sh
index 0fd2e95..dc825b2 100755
--- a/project-bin/verify-module.sh
+++ b/project-bin/verify-module.sh
@@ -97,6 +97,11 @@ if [ -z "${MXTK_ROOT:-}" ]; then
   _self=$(cd "$BIN/.." 2>/dev/null && pwd)
   [ -d "${_self:-/nonexistent}/skills" ] && MXTK_ROOT="$_self"
 fi
+# Export it: the coverage rung runs coverage-preflight.sh as a child process, and that reads
+# MXTK_ROOT from the environment. Derived but unexported, the rung reported INSTRUMENT FAULT
+# "coverage-check.sh not found" with the clone resolved a few lines above (card-disbursement
+# requirements-driven build, 2026-09-25).
+[ -n "${MXTK_ROOT:-}" ] && export MXTK_ROOT
 
 _tool() {
   local n="$1" d
diff --git a/project-tests/e2e/design-audit.js b/project-tests/e2e/design-audit.js
index 38ea69c..7b964a3 100644
--- a/project-tests/e2e/design-audit.js
+++ b/project-tests/e2e/design-audit.js
@@ -95,22 +95,30 @@ const nowIso = () => new Date().toISOString();
 // ============================================================================
 // 1. CSS — which classes are actually DEFINED, and where
 // ============================================================================
-// Selector-position only: we walk the file tracking brace depth and harvest class
-// tokens from the text that PRECEDES an opening brace. Harvesting the whole file
-// would pick up `content: ".foo"` and url fragments and quietly define classes that
-// no rule ever declares — which turns the invented-class check into decoration.
+// Selector-position only: we harvest class tokens from the text that PRECEDES an opening
+// brace. Harvesting the whole file would pick up `content: ".foo"` and url fragments and
+// quietly define classes that no rule ever declares — which turns the invented-class
+// check into decoration. Strings are blanked first and `;` ends a declaration, so a
+// declaration value never reaches a harvest.
+//
+// Every depth, not only depth 0: a rule inside `@media` / `@supports` / `@layer` defines
+// its class just as much. Harvesting depth 0 alone called Atlas's `spacing-outer-bottom-large`
+// "invented" on every page — Atlas emits it ONLY inside three breakpoint @media blocks — while
+// design-spacing.md prescribes that exact class (card-disbursement build, 2026-09-26). An
+// at-rule's own prelude (`@media (min-width: 992px)`) names no class and is skipped.
 function classesInCss(text) {
   const out = new Set();
-  const src = text.replace(/\/\*[\s\S]*?\*\//g, '');
-  let depth = 0, buf = '';
+  const src = text.replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'/g, '""');
+  let buf = '';
   for (let i = 0; i < src.length; i++) {
     const c = src[i];
     if (c === '{') {
-      if (depth === 0) harvest(buf, out);
-      buf = ''; depth++;
-    } else if (c === '}') {
-      depth = Math.max(0, depth - 1); buf = '';
-    } else if (depth === 0) {
+      if (!/^\s*@/.test(buf)) harvest(buf, out);
+      buf = '';
+    } else if (c === '}' || c === ';') {
+      buf = '';
+    } else {
       buf += c;
       if (buf.length > 8000) buf = buf.slice(-4000);
     }
@@ -444,20 +452,29 @@ async function checkStructure(page) {
 }
 
 // ── navigation map, derived from the live navigation document
-function buildNavMap() {
-  const txt = describeNavigation();
-  if (!txt) return { map: new Map(), source: 'unavailable' };
+// Real `describe navigation` output carries an `icon <ref>` clause between the target and
+// the `;` on items, and between the caption and the `(` on groups. Anchoring on `;` right after
+// the page name matched no item that had an icon, so every page read as "no navigation route"
+// and rung 7 never ran (card-disbursement build, 2026-09-26). Match up to the terminator.
+function parseNavigation(txt) {
   const map = new Map();
   let group = null;
   for (const line of txt.split('\n')) {
-    let m = /^\s*menu\s+'([^']+)'\s*\(/.exec(line);
+    let m = /^\s*menu\s+'([^']+)'[^;]*\(\s*$/.exec(line);
     if (m) { group = m[1]; continue; }
     if (/^\s*\);\s*$/.test(line)) { group = null; continue; }
-    m = /^\s*menu item\s+'([^']+)'\s+page\s+([\w.]+);/.exec(line);
+    m = /^\s*menu item\s+'([^']+)'\s+page\s+([\w.]+)(?=[\s;])[^;]*;/.exec(line);
     if (m) { map.set(m[2], { group, item: m[1], via: 'page' }); continue; }
-    m = /^\s*menu item\s+'([^']+)'\s+microflow\s+([\w.]+);/.exec(line);
+    m = /^\s*menu item\s+'([^']+)'\s+microflow\s+([\w.]+)(?=[\s;])[^;]*;/.exec(line);
     if (m) map.set(`microflow:${m[2]}`, { group, item: m[1], via: 'microflow' });
   }
+  return map;
+}
+
+function buildNavMap() {
+  const txt = describeNavigation();
+  if (!txt) return { map: new Map(), source: 'unavailable' };
+  const map = parseNavigation(txt);
   // Resolve microflow-opened items onto pages by module + name tokens. Inference is
   // labelled as such in the row detail; it is never presented as measured routing.
   for (const [k, v] of [...map]) {
diff --git a/project-tests/e2e/helpers.js b/project-tests/e2e/helpers.js
index 83d358e..9cd2a6f 100644
--- a/project-tests/e2e/helpers.js
+++ b/project-tests/e2e/helpers.js
@@ -375,11 +375,17 @@ async function login(page) {
 // GET /logout does NOT work — it renders a page and leaves the session alive
 // (measured: the app root still resolved to the dashboard afterwards). The xas
 // `logout` action does; after it, / redirects to login.html.
+// The token matters: without it the server still answers 200 `{}` and the
+// session lives on. Mendix 11 has no mx.session.getCSRFToken — the token is in
+// mx.session.sessionData.csrftoken (measured 2026-09-26, 11.13: 13 leaked
+// sessions from runs that all "logged out", then the trial cap refused login).
 async function logout(page) {
   try {
     const status = await page.evaluate(async () => {
-      const token = (window.mx && mx.session && mx.session.getCSRFToken)
-        ? mx.session.getCSRFToken() : '';
+      const s = (window.mx && mx.session) || {};
+      const token = s.getCSRFToken ? s.getCSRFToken()
+        : ((s.sessionData && s.sessionData.csrftoken) || '');
+      if (!token) return 'no-token';
       const res = await fetch('/xas/', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'X-Csrf-Token': token },
@@ -476,7 +482,10 @@ async function dismissModal(page, retries = 3) {
 // (no deeplink navigation). parentTitle opens the group; childTitle is the dest.
 async function navTo(page, parentTitle, childTitle) {
   const clickTitle = (t) => page.evaluate((title) => {
-    const a = [...document.querySelectorAll('.mx-navigationtree a')]
+    // A top-bar layout (the `mxcli new` template's home page) renders the same menu as
+    // .mx-navbar with the same a[title] shape; tree-only found nothing there and every
+    // journey died at step 1 (card-disbursement requirements-driven build, 2026-09-25).
+    const a = [...document.querySelectorAll('.mx-navigationtree a, .mx-navbar a')]
       .find((x) => x.getAttribute('title') === title);
     if (a) { a.scrollIntoView({ block: 'nearest' }); a.click(); return true; }
     return false;
diff --git a/project-tests/e2e/journey-runner.js b/project-tests/e2e/journey-runner.js
index 9f4f08c..b9d3a45 100644
--- a/project-tests/e2e/journey-runner.js
+++ b/project-tests/e2e/journey-runner.js
@@ -160,6 +160,25 @@ async function act(page, a, vars, note) {
       await el.scrollIntoViewIfNeeded({ timeout: 2000 }).catch(() => {});
       if (!(await el.isVisible({ timeout: 6000 }).catch(() => false)))
         throw new Error(`.mx-name-${a.widget} not visible`);
+      // Hit-test before the forced click. `force` skips Playwright's actionability check, so a
+      // click lands on whatever sits on top: a toast over the page's header actions swallowed
+      // a click and the step read as "the action did nothing" two steps later (card-disbursement
+      // build, row 5.6). A user's click lands there too, so a cover that outlasts an animation
+      // (5 × 250 ms) is the finding, named by its class.
+      let cover = null;
+      for (let t = 0; t < 5; t++) {
+        cover = await el.evaluate(n => {
+          const r = n.getBoundingClientRect();
+          const e = document.elementFromPoint(r.x + r.width / 2, r.y + r.height / 2);
+          if (!e || n.contains(e) || e.contains(n)) return null;
+          const c = e.closest('[class]') || e;
+          return String(c.className || c.tagName).trim().split(/\s+/).slice(0, 3).join('.');
+        }).catch(() => null);
+        if (!cover) break;
+        await PAUSE(250);
+      }
+      if (cover)
+        throw new Error(`.mx-name-${a.widget} is covered by .${cover} — a click lands on that, not on the widget`);
       await el.click({ force: true }).catch(() => el.click());
       break;
     }
@@ -506,7 +525,12 @@ function controlMutants(j) {
     for (const s of c.steps) {
       for (const spec of (s.data && s.data.assocMustBeSet) || []) {
         if (spec.mustPointAt) {
-          spec.mustPointAt.value = '__LOC_THAT_WAS_NEVER_SELECTED__';
+          // A numeric key (Long/Integer) needs a numeric never-picked value: the text
+          // sentinel is an OQL error there, the targeted check reads INVALID instead of
+          // FAIL, and the rung is reported unproven over a working assertion
+          // (card-disbursement build, row 3.8: a Long package key).
+          spec.mustPointAt.value = /^-?\d+$/.test(String(spec.mustPointAt.value))
+            ? '-424242' : '__LOC_THAT_WAS_NEVER_SELECTED__';
           return;
         }
       }
@@ -515,9 +539,14 @@ function controlMutants(j) {
   }, named('points at the seeded'));
 
   // Rung 5 — the end-to-end outcome claim.
-  add('outcome', 'outcome query with an unreachable floor', (c) => {
-    if (!c.outcome || c.outcome.atLeast === undefined) return false;
-    c.outcome.atLeast = 999999;
+  // An exact `expect` is the stronger claim; the mutant once knew floors alone, so a
+  // journey declaring `expect` had this rung reported unproven (card-disbursement build,
+  // row 4.8).
+  add('outcome', 'outcome query with an unreachable floor or exact value', (c) => {
+    if (!c.outcome) return false;
+    if (c.outcome.atLeast !== undefined) c.outcome.atLeast = 999999;
+    else if (c.outcome.expect !== undefined) c.outcome.expect = 999999;
+    else return false;
   }, named('end state'));
 
   // The denominator is declared, not counted from whatever happened to be added.
@@ -695,7 +724,10 @@ async function runJourney(page, j) {
 
     // ── RUNG 2: ordered spans ────────────────────────────────────────────────
     if (step.spans && step.spans.ordered && step.spans.ordered.length) {
-      const spans = await O.capture(t0, { min: 1 });
+      // Wait for the claimed microflows, not just any span — see otel.js capture() `until`.
+      const claimed = step.spans.ordered;
+      const spans = await O.capture(t0, { min: 1,
+        until: sp => { const got = O.microflowNames(sp); return claimed.every(n => got.includes(n)); } });
       if (!spans.length) {
         record('trace', `${step.name}: spans`, 'INVALID',
                'zero spans captured — Jaeger down or OTel off. Trace rung did NOT run.', req);
@@ -792,12 +824,32 @@ async function runJourney(page, j) {
   }
 }
 
+// ── Exit code ───────────────────────────────────────────────────────────────
+// A walk passes when nothing FAILed and nothing was INVALID. A CONTROL run asks the other
+// question — can the harness tell when the app is broken — so its FAIL rows are the mutants
+// doing their job, and it passes only when every rung's mutant was caught (each `control`
+// row PASS, proven == expected, and at least one rung tried).
+//
+// MEASURED 2026-09-26 (card-disbursement requirements-driven build): the walk's rule was
+// applied to both runs. A control that proved 7 of 7 rungs exited 1 on its own 7 mutant
+// FAILs plus the INVALID a broken landing leaves downstream, so verify-module graded the
+// rung FINDING and the module INCOMPLETE on every run — a control rung that could not go
+// green, and so told the reader nothing when it went red.
+function runExitCode(positiveControl, results, mutants) {
+  if (!positiveControl) return results.some(r => r.verdict === 'FAIL' || r.verdict === 'INVALID') ? 1 : 0;
+  const ctl = results.filter(r => r.rung === 'control');
+  return mutants.expected > 0 && mutants.proven === mutants.expected
+    && ctl.length === mutants.expected && ctl.every(r => r.verdict === 'PASS') ? 0 : 1;
+}
+
 // ── Exports for the rung-4 scope unit test ──────────────────────────────────
 // The SQL builders are pure and exported so their behaviour can be proven against
 // fixture rows without a running app. See tests/e2e/journey-rung4-scope.test.js.
+// runExitCode is exported for tests/wave2/test-journey-control-exit.sh.
 module.exports = {
   sqlRowCount, sqlWatermark, whereScoped, scopeLiteral,
   sqlAssocTotal, sqlAssocLinked, sqlMustPointAt, captureScope, scopeEvidence,
+  runExitCode,
 };
 
 // ── Main ────────────────────────────────────────────────────────────────────
@@ -917,6 +969,9 @@ if (require.main !== module) return;
       console.log('    Unproven is fault, not pass. Declare the missing claim on the journey,');
       console.log('    or accept that this rung has never been shown able to go red.');
     }
+    console.log(runExitCode(true, results, mutants) === 0
+      ? '  control verdict: PASS — every rung\'s mutant was caught; the FAIL/INVALID rows above are the mutants\''
+      : '  control verdict: FAIL — at least one rung is unproven; read the [control] rows above');
   }
 
   fs.mkdirSync(cfg.artifactsDir, { recursive: true });
@@ -939,7 +994,7 @@ if (require.main !== module) return;
   }, null, 2));
   console.log(`  findings → ${path.relative(cfg.root, out)}`);
 
-  process.exit(n('FAIL') === 0 && n('INVALID') === 0 ? 0 : 1);
+  process.exit(runExitCode(POSITIVE_CONTROL, results, mutants));
 })().catch(e => {
   console.error('ERR', e.stack?.split('\n').slice(0, 8).join('\n'));
   process.exit(1);
diff --git a/project-tests/e2e/monkey.js b/project-tests/e2e/monkey.js
index ed00617..a3dd128 100644
--- a/project-tests/e2e/monkey.js
+++ b/project-tests/e2e/monkey.js
@@ -147,13 +147,38 @@ async function typeSafely(page, handle, text) {
   }, b64);
 }
 
+// ── leaving the app is the harness's move, not the app's crash ─────────────
+// MEASURED 2026-09-26 (card-disbursement requirements-driven build, seed 410855898): on the
+// landing page a backAfterSubmit clicked a control that pushes no history entry (a theme
+// toggle), so Back left the app — to login.html, then to about:blank. The oracle scored the
+// non-app page "blank page", every later round on that target scored it again, and the next
+// target was never reached: 10 crash-class findings, one target unfuzzed, no app defect.
+const SIGN_OUT = /\b(sign|log)\s*(out|off)\b/i;
+function leftApp(url, baseUrl) {
+  const base = String(baseUrl).replace(/\/+$/, '');
+  if (!url || (url !== base && !url.startsWith(base + '/'))) return true;
+  return /\/login\.html(?:[?#]|$)/.test(url);
+}
+
+// Open a NAV target, from outside the app if a round left it.
+async function land(page, group, item) {
+  if (leftApp(page.url(), cfg.baseUrl)) await page.goto(cfg.baseUrl + '/', { timeout: 20000 }).catch(() => {});
+  await H.navTo(page, group, item).catch(() => {});
+  await page.waitForTimeout(2000);
+  return page.locator('.mx-page').first().isVisible({ timeout: 8000 }).catch(() => false);
+}
+
 // ── one round ───────────────────────────────────────────────────────────────
 async function round(page, target, bucket) {
   bucket.jsErrors = []; bucket.http5xx = [];
   const t0 = Date.now();
 
   const inputs = page.locator('.mx-page input:visible, .mx-page textarea:visible');
-  const buttons = page.locator('.mx-page button:visible, .mx-page .mx-button:visible');
+  // Sign-out controls are excluded: a monkey that signs itself out measures the login page
+  // for the rest of the target (same run as leftApp: an app shell with a Sign out button
+  // inside the page, clicked by a reloadMidFlow round).
+  const buttons = page.locator('.mx-page button:visible, .mx-page .mx-button:visible')
+                      .filter({ hasNotText: SIGN_OUT });
   const nIn = await inputs.count().catch(() => 0);
   const nBtn = await buttons.count().catch(() => 0);
 
@@ -176,6 +201,11 @@ async function round(page, target, bucket) {
       if (btn) await btn.click({ force: true, timeout: 4000 }).catch(() => {});
       await page.waitForTimeout(1500);
       await page.goBack({ timeout: 6000 }).catch(() => {});
+      if (leftApp(page.url(), cfg.baseUrl)) {
+        // The oracle below then scores the page Forward returns to — the abuse still ran.
+        await page.goForward({ timeout: 10000 }).catch(() => {});
+        what += ' (Back left the app: the click pushed no history entry; returned with Forward)';
+      }
     } else if (abuse === 'rapidTab') {
       for (let i = 0; i < 15; i++) await page.keyboard.press('Tab').catch(() => {});
       await page.keyboard.press('Enter').catch(() => {});
@@ -193,8 +223,11 @@ async function round(page, target, bucket) {
   return traceRan;
 }
 
+// leftApp is exported for tests/wave2/test-monkey-left-app.sh; requiring this file runs nothing.
+module.exports = { leftApp, SIGN_OUT };
+
 // ── main ────────────────────────────────────────────────────────────────────
-(async () => {
+if (require.main === module) (async () => {
   console.log(`MONKEY_SEED=${SEED}   rounds=${ROUNDS}   (re-run exactly: --seed ${SEED})`);
 
   const { browser, page } = await H.launchBrowser();
@@ -221,12 +254,17 @@ async function round(page, target, bucket) {
     const nav = NAV[key];
     const [group, item] = nav.length === 1 ? [null, nav[0]] : nav;
     console.log(`\n=== ${key}`);
-    await H.navTo(page, group, item).catch(() => {});
-    await page.waitForTimeout(2000);
-    const landed = await page.locator('.mx-page').first().isVisible({ timeout: 8000 }).catch(() => false);
-    if (!landed) { finding('info', key, 'not reached', 'nav did not land — target skipped, NOT fuzzed'); continue; }
-    for (let i = 0; i < Math.ceil(ROUNDS / targets.length); i++) {
+    if (!(await land(page, group, item))) { finding('info', key, 'not reached', 'nav did not land — target skipped, NOT fuzzed'); continue; }
+    const n = Math.ceil(ROUNDS / targets.length);
+    for (let i = 0; i < n; i++) {
       anyTrace = (await round(page, key, bucket)) || anyTrace;
+      // A round that leaves no page behind would have every later round re-score the same
+      // screen. Re-land; if that fails, say how much of the target went unfuzzed.
+      if (!(await page.locator('.mx-page').first().isVisible({ timeout: 3000 }).catch(() => false))
+          && !(await land(page, group, item))) {
+        finding('info', key, 'lost', `no page after round ${i + 1} (at ${page.url()}) and re-landing failed — the remaining ${n - i - 1} round(s) NOT fuzzed`);
+        break;
+      }
     }
   }
 
diff --git a/project-tests/e2e/otel.js b/project-tests/e2e/otel.js
index 887ed30..1fc35c1 100644
--- a/project-tests/e2e/otel.js
+++ b/project-tests/e2e/otel.js
@@ -35,20 +35,65 @@ const sleep = ms => new Promise(r => setTimeout(r, ms));
  * Collect every span the service emitted at or after `t0` (ms epoch).
  * Polls, because the exporter batches — spans lag the click by a second or two.
  * Retains `logs`, which is where OTel exception events land in Jaeger.
+ *
+ * `until(spans)` — keep polling until it returns true (or retries run out), not merely
+ * until `min` spans exist. `min: 1` alone stops at the FIRST flushed batch, which is
+ * routinely the page's HTTP/xas spans without the microflow spans behind them: a
+ * journey step then fails "ordered — actual (none)" over a sequence Jaeger holds a
+ * second later (card-disbursement requirements-driven build, 2026-09-26: 2 of 6 trace
+ * claims red on one run, green on the same app with the spans verified in Jaeger).
+ * A predicate that never holds costs the full retry window and returns what it has,
+ * so a genuinely missing microflow still fails — later, never falsely.
  */
-async function capture(t0, { min = 1, retries = 8, waitMs = 1500 } = {}) {
+// Jaeger answers the NEWEST `limit` traces in the window, and says nothing about the rest. On
+// an app with timers and health checks running, 400 traces can be two minutes: measured on the
+// card-disbursement requirements-driven build, 2026-09-27, the newest 400 spanned 08:31-08:33
+// while t0 was 15 minutes back — 4,608 traces in the window, 24 ERROR spans at 08:21 that a
+// one-page capture reported as "0 errors". So page backwards (end = the oldest trace's start
+// - 1 µs) while a page comes back full and still starts after t0, dedupe by trace, and cap
+// the pages. The result carries `.pages`, and `.truncated` when the cap was hit before t0 —
+// a capture that stopped short says so instead of reading as complete. A step's own capture
+// (t0 seconds back) is one page, exactly as before.
+const PAGE_LIMIT = 400;
+const MAX_PAGES = Number(process.env.OTEL_MAX_PAGES) || 25;
+
+async function fetchSince(t0) {
+  const t0Us = Math.floor(t0 * 1000);
+  const nowUs = Date.now() * 1000;
+  const startUs = Math.min(nowUs - 3600e6, t0Us);   // never narrower than the old lookback=1h
+  let endUs = nowUs + 60e6;                          // headroom for clock skew
+  const byId = new Map();
+  let pages = 0, truncated = false;
+  for (;;) {
+    const r = await fetch(`${JAEGER}/api/traces?service=${SVC}&limit=${PAGE_LIMIT}&start=${startUs}&end=${endUs}`);
+    const data = (await r.json()).data || [];
+    pages++;
+    let oldest = Infinity;
+    for (const t of data) {
+      if (!byId.has(t.traceID)) byId.set(t.traceID, t);
+      for (const s of t.spans) if (s.startTime < oldest) oldest = s.startTime;
+    }
+    if (data.length < PAGE_LIMIT || !(oldest > t0Us)) break;
+    if (pages >= MAX_PAGES) { truncated = true; break; }
+    endUs = oldest - 1;
+  }
+  return { data: [...byId.values()], pages, truncated };
+}
+
+async function capture(t0, { min = 1, retries = 8, waitMs = 1500, until = null } = {}) {
   let out = [];
   for (let i = 0; i < retries; i++) {
     await sleep(waitMs);
-    let data = [];
+    let data = [], pages = 0, truncated = false;
     try {
-      const r = await fetch(`${JAEGER}/api/traces?service=${SVC}&limit=400&lookback=1h`);
-      data = (await r.json()).data || [];
+      ({ data, pages, truncated } = await fetchSince(t0));
     } catch (e) {
       // A flaky query shouldn't kill a run mid-suite; retry.
       continue;
     }
     out = [];
+    out.pages = pages;
+    if (truncated) out.truncated = true;
     for (const t of data) for (const s of t.spans) {
       if (s.startTime / 1000 < t0) continue;
       out.push({
@@ -63,7 +108,7 @@ async function capture(t0, { min = 1, retries = 8, waitMs = 1500 } = {}) {
         logs: (s.logs || []).map(l => Object.fromEntries(l.fields.map(f => [f.key, f.value]))),
       });
     }
-    if (out.length >= min) break;
+    if (out.length >= min && (!until || until(out))) break;
   }
   return out;
 }
diff --git a/project-tests/e2e/project.config.template.js b/project-tests/e2e/project.config.template.js
index 4638a10..790e23c 100644
--- a/project-tests/e2e/project.config.template.js
+++ b/project-tests/e2e/project.config.template.js
@@ -128,8 +128,19 @@ function mprPath() {
 // name, which MUST match what the runtime emits, so deriving a wrong name here
 // would make every trace assertion query a service that does not exist. Set
 // NAME_OVERRIDE to null in a project whose directory name is correct.
+//
+// Two-tree layout: ROOT is app/, and "app" names nothing — `id` came out as `app`, so every
+// trace assertion queried a service called `app` (card-disbursement requirements-driven
+// build, 2026-09-25). There the model's own name is the identity, and it is also what
+// `mxcli run --local --trace` defaults OTEL_SERVICE_NAME to. Read inside a try: this file
+// must not throw on require, and a missing .mpr still throws where `mpr` is accessed.
 const NAME_OVERRIDE = null;   // TEMPLATE: set only if your checkout dir != the app name
-const ID = process.env.PROJECT_ID || NAME_OVERRIDE || path.basename(ROOT);
+function derivedId() {
+  const dirName = path.basename(ROOT);
+  if (dirName !== 'app') return dirName;
+  try { return path.basename(mprPath(), '.mpr'); } catch { return path.basename(path.dirname(ROOT)); }
+}
+const ID = process.env.PROJECT_ID || NAME_OVERRIDE || derivedId();
 const DISPLAY_NAME = process.env.PROJECT_DISPLAY_NAME || ID.replace(/[-_]+/g, ' ');
 
 // ============================================================================
diff --git a/project-tests/e2e/report-normalize.js b/project-tests/e2e/report-normalize.js
index af41704..d51a825 100644
--- a/project-tests/e2e/report-normalize.js
+++ b/project-tests/e2e/report-normalize.js
@@ -94,7 +94,8 @@ const INPUTS = {
   verifyDir:       '.claude/loop/verify',
   conformanceDir:  'docs/conformance',
   modulesDir:      'architecture/modules',
-  journeysDir:     'journeys',
+  // verify-module.sh's JOURNEY_DIR, so a project keeping journeys elsewhere is read where it keeps them.
+  journeysDir:     process.env.JOURNEY_DIR || 'journeys',
   runLedger:       '.claude/loop/run-ledger.jsonl',
   deferrals:       '.claude/loop/deferrals.jsonl',
   mpr:             PROJ.mprName,
@@ -156,7 +157,30 @@ const V_CONF = { OK: 'pass', STALE: 'fail', UNDERSTATED: 'fail', OVERSTATED: 'fa
 
 // ── Small utilities ──────────────────────────────────────────────────────────
 
-const abs = p => (path.isAbsolute(p) ? p : path.join(ROOT, p));
+// Two-tree layout (F-042; card-disbursement requirements-driven build, 2026-09-26): ROOT is
+// the model's app/ directory, while docs/, architecture/, .claude/loop/, tests/e2e/artifacts/
+// and journeys/ sit beside it at the repository root. Resolving every INPUT against ROOT made
+// all of them "missing" — 8 instrument FAULTs over artefacts that existed — and wrote the
+// report into a stray app/docs/, so verify-module found no docs/report.json to render. Same
+// cure as project.config.js designPath() and design-audit.js nearRoot(): probe ROOT first (the
+// .mpr, deployment/model/*, .mxcli/catalog.db live there), then the repo root. PROJECT_DIR is
+// ROOT's parent only when this harness sits outside ROOT but inside that parent — the
+// signature of the two-tree checkout; in a single tree it IS ROOT and nothing changes.
+const inside = (dir, p) => { const r = path.relative(dir, p); return !!r && !r.startsWith('..') && !path.isAbsolute(r); };
+const PROJECT_DIR = (!inside(ROOT, __dirname) && inside(path.dirname(ROOT), __dirname))
+  ? path.dirname(ROOT) : ROOT;
+function abs(p) {
+  if (path.isAbsolute(p)) return p;
+  const inRoot = path.join(ROOT, p);
+  if (PROJECT_DIR === ROOT || fs.existsSync(inRoot)) return inRoot;
+  return path.join(PROJECT_DIR, p);
+}
+// An absolute JOURNEY_DIR (verify-module passes $PWD/...) is re-expressed relative to the
+// project, so the report's reproduce commands and evidence paths carry no machine path.
+if (path.isAbsolute(INPUTS.journeysDir) && inside(PROJECT_DIR, INPUTS.journeysDir))
+  INPUTS.journeysDir = path.relative(PROJECT_DIR, INPUTS.journeysDir).split(path.sep).join('/');
+// Outputs are never probed: they belong at the repo root, where verify-module looks for them.
+const absOut = p => (path.isAbsolute(p) ? p : path.join(PROJECT_DIR, p));
 
 // Requirement pointers: rule 4 of the schema. A blank cell in a source is the
 // ABSENCE of a pointer, and "" renders as an empty table cell that reads like an
@@ -193,7 +217,7 @@ function sortKeysDeep(v) {
 
 // Evidence paths are relative to report.json and never base64 (schema rule 3).
 function relTo(outFile, target) {
-  return path.relative(path.dirname(abs(outFile)), abs(target)).split(path.sep).join('/');
+  return path.relative(path.dirname(absOut(outFile)), abs(target)).split(path.sep).join('/');
 }
 
 // Every read goes through here so that "missing" and "unreadable" and "not JSON"
@@ -2422,7 +2446,7 @@ function loadInputs(outFile) {
     .filter(l => !(l.file.status === 'missing'));   // a module dir with no ledger is not an input
 
   // ── Project / run metadata ────────────────────────────────────────────────
-  const meta = { projectId: path.basename(ROOT), mpr: INPUTS.mpr };
+  const meta = { projectId: PROJ.id || path.basename(ROOT), mpr: INPUTS.mpr };   // basename(ROOT) is 'app' in a two-tree checkout
   try { meta.mprModifiedAt = fs.statSync(abs(INPUTS.mpr)).mtime.toISOString(); } catch { meta.mprModifiedAt = null; }
   const md = readJsonInput(INPUTS.metadata);
   if (md.status === 'ok') {
@@ -2478,6 +2502,17 @@ function loadInputs(outFile) {
 // ============================================================================
 function selftest() {
   let bad = 0;
+  // The cases below exercise two walkthrough instruments. WALKTHROUGHS comes from the
+  // project's config — the template declares one, a real project may declare none — so the
+  // selftest pins its own declarations, for this process only (it exits when done). Without
+  // this it failed 2 cases on the template config (mobile-fieldscan is commented out there)
+  // and threw a TypeError on a project declaring neither (card-disbursement
+  // requirements-driven build, 2026-09-26: 41 ok, 4 FAIL, then `canExpressFault` of undefined).
+  WALKTHROUGHS.splice(0, WALKTHROUGHS.length,
+    { instrument: 'full-app-walkthrough', input: 'findings', script: 'full-app-walkthrough.js', tags: [] },
+    { instrument: 'mobile-fieldscan', input: 'findingsMobile', script: 'mobile-fieldscan.js', tags: ['mobile'] });
+  WALKTHROUGH_BY_NAME.clear();
+  for (const w of WALKTHROUGHS) WALKTHROUGH_BY_NAME.set(w.instrument, w);
   const t = (name, got, want) => {
     const ok = JSON.stringify(got) === JSON.stringify(want);
     if (!ok) bad++;
@@ -3028,7 +3063,7 @@ function main() {
   const inputs = loadInputs(outFile);
   const report = sortKeysDeep(normalize(inputs));
 
-  const outPath = abs(outFile);
+  const outPath = absOut(outFile);
   try {
     fs.mkdirSync(path.dirname(outPath), { recursive: true });
     fs.writeFileSync(outPath, JSON.stringify(report, null, 2) + '\n');
diff --git a/project-tests/e2e/review-report.js b/project-tests/e2e/review-report.js
index 46f7d8e..7cf7998 100644
--- a/project-tests/e2e/review-report.js
+++ b/project-tests/e2e/review-report.js
@@ -404,15 +404,49 @@ let leaves = null;
 // Measured 2026-08-18 with coverage.txt = "cannot read BRD: unexpected token at line 1".
 // So: parse first, and only claim a verdict if all five counters are real numbers.
 const COUNTERS = ['total', 'claimed', 'unclaimed', 'phantom', 'doubleClaimed'];
+// Multi-ledger mode (one ledger per BRD) runs coverage-check-all.sh instead, which prints one
+// `<BRD>: CLEAN|FINDINGS|FAULT|NO LEDGER — <counters flattened onto the line>` line per BRD and
+// a closing `N BRD(s) checked.` Read with the one-counter-per-line regexes above, every counter
+// was null and every multi-ledger module carried a permanent coverage FAULT over a clean count
+// (card-disbursement requirements-driven build, 2026-09-26: two modules, `All clean.` in the
+// same coverage.txt as the FAULT row). So: sum each counter across the BRD lines — and leave it
+// null (unmeasured) when any BRD line is a FAULT / NO LEDGER, lacks that counter, or the lines
+// do not add up to the stated BRD count.
+const COVER_BRD_RE = /^(\S+): (CLEAN|FINDINGS|FAULT|NO LEDGER)\b(.*)$/gm;
+const COVER_ON_LINE = {
+  total:         /(?:^|\s)leaves:\s*(\d+)/,
+  claimed:       /(?:^|\s)CLAIMED:\s*(\d+)/,
+  unclaimed:     /(?:^|\s)UNCLAIMED:\s*(\d+)/,
+  phantom:       /(?:^|\s)PHANTOM:\s*(\d+)/,
+  doubleClaimed: /DOUBLE-CLAIMED:\s*(\d+)/,
+};
+let covBrds = 0;
 if (covTxt) {
-  const g = (re) => { const m = re.exec(covTxt); return m ? Number(m[1]) : null; };
-  leaves = {
-    total:         g(/^\s*leaves:\s*(\d+)/m),
-    claimed:       g(/^\s*CLAIMED:\s*(\d+)/m),
-    unclaimed:     g(/^\s*UNCLAIMED:\s*(\d+)/m),
-    phantom:       g(/^\s*PHANTOM:\s*(\d+)/m),
-    doubleClaimed: g(/^\s*DOUBLE-CLAIMED:\s*(\d+)/m),
-  };
+  const perBrd = [...covTxt.matchAll(COVER_BRD_RE)];
+  if (perBrd.length) {
+    covBrds = perBrd.length;
+    const stated = /^(\d+) BRD\(s\) checked\./m.exec(covTxt);
+    const whole = !stated || Number(stated[1]) === perBrd.length;
+    leaves = {};
+    for (const k of COUNTERS) {
+      let sum = whole ? 0 : null;
+      for (const m of perBrd) {
+        if (sum === null) break;
+        const hit = (m[2] === 'CLEAN' || m[2] === 'FINDINGS') ? COVER_ON_LINE[k].exec(m[3]) : null;
+        sum = hit ? sum + Number(hit[1]) : null;
+      }
+      leaves[k] = sum;
+    }
+  } else {
+    const g = (re) => { const m = re.exec(covTxt); return m ? Number(m[1]) : null; };
+    leaves = {
+      total:         g(/^\s*leaves:\s*(\d+)/m),
+      claimed:       g(/^\s*CLAIMED:\s*(\d+)/m),
+      unclaimed:     g(/^\s*UNCLAIMED:\s*(\d+)/m),
+      phantom:       g(/^\s*PHANTOM:\s*(\d+)/m),
+      doubleClaimed: g(/^\s*DOUBLE-CLAIMED:\s*(\d+)/m),
+    };
+  }
 }
 const covMissing = leaves ? COUNTERS.filter((k) => leaves[k] == null) : COUNTERS;
 if (covTxt && covMissing.length === 0) {
@@ -424,7 +458,7 @@ if (covTxt && covMissing.length === 0) {
     verdict: bad.length ? 'fail' : 'pass', provenance: 'measured',
     detail: 'leaves ' + leaves.total + ' · claimed ' + leaves.claimed + ' · unclaimed ' +
             leaves.unclaimed + ' · phantom ' + leaves.phantom + ' · double-claimed ' +
-            leaves.doubleClaimed,
+            leaves.doubleClaimed + (covBrds ? ' · summed over ' + covBrds + ' BRD ledger(s)' : ''),
     measuredAt: STARTED,
     nonVacuity: { controlRan: false, note: 'coverage-check has no positive control' },
     evidence: [{ type: 'log', path: relOut(path.join(DIR, 'coverage.txt')) }],
@@ -437,7 +471,11 @@ if (covTxt && covMissing.length === 0) {
     (covTxt
       ? 'coverage-check wrote output but no ' + covMissing.join('/') + ' count could be ' +
         'read from it, so it did not finish a count. An unreadable counter is an ' +
-        'unmeasured one, never a zero.'
+        'unmeasured one, never a zero.' +
+        (covBrds && covMissing.length === 1 && covMissing[0] === 'total'
+          ? ' Its per-BRD lines carry no `leaves:` — a coverage-check-all.sh from before ' +
+            '2026-09-27 drops it; run bin/sync-project.sh to refresh the installed copy.'
+          : '')
       : 'coverage-check produced no output')));
   // The rollup must not inherit half-parsed counters either.
   if (covMissing.length) leaves = null;
diff --git a/skills/architecture-blueprint.md b/skills/architecture-blueprint.md
index 8fa5a8b..49c20cb 100644
--- a/skills/architecture-blueprint.md
+++ b/skills/architecture-blueprint.md
@@ -327,13 +327,20 @@ the consuming project's `PROJECT.md` — rows under its dependencies and open-qu
 register (`conversion-runbook.md` §"One decision register"), and a second register beside it is
 how the same question ends up with two answers:
 
-| # | Item | Type | Resolution / owner |
+| ID | Item | Type | Resolution / owner |
 |---|---|---|---|
-| 1 | Unresolved BRD `openQuestions` | Decision needed | who decides, by when |
-| 2 | Cross-module associations | Scripted via mxcli (BUG-02 fixed v0.13.0) | which module's script creates each, scheduled in which build step |
-| 3 | Marketplace "Buy" decisions | Dependency | confirmed / deferred |
-| 4 | mxcli known bugs on this app's shape | Handoff | see `bug-logs/mxcli-bugs.md` |
-| 5 | Behavior changes vs. source | Faithful-rebuild risk | documented + signed off |
+| OI-1 | Unresolved BRD `openQuestions` | Decision needed | who decides, by when |
+| OI-2 | Cross-module associations | Scripted via mxcli (BUG-02 fixed v0.13.0) | which module's script creates each, scheduled in which build step |
+| OI-3 | Marketplace "Buy" decisions | Dependency | confirmed / deferred |
+| OI-4 | mxcli known bugs on this app's shape | Handoff | see `bug-logs/mxcli-bugs.md` |
+| OI-5 | Behavior changes vs. source | Faithful-rebuild risk | documented + signed off |
+
+**Number these rows `OI-n`, never a bare `1`, `2`, `3`.** `bin/gate-check.sh` reads the first
+cell of every table row in `PROJECT.md` as a Stage field, so a register row numbered `| 7 |`
+counts as a cutover decision. On a card-disbursement requirements-driven build (2026-09-25) a
+row `| 7 | Behaviour change … |` made Stage 7 report FAIL before Stage 4 had begun; renumbering
+the rows `OI-n` cleared it. The same misreading can make a `CONFIRMED` row `| 3 | … |` pass the
+Stage 3 ✋ gate.
 
 **Every unresolved BRD `openQuestion` must appear here.** Do not resolve them silently to make the diagram tidy — an open question in a diagram is honest; a wrong assumption baked into MDL is expensive.
 
diff --git a/skills/brd-generation.md b/skills/brd-generation.md
index 4bb7aad..fa87ba0 100644
--- a/skills/brd-generation.md
+++ b/skills/brd-generation.md
@@ -217,7 +217,7 @@ of BRDs kept guessing at the shape.
 | `generatedAt`, `appType`, `summary{}`, `openGaps[]` | top level | all three scaffolders | the fingerprint that identifies a BRD as code-extracted |
 | `webBlocks[]`, `timers[]` | top level | all three scaffolders | |
 | `reviewStatus` | `useCases[]` | all three (`use-case-mapper.js`) | `pending` until a human reviews the narrative |
-| `status` | `useCases[]` | set by `brd-validation.md` check 6 | `code-inferred` / `doc-confirmed` / `doc-conflict` |
+| `status` | `useCases[]` | set by `brd-validation.md` check 6 | `code-inferred` / `doc-confirmed` / `doc-conflict` / `proposed` (no code and no document behind it — this build's own design, owed a sign-off) |
 | `hiddenRules[]` | `microflows[]` | java-angular and node-express-react only (`microflow-mapper.js`) — **not** OutSystems | rules found inside code that the domain model does not show |
 | `mendixType`, `attributeCount` | `domainEntities[]` | all three (`domain-entity-mapper.js`) | `attributeCount` is the retired form of `attributes[]`; the count is derivable from the list, the list is not derivable from the count |
 | `gaps[]` | every mapped item | all three | feeds `confidence` |
diff --git a/skills/brd-to-build-plan.md b/skills/brd-to-build-plan.md
index ec8c8c2..bd2113c 100644
--- a/skills/brd-to-build-plan.md
+++ b/skills/brd-to-build-plan.md
@@ -624,8 +624,8 @@ Before any `GRANT` script, decide and document:
 **⛔ Demo user password rules — read before writing any security MDL:**
 
 - **Never touch MxAdmin.** Every project ships with MxAdmin and password `1` as a standard. Do not wipe it, reset it, or re-create it. Any script that modifies MxAdmin is wrong.
-- **Do not set passwords for demo users.** Create the user account (name, user role); leave the password field unset. The user switches to a demo account from inside the app after signing in as MxAdmin — no password is required. Setting a password is unnecessary and creates inconsistency across projects.
-- **Pattern:** `create demo user "firstname.lastname" with roles "Module"."Role";` — nothing more. No password block.
+- **A demo user's password is mandatory in the grammar, so give it one throwaway value.** On mxcli v0.24.0 `CREATE DEMO USER '<name>' (<UserRole>)` with no password is a parse error (`mismatched input '(' expecting PASSWORD`, `mxcli syntax security demo-user`). Pick one value per project that meets the project's password policy (a demo user also needs security above Off, and a 12-character minimum is common — `walking-skeleton.md`). Record it in the build plan, reuse it for every demo user, and never use a real credential. Signing in as MxAdmin and switching demo user from inside the app still needs no password.
+- **Pattern:** `create demo user 'firstname.lastname' password '<project demo password>' (<UserRole>);` — a single-quoted name and a project **user** role, not a qualified module role. The older form `create demo user "firstname.lastname" with roles "Module"."Role";` (no password) no longer parses (a card-disbursement requirements-driven build, 2026-09-25).
 
 ## Step 7: Navigation Wiring
 
diff --git a/skills/brd-validation.md b/skills/brd-validation.md
index 6867dc2..9d668f8 100644
--- a/skills/brd-validation.md
+++ b/skills/brd-validation.md
@@ -126,6 +126,12 @@ Once `KB.md` exists (Phase 4), reconcile each use case against it:
   as check #2, don't have the pipeline silently pick a side.
 - **No coverage:** doc-KB says nothing about this screen/action → leave `status` as
   `code-inferred`. This is not itself a finding; it just means Phase 4 didn't cover that area.
+- **No source at all:** on a `documents`/`interview`/`greenfield` BRD a use case can be this
+  build's own design — a screen or flow no code and no document describes (the operator UI of
+  a card-disbursement requirements-driven build: 21 of 45 use cases). Set `status: proposed`,
+  never `code-inferred` — that claims a code source that does not exist — and give it an
+  `openQuestions` entry for sign-off, or cite the `CONFIRMED` register row that signed it off.
+  A `proposed` use case is not corroboration: `bin/brd-report.sh` counts only `doc-confirmed`.
 
 **Update these fields in place on the BRD JSON, not in a separate reconciliation file** — this
 is what makes re-running `node generate-report.js` produce the combined code+doc report for
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 7f8c030..18f58c3 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -3,6 +3,8 @@
 **Applies to:** any mxcli project — see Entry Modes below for where your project type enters the pipeline.
 **Requires:** bash and Python 3 — this skill runs toolkit shell scripts. Run `bin/doctor.sh` once on a new machine; it names anything missing and how to get it. Windows: use Git Bash, and see the Prerequisites section of `conversion-runbook.md`.
 
+**Which `bin/`:** a bare `bin/<script>` in this runbook is the **toolkit's** copy — run it as `<Toolkit root>/bin/<script>`, the root being the first row of your project's `CLAUDE.local.md` wiring table. Only the `project-bin/*` scripts are installed into a project's own `bin/`, and for those `./bin/<script>` is right. (A Stage 0 session ran `bin/source-sufficiency.sh` from the project root and found no such file — 2026-09-25.)
+
 **Purpose:** The spine the toolkit was missing. Each stage below has an owning skill and each skill is good — but until now nothing said *what a stage must produce before the next one starts*, *what the user has to decide*, or *whose job it is to ask them*. This skill is that layer: a stage completes when a decision is on record, not when the agent stops typing.
 
 **Upstream:** `bootstrap-project.md` (Stage P scaffolding), `query-the-model.md` (the lookup-before-ask discipline every gate depends on).
diff --git a/skills/extractor-quality-loop.md b/skills/extractor-quality-loop.md
index d50cc5f..fea175d 100644
--- a/skills/extractor-quality-loop.md
+++ b/skills/extractor-quality-loop.md
@@ -119,6 +119,22 @@ non-standard auth/middleware files that define routes) appears in `inventory.end
 
 **Overall score = sum(dimension_score × weight) / sum(weights)**
 
+### A source that is not code-shaped: replace the dimensions, keep the contract
+
+The six above are code-shaped (fields, FKs, enums, routes, specs). A source with none of
+those — a process model, a form catalogue, a spreadsheet of rules — gets **its own**
+dimensions, declared in the validator header and used as the `dimensions` keys of
+`extraction-quality.json`. Scoring a code dimension the stack does not have is the wrong
+move: 0 found / 0 expected scores 100 by arithmetic and pads the average (the
+Suspicious-Zero Gate below exists for exactly that).
+
+Field case (a card-disbursement requirements-driven build, 2026-09): an Enterprise
+Architect XMI/BPEL process model was scored on **nodes, transitions, guards, documentation,
+diagram membership, and diagram-image label recall** — each a count of items in the source
+against items captured. What stays fixed whatever the dimensions are: every expected count
+comes from the source (never from the inventory), 0–100 per dimension, weights stated,
+the ≥ 95% gate, the Suspicious-Zero Gate, and the self-graded rule below.
+
 ## What Is Explicitly NOT Scored
 
 The following are intentionally excluded — they belong in BRDs and human review, not the
diff --git a/skills/journey-proof.md b/skills/journey-proof.md
index 473ef49..d001f01 100644
--- a/skills/journey-proof.md
+++ b/skills/journey-proof.md
@@ -116,8 +116,8 @@ the same vacuity bug one level up.
 | `trace-order` | expect a microflow that never fires | span ORDER, not existence |
 | `trace-negative` | assert a microflow that *did* run must not have | the negative trace claim |
 | `data-delta` | expect +2 from a +1 action | the row-count delta |
-| `data-target` | `mustPointAt` a value never picked | the association *target* |
-| `outcome` | unreachable floor on the outcome query | the end-to-end claim |
+| `data-target` | `mustPointAt` a value never picked (numeric for a numeric key) | the association *target* |
+| `outcome` | unreachable `atLeast` or `expect` on the outcome query | the end-to-end claim |
 
 **A rung with no mutant is UNPROVEN, which is `fault` — never `pass`.** Same discipline as INVALID.
 
@@ -216,6 +216,8 @@ across runs, so a diff in the report means a diff in the project.
 | Two windows, one account | menu entries disappear mid-run, read as "role restriction" | One account per window; a menu that *loses* entries mid-run is never a role restriction |
 | `DEMO_SPEED` raised | four real-looking failures | It divides hand-tuned pauses too |
 | Seeds return nothing | whole journey INVALID | Usually a race: runner fired while the runtime was still warming. **INVALID, not FAIL** |
+| Seed with `HAVING` and no `GROUP BY` | "mismatched input 'HAVING'", journey INVALID | Put the precondition in the WHERE as a scalar subquery (`… AND (SELECT COUNT(x.ID) FROM M.E AS x) = 2`): no row when it fails, so INVALID, never a feature FAIL (BUG-153) |
+| "Newer than baseline" watermark on a date | `MAX(date)` comes back as a Java `Date.toString()` string that OQL "could not be parsed" | Put the watermark on `ID` — numeric, monotonic, round-trips (BUG-153) |
 | Raw `curl` to M2EE | "Authentication failed" | The scheme is not plain base64-in-a-header. Use the tool that works, and do not conclude an outage from your own broken client |
 
 ---
diff --git a/skills/learned-constants-and-secrets.md b/skills/learned-constants-and-secrets.md
index 4805095..f320475 100644
--- a/skills/learned-constants-and-secrets.md
+++ b/skills/learned-constants-and-secrets.md
@@ -192,7 +192,7 @@ developer sees in Studio Pro without leaving the model.
 
 ---
 
-## Step 5 — Run the audit, and read all four verdicts
+## Step 5 — Run the audit, and read all five verdicts
 
 ```bash
 bin/constants-audit.sh            # table + summary
@@ -207,6 +207,7 @@ It never prints a value — only `EMPTY` vs `SET`, the type, and the flags.
 | `EMPTY` | no model default | fine on a licensed node whose Portal sets it; on a free node, in a Docker run, or in a fresh clone it is blank at runtime. Give it a value or a sentinel |
 | `MODEL-SECRET` | a secret-named constant that does carry a model default | deliberate on a demo (the value is in git, Team Server and every clone — say "burned"); never right for anything holding real data |
 | `WAIVED` | a finding with a register line | nothing — but re-read the reason at each stage gate |
+| `SENTINEL` | the default is a `__NAME__` placeholder (`__SET_ME__`, Step 3) — not a finding, and no value of that shape is a secret | make sure every environment you run in overrides it; the app fails fast where one does not |
 
 **Completion criterion, with the denominator:** the run states the total (`N constants`) and
 ends at **0 unwaived findings**. `WAIVED` is legal; silence is not — an audit nobody ran is not
diff --git a/skills/learned-css-that-never-applied.md b/skills/learned-css-that-never-applied.md
index 10d4118..ef58b85 100644
--- a/skills/learned-css-that-never-applied.md
+++ b/skills/learned-css-that-never-applied.md
@@ -82,6 +82,14 @@ consulted, so "mine is later" was never relevant. The fix was `.mx-listview > ul
 the framework deliberately blanking that element. A rule you add without outranking it is not
 "competing", it is being deleted.
 
+**The same erasure hides inside classes a port calls "Atlas-native, styled by the knobs".** Some
+Atlas base properties have no custom-variables knob at all: `.btn { font-weight: normal }` and,
+above 767px, `.form-group { display: flex; flex-direction: row }`. Field case (a
+card-disbursement requirements-driven build, Mendix 11.13.0, 2026-09-25): every button rendered
+at 400 against the design system's 500, and hand-written labels sat beside their inputs;
+`check-design-reaches-app.sh` saw nothing, because both classes counted as bound. Port each such
+property as its own rule, and read it back as a computed value, not as a knob that was set.
+
 ---
 
 ## The diagnostic — two reads, before you touch the rule
diff --git a/skills/learned-datagrid-customcontent-binding.md b/skills/learned-datagrid-customcontent-binding.md
index cad8ff3..59e6d92 100644
--- a/skills/learned-datagrid-customcontent-binding.md
+++ b/skills/learned-datagrid-customcontent-binding.md
@@ -7,6 +7,10 @@ field, anything bound to the row object. Read this **before** writing the widget
 **Status:** confirmed on Mendix 11.12.0 / mxcli v0.16.0, 2026-07-30, by observing the
 Studio Pro error pane before and after. Not confirmed by `mxcli check` — see the trap below.
 
+**v0.24.0 (BUG-142):** the rule holds for every `dynamictext` bound to an object, not only in
+customContent columns — only a bare attribute or a quoted literal builds. `check --references`
+now refuses the parenthesised forms but still passes `if … then … else`.
+
 ---
 
 ## The rule
diff --git a/skills/learned-db-assertions.md b/skills/learned-db-assertions.md
index d4897c7..a64d208 100644
--- a/skills/learned-db-assertions.md
+++ b/skills/learned-db-assertions.md
@@ -17,6 +17,9 @@ suite that silently loses this rung is a UI-only suite still reporting "e2e".
 2. Only if that genuinely 401s, **and only on a host that actually has PostgreSQL**, fall back
    to a direct DB connection (below) — and record in the run report that the data rung came
    from a different instrument than usual.
+   **Not `mx.data.get` from the browser.** The React client (`OptimizedClient: Yes`, Mendix 11)
+   throws `mx.data.get is disabled`, so a Playwright probe that reads rows that way errors out
+   and says nothing about the data (field case, Mendix 11.13.0, 2026-09-25).
 3. If neither is available, the run has **no data rung**. Say so in the report. A suite that
    silently drops to UI-only is the same class of false-green as a spec that logs in as admin:
    it still prints "passed".
diff --git a/skills/learned-detection-gaps.md b/skills/learned-detection-gaps.md
index 0730376..6e670d3 100644
--- a/skills/learned-detection-gaps.md
+++ b/skills/learned-detection-gaps.md
@@ -40,11 +40,17 @@ verification rungs form a ladder, and a green result only certifies what that ru
 | A **navigation menu item pointing at a popup-layout page** (`ConversationalUI.Layout_FloatingPopup` and kin), or at any page that takes a parameter | rungs 1–3 — `check --references` reports **0 errors**, exec succeeds, `SHOW NAVIGATION MENU` reads the entry back cleanly | live runtime, or reading the target page's own `Layout:` and parameter list | A nav item cannot pass a page parameter, so the page opens without its context object and a popup layout renders as a dead-end modal. Note what the green result certifies: the *reference* is valid — the page exists. Nothing on the static ladder checks that a nav item is a legal way to reach it. Enumerate entry points and read `Layout:` first (`ui-preflight-pages.md` Step 0) | a MOC/PSSR app replacement, 2026-09-16 |
 | `elseif` in a page/widget expression (DynamicClasses, Visible, …) | rungs 1–3 | native `mx check`: CE0117 | Nested `else if` — the native page-expression parser has no `elseif` token (microflows compile it away; page expressions pass through). Already a preflight bullet: `learned-mdl-preflight.md` | a product-provisioning PoC project, 2026-08-13 |
 | **Quoted** association-path / attribute bindings: `attribute: "Assoc/Attr"`, quoted names in `attributes: [...]`, `$Obj/"Attr"` | rungs 1–3 (`DESCRIBE` round-trips the corrupted binding as if fine) | native `mx check`: CE1613 / CE0117 naming the literal quoted string | Association paths and member accesses go **unquoted** — the one place an "always quote identifiers" convention must break. `resolveAssociationAttributePath` doesn't strip quotes before splitting on `/` | a martial-arts-academy PoC project 2026-08-14 + independently a product-provisioning PoC (BUG-75 family) |
-| `calculated by` on an attribute | rungs 1–4 **and** BSON looks like a normal attribute unless decoded | live retrieve: value always empty; `SHOW CALLERS` of the microflow: none | Don't use it this mxcli version: stored attribute + explicit compute-change-commit. Verify with `mx.data.get` before anything depends on it | BUG-98 |
+| `calculated by` on an attribute | rungs 1–4 **and** BSON looks like a normal attribute unless decoded | live retrieve: value always empty; `SHOW CALLERS` of the microflow: none | Don't use it this mxcli version: stored attribute + explicit compute-change-commit. Verify with a live retrieve (`mxcli oql --direct`, `learned-db-assertions.md` — `mx.data.get` is disabled in the React client) before anything depends on it | BUG-98 |
 | A **`PARALLEL SPLIT` path with no terminator node** — i.e. every scripted split, since MDL cannot write one | rungs 1–4, and in **both directions**: `check`, `exec`, `DESCRIBE WORKFLOW`, `mxbuild` and native `mx check` report identically on the broken and the repaired model | a **live run**: count the tasks the engine opens at the split. Consecutive *End of parallel split path* rows with no task between them | `bin/wf-add-path-terminators.py <unit> --apply` after the script, and after every later script that rewrites the workflow; verify by running it, never by building it | BUG-121, `learned-workflow-patterns.md` §23 |
+| A **workflow branch point** in a `create workflow` script: a `DECISION`, or a call-microflow task with Boolean or enumeration outcomes (both go through the same outcome writer) | rungs 1–4, lint, **and rung 6 within one deploy**: every journey that starts and finishes an instance passes | rung 6 **across a restart or redeploy**. An instance left paused after the decision comes back `Incompatible` (*"A selected outcome has been replaced in the already executed path"*), even when the restart changes nothing in the model | mxcli writes condition outcomes with no `PersistentId`, so the runtime gives them a new identity on every load. There is no MDL fix. Once per workflow, probe it: start an instance, let it stop at the first task after a decision, restart the app, read the instance's state. Until upstream fixes it, the app's workflow admin page must list and handle `Incompatible` instances. Note what the ladder cannot express here: the defect is not in any one deploy, it is *between* two | BUG-141 |
 | `create import mapping` array-to-child binding | rungs 1–4; `DESCRIBE IMPORT MAPPING` looks correct | live retrieve after a real `import from mapping`: child list empty | Unverified-until-proven-live; severity not yet classified — read BUG-99's hold before blaming mxcli | BUG-99 |
 | Cross-module `ALTER PAGE ... INSERT` of a DG2 column | rungs 1–3 (`DESCRIBE` *omits* the malformed column) | rung 5: Studio Pro loader `InvalidCastException`; `mx check` also crashes | Forbidden construct; recovery is `create or replace page` | BUG-96 |
-| Expression in `ContentParams:` inside a customContent column | rungs 1–3 (`DESCRIBE` normalises correct and broken forms to the same text) | mxbuild / Studio Pro error pane: CE1613 | Bind with `Attribute:`, never an expression | `learned-datagrid-customcontent-binding.md` |
+| An `if` with no `else` inside an `on error { }` handler body | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE0079 / CE0773 — the `if`'s false flow is not configured | Keep handler bodies straight-line calls; move the branching into a sub-microflow the handler calls | card-disbursement requirements-driven build, 2026-09-26 |
+| An entity, attribute or Java action parameter named with a Mendix-reserved word — `Case` failed as both an entity and a Java action parameter; `Context` as an attribute | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE7247 | Qualify the name (`CustomerCase`, `ApprovalContext`). The reserved list is Mendix's, not MDL's, so quoting does not help — mxcli's bundled `check-syntax` skill lists what it knows (`syntax domain-model keywords` lists MDL's keywords, not these) | card-disbursement requirements-driven build, 2026-09-26; BUG-149 |
+| A data widget on a page some role can open without read access to the widget's entity — even in a section that role never sees (BUG-94: no role-scoped visibility) | rungs 1–3, **and a bare `mx check` on a scratch copy** (cause of the difference not isolated) | exec.sh's mxbuild gate: CE2729 per widget attribute | Give that role read under an XPath no row satisfies (`[Assoc = empty and Assoc != empty]`), or move the widget to a page only the reading roles open. A clean scratch probe is not a pass for pages with security-scoped widgets — gate on the real exec | card-disbursement requirements-driven build, 2026-09-26 |
+| `[%CurrentUser%]` in a retrieve inside a microflow a REST, scheduled or system-context path can reach | rungs 1–5, lint, and every UI journey | rung 6 **on the system-session path only**: *"token cannot be used in a system session"*, the operation answers 500 | Look the account up by login name — `learned-microflow-patterns.md` → `[%CurrentUser%]` | card-disbursement requirements-driven build, 2026-09-27 |
+| Expression in `ContentParams:` on any `dynamictext` in an object context (customContent column, list view, data view) | rungs 1–3 — on v0.24.0 `check --references` refuses the parenthesised forms but **passes `if … then … else`**; `DESCRIBE` hides the difference | mxbuild / Studio Pro error pane: CE1613 | Bind a bare attribute (`Attribute:`) or a quoted literal only; a computed label becomes a String attribute, tone goes in `DynamicClasses` | BUG-142; `learned-datagrid-customcontent-binding.md` |
+| `get workflows for $X` on an entity no workflow uses as its context yet | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE1870 | Stub the helper and write its body in the same step as the workflow | BUG-149 |
 | A `commit` (or `create … commit`) **inside a loop** — and every other shape defect `mxcli lint` has a rule for (CONV011, empty container MPR006, empty nanoflow MPR002) | rungs 1–4 **including exec.sh's mxbuild gate**, and `mxcli check` (whose MDL001/MDL067 hints are not lint, however the script header labels them) | `mxcli lint` — but only if something *runs* it | On a 2026-09-24 field project the gate-agent, where lint was an optional step, had been spawned 0 times against 21 `exec.sh` runs and 234 raw `mxcli exec` runs; `lint-gate.sh` had run twice, by hand, to seed a baseline. A migration flow shipped three commits-in-a-loop under "✅ applied · mxbuild clean". Fix: `exec.sh` runs `lint-gate.sh` after every clean mxbuild and writes the lint verdict into the BUILD-LOG row (`LINT ROSE` exits 1, write kept, `SKIP_LINT=<reason>` recorded). **An instrument that lives only in an agent definition is a suggestion; count its BUILD-LOG rows before claiming coverage** | a marketplace guest-group migration, 2026-09-24 |
 | `Title = null` (or any `= null`) as an **XPath retrieve constraint** | rungs 1–3 — `check --references` clean, exec succeeds, and mxcli's **own OQL engine evaluates the query** and returns rows, so even a read-back looks right | native `mx check` / mxbuild: CE0161 | XPath has no `= null`; write `not(Title)` / `Title != ''` for the empty test. Note what makes this one expensive: mxcli's query engine is more permissive than the model loader, so "I ran the query and it worked" is **not** evidence the constraint is legal | PRD benchmark, Arm A (Maurits Visser), 2026-09 |
 | A page layout migrated with `ALTER PAGES … WHERE LAYOUT = X`, in a project whose page scripts **hardcode** `Layout:` inside `create or replace page` | rungs 1–6 — every rung, including live runtime: the app loads, every page renders, every journey passes. There is no error anywhere | a screenshot **of the nav shell** on every page, or `grep -l 'Layout: <old>' mdlsource/` after the migration | `create or replace page` rewrites the page **wholesale**, layout included — so re-running any older page script silently reverts that page to the old shell, and the app ships **two navigation shells at once**. Found when 4 of 7 screens had no navigation at all, just a bare hamburger, after a UI fix loop re-ran five page scripts. A layout migration is not done until the `Layout:` literal is fixed **in the source scripts**; the `ALTER` is a one-shot, the scripts are the repeat offender | PRD benchmark, Arm A (Maurits Visser), 2026-09 |
diff --git a/skills/learned-dg2-patterns.md b/skills/learned-dg2-patterns.md
index 1e31ef7..2117dbd 100644
--- a/skills/learned-dg2-patterns.md
+++ b/skills/learned-dg2-patterns.md
@@ -141,6 +141,38 @@ pluggablewidget 'com.mendix.widget.web.datagrid.Datagrid' "dgName" (
 - On the native `DATAGRID` form, `DynamicRowClass` is not MDL-able either (MDL-WIDGET01) —
   set it via MCP after exec (`pg_patch_page`, path `.../object/dynamicRowClass`).
 
+## Column sizing at phone width — shrink what may ellipsize, floor what must read whole
+
+mxcli writes every DG2 column's `minWidth` as `auto` with no MDL property for it, and a column
+`Size` is only legal with `ColumnWidth: manual` (MDL-WIDGET10). So column minimums live in the
+theme. Two facts decide the CSS:
+
+- DG2 puts `min-width: 0` on every `.th` and `.td`, so a `1fr` column shrinks below its content.
+- A custom-content cell's wrapper `.td-custom-content` is a flex item of `.td` and keeps
+  `min-width: auto`, so long text in it grows past the column and runs under the next one.
+
+**Before (the obvious fix, wrong):** `.td > .td-custom-content { min-width: 0; }` on every cell.
+Long names ellipsize — and every status pill and id shrinks below its width and spills out of its
+cell. Field case (a card-disbursement requirements-driven build, Mendix 11.13.0, 2026-09-27):
+20 of 20 pills spilled on one list page at 390px, 5 of 5 on the dashboard, and a header read
+"Packa…".
+
+**After:** shrink only the wrapper around text that may ellipsize, floor every header and every
+cell that must read whole, and let the grid scroll sideways inside its card:
+
+```scss
+.td > .td-custom-content:has(.<text-class>) { min-width: 0; }          // may ellipsize
+.widget-datagrid-grid .th,
+.widget-datagrid-grid .td:has(.<id-class>, .<pill-class>, .<time-class>) { min-width: max-content; }
+.widget-datagrid-content { overflow-x: auto; }
+.widget-datagrid-grid { min-width: <the wireframe's grid minimum>; }
+```
+
+The class names in `<…>` are your design system's — grep the theme for them, do not copy these.
+Measured after: 0 of 20 and 0 of 5 spilled at 390, names still ellipsized, desktop widths
+unchanged. Measure per cell (spilled / total, at 390 and 1280); a screenshot glance misses one
+clipped pill in twenty.
+
 ## Grants
 
 A grid is a widget on a page — no separate grant beyond the page VIEW grant. Access to the
diff --git a/skills/learned-mdl-cannot-express.md b/skills/learned-mdl-cannot-express.md
index abf6270..975ee69 100644
--- a/skills/learned-mdl-cannot-express.md
+++ b/skills/learned-mdl-cannot-express.md
@@ -22,8 +22,13 @@ would have taken four minutes to find at Stage 3, when the design was still chea
 | A **file upload** control | nothing. `mxcli syntax page.widgets` prints the complete keyword set and there is no `filemanager`/`fileuploader`/`imageuploader` in it — `filemanager fm (…)` is a parse error, not an unknown property | ⛔ **not buildable** |
 | A **pluggable widget with a list-valued property** (an HTML element's `attributes`, a chart's `series`, a datagrid's `columns` written by hand) | nothing. On v0.20.0 a pluggable widget takes **scalar properties in parens and no body at all**: `pluggablewidget '<id>' <name> ( tagName: 'div' )` parses, and *every* body form is rejected with `mismatched input '<keyword>' expecting '}'` — the object-list keywords (`attribute`, `event`) and the child-slot keywords (`tagcontentcontainer`) alike | ⛔ **not buildable** |
 | A page-level **boolean a button toggles** (a collapsible section, a show/hide) | page `variables:` exist and can be READ by `visible:`, but nothing in MDL writes one — that needs a nanoflow | ⛔ **not buildable** |
-| A **gallery empty-placeholder** | no `emptyState`/`emptyplaceholder` block on `gallery` (`datagrid` DOES have `emptyplaceholder`) | ⚠️ **workaround**: a one-attribute non-persistent entity the page switches on |
+| A **gallery empty-placeholder** | no `emptyState`/`emptyplaceholder` block on `gallery`. On v0.24.0 the Data grid 2 `emptyplaceholder` slot fails mxbuild with CE0463 too, because the bundled definition fixes `showEmptyPlaceholder` to `none` (BUG-150) | ⚠️ **workaround**: a one-attribute non-persistent entity the page switches on |
 | An **aggregate over an association** inside a gallery/listview template | client expressions have no `count()`; XPath does, but a template expression is not XPath | ⚠️ **workaround**: denormalise, with ONE writer that recomputes rather than increments |
+| A **count badge on a tab** ("Documents 3") | nothing on v0.24.0: a tab page is written with Caption and Widgets only, `Badge:` is refused by `check`, and `update widgets` reaches only pluggable property bags. `Forms$TabPage.Badge` exists in the metamodel | ⛔ **not buildable** — say the count in the pane's lead line |
+| A text box that **validates while typing** | nothing: v0.24.0 hard-codes `SubmitBehaviour` to on-leave (`widget_write.go`), so a field error clears only on blur | ⛔ **not buildable** — make the error line take the hint's height so the form does not reflow |
+| The **browser tab title** (`<AppTitle> - <page title>`) | nothing: the client takes AppTitle from the navigation profile, and `create navigation` has no title clause (`describe navigation` does not print it). A theme `index.html` `<title>` changes only the pre-boot title | ⚠️ **workaround**: set AppTitle in Studio Pro, or bridge `document.title` from a script in `theme/web/index.html` |
+| **Always-open menu groups** in a sidebar navigation tree | nothing: `create navigation` has no expanded/collapsed flag, and Mendix renders groups collapsed | ⚠️ **workaround**: CSS only — `li.mx-navigationtree-has-items > ul { display: flex }`, parent anchor restyled as the group heading (it keeps `aria-expanded="false"`) |
+| A **sidebar toggle button**, a **page-load nanoflow**, or a button added to a **Marketplace module's layout** | nothing: no `SidebarToggleButton`, no nanoflow data source or on-load event, and `alter layout` refuses a Marketplace layout (so an app copy of `Atlas_Default` loses its toggle) | ⚠️ **workaround**: an own layout (move pages with `alter pages … where layout =`), an action button calling a JS action that toggles a class on `<html>`, and a pre-boot script in `theme/web/index.html` for on-load work |
 | A **pluggable widget you want to configure** | only its scalar properties, and **case-sensitively** — `ItemSelectionMode` fails where `itemSelectionMode` works, even though the rest of MDL is case-insensitive | ⚠️ works, read the widget's own doc |
 
 ## The probe — four minutes, at Stage 3
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index a217418..eccb64e 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -10,7 +10,7 @@
 - **Rule 17 (uppercase `AND`/`OR` + `!=`) is resolved** — builds at 0 errors; keep the lowercase habit only for projects pinned to older binaries.
 - **Rule 1c's class (ALTER PAGE `SET Editable`/conditional settings) is resolved** — `SET Editable = [expr] ON widget` stores correctly and the project loads.
 - **ALTER PAGE now requires the braced block form** `ALTER PAGE Mod.Page { SET … ON w; };` — the old flat `alter page X set … on w;` is a parse error. DataGrid2 columns are addressed by **derived** name (bound attribute, else caption — MDL-WIDGET16), and a bare column name in REPLACE is refused in favour of `grid.column`.
-- **Still corrupting, STOP stays:** workflow `DECISION` activities (BUG-76 — project unloadable, `EnumerationValueIdentifier`).
+- **Still corrupting, STOP stays:** workflow `DECISION` activities (BUG-76 — project unloadable, `EnumerationValueIdentifier`). **v0.24.0 narrows it:** the bare-enum form is refused by `MDL-WF03` (never force it with `--no-check`), and a Boolean decision with `true`/`false` outcome keywords builds at 0 native errors — `learned-workflow-patterns.md` §8 Warning 1.
 - ~~`marketplace install` on a split-model project (#879)~~ — **RESOLVED in v0.21.0, STOP LIFTED (probed 2026-09-10).** Install no longer shells out to `mx module-import`; it copies units with mxcli's own writer and MPR v2 survives. The destructive path is now opt-in behind `--allow-format-change`, so the failure can only happen on purpose. Measured on a real 501-unit project: 501 → 1075 `.mxunit`, `.mpr` 84 KB → 156 KB (an index, not the 35 MB blob #879 produced), native mxbuild **0 errors**. **Read `bug-logs/mxcli-bugs.md` → the #879 entry before your first install** — the corruption is gone, and three *new* operational traps replaced it (packages do not carry their dependencies; two `mxcli fix` repairs are mandatory, not advisory; a bundled widget can silently fail to land and the installer cannot self-repair it).
 - The 10–12-writes-per-session cap from BUG-97 is downgraded to snapshot-plus-read-back: 16 sequential writes were clean on v0.20.0.
 - **Rule 2 (settings/security-level writes) is resolved** — probe-verified 2026-08-31: `alter project security level production`, `alter project security demo users on`, `alter project security guest access off` (guest access is new v0.19 surface — anonymous access was previously read-only), `alter settings model FirstDayOfWeek = Monday` and `alter settings configuration … HttpPortNumber` all land, read back, and cold-load at 0 errors. **Project security setup is now a scriptable project-start step, not an end-of-build Studio Pro chore** — see `brd-to-build-plan.md` Step 5's scaffold row.
@@ -57,16 +57,16 @@ Once you've picked a mode per operation, run the STOP table below against every
 | 9 | Set an association inline in a CHANGE or CREATE activity: `change $Obj (Module.AssocName = $Other)` or `create Entity (Module.AssocName = $Other)` | **RESOLVED in mxcli v0.17.0 for the cross-module case — verified 2026-08-11** (see `bug-logs/mxcli-bugs.md` BUG-21/#838): v0.17.0 either rejects an unresolvable association name with a clear pre-write error, or writes it correctly with no corruption. Retire the `--mcp` requirement below for projects whose `./mxcli` binary has been upgraded to v0.17.0+; keep it in force for any project still pinned to v0.16.0. **Depends on whether the association crosses modules — check this before picking a mode.** **Cross-module (e.g. to `System.User`, `Administration.Account`, or any other module's entity): STOP → `mxcli --mcp exec script.mdl`** (SP must be open) — confirmed still corrupting on **v0.16.0** as recently as 2026-07-13 (`change $NewAccount (System.User_UserRoles = $Role)` → invalid-`AttributeIdentifier` load failure, a WMS conversion project, two branches). **Same-module (both entities in the association live in the same module — including a marketplace module's own internal associations, not just a project-authored module): confirmed SAFE via plain CLI on v0.16.0**, 2026-07-23 (a PLM parts-flow project) — an isolated throwaway test (2 new entities + 1 new association, all in one project module) and a real 176-activity production microflow (46 inline association-sets, all within the same module) both passed a full `mx check` clean. Do not assume this same-module finding extends to cross-module cases — those two are separately confirmed, in opposite directions, on the identical mxcli version. When genuinely unsure which category an association falls into, treat it as cross-module (the safer default) until confirmed otherwise. **⛔ Never resolve this STOP by dropping the association set** — the object still needs the link. Routing to `--mcp` (or MCP fallback) preserves it; silently omitting it ships a broken golden path (a real WMS incident: a scanned order created with no link to its unit/location, mxbuild clean). If the brief's golden-path data-effects table lists an association for this action, it must be set. | mxcli's disk-write serializer writes the association name as an `AttributeIdentifier` in CHANGE/CREATE BSON in a way that fails module-boundary resolution on SP load for cross-module associations specifically — same-module associations apparently resolve fine through the same code path. `--mcp` routes through SP's own engine, bypassing mxcli's serializer entirely, and is confirmed safe for both cases. **Reading through an association (`$Obj/Module.Assoc/Target/Attr`) is safe on any path, cross-module or not.** |
 | 10 | Use `count($list)` anywhere in an expression | **Write `length($list)`.** | `count()` is not a Mendix expression function: `toString(count($X))` passes `mxcli check` and fails `mx check`/SP with CE0117 (2026-07-20). The 2026-07-09 "count() is safe" retest is unverified — prefer `length()` until re-confirmed. |
 | 11 | Filter an XPath with an association-traversal as the comparand: `[Assoc_X = $Ctx/Other.Assoc]` | **STOP → retrieve target first, then filter** | XPath constraint right-hand side must be a directly-bound variable, not an association path. Pattern: `retrieve $Target from ... where [...]; retrieve $Result from Module.Entity where [Module.Assoc_X = $Target]` |
-| 12 | Write `$currentObject/Attr` **inside** a `ContentParams` value on a `dynamictext` — bare or wrapped in a function, e.g. `ContentParams: [{1} = someFunction($currentObject/Attr, ...)]` or even `ContentParams: [{1} = $currentObject/Attr]` | **Drop the `$currentObject/` prefix — use the bare attribute name.** `ContentParams: [{1} = toString(Attr)]` or `ContentParams: [{1} = Attr]`. Function calls themselves are fine; the prefix is the trigger. | mxcli serializes the whole ContentParams value as an attribute-path suffix and concatenates the dataview's qualified entity name onto it — producing a nonsense path, CE1613: "The selected attribute '<Entity>.<literal expression text>' no longer exists." Confirmed on Mendix 11.12.0 / mxcli v0.13.0, 2026-07-16 and re-confirmed 2026-07-20 (root cause corrected — see BUG-23): the trigger is the literal `$currentObject/` prefix, not "any function call" as originally written here, and it fails even with NO function at all (bare `$currentObject/Attr`). **`Attribute: "AttrName"` is NOT a safe alternative for non-string types** — mxcli silently re-serializes it back into the same broken `ContentParams: [{1} = toString($currentObject/Attr)]` form (confirmed via `describe page`), so it round-trips into this exact bug. **Do not confuse with `DynamicClasses`/`Visible` expressions, which take the opposite form and genuinely require `$currentObject/Attr`** — e.g. `DynamicClasses: 'if $currentObject/State = Enum.Value then ...'` is correct and already the working pattern elsewhere in this codebase. `mxcli check`/`describe page` never catch this — only a real `mx check`/`docker check`/SP compile does. |
+| 12 | Put anything but a bare attribute or a quoted literal in a `dynamictext`'s `ContentParams` — `toString(Attr)`, `$currentObject/Attr`, `if … then … else`, any function | **Bind a bare attribute (`{1} = Attr`) or a quoted literal, nothing else.** A computed label becomes data: a stored or derived String attribute, bound bare. Tone variants go in `DynamicClasses`, which takes a real expression (and there *needs* the prefix: `'if $currentObject/State = Enum.Value then ...'`). | mxcli v0.24.0 / Mendix 11.13.0 (BUG-142): every unquoted value is stored as an attribute path, so any expression is CE1613 at mxbuild ("The selected attribute '<Entity>.<expression text>' no longer exists"). `check --references` refuses the parenthesised forms but **passes `if … then … else`**; `describe` printing the value with its spaces stripped is the only tell before mxbuild. The `toString(Attr)` form this row taught through v0.21 (BUG-23) no longer builds. A bare Boolean renders "Yes"/"No", not `true`/`false`. `Attribute: Attr` is the documented shorthand for the bare form (`learned-datagrid-customcontent-binding.md`). |
 | 13 | Filter a `retrieve` by an association in a Retrieve object(s) activity: `retrieve $X from Module.Entity where AssocName = $Other` | **Fully module-qualify the association name in the WHERE clause**: `where "OwningModule"."AssocName" = $Other` | An unqualified association name in a retrieve XPath constraint compiles (`mxcli check` passes) and even loads in SP without a syntax error, but fails Studio Pro's own `mx check`/build with CE0161 "Error(s) in XPath constraint." Confirmed 2026-07-20 on Mendix 11.12.0 (PROJECT-D): two retrieves using the bare association name (`TransportOrder_TransportUnit`, `TransportOrder_TargetLocation`) both failed; a third retrieve in the same microflow that already used the fully qualified form (`Transportation.TransportOrder_TransportUnit`) passed clean. `mxcli check --references` does not catch this — only `mx check` / SP does. |
 | 15 | Quote attribute names inside a **`CHANGE`** activity argument list: `change $Obj ("State" = val)` | **STOP → never quote attribute names in CHANGE argument lists** | mxcli writes an invalid `AttributeIdentifier` to BSON — `StorageLoadException` on SP open, project unloadable. Confirmed 2026-07-20 on Mendix 11.12.0 / mxcli v0.13.0 (PROJECT-D): `change $Order ("State" = $MappedState, "StartDate" = [%CurrentDateTime%])` corrupted the MPR, required full backup restore. `mxcli check` and `mxcli check --references` both pass — only `mx check` / SP open reveals the damage. **Correct form:** `change $Order (State = $MappedState, StartDate = [%CurrentDateTime%])` — never quote attribute names in CHANGE value/expression positions. **Scope narrowed 2026-07-23:** originally written to cover `CREATE` too, but a PLM parts-flow project's `done-06-seed.mdl` (StyleGallery) has multiple `CREATE` activities with quoted attribute names (`"PLMId" = ...`, `"PartName" = ...`) that executed clean and gated `done-` (`mx check` 0 errors) — the confirmed corruption incident was CHANGE-specific, not CREATE. Quoting attribute names in `CREATE` argument lists is safe; only `CHANGE` is a STOP. |
-| 14 | `revoke Module.Role on Module.Entity (write *)` followed by `grant Module.Role on Module.Entity (write (list))`, when another role has its own separate `grant` on the same entity | **STOP → revoke ALL roles' access on the entity first, then re-grant every role's full rule in one script** | mxcli's revoke/grant on one role can collapse or silently merge the entity's access-rule set, dropping a *different* role's untouched grant entirely. Confirmed 2026-07-20 (PROJECT-D): revoking `write *` and re-granting an explicit write list for `TransportOperator` caused `TransportViewer`'s separate read-only grant to disappear, and `TransportOperator` silently lost its `create`/`delete` structural rights — surfacing as ~48 new CE2729 "no read access" errors on unrelated pages. Root cause only visible via `DESCRIBE ENTITY` after the fact — `mxcli check --references` and even a subsequent `mx check` pass to reveal the fallout, not the mechanism. **Safe pattern:** `revoke Role1 on Entity; revoke Role2 on Entity; grant Role1 on Entity (...); grant Role2 on Entity (...);` — rebuild the whole entity's security from scratch in one script whenever any existing rule needs its write/read list changed, never patch one role's rule in isolation. |
+| 14 | `revoke Module.Role on Module.Entity (write *)` followed by `grant Module.Role on Module.Entity (write (list))`, when another role has its own separate `grant` on the same entity | **STOP → revoke ALL roles' access on the entity first, then re-grant every role's full rule in one script** | mxcli's revoke/grant on one role can collapse or silently merge the entity's access-rule set, dropping a *different* role's untouched grant entirely. Confirmed 2026-07-20 (PROJECT-D): revoking `write *` and re-granting an explicit write list for `TransportOperator` caused `TransportViewer`'s separate read-only grant to disappear, and `TransportOperator` silently lost its `create`/`delete` structural rights — surfacing as ~48 new CE2729 "no read access" errors on unrelated pages. Root cause only visible via `DESCRIBE ENTITY` after the fact — `mxcli check --references` and even a subsequent `mx check` pass to reveal the fallout, not the mechanism. **Safe pattern:** `revoke Role1 on Entity; revoke Role2 on Entity; grant Role1 on Entity (...); grant Role2 on Entity (...);` — rebuild the whole entity's security from scratch in one script whenever any existing rule needs its write/read list changed, never patch one role's rule in isolation. A narrowing `grant` with no `revoke` narrows nothing — it merges into the existing rule (BUG-145). |
 | 17 | Write a compound boolean expression combining uppercase `AND`/`OR` with a `!=` comparison anywhere in the same expression — in a Decision/IF condition OR a `retrieve ... where` clause | **Use lowercase `and`/`or` for boolean keyword operators.** Confirmed safe in every combination tested: lowercase `and`/`or` + `!=`, uppercase `AND`/`OR` + only `=` comparisons. Uppercase `AND` + a `!=`, and uppercase `OR` + a `!=`, both independently confirmed to fail — each tested directly, not inferred by symmetry from the other. Given the narrow, easy-to-miss trigger, default to lowercase `and`/`or` everywhere as a blanket-safe habit rather than trying to remember the exact boundary. | Confirmed 2026-07-23 (a PLM parts-flow project, mxcli v0.16.0) via 6 isolated tests, each run through a real `mx check` (not just `mxcli check`, which passes all of them): (1) `IF $Flag = Enum.HIGH AND $Outcome != Enum.ReleaseHold THEN` → CE0117. (2) Same with explicit parens per comparison → still CE0117; parens are not the fix. (3) Same with lowercase `and` → 0 errors. (4) Uppercase `AND` with two `=` comparisons (no `!=`) → 0 errors — isolates `!=` as the co-trigger, not `AND` alone. (5) Uppercase `OR` with two `=` comparisons → 0 errors. (6) Uppercase `OR` with one `=` and one `!=` comparison (`$Outcome = Enum.Release OR $Outcome != Enum.ReleaseHold`) → CE0117 — this is the one that was initially written up as assumed-by-symmetry rather than tested; it has since been run for real and does fail identically to the `AND` case. Same bug also reproduced in a `retrieve ... where PartId = 'x' AND PlantCode = $P AND "Status" != Enum.Archived` → CE0161; lowercase `and` fixed it. Root cause appears to be in mxcli's expression/XPath serializer mishandling the token sequence, not a real Mendix expression-language restriction (Studio Pro accepts lowercase `and`/`or` combined with `!=` without issue). |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script.** The rules that used to sit here as rows 18–20 and 24 live there: `WITH` mapping for every callee parameter (§7/§13 — red-pin corruption, invisible to `mxcli check`); every callee's `create/modify microflow` above the workflow statement in the same exec (§14 — an unknown callee corrupts the stored workflow, and creating it afterwards does not heal it); `JUMP TO` targets are the real activity names, never the `DESCRIBE` output's (§21, BUG-109, mxcli#1005); read the BRD lifecycle + wireframe before writing a single outcome. | Four incidents, four projects (2026-07-24 PLM parts-flow ×2, 2026-08-21 QA-sampling approval, 2026-08-31 BPM-engine conversion) — all passed `mxcli check --references` and `exec`, all failed only on SP open or native `mx check`. |
 | 16 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[FeasibilityDecision_Supplier = '[%CurrentUser/PLM.Account_Supplier%]']`. **Fix (confirmed working):** `[PLM.FeasibilityDecision_Supplier/PLM.Supplier/Administration.Account_Supplier = '[%CurrentUser%]']` — walk Supplier→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | This is genuinely invalid Mendix XPath, not an mxcli-specific bug — `CE0161` "Error(s) in XPath constraint" is Mendix correctly rejecting it every time it's checked, which is why it kept resurfacing across three separate incidents on a PLM parts-flow project (2026-07-22/23, `bug-logs/mxcli-bugs.md`) that were originally misdiagnosed as mxcli corrupting the domain model on unrelated grant rewrites. In fact the "unrelated entity broke too" symptom was just two independently-broken rules (both using the same invalid CurrentUser-path form) surfacing together once a full `mx check` ran — not one rule corrupting the other. Once rewritten to the correct bare-CurrentUser/full-LHS-chain form, the earlier "Studio Pro GUI only, module-wide" restriction no longer applies — **confirmed mxcli-safe 2026-07-23** via `test-05-currentuser-xpath-chain.mdl` (rebuilt all 4 role grants on the affected entity through mxcli exec, reproducing the corrected XPath verbatim, `mx check: 0 errors`). Use mxcli directly for this pattern; no GUI fallback needed. |
 | 21 | `DROP` + `CREATE` (or `CREATE OR REPLACE`) any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved.** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | Confirmed 2026-08-26 on a field run: two scripts each did DROP+CREATE on one shared seed aggregator. The second restated it as it had been *before* the first ran, and a demo-data seed call silently vanished. Every instrument was green — `mx check` reported **0 errors** because an uncalled microflow is perfectly legal, and `mxcli lint`'s orphan rule (QUAL004, `orphaned_elements.star`) exempts the `ACT_` prefix as a presumed UI entry point, so an `ACT_` microflow with no callers at all reports clean. It was found by opening a page and reading "0 to 0 of 0". |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** mxcli is **not transactional across statements**: the first failure stops the script and every statement below it is **silently skipped**, while the mxbuild gate reports 0 errors — the model is valid, it is merely missing work nobody asked it to skip. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | Confirmed 2026-08-31 (a dashboard-publishing migration, mxcli v0.20.0). Script `09b` added two attributes with `alter entity … add attribute` and then defined two microflows. Re-running it after the attributes existed died on statement 1 with "attribute already exists" — and the two microflows at the end were never applied. It surfaced days later as `ACT_Version_Delete` quietly missing a call it had had an hour earlier, found by `DESCRIBE MICROFLOW` on a hunch; no gate saw it, because a microflow that no longer calls a sub-microflow is a perfectly valid model. Compounded by rule 21's defect one level up: six scripts held a grant on the same three entities, so whichever ran last decided their security. **The fix that makes both go away is the same one:** one owner per document, `create or modify` throughout, and a from-empty replay in CI or at wrap-up. Worked example incl. the before/after comparison: the project's `docs/REBUILD.md` pattern — 23/23 scripts replay, `BUILD SUCCEEDED`, rebuilt model identical to the live one element for element. |
-| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (a dashboard-publishing migration, mxcli v0.20.0). A new script declared `create or modify non-persistent entity DashboardPublishing."ViewerContext"` with one attribute, believing the name unused. The entity already existed, owned by an earlier page script, carrying four attributes — `VersionLabel`, `HasContent`, `Html`, `DashboardTitle` — which are the entire datasource of the app's viewing page. `diff --format struct` reported `+ Attribute SharedCount` and **four `- Attribute` lines**, i.e. `create or modify` on an entity does not merge into the attribute set, it **replaces** it. Renaming the new entity took ten seconds; the alternative was a page that renders nothing, on a model that would have passed `mx check` and mxbuild clean, since an entity losing four attributes is a perfectly valid model. **This is the cheapest guard in the file — the whole rule is `diff` before `exec`.** |
+| 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | Confirmed 2026-09-01 (a dashboard-publishing migration, mxcli v0.20.0). A new script declared `create or modify non-persistent entity DashboardPublishing."ViewerContext"` with one attribute, believing the name unused. The entity already existed, owned by an earlier page script, carrying four attributes — `VersionLabel`, `HasContent`, `Html`, `DashboardTitle` — which are the entire datasource of the app's viewing page. `diff --format struct` reported `+ Attribute SharedCount` and **four `- Attribute` lines**, i.e. `create or modify` on an entity does not merge into the attribute set, it **replaces** it. Renaming the new entity took ten seconds; the alternative was a page that renders nothing, on a model that would have passed `mx check` and mxbuild clean, since an entity losing four attributes is a perfectly valid model. **This is the cheapest guard in the file — the whole rule is `diff` before `exec`.** On v0.24.0 it also prints false `~ Modified` and `- Attribute` lines (BUG-146): check each `- Attribute` against `DESCRIBE ENTITY` before trusting or dismissing it. |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme" — after `check --references` passed it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | Greenfield pilot 2026-09-04, mxcli v0.20.0, Mendix 11.13.0, signal theme: `DesignProperties: ['Form orientation': 'Vertical']` on a DataView → exec ok, CE6083 at the gate, auto-restored. `Class: 'form-vertical'` built clean — and then changed nothing on screen, because in that theme the form layout is decided by the theme's own dataview rules, not the class (ui-loop.md "which side is wrong", row 1). The look caught it; no gate could. |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. |
 | 26 | Bind a DataGrid 2 column, or a grid `sort by`, to an attribute **over an association** | **STOP → write the column path unquoted, and do not sort over an association.** Use `Attribute: Assoc_A_B/Name`, never `"Assoc_A_B/Name"`. On ≤ v0.24.0 sort by a local attribute or use a microflow datasource. This is the one place a quote-every-identifier convention must break. | A quoted path is stored as one attribute named `Assoc_A_B/Name`, and `sort by Assoc/Attr` is written as a plain attribute of the grid entity. Both pass `check --references` (v0.24.0, re-verified 2026-09-25) and give CE1613 at build (v0.23.0 field run). `BUG-DRAFT-dg2-association-path-bindings` |
@@ -86,7 +86,7 @@ None of these needs a STOP, but each passes `mxcli check` and fails later — at
 - **Grants are co-located with the element, never deferred to one `security.mdl`:** `grant execute` ends the microflow script, `grant view` the page script, entity access the domain script — the entity and its access rule are one unit, same script, same commit. mxbuild raises no error for a missing grant; the only symptom is a blank screen or CE2729 once a non-admin role opens the page. A `roles.mdl` that only *creates* roles is fine. Pre-flight per entity: access rule in the same script? every module role that needs it granted? every module role composed into a user role? non-persistent DTOs — read/write only (CONV006)?
 - **Module roles are module-scoped:** the role in any `GRANT` (entity, microflow, page) must be declared in the same module as the element — `ModuleA.Role` on a `ModuleB` element is a CE ("role not found in module"). Every module that owns grantable elements declares its own roles; user roles compose across modules: `create user role "AppUser" ("System"."User", "ModuleA"."ReadRole", "ModuleB"."ReadRole");`.
 - **`System.User` in every user role:** without it users cannot log in, and nothing — mxbuild, SP, CE — says so.
-- **Demo users:** name + roles only, no password block; never wipe, reset or re-create MxAdmin (ships with password `1`).
+- **Demo users:** `create demo user '<name>' password '<project demo password>' (<UserRole>);` — the password is mandatory on v0.24.0 (without it: `mismatched input '(' expecting PASSWORD`); one throwaway policy-compliant value per project, recorded in the build plan (`brd-to-build-plan.md` Step 7). Never wipe, reset or re-create MxAdmin (ships with password `1`).
 - **No `elseif` in page/widget expressions** (DynamicClasses, Visible, ContentParams, …): nest `else if … then … else …`. Microflow `IF/ELSEIF` compiles into decision splits; a page expression passes through to Mendix's parser, which has no `elseif` token → CE0117 at native `mx check`, invisible to `mxcli check --references` (2026-08-13; unquoting the paths did not fix it, only the rewrite did).
 - **`DROP MODULE` removes the model only:** `themesource/<Module>/`, `skillssource/_modules/<module>/`, `javascriptsource/<module>/` stay as empty folders and every line of `theme/web/*.scss` survives, because that is app-level. See [[learned-stylegallery]] → "The Mendix DOM contract" before calling a reset total.
 - **`mxcli check` does not catch corruption.** Every STOP row above is grammatically valid MDL that `check` passes; only mxbuild or SP open reveals the damage. Run the real mxbuild gate after every exec (`iterative-build-loop.md`).
diff --git a/skills/learned-microflow-patterns.md b/skills/learned-microflow-patterns.md
index b9d9b17..bdd9632 100644
--- a/skills/learned-microflow-patterns.md
+++ b/skills/learned-microflow-patterns.md
@@ -77,6 +77,19 @@ retrieve $MyItems from Module.MyEntity
 
 **Never** use `[%CurrentUser%]` as a string expression value — it stores as the literal text.
 
+**Nor in any microflow a system session can reach** — a published REST operation without
+platform authentication, a scheduled event, a Java action's system context. The runtime refuses
+the retrieve (*"token cannot be used in a system session"*) and the call fails; check, exec,
+mxbuild, lint and every UI journey stay green, because a browser always has a user. Field case
+(a card-disbursement requirements-driven build, Mendix 11.13.0, 2026-09-27): a shared
+state-change sub-microflow gained the token, and the REST start operation went from 201 to 500.
+In shared microflows look the account up by login instead:
+
+```mdl
+declare $LoginName String = if $currentUser = empty then '' else $currentUser/Name;
+retrieve $Account from Administration.Account where [Name = $LoginName] limit 1;
+```
+
 ---
 
 ## Page → Microflow Data Passing: Objects Only
diff --git a/skills/learned-page-patterns.md b/skills/learned-page-patterns.md
index a234a6b..bfa188c 100644
--- a/skills/learned-page-patterns.md
+++ b/skills/learned-page-patterns.md
@@ -208,7 +208,7 @@ else 'badge-default'
 
 - **Cannot INSERT rows into a layoutgrid by row name:** `insert after row5 { row newRow { ... } }` fails with "widget not found". ALTER PAGE can only INSERT widgets within an existing column. To add a full new row, use `create or modify page` to rebuild the section, or do it in Studio Pro.
 - **SET content on dynamictext with ContentParams (BUG-07):** fails with "property 'content' not found (widget has no pluggable Object)". Use REPLACE with a different widget name instead.
-- **REPLACE with same widget name (BUG-08):** fails with "duplicate widget name". Always use a different name in the replacement body — the old name is dropped when the old widget is removed.
+- **REPLACE with same widget name (BUG-08):** fails with "duplicate widget name". On v0.24.0 the same happens for any reused **child** name (the natural case: the same grid with one column added), so a REPLACE hook is never re-run safe. Use `drop widget X;` then `insert into <parent> { … }` (or `insert after <sibling>`); that shape ran twice clean on a probe and on the real model.
 - **CONTAINER inside dataview/form slot corrupts BSON (BUG-18):** Wrapping a widget in a new CONTAINER via `replace txtWidget with { container cWrapper { textbox txtWidget } }` inside a `dataview` writes a `DivContainer` into a BSON slot typed for `WidgetObject` — SP crashes on load with `InvalidCastException`. Use SCSS to fake affixes/wrappers instead. Never REPLACE a widget with a container wrapping it inside a form/dataview body.
 - **REPLACE on datagrid custom-content columns drops them (observed a Java/Angular analysis project, 2026-07-05):** `replace colName with { column colName (...) { ... } }` silently deletes the column instead of swapping it. Use `insert after dgName.LastColumn { column ... }` to re-add dropped columns, or rebuild the full datagrid with `create or modify page`.
 
@@ -332,3 +332,20 @@ move and it is exactly the shape that raises CE1571: the stored model carries an
 `DESCRIBE` does not render. So the module's button is not the example to follow here; the
 `-- Context:` comment is. (Field-found 2026-09-07 wiring an "Import and process" button onto
 `ExcelImporter.Import_Overview` in a sales-coaching build, after two failed applies.)
+
+**Attributes in the control bar resolve against the grid's entity, not the context.** A widget in
+the control bar showing a bare attribute (`Attribute: OpenCount`) is resolved by mxcli against the
+**grid's** entity, although at runtime the context there is the enclosing data view's object. So
+mxbuild fails with CE1613 naming `<GridEntity>.OpenCount`. Inside the control bar, name the data
+view's attributes fully qualified. (mxcli v0.24.0, BUG-150 item 5; a card-disbursement
+requirements-driven build, 2026-09-25.)
+
+## List view `Editable`: every list view on the path to an input
+
+mxcli writes a list view with `Editable` false by default, and a non-editable list view makes
+**every** input inside it read-only, including an input in a **nested** list view whose own
+`Editable` is true. The input draws but cannot be changed (`aria-readonly`, a click changes
+nothing). Making the input itself editable does nothing. Set `Editable: true` on each list view
+between the page and the input. Lint MDL-WIDGET31 checks only native inputs, so it misses a
+pluggable one such as a Switch (BUG-149). (Mendix 11.13.0, mxcli v0.24.0, the same build,
+2026-09-26: fixed only when both the outer and the inner list view were editable.)
diff --git a/skills/learned-workflow-patterns.md b/skills/learned-workflow-patterns.md
index 4b2e741..aa85866 100644
--- a/skills/learned-workflow-patterns.md
+++ b/skills/learned-workflow-patterns.md
@@ -293,7 +293,8 @@ MULTI USER TASK "Board" 'Board review'
   OUTCOMES 'Approve' { } 'Reject' { };
 
 -- jump to, inside a user-task outcome. Must be the last statement of its path.
--- Inside a BOUNDARY EVENT body it writes a targetless, name-colliding Jump — BUG-109.
+-- Inside a BOUNDARY EVENT body it wrote a targetless, name-colliding Jump through v0.20.0
+-- (BUG-109); on v0.24.0 it writes a real jump there too.
 USER TASK "Review" 'Review'
   PAGE MyModule."WF_Task_ApproveReject"
   OUTCOMES 'Ok' { } 'Redo' { JUMP TO "Review"; };
@@ -346,6 +347,13 @@ the workflow**, not a later UI row. A plan that builds the workflow at row 41 an
 `WITH (Ctx = $WorkflowContext)` **segfaults the binary** — and the "parameter is not mapped"
 hint `--references` prints talks you straight into the crashing spelling. BUG-107.
 
+> **v0.24.0 (Mendix 11.13.0, 2026-09-26): the two halves below have come apart.** The
+> bare-enum form is now refused before the write by `MDL-WF03` (forced with `--no-check` it
+> still writes the `StorageLoadException`). A Boolean decision with `true`/`false` outcome
+> keywords on an expression — `decision N '$WorkflowContext/Attr = ''X''' outcomes true -> { … }
+> false -> { };` — builds at 0 native errors and reads back intact. The string-labelled repro
+> in §8 Warning 1 was not re-run on v0.24.0. Table: §8 Warning 1.
+
 **Never script a `DECISION` at all — not on an enumeration, not on a boolean.** This is
 **BUG-76**, open since 2026-08-13 and re-confirmed on v0.20.0 twice: mxcli writes every
 outcome label as a raw string into a field Mendix requires to hold an
@@ -447,6 +455,31 @@ button also commits the form and closes the page; the statement does neither, so
 means rebuilding both by hand. Use `SET TASK OUTCOME` only when you must validate or mutate
 first in a flow that has no page.
 
+**`SET TASK OUTCOME` needs a signed-in named user — assigning the task first is not enough.**
+A published REST operation without platform authentication (or a scheduled event, or any
+system-context call) has no current user, and the runtime refuses the outcome with
+`UserException: Only named users can complete user task.` — even when the same flow first
+assigned the task to a real account. `mxcli check`, `exec` and `mx check` cannot see this; it
+surfaces as a 4xx/5xx from the operation and one line in `runtime.log`. Field case (a
+card-disbursement requirements-driven build, Mendix 11.13.0, 2026-09-26): an API-driven
+"assign, then complete" answered 403 until the assign + outcome ran in a session of the calling
+account, after which the proof test answered 200 with the outcome recorded under that account.
+The run-as pattern is a Java action that opens a session for the named account, runs the
+microflow in it, and always closes it:
+
+```java
+IUser user = Core.getUser(Core.createSystemContext(), userName);   // the account the call has already authenticated
+if (user == null) throw new CoreException("No account '" + userName + "'");
+ISession session = Core.initializeSession(user, null);
+try {
+  return Core.microflowCall("Module.SUB_Task_Complete").inTransaction(true)
+      .withParam("Task", task).execute(session.createContext());
+} finally { Core.logout(session); }
+```
+
+Authenticate the account *before* this runs (the Java action trusts the name it is given), and
+keep the microflow's own checks — it now runs with that user's access rules, not as system.
+
 **`DESCRIBE MICROFLOW` reads `call workflow` back since v0.20.0 — but the catalog still
 does not see it.** The describe half of this warning is retired: on mxcli v0.20.0 the round
 trip closes — `DESCRIBE` emits `call workflow Mod.WF ($Var);` (the positional form, added to
@@ -497,6 +530,7 @@ mxcli **v0.18.0**, where `DECISION` writes correctly.
 | `v0.17.0` | **corrupts the `.mpr`** — confirmed, BUG-76 (binary `2026-08-10T05:12:17Z`) |
 | `v0.18.0`+ | writes correctly; verify what was stored anyway |
 | `v0.20.0` / `v0.21.0` | **resolved 2026-09-08 — a spelling pincer, not a shape.** The two 2026-08-31 probes disagreed because one used bare outcomes and one used qualified ones: bare `'Yes'` passes `mxcli check` and produces the byte-exact `StorageLoadException`; qualified `Module.Enum.Value` is rejected by `MDL-WF03` but loads natively via `exec --no-check` with one `CE0117` (the empty condition). Re-probed on v0.21.0: unchanged. Workaround: qualified spelling + `--no-check`, then pick the expression in Studio Pro (BUG-76, mendixlabs/mxcli#1031) |
+| `v0.24.0` | **split in two, 2026-09-26 (Mendix 11.13.0, a card-disbursement requirements-driven build).** Bare-enum outcome: refused before the write by `MDL-WF03`; forced with `--no-check`, the same `StorageLoadException` (rc 1) — guarded, not fixed. Boolean decision with `true`/`false` outcome keywords on a context-attribute expression: check, exec and native `mx check` 0 errors, `DESCRIBE` shows the expression intact — scriptable. The string-labelled `'1 = 1'` repro below was not re-run; run it before scripting that shape |
 
 Two half-right versions of this warning coexisted for four days from 2026-08-21. One said
 "absolute prohibition, confirmed on v0.17.0" and never learned about the v0.18.0 fix — follow
@@ -606,6 +640,7 @@ varying **only** the suspected cause — see [[sandbox-ab-tool-defect-probe]].
 | Error | Cause | Fix |
 |---|---|---|
 | **CE7412** | Task page missing `$WorkflowUserTask` (or `$WorkflowContext`) in `Params:` | Declare both parameters |
+| **CE7410** | A user task's `PAGE` takes no `System.WorkflowUserTask` parameter. On mxcli v0.24.0 `check --references` names it and refuses before the write (`exec`, even `--no-check`, cannot write it) — no longer a native-only find (2026-09-26) | Give the page the task parameter |
 | **CE1571** "no argument selected" | Button sits outside the dataview scoped to its parameter entity | Move the button inside the correct `DATAVIEW` |
 | **CE2421** | `TEXTBOX` bound to an enum attribute | Use `RADIOBUTTONS` (editable) or `DYNAMICTEXT` + `ContentParams` (read-only) |
 | **CE0111** | `complete_task 'WrongName'` — outcome string does not match the definition | Check `DESCRIBE WORKFLOW` for the exact outcome strings |
@@ -985,6 +1020,12 @@ already exists.
 > terminator, CE0105 — and neither is expressible, see §11 of `workflow-structure-rules.md`),
 > and there is **no notification boundary event** in the grammar at all.
 >
+> **The interrupting half is superseded on v0.24.0 (Mendix 11.13.0, 2026-09-26).** An
+> interrupting timer whose body calls a microflow and ends in `end workflow comment '…';` or in
+> `jump to <earlier activity>;` builds at 0 native errors, and the read-back shows a real jump
+> with a real target — BUG-109 no longer reproduces. Only one interrupting boundary per activity
+> (`MDL-WF15` / CE6697); `workflow-structure-rules.md` §2.
+>
 > This entry is the reason the rule exists: a construct "used in a real build" was verified by
 > the tool that cannot see the defect. `mxcli check` is not evidence for workflows.
 
@@ -1054,7 +1095,7 @@ was disputed until 2026-09-08 (the `DECISION`, below — now resolved as a spell
 | Claim, and where it still appears | Status on v0.20.0 |
 |---|---|
 | `DECISION` corrupts the `.mpr` (§8 Warning 1, BUG-76) | **Resolved 2026-09-08 — spelling, not shape.** This probe's `ExclusiveSplitActivity` loaded because its outcomes were qualified (`Module.Enum.Value`, forced through `--no-check` past `MDL-WF03`); the same-day retest (`bug-logs/mxlabs-v0.20.0-retest-2026-08-31.md`) corrupted because its outcomes were bare, which `mxcli check` accepts and the loader rejects as an invalid `EnumerationValueIdentifier`. Re-probed on v0.21.0 (2026-09-08): both jaws unchanged. Keep BUG-76's STOP rule until upstream fixes either jaw (mendixlabs/mxcli#1031); the workaround is qualified spelling + `exec --no-check` + one `CE0117` to fix in the canvas. |
-| An MDL-written `BOUNDARY EVENT … TIMER` is always malformed — `CE0105` | **Cleared for the non-interrupting form.** The timer wrote correctly, reading `$WorkflowContext/<DeadlineAttribute>`. The *interrupting* form still fails `CE0105` because its terminator is inexpressible (§19, BUG-109). |
+| An MDL-written `BOUNDARY EVENT … TIMER` is always malformed — `CE0105` | **Cleared for the non-interrupting form.** The timer wrote correctly, reading `$WorkflowContext/<DeadlineAttribute>`. The *interrupting* form still fails `CE0105` because its terminator is inexpressible (§19, BUG-109) — **on v0.24.0 it writes and loads too** (§19's second correction). |
 | `CALL MICROFLOW` stores the pre-11.9 `$Type` (§13, BUG-WF06) | **Cleared.** 14/14 landed as `CallMicroflowActivity` — re-confirming the v0.17.0 fix. |
 | `DESCRIBE WORKFLOW` is blind to boundary events, decisions, jumps and waits | **Largely cleared.** All four now read back. The Event Sub-Process still does not — see below. |
 | §10 step 5's bare "No `DECISION`" | **Historical.** Read it as "no `DECISION` before v0.18.0, and verify what was stored on any binary"; §15 governs whether to use one at all. |
@@ -1123,11 +1164,11 @@ sibling (a *valid* target, still name-collided and targetless, CE0495 + CE6680)
 | `jump to <target>` | `check --references` | `exec` | native `mx check` |
 |---|---|---|---|
 | a real activity name, earlier in the flow | pass | pass | **0 errors** |
-| a real activity name, later in the flow | pass | pass | **CE6681** — a genuine platform rule, `workflow-structure-rules.md` (forward jumps), not this defect |
+| a real activity name, later in the flow | pass | pass | **0 errors on v0.24.0** (2026-09-26). This row read "CE6681, a genuine platform rule" — it was mxcli's jump-named-after-its-target defect, fixed upstream in v0.21.0 (§25), not a platform rule |
 | any name that matches nothing | pass | pass | **CE6681** — this defect: the self-referencing jump |
 
-So `CE6681` has two causes and the message names neither. Check the target exists *before*
-you reason about direction.
+So on a current binary `CE6681` on a jump has one cause, and the message does not name it:
+check the target exists before anything else.
 
 **Why `DESCRIBE` walks you straight into it:** describe emits the *source* model's activity
 names, but a rebuild derives names from the called microflow. So `jump to callMicroflow6`
@@ -1199,8 +1240,8 @@ behind it, so that jump has no valid target at all. What happens:
 
 The message is about the **kind** of the target, so it sends you inspecting a target that does
 not exist. Read `CE6681` as *"this jump does not resolve"* and check existence before kind.
-(§11's forward-`JUMP TO` row is the same code from the other cause: a forward target resolves
-to the end/jump activity.) The fix is not a better jump — it is that **a reject ends the
+(`workflow-structure-rules.md` §11's forward-`JUMP TO` row used to blame the same code on
+direction; on v0.24.0 a forward jump builds clean, so there is no second cause.) The fix is not a better jump — it is that **a reject ends the
 workflow**. `WF_MOCApproval` therefore contains no `JUMP TO` at all.
 
 This is a fourth entry for the detection-gap register: clean at three rungs, broken at the
diff --git a/skills/microflow-preflight.md b/skills/microflow-preflight.md
index d743d94..193b39c 100644
--- a/skills/microflow-preflight.md
+++ b/skills/microflow-preflight.md
@@ -153,6 +153,9 @@ ratchet then rises on a script with nothing wrong in it. Plain if/else and a loo
 table asks for anyway. Or move the following activity to after `end if`. Name the chosen
 remedy on the checklist's Layout line.
 
+Same overlap, second shape: an `on error { … }` handler that does not end in `return` merges
+back into the main flow on top of the next activity. End every handler with its own `return`.
+
 ## Verify — read the BUILD-LOG row
 
 After `./bin/exec.sh`, the lint ratchet writes its verdict into the same BUILD-LOG row:
@@ -163,13 +166,17 @@ checklist, **the preflight failed. Say so in chat**, fix the script and re-run.
 the rise with `--update-baseline`. Lint cannot see a retrieve or REST call inside a loop, so a
 clean row proves only the rows lint covers. The checklist is the record for the rest.
 
+Verified on v0.24.0: **CONV013 fires falsely** on a Java or REST call with a custom
+`on error without rollback { … }` handler, so baseline it citing BUG-149. A `/** … */` doc comment
+before `create microflow` does land in its Documentation (BUG-152 item 4).
+
 ## Not verified
 
 - That `mx check` passes a flow whose loop child escaped its box (MPR011). This comes from the
   rule's source comment only.
-- CONV013 / CONV014 firing on a REST or Java call.
-- The `while` + `limit … offset` batch recipe run end to end. `while` itself executes on v0.24.0.
-- Whether a `/** … */` doc comment round-trips into the microflow's Documentation.
+- CONV014 firing on a REST or Java call.
+- The `while` + `limit … offset` batch recipe run end to end. `while` itself executes on v0.24.0;
+  a variable first assigned inside it must be `declare`d before it (BUG-154).
 - Nanoflow-vs-microflow guidance. No current Mendix docs page was found.
 - Whether upstream fixes the if-branch merge overlap in a later release.
 - Whether a later `mxcli layout` release re-lays-out microflows, and whether that run clears the if-branch merge overlap. Re-probe `mxcli layout --help` on each new binary.
diff --git a/skills/module-folder-convention.md b/skills/module-folder-convention.md
index 21b4973..f47f15d 100644
--- a/skills/module-folder-convention.md
+++ b/skills/module-folder-convention.md
@@ -98,7 +98,17 @@ root — the script placed what it could and said nothing about the rest.
 | Java action | `<Feature>/Services` | ❌ undocumented | ❌ undocumented — Studio Pro |
 | Scheduled event | `<Feature>/Services` | ❌ undocumented | ❌ undocumented — Studio Pro |
 | Mapping · JSON structure · published/consumed service · message definition | `<Feature>/Services` | ❌ not supported | ❌ not supported — Studio Pro |
-| Workflow · document template · image collection · regex · dataset | `<Feature>/Resources` (workflow: `Microflows`) | ❌ not supported | ❌ not supported — Studio Pro |
+| Workflow | `<Feature>/Microflows` | ✅ `folder 'path'` keyword on `create [or modify] workflow` — **mxcli v0.24.0+**; ❌ on older binaries | see the v0.24.0 note below |
+| Document template · image collection · regex · dataset | `<Feature>/Resources` | ❌ not supported | ❌ not supported — Studio Pro |
+
+**mxcli v0.24.0 moved the line (2026-09-26, a card-disbursement requirements-driven build).**
+`create or modify workflow … folder 'Workflow/Microflows'` stored the workflow in that folder —
+`DESCRIBE WORKFLOW` reads the `folder` clause back — so a workflow is no longer a Studio Pro
+placement. On the same binary `mxcli syntax move` lists `MOVE` for `WORKFLOW`, `JAVA ACTION`,
+`SCHEDULED EVENT`, `JSON STRUCTURE`, `IMPORT`/`EXPORT MAPPING`, `REST CLIENT`,
+`PUBLISHED REST SERVICE`, `IMAGE COLLECTION` and `REGULAR EXPRESSION`; those moves are documented
+there, not probed here. Run `mxcli syntax move` on your binary and treat the ❌ cells above as
+"before v0.24.0" until a `describe` read-back shows the document where you put it.
 
 **Two consequences you have to act on, not just know:**
 
diff --git a/skills/module-review.md b/skills/module-review.md
index d720014..fe65308 100644
--- a/skills/module-review.md
+++ b/skills/module-review.md
@@ -206,6 +206,12 @@ page has not been looked at.
   native widgets wrap content in fixed structural children (gallery →
   `.widget-gallery-top-bar` / `-content` / `-footer`). A custom grid/flex class on the wrong DOM
   level is the common, easy-to-miss cause. See `learned-stylegallery.md`.
+- **Measure text alignment on the glyphs, not the element boxes.** Box centres cannot see text
+  offset inside a box: a breadcrumb link with a 44px touch target and its plain-text neighbour
+  both centred at y=91 ("aligned") while the link's text sat 12px high. Read the text node's own
+  box: `const r = document.createRange(); r.selectNodeContents(el); r.getBoundingClientRect()`.
+  Glyph centres read 79 vs 91 before the fix and 79/79 after (a card-disbursement
+  requirements-driven build, 2026-09-25).
 - **Capture below the fold.** Atlas often scrolls `.mx-scrollcontainer-center`, not
   `document.body` — find where `scrollHeight > clientHeight` and scroll that.
 
diff --git a/skills/rest-integration-first-time-right.md b/skills/rest-integration-first-time-right.md
index 94e2565..8a27ae7 100644
--- a/skills/rest-integration-first-time-right.md
+++ b/skills/rest-integration-first-time-right.md
@@ -155,7 +155,7 @@ Why each line is there:
 | unset enum → `''` | any non-blank value is an exact-match filter server-side; `toString(empty)` poisons the URL |
 | one `{1}` for the whole URL | multi-placeholder templates do not substitute — they go out literally |
 | `@Mod.ApiBaseUrl` constant | a hard-coded `localhost` is the container under Docker; constant syntax proven |
-| `on error continue` on `rest call` | the only handler it accepts; a block is CE6035. An empty body is how failure presents |
+| `on error continue` on `rest call` | the simplest handler: an empty body is how failure presents. A custom block (`on error { … }`, `on error without rollback { … }`) also passes `mx check` now (Mendix 11.13, mxcli v0.24 — the older "a block is CE6035" note is stale), but **never inside a loop**: any custom handler there is CE0644, so a retry loop calls a sub-microflow that holds the attempt (`learned-microflow-patterns.md` → per-row isolation) |
 | **`all`** on `import from mapping` | **see §0** — omitted = `ForceSingleOccurrence=1` = silent EMPTY |
 | `[3]` empty check | distinguishes "threw" from "mapped nothing" — the two must never look alike |
 | `$Count = count($Routes)` | bare `$x = count(...)` is the aggregate form; `length()` is for strings |
@@ -291,6 +291,21 @@ association direction; all fine, page empty → stale deployment or a different
 - Fixture facts cost hours: an endpoint that genuinely returns 0 children looks exactly like
   a broken mapping. Know which fixture id has data before you debug.
 
+### Added on mxcli v0.24.0 (Mendix 11.13.0, 2026-09-26)
+
+- **`rest call … body $Var` sends the literal text `$Var`**, with check, exec and mxbuild all
+  green. Write `body '{1}' with ({1} = $Var)` (BUG-151).
+- **`import from mapping M($Call/ResponseBody)` is a parse error.** Declare a String first:
+  `declare $Body String = $Call/ResponseBody;` then `M($Body)` (BUG-152).
+- **A published REST service has no auth clause**, and an `Authentication:` property is
+  silently ignored. Authenticate inside the operation microflow, and prove that no credentials
+  and a wrong password each answer 401 (BUG-152).
+- **`create or modify published rest service` replaces the resource list.** One script owns
+  the service and names every resource (BUG-152).
+- **Extend an import mapping with `create or modify`, never drop and recreate it.** The drop
+  orphans every import activity that calls it (BUG-99), and `drop import mapping` on a missing
+  mapping stops the script (BUG-152).
+
 ## Related
 
 - `learned-mdl-preflight.md` — write-mode choice and the STOP table
diff --git a/skills/testing-shape.md b/skills/testing-shape.md
index 36cbb96..c12550c 100644
--- a/skills/testing-shape.md
+++ b/skills/testing-shape.md
@@ -174,6 +174,7 @@ so the next person argues with the incident rather than with the rule.
 | **Unit** | A microflow passes in isolation but no button calls it, or the caller passes different args | Assert the **caller path** exists, not just the microflow |
 | **Trace** | `[].every()` is `true` — assertions pass on **zero spans** | Assert the span set is **non-empty first**, then assert over it. Also check the action wasn't a no-op: navigating to the page you are already on fires nothing. |
 | **Trace** | A caught error leaves the microflow span `OK` while its activities are `ERROR` | Assert at **activity** granularity, not microflow granularity |
+| **all** | `mxcli run --local` starts with **scheduled events off**, so a job-driven feature never runs under test and its journey passes vacuously or fails for the wrong reason (2026-09-26, Mendix 11.13.0) | Prove it in a separate start with scheduled events on — §5, "`run --local` starts with scheduled events off" |
 | **all** | `$?` after a pipeline measures the pipe, not the script — biased toward false *success* | Never read `$?` through a pipe. See `tool-output-is-not-ground-truth.md`. |
 
 **Verdict discipline — the canonical statement, referenced from `journey-proof.md` rather than
@@ -315,6 +316,39 @@ generic dialog, so that file is where a server-side error is actually readable.
 | `--hub` | expose the running app at a public URL through `mxcli tunnel-hub` — a chisel client reverse-tunnels out over 443 and the runtime boots with `ApplicationRootUrl` set to the hub URL, so the app works under that origin. Implies `--local`. |
 | `--test-endpoint` | host mxcli's token-guarded test endpoint, so `mxcli test <files> -p <app.mpr> --attach` runs against this already-warm app — a couple of seconds instead of ~30 |
 
+**`mxcli test … --attach` is a model write even when nothing changes.** It adds and then removes
+its `MxTest` microflows, so the `.mpr` mtime moves while every unit comes back byte-identical —
+and the catalog then reads stale, so `verify-module.sh`'s graph sweep FAULTs with "catalog is
+stale" on a module you did not touch. Order a test-then-verify loop as: `mxcli test … --attach`
+→ `./mxcli -p <app.mpr> -c 'REFRESH CATALOG FULL'` (~6 s) → `verify-module.sh`. (Field case: the
+card-disbursement requirements-driven build, 2026-09, mxcli v0.24.0 — a seeding test run before
+the module verify made the graph sweep FAULT until the catalog was rebuilt.)
+
+**`--test-endpoint` writes into the working model for as long as the app runs.** It injects an
+`MxTest` module, `javasource/mxtest/`, `themesource/mxtest/` and a Settings-unit change that
+chains its registration after startup; a clean stop prints "test endpoint removed; project
+restored". In that window `git status` shows extra model paths and the lint ratchet rises
+(CUSTOM002, CONV013). So: run the build-time app **without** the flag and switch it on only for a
+test window; no exec, no commit and no model restore until the clean stop. Restoring the model
+under a running endpoint deletes `MxTest`, and the next `--attach` refuses with "needs a runtime
+restart". After the stop, `git status` on the model must be empty. (Field case: the same build,
+v0.24.0, 2026-09-26: 11 model paths with the endpoint up, back to 2 after the stop.)
+
+**`run --local` starts with scheduled events off.** The runtime log reads "Synchronizing scheduled
+events: None", so job-driven behaviour is never exercised and a journey over it can only pass
+vacuously or fail for the wrong reason. Prove scheduled work in a **separate** start with
+`--runtime-setting ScheduledEventExecution=ALL`: count rows over at least 2 ticks and grep the log
+for the "Scheduling …" line. Keep journeys that count rows exactly on the default start, where no
+timer moves the data. (Field case: the same build, Mendix 11.13.0, 2026-09-26.)
+
+**A gate build while `run --local` serves breaks the running client.** `bin/verify-model.sh` and
+exec.sh's gate run `mxbuild --target=deploy`, which rewrites `deployment/web/` and drops the
+`dist/` bundle `run --local` built. The runtime keeps answering 200, but every page load 404s on
+`dist/index.js`, so a journey's login hangs waiting for `.mx-page` — it reads as a login or
+licence failure. The tell is `404 - file not found for file: dist%2Findex.js` in
+`.mxcli/runtime.log`. Restart `run --local` after every gate build; never probe across one.
+(Field case: the card-disbursement requirements-driven build, Mendix 11.13.0, 2026-09-25.)
+
 **`--hub` is what makes a container-hosted run reachable.** A cloud/devcontainer session has no
 shared filesystem with a laptop and cannot serve `localhost` to one. Before `--hub` the only answer
 was a hand-rolled ngrok/cloudflared tunnel; it is now a flag. `mxcli test --local` likewise boots on
diff --git a/skills/workflow-structure-rules.md b/skills/workflow-structure-rules.md
index 6550a7a..28e554f 100644
--- a/skills/workflow-structure-rules.md
+++ b/skills/workflow-structure-rules.md
@@ -71,6 +71,16 @@ event path*, or a non-interrupting one ending in *End workflow*. Decide the type
 writing the body; the terminator follows from it. Whether the task deserves a timer at all is a
 separate question — `learned-workflow-patterns.md` §19: no SLA in the requirements, no timer.
 
+**One interrupting boundary per activity, and a non-interrupting path cannot end the workflow.**
+A second interrupting boundary on the same parent is `MDL-WF15` at `mxcli check` (CE6697
+natively); `end workflow` inside a non-interrupting path is `MDL-WF08` (CE1844). So once a task
+carries an interrupting cancellation timer, a second "abort on signal" trigger can be neither
+kind of boundary. Field case (a card-disbursement requirements-driven build, mxcli v0.24.0,
+2026-09-26): the design wanted an API call to notify a boundary on a task that already had an
+interrupting timer; both routes were refused at check time, and the API completed the task
+directly instead. Pick the second trigger's mechanism — task completion, or an event
+sub-process (§3) — before scripting either boundary.
+
 ## 3. Event sub-processes — cancellation lives outside the main flow
 
 An event sub-process is a **sibling of the main flow, not part of it**. It has its own flow,
@@ -290,7 +300,8 @@ easy to miss when writing the runbook for cutover:
 | Code | Meaning | Section |
 |---|---|---|
 | CE6689 | activity unreachable — written after a terminal | §1, §3 |
-| CE1844 | *End workflow* inside a non-linear path (parallel branch) | §4 |
+| CE1844 | *End workflow* inside a non-linear path (parallel branch, or a non-interrupting boundary path — `MDL-WF08`) | §4, §2 |
+| CE6697 | a second interrupting boundary event on one activity (`MDL-WF15`) | §2 |
 | CE1845 | parallel split with fewer than two paths | §4 |
 | MW0012 | *Jump to* inside a parallel branch | §4 |
 | CE1834 | user task has no page | task page rules, `learned-workflow-patterns.md` §4. The page's parameter must be **`System.WorkflowUserTask`** — `System.UserTask` does not exist, and a page built against it never satisfies the check no matter how many times it is re-set |
@@ -319,10 +330,11 @@ row's stated floor is evidence against it.
 | ~~decision on a **boolean or free-text** outcome~~ | **RETRACTED 2026-09-03 — see the CORRUPTING row below.** This row read "proven on mxcli ≥ v0.18.0" and it was wrong: BUG-76's v0.20.0 retest corrupts on a condition of literal `1 = 1`. The condition never mattered; the defect is in how the *outcome label* is written. Left visible with a strikethrough rather than deleted, because "a boolean decision is the safe kind" is the belief this table has to actively kill |
 | call microflow, with or without parameters | **proven** — with two limits. (1) The `WITH` clause's **value must be quoted**: `WITH ("Ctx" = '$WorkflowContext')`. Unquoted (`= $WorkflowContext`) segfaults the binary, BUG-107. (2) **`$WorkflowUserTask` is NOT in scope here** — only `$WorkflowContext` and `$WorkflowInstance` are. Passing it is a **CE0117** that `mxcli check --references` passes completely clean; only mxbuild catches it. A microflow that needs the task looks it up by name off `$WorkflowInstance` through `System.WorkflowEndedUserTask`. Proven by sandbox A/B on a full project copy, 2026-09-04 — this corrects an earlier reading of §8 that treated *call microflow* as having the task |
 | — | — |
-| **decision on an enumeration** | **CORRUPTING — BUG-76**, of which this probe is a re-confirmation on 11.14 (first logged as BUG-108 before the older entry was found). BUG-76 is the general case: *every* `DECISION` with outcomes corrupts, whatever its condition reads. The enum case is the worse one — it has no writable spelling at all, since mxcli rejects both fully-qualified forms and accepts only the bare value that corrupts. Hand-add every decision in Studio Pro; never script one. Recovery: `DROP WORKFLOW` |
+| **decision on an enumeration** | **CORRUPTING — BUG-76**, of which this probe is a re-confirmation on 11.14 (first logged as BUG-108 before the older entry was found). BUG-76 is the general case: *every* `DECISION` with outcomes corrupts, whatever its condition reads. The enum case is the worse one — it has no writable spelling at all, since mxcli rejects both fully-qualified forms and accepts only the bare value that corrupts. Hand-add every decision in Studio Pro; never script one. Recovery: `DROP WORKFLOW`. **v0.24.0 (2026-09-26): guarded, not fixed** — the bare-value spelling is now refused before the write by `MDL-WF03`; forced through with `--no-check` it still writes the byte-exact `StorageLoadException` |
+| **decision on a Boolean expression, `true`/`false` outcomes** | **proven on v0.24.0 / Mendix 11.13.0** (2026-09-26, a card-disbursement requirements-driven build): `decision N '$WorkflowContext/Attr = ''X''' outcomes true -> { … } false -> { };` passes check, exec and native `mx check` at 0 errors, and `DESCRIBE` reads the expression back intact. This is the keyword-outcome form only — the string-labelled `'1 = 1'` / `'OutcomeA'` repro of BUG-76 was not re-run on v0.24.0; run `learned-workflow-patterns.md` §8 Warning 1's repro before scripting any other shape |
 | **parallel split**, incl. **nested** | **proven on v0.21.0 — with one mandatory post-exec step**, which is the whole of §4's warning above and `learned-workflow-patterns.md` §18. The structure writes correctly at any depth; the `EndOfParallelSplitPathActivity` that closes each path does not, and MDL has no keyword for it. Add it with `bin/wf-add-path-terminators.py <unit.mxunit> --apply` after this script **and after every later script that rewrites the workflow** (§23), then verify with a live run, never a gate. BUG-121; field-proven 8-of-16 → **16-of-16 stations, 6 concurrent**. This row read RETRACTED until 2026-09-14 |
-| **forward `JUMP TO`** (target later in the flow than the outcome jumping to it) | **CE6681.** A *backward* `jump to` builds clean; a forward one is *"not possible to jump to end activities or jump-to activities"* — mxcli resolves a forward target to the end/jump activity rather than the task. Isolated with a two-task probe workflow: same statement, backward clean, forward CE6681. Restructure so the jump goes backwards, or hand-add |
-| **boundary event timer, interrupting** | **hand-add in Studio Pro.** Its path must end in *End* or *Jump* (CE0105); `END WORKFLOW` does not parse and `JUMP TO` is BUG-109 |
+| **forward `JUMP TO`** (target later in the flow than the outcome jumping to it) | **proven on v0.24.0 / Mendix 11.13.0 — this row taught CE6681 until 2026-09-26, and direction was never the platform rule.** Re-probed as an intended known-bad control (a card-disbursement requirements-driven build): `check --references`, `exec` and native `mx check` all 0 errors, and `DESCRIBE` reads the jump back with its real target. The CE6681 recorded here came from mxcli's jump-named-after-its-target defect, for which forward order was the broken case; upstream `825873d6` fixed it in v0.21.0 (`learned-workflow-patterns.md` §25). On a binary older than v0.21.0, jump backwards or hand-add. A CE6681 on a jump now means the target does not resolve — see the reject-path paragraph below the table |
+| **boundary event timer, interrupting** | **proven on v0.24.0 / Mendix 11.13.0** (2026-09-26, a card-disbursement requirements-driven build): a body that calls a microflow and then ends in `end workflow comment '…';`, or in `jump to <earlier activity>;`, passes check, exec and native `mx check` at 0 errors, and the read-back shows a real jump with a real target — BUG-109 no longer reproduces. The path must still end in *End* or *Jump* (CE0105 on an empty body), and §2's one-interrupting-boundary rule applies. **Before v0.24.0: hand-add** — `end workflow` did not parse before the post-v0.22.0 nightly, and `JUMP TO` there was BUG-109 through v0.20.0 |
 | **boundary event on notification** | **hand-add** — the grammar admits `{TIMER, INTERRUPTING, NON}` only |
 | **event sub-process** (all four start kinds), recurrence | **hand-add** — no construct in the grammar, in any position |
 | **multi-user decision method / completion timing** | **hand-add** — the activity is scriptable, its decision rule is not |
@@ -370,8 +382,9 @@ reject outcome is a *dangling* jump: no valid target exists. `mxcli check --refe
 it, `exec` reports `Created workflow`, `DESCRIBE WORKFLOW` reads it back — and the native build
 refuses with **CE6681**, *"not possible to jump to end activities or jump-to activities"*. That
 message is about jump **targets**, so it sends you looking at the target's type; the actual
-fault is that there is no target at all. The table's forward-`JUMP TO` row above is the same
-code from a different cause. Read `CE6681` as **"this jump does not resolve"**, then check
+fault is that there is no target at all. The table's forward-`JUMP TO` row blamed the same
+code on direction until 2026-09-26; on v0.24.0 a forward jump builds clean, so direction is not
+a second cause. Read `CE6681` as **"this jump does not resolve"**, then check
 whether a target exists before checking what kind it is. Design the reject path to *End* and
 the question disappears.
 
@@ -454,7 +467,7 @@ between people, this decides how many workflows exist and who each task targets.
 
 | BPMN element | Mendix | Then check §11 for |
 |---|---|---|
-| Exclusive gateway (XOR) | **Native** — Decision | **BUG-76.** Qualified outcome spelling, `exec --no-check`. Often better expressed as outcomes on the preceding user task — §15 |
+| Exclusive gateway (XOR) | **Native** — Decision | **BUG-76.** Qualified outcome spelling, `exec --no-check`; a Boolean `true`/`false` decision is clean on v0.24.0 (§11). Often better expressed as outcomes on the preceding user task — §15 |
 | Parallel gateway (AND) | **Native** — Parallel Split | **BUG-121.** Path terminators after every write — `learned-workflow-patterns.md` §18, §23 |
 | **Inclusive gateway (OR)** | **Workaround** — parallel split *with a decision on each path* | Both damaged constructs at once. **Cost this explicitly in `fit-gap.md`**; do not let it enter a build plan as one row |
 | User task | **Native** — User Task | proven. Page takes `System.WorkflowUserTask`; targeting microflow takes two parameters |
@@ -464,7 +477,7 @@ between people, this decides how many workflows exist and who each task targets.
 | Receive task | **Native** — Wait for Notification | proven; takes no name |
 | Call activity / reusable subprocess | **Native** — Call Workflow | proven |
 | Event sub-process | **Native** | **hand-add** — no MDL construct, in any position (§3, §11) |
-| Timer: intermediate catch, boundary interrupting/non-interrupting | **Native** | non-interrupting proven; **interrupting is a hand-add** (§2, §11) |
+| Timer: intermediate catch, boundary interrupting/non-interrupting | **Native** | non-interrupting proven; interrupting proven on v0.24.0, **a hand-add on older binaries** (§2, §11) |
 | Message / signal / conditional / escalation / compensation / cancel events | **Workaround** — microflow combinations | per-case; §11 has no row, so probe before promising |
 | Link events (throw/catch) | **Native** | unprobed in MDL |
 | None start / none end | **Native** | end-of-branch is **not expressible** — §4, §11 |
diff --git a/tests/wave2/fixtures/design-audit-css/theme-excerpt.css b/tests/wave2/fixtures/design-audit-css/theme-excerpt.css
new file mode 100644
index 0000000..436d80c
--- /dev/null
+++ b/tests/wave2/fixtures/design-audit-css/theme-excerpt.css
@@ -0,0 +1,45 @@
+/* VERBATIM excerpts of a real deployment/web/theme.compiled.css (mxbuild output, Mendix 11.13.0,
+   Atlas Core theme) captured 2026-09-26 for tests/wave2/test-design-audit-css-corpus.sh.
+   Not hand-written: each block below is copied byte-for-byte from that file. */
+@media (max-width: 767px) {
+  .spacing-outer-bottom-large {
+    margin-bottom: var(--m-spacing-large)  !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .spacing-outer-bottom-large {
+    margin-bottom: var(--t-spacing-large)  !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .spacing-outer-bottom-large {
+    margin-bottom: var(--spacing-large)  !important;
+  }
+}
+
+@font-face {
+  font-family: "Atlas_Core$Atlas_Styling";
+  src: url("./fonts/Atlas_Core$Atlas_Styling.ttf") format("truetype");
+}
+
+@keyframes placeholderGradient {
+  0% {
+    background-position: 100px 0;
+  }
+  100% {
+    background-position: -100px 0;
+  }
+}
+
+.mx-datagrid-table-resizing th,
+.mx-datagrid-table-resizing td {
+  cursor: col-resize !important;
+}
+
+@supports (padding-bottom: env(safe-area-inset-bottom)) {
+  .mx-menubar {
+    padding-bottom: env(safe-area-inset-bottom);
+  }
+}
diff --git a/tests/wave2/fixtures/design-audit-nav/describe-navigation-responsive.txt b/tests/wave2/fixtures/design-audit-nav/describe-navigation-responsive.txt
new file mode 100644
index 0000000..1b10962
--- /dev/null
+++ b/tests/wave2/fixtures/design-audit-nav/describe-navigation-responsive.txt
@@ -0,0 +1,19 @@
+-- GOLDEN CAPTURE, verbatim: `mxcli -p <app>.mpr describe navigation Responsive` (mxcli v0.24.0,
+-- Mendix 11.13.0), 2026-09-26, card-disbursement requirements-driven build. Only these three
+-- header lines were added; mxcli's WARNING banner lines on stderr are not part of stdout.
+-- navigation PROFILE: Responsive
+--   Kind: Responsive
+create or replace navigation Responsive
+  home page MyFirstModule.Home_Web
+  menu (
+    menu 'Work' icon Atlas_Core.Atlas.briefcase (
+      menu item 'Home' page MyFirstModule.Home_Web icon Atlas_Core.Atlas.home;
+      menu item 'Cases' page Disbursement.Case_Overview icon Atlas_Core.Atlas."list-bullets";
+    );
+    menu 'Configure' icon Atlas_Core.Atlas.cog (
+      menu item 'Mock console' page MockServices.MockConsole_Overview icon Atlas_Core.Atlas."console-terminal";
+      menu item 'Design system' page StyleGallery.Gallery_Overview icon Atlas_Core.Atlas."color-painting-palette";
+    );
+  )
+;
+
diff --git a/tests/wave2/fixtures/journey-control/control-run.json b/tests/wave2/fixtures/journey-control/control-run.json
new file mode 100644
index 0000000..6c50a9d
--- /dev/null
+++ b/tests/wave2/fixtures/journey-control/control-run.json
@@ -0,0 +1,2393 @@
+{
+ "capturedAt": "2026-09-26T08:20:55.521Z",
+ "positiveControl": true,
+ "mutants": {
+  "expectedPerJourney": 7,
+  "expected": 7,
+  "supported": 7,
+  "proven": 7,
+  "unsupported": []
+ },
+ "results": [
+  {
+   "rung": "ui",
+   "name": "login",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: downstream rungs",
+   "verdict": "INVALID"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · ui-landing: first step lands on a widget that does not exist",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"__text_this_page_will_never_render__\"",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-ui-text end state",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · ui-text: expect text the page never renders",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-trace-order end state",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · trace-order: expect a microflow that never fires",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: ACT_Mock_Reset did not run",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-trace-negative end state",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · trace-negative: assert a microflow that DID run must not have run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +3",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-data-delta end state",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · data-delta: expect +2 rows from a +1 action",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-data-target end state",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · data-target: association must point at a value the journey never picked",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices-CTL-outcome end state",
+   "verdict": "FAIL"
+  },
+  {
+   "rung": "control",
+   "name": "MockServices · outcome: outcome query with an unreachable floor",
+   "verdict": "PASS"
+  }
+ ]
+}
diff --git a/tests/wave2/fixtures/journey-control/walk-run.json b/tests/wave2/fixtures/journey-control/walk-run.json
new file mode 100644
index 0000000..6c0742b
--- /dev/null
+++ b/tests/wave2/fixtures/journey-control/walk-run.json
@@ -0,0 +1,408 @@
+{
+ "capturedAt": "2026-09-26T08:15:38.349Z",
+ "positiveControl": false,
+ "mutants": {
+  "expectedPerJourney": 7,
+  "expected": 0,
+  "supported": 0,
+  "proven": 0,
+  "unsupported": []
+ },
+ "results": [
+  {
+   "rung": "ui",
+   "name": "login",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget btnReset",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvSystems",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: widget lvPackages",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"Mock console\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Open Configure › Mock console: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"DO_SIGN_CONTRACTS\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset the hub to its baseline: page says \"7710001\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset the hub to its baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset the hub to its baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset the hub to its baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: no scenario is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: all six systems are Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: one default package",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset the hub to its baseline: two applications, none KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: radio rbKind checked \"Custom payload\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: widget btnDlgCancel",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "A custom payload that is not JSON is refused: page says \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] A custom payload that is not JSON is refused: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] A custom payload that is not JSON is refused: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: A custom payload that is not JSON is refused: ^MockServices\\.SUB_MockScenario_Arm$ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "A custom payload that is not JSON is refused: nothing was armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: radio rbKind checked \"Fault\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page says \"· once\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: page does NOT say \"Not valid JSON\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Arm a one-shot fault on DO_SIGN_CONTRACTS: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Arm a one-shot fault on DO_SIGN_CONTRACTS: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Arm a one-shot fault on DO_SIGN_CONTRACTS: VAL_MockScenario_Payload did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: DO_SIGN_CONTRACTS is armed with fault MWF-503 / 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Arm a one-shot fault on DO_SIGN_CONTRACTS: only that one is armed",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) answers 503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (armed) response has MWF-503",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: DO_SIGN_CONTRACTS (after the one shot) answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: MockServices.MockCallLog +2",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the call log holds the 503 then the 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "The hub answers the fault once, then succeeds: the one-shot disarmed itself; both calls counted",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GET_SYSTEM_STATUS response has \"StatusCode\":\"0\",\"StatusDescription\":\"Offline\",\"System\":\"GM4\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Take GM4 offline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Take GM4 offline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Take GM4 offline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: GM4 answers StatusCode 0",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Take GM4 offline: the other five stay Online",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL answers 200",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: DO_START_APPROVAL response has \"APPROVED_FLAG\":false",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Mark application 7710001 KO: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Mark application 7710001 KO: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Mark application 7710001 KO: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Mark application 7710001 KO: 7710001 is KO, 7710002 is not",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Cancelling the reset changes nothing: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: GM4 is still offline",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: 7710001 is still KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Cancelling the reset changes nothing: the call log is kept",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: confirmation says \"Reset the mock hub?\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: reached",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "ui",
+   "name": "Reset restores the baseline: page does NOT say \"MWF-503\"",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[GUARD] Reset restores the baseline: capture non-empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: ordered",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] Reset restores the baseline: no ERROR at any level",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "trace",
+   "name": "[MF] NEGATIVE: Reset restores the baseline: REST_ did not run",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage set on every row",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: MockServices.MockApplication_MockPackage points at the seeded ProdPackageKey",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: the call log is empty",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no scenario is armed and no hit count survives",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "data",
+   "name": "Reset restores the baseline: no application is KO",
+   "verdict": "PASS"
+  },
+  {
+   "rung": "outcome",
+   "name": "MockServices end state",
+   "verdict": "PASS"
+  }
+ ]
+}
diff --git a/tests/wave2/fixtures/otel-capture/jaeger-trace-refused-arm.json b/tests/wave2/fixtures/otel-capture/jaeger-trace-refused-arm.json
new file mode 100644
index 0000000..973ab99
--- /dev/null
+++ b/tests/wave2/fixtures/otel-capture/jaeger-trace-refused-arm.json
@@ -0,0 +1,520 @@
+{
+ "data": [
+  {
+   "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+   "spans": [
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "6b80ee02197cd6c0",
+     "operationName": "Microflow MockServices.VAL_MockScenario_Payload",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "fa4649c3449fa902"
+      }
+     ],
+     "startTime": 1790409626709073,
+     "duration": 18484,
+     "tags": [
+      {
+       "key": "mx.microflow.depth",
+       "type": "int64",
+       "value": 3
+      },
+      {
+       "key": "mx.microflow.name",
+       "type": "string",
+       "value": "MockServices.VAL_MockScenario_Payload"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "fa4649c3449fa902",
+     "operationName": "Microflow MockServices.VAL_MockScenario_Arm",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "f989744b009500c8"
+      }
+     ],
+     "startTime": 1790409626707895,
+     "duration": 19740,
+     "tags": [
+      {
+       "key": "mx.microflow.depth",
+       "type": "int64",
+       "value": 2
+      },
+      {
+       "key": "mx.microflow.name",
+       "type": "string",
+       "value": "MockServices.VAL_MockScenario_Arm"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "f989744b009500c8",
+     "operationName": "Microflow MockServices.ACT_MockScenario_Arm",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "28bab01e60e87dd5"
+      }
+     ],
+     "startTime": 1790409626707352,
+     "duration": 20532,
+     "tags": [
+      {
+       "key": "mx.microflow.depth",
+       "type": "int64",
+       "value": 1
+      },
+      {
+       "key": "mx.microflow.name",
+       "type": "string",
+       "value": "MockServices.ACT_MockScenario_Arm"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "28bab01e60e87dd5",
+     "operationName": "Call microflow MockServices.ACT_MockScenario_Arm",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "11fa3a7d5e02c482"
+      }
+     ],
+     "startTime": 1790409626696746,
+     "duration": 32391,
+     "tags": [
+      {
+       "key": "mx.operation.type",
+       "type": "string",
+       "value": "callMicroflow"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "32acedcc452e6e31",
+     "operationName": "SELECT /work/app/deployment/data/database/hsqldb/carddisbursement/carddisbursement.mockservices$mockscenario",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "28bab01e60e87dd5"
+      }
+     ],
+     "startTime": 1790409626703564,
+     "duration": 154,
+     "tags": [
+      {
+       "key": "db.connection_string",
+       "type": "string",
+       "value": "hsqldb:file:"
+      },
+      {
+       "key": "db.name",
+       "type": "string",
+       "value": "/work/app/deployment/data/database/hsqldb/carddisbursement/carddisbursement"
+      },
+      {
+       "key": "db.operation",
+       "type": "string",
+       "value": "SELECT"
+      },
+      {
+       "key": "db.sql.table",
+       "type": "string",
+       "value": "mockservices$mockscenario"
+      },
+      {
+       "key": "db.statement",
+       "type": "string",
+       "value": "SELECT \"mockservices$mockscenario\".\"id\", \"mockservices$mockscenario\".\"operation\", \"mockservices$mockscenario\".\"kind\", \"mockservices$mockscenario\".\"sticky\", \"mockservices$mockscenario\".\"active\", \"mockservices$mockscenario\".\"custompayload\", \"mockservices$mockscenario\".\"faultcode\", \"mockservices$mockscenario\".\"httpstatus\", \"mockservices$mockscenario\".\"hitcount\", \"mockservices$mockscenario\".\"createddate\", \"mockservices$mockscenario\".\"changeddate\", \"mockservices$mockscenario\".\"system$owner\", \"mockservices$mockscenario\".\"system$changedby\" FROM \"mockservices$mockscenario\" WHERE \"mockservices$mockscenario\".\"id\" = ?"
+      },
+      {
+       "key": "db.system",
+       "type": "string",
+       "value": "hsqldb"
+      },
+      {
+       "key": "db.user",
+       "type": "string",
+       "value": "SA"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "io.opentelemetry.jdbc"
+      },
+      {
+       "key": "otel.scope.version",
+       "type": "string",
+       "value": "2.29.0-alpha"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "client"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "11fa3a7d5e02c482",
+     "operationName": "POST /*",
+     "references": [],
+     "startTime": 1790409626694533,
+     "duration": 36156,
+     "tags": [
+      {
+       "key": "client.address",
+       "type": "string",
+       "value": "127.0.0.1"
+      },
+      {
+       "key": "http.request.method",
+       "type": "string",
+       "value": "POST"
+      },
+      {
+       "key": "http.response.status_code",
+       "type": "int64",
+       "value": 200
+      },
+      {
+       "key": "http.route",
+       "type": "string",
+       "value": "/*"
+      },
+      {
+       "key": "network.peer.address",
+       "type": "string",
+       "value": "127.0.0.1"
+      },
+      {
+       "key": "network.peer.port",
+       "type": "int64",
+       "value": 36678
+      },
+      {
+       "key": "network.protocol.version",
+       "type": "string",
+       "value": "1.1"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "io.opentelemetry.jetty-12.0"
+      },
+      {
+       "key": "otel.scope.version",
+       "type": "string",
+       "value": "2.29.0-alpha"
+      },
+      {
+       "key": "server.address",
+       "type": "string",
+       "value": "localhost"
+      },
+      {
+       "key": "server.port",
+       "type": "int64",
+       "value": 8080
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      },
+      {
+       "key": "url.path",
+       "type": "string",
+       "value": "/xas/"
+      },
+      {
+       "key": "url.scheme",
+       "type": "string",
+       "value": "http"
+      },
+      {
+       "key": "user_agent.original",
+       "type": "string",
+       "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.7390.37 Safari/537.36"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "42fe3d00af19a6d8",
+     "operationName": "Java action MockServices.JA_Json_IsValid",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "6b80ee02197cd6c0"
+      }
+     ],
+     "startTime": 1790409626711291,
+     "duration": 14513,
+     "tags": [
+      {
+       "key": "mx.activity.input_variable_names",
+       "type": "string",
+       "value": "Scenario/CustomPayload"
+      },
+      {
+       "key": "mx.activity.name",
+       "type": "string",
+       "value": "JavaAction"
+      },
+      {
+       "key": "mx.activity.output_variable_name",
+       "type": "string",
+       "value": "IsJson"
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    },
+    {
+     "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+     "spanID": "581b94df924d35a3",
+     "operationName": "AddValidationFeedback activity",
+     "references": [
+      {
+       "refType": "CHILD_OF",
+       "traceID": "c4dc26854ecdb369548b4f882d2bd351",
+       "spanID": "6b80ee02197cd6c0"
+      }
+     ],
+     "startTime": 1790409626726390,
+     "duration": 1084,
+     "tags": [
+      {
+       "key": "mx.activity.input_variable_names",
+       "type": "string",
+       "value": "Scenario"
+      },
+      {
+       "key": "mx.activity.name",
+       "type": "string",
+       "value": "AddValidationFeedback"
+      },
+      {
+       "key": "mx.activity.output_variable_name",
+       "type": "string",
+       "value": ""
+      },
+      {
+       "key": "otel.scope.name",
+       "type": "string",
+       "value": "com.mendix.runtime"
+      },
+      {
+       "key": "otel.status_code",
+       "type": "string",
+       "value": "OK"
+      },
+      {
+       "key": "span.kind",
+       "type": "string",
+       "value": "server"
+      },
+      {
+       "key": "thread.id",
+       "type": "int64",
+       "value": 146
+      },
+      {
+       "key": "thread.name",
+       "type": "string",
+       "value": "JettyServer-7"
+      }
+     ],
+     "logs": [],
+     "processID": "p1",
+     "warnings": null
+    }
+   ],
+   "warnings": null
+  }
+ ],
+ "total": 0,
+ "limit": 0,
+ "offset": 0,
+ "errors": null
+}
diff --git a/tests/wave2/test-closeout.sh b/tests/wave2/test-closeout.sh
index 2532517..ef15ff2 100755
--- a/tests/wave2/test-closeout.sh
+++ b/tests/wave2/test-closeout.sh
@@ -119,6 +119,12 @@ echo "== T8: --closeout without a stage refuses =="
 "$GATE" --closeout "$P" >/dev/null 2>&1; RC=$?
 [ "$RC" -eq 2 ] && ok "exit 2" || bad "exit $RC"
 
+echo "== T9: a row the entry mode does not owe is N/A, never 'still missing' (2026-09-25) =="
+P="$(mkproj t9)"
+OUT="$("$GATE" --closeout "$P" 0 2>&1)"
+case "$OUT" in *"⏭ \`app-report\` — N/A: entry mode requirements does not owe it"*) ok "app-report N/A on a requirements-driven register" ;; *) bad "app-report not N/A: $(printf '%s' "$OUT" | grep app-report)" ;; esac
+if printf '%s\n' "$OUT" | grep 'still missing for this stage' | grep -q 'app-report'; then bad "plain words list app-report as missing"; else ok "plain words do not list a row this mode does not owe"; fi
+
 rm -rf "$WORK"
 echo "passed $PASS, failed $FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-conformance-baseline-scope.sh b/tests/wave2/test-conformance-baseline-scope.sh
new file mode 100755
index 0000000..a10fa5c
--- /dev/null
+++ b/tests/wave2/test-conformance-baseline-scope.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Usage: bash test-conformance-baseline-scope.sh [path-to-conformance-check.sh]
+#
+# Fixture for project-bin/conformance-check.sh's baseline — which rows it guards, and which rows
+# a `--module` rewrite may touch.
+#
+# The defects (card-disbursement requirements-driven build, 2026-09-26):
+#   (a) The baseline is written once, by the first run. A module built afterwards has no baseline
+#       rows, its rows were compared with "" and could never regress — silently, forever. That
+#       project's committed baseline held 1 of its 4 modules (127 of 246 rows).
+#   (b) `--update-baseline --module X` wrote X's rows over the WHOLE file, dropping every other
+#       module's rows — a scoped measurement doing an unscoped write.
+# Cases 2-3 are (a), cases 4-5 are (b), case 6 guards the unscoped rewrite.
+#
+# The ledgers and the mxcli stub are SYNTHETIC. That is deliberate and allowed: the field-proof
+# rule's "golden input is captured" governs parsers of tool output, and nothing below exercises
+# the DESCRIBE-output parser — the stub answers the two shapes it already classifies (text + rc 0
+# = PRESENT, "Error: … not found" + rc 1 = ABSENT) and the assertions are about the baseline file.
+# The field run that motivated it is cited in CHANGELOG.md.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/conformance-check.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+SUT="$(cd "$(dirname "$SUT")" && pwd)/$(basename "$SUT")"
+[ -f "$(dirname "$SUT")/_common.sh" ] || { echo "FAIL — _common.sh not beside $SUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/conf-baseline.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+P="$WORK/proj"
+mkdir -p "$P/architecture/modules/Orders" "$P/architecture/modules/Billing"
+: > "$P/Shop.mpr"
+# PRESENT lists the qualified names the stub model holds; edit it to break or restore one.
+printf 'Orders.Order\nOrders.ACT_Order_Save\nBilling.Invoice\nBilling.ACT_Invoice_Send\n' > "$P/PRESENT"
+cat > "$P/mxcli" <<'EOF'
+#!/usr/bin/env bash
+cmd=""; while [ $# -gt 0 ]; do [ "$1" = -c ] && cmd="$2"; shift; done
+name="${cmd##* }"
+if grep -qx "$name" "$(dirname "$0")/PRESENT"; then echo "-- $name"; echo "create $name;"; exit 0; fi
+echo "Error: $name not found"; exit 1
+EOF
+chmod +x "$P/mxcli"
+ledger() {  # ledger <Module> <entity> <microflow>
+  cat > "$P/architecture/modules/$1/coverage-ledger.md" <<EOF
+| Pointer | Kind | Name | Row | Proof | Acceptance | Status |
+|---|---|---|---|---|---|---|
+| \`/domainEntities/0\` | entity | $2 | 1.1 | exec.sh | \`DESCRIBE ENTITY $1.$2\` | built |
+| \`/microflows/0\` | microflow | $3 | 1.2 | exec.sh | \`DESCRIBE MICROFLOW $1.$3\` | built |
+EOF
+}
+run() { ( cd "$P" && PROJECT_ROOT="$P" bash "$SUT" --quiet "$@" ) > "$WORK/out" 2>&1; echo $?; }
+rows() { awk -F'\t' -v m="$1" '$1==m' "$P/docs/conformance/baseline.tsv" 2>/dev/null | grep -c . ; }
+out() { tr '\n' ' ' < "$WORK/out" | cut -c1-300; }
+
+# --- 1. first run writes the baseline (unchanged behaviour) ---------------------------------
+ledger Orders Order ACT_Order_Save
+rc="$(run)"
+[ "$rc" = 0 ] && [ "$(rows Orders)" = 2 ] && ok "first run baselines Orders (2 rows)" \
+  || bad "first run did not write a 2-row Orders baseline (rc=$rc)" "$(out)"
+
+# --- 2. a module built after the baseline is baselined on first sight, and said so -----------
+ledger Billing Invoice ACT_Invoice_Send
+rc="$(run)"
+[ "$rc" = 0 ] && [ "$(rows Billing)" = 2 ] && ok "Billing's rows are baselined on first sight (2 rows added)" \
+  || bad "Billing's rows never reached the baseline (the 2026-09-26 unguarded module)" "rc=$rc rows=$(rows Billing)"
+grep -q "newly baselined *2" "$WORK/out" && ok "the run says how many rows it newly baselined" \
+  || bad "no 'newly baselined 2' line" "$(out)"
+
+# --- 3. ...so a later break in Billing IS a regression ----------------------------------------
+sed -i.bak '/^Billing.Invoice$/d' "$P/PRESENT"
+rc="$(run)"
+[ "$rc" = 1 ] && grep -q "Billing.*was OK, now STALE" "$WORK/out" \
+  && ok "Billing.Invoice going absent fails the run as a regression" \
+  || bad "a module built after the baseline cannot regress" "rc=$rc $(out)"
+mv "$P/PRESENT.bak" "$P/PRESENT"
+
+# --- 4. --update-baseline --module rewrites only that module's rows ---------------------------
+rc="$(run --module Billing --update-baseline)"
+[ "$rc" = 0 ] && [ "$(rows Orders)" = 2 ] && [ "$(rows Billing)" = 2 ] \
+  && ok "--module Billing --update-baseline keeps Orders' 2 rows" \
+  || bad "a --module rewrite dropped other modules' rows (the 2026-09-26 clobber)" "rc=$rc Orders=$(rows Orders) Billing=$(rows Billing)"
+
+# --- 5. ...so Orders is still guarded after it ------------------------------------------------
+sed -i.bak '/^Orders.ACT_Order_Save$/d' "$P/PRESENT"
+rc="$(run)"
+[ "$rc" = 1 ] && grep -q "Orders.*was OK, now STALE" "$WORK/out" \
+  && ok "Orders.ACT_Order_Save going absent still fails the run after Billing's rewrite" \
+  || bad "Orders lost its regression guard" "rc=$rc $(out)"
+mv "$P/PRESENT.bak" "$P/PRESENT"
+
+# --- 6. an unscoped --update-baseline still rewrites everything --------------------------------
+printf 'Orders\t`/stale`\tOK\n' >> "$P/docs/conformance/baseline.tsv"
+rc="$(run --update-baseline)"
+[ "$rc" = 0 ] && [ "$(wc -l < "$P/docs/conformance/baseline.tsv" | tr -d ' ')" = 4 ] \
+  && ok "unscoped --update-baseline rewrites the whole file (a retired row is dropped)" \
+  || bad "unscoped rewrite changed behaviour" "rc=$rc lines=$(wc -l < "$P/docs/conformance/baseline.tsv")"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-coverage-preflight-ledger-dir.sh b/tests/wave2/test-coverage-preflight-ledger-dir.sh
new file mode 100755
index 0000000..ab215b3
--- /dev/null
+++ b/tests/wave2/test-coverage-preflight-ledger-dir.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Usage: bash test-coverage-preflight-ledger-dir.sh [path-to-coverage-preflight.sh]
+#
+# Fixture for project-bin/coverage-preflight.sh's ledger discovery — the per-BRD directory form
+# `architecture/modules/<Module>/coverage-ledger/<BRDID>.md` (project-bin/coverage-check-all.sh's
+# convention) at LEVEL 1.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): a module that splits its
+# ledger per BRD keeps coverage-ledger.md beside the directory as an index. find_ledger() only
+# tested for files, found the index, and ran EVERY BRD against it — 9 of 9 BRDs UNCLAIMED for a
+# module that owns one, while coverage-check-all.sh reported all 9 clean from the same files.
+# Case 1 below is that project's shape in miniature, including the index file.
+#
+# The BRDs and ledgers here are SYNTHETIC and hand-written. That is deliberate and allowed: the
+# field-proof rule's "golden input is captured" governs parsers of tool output, and nothing below
+# parses tool output — it lays out files and asserts which ledger the script measures against.
+# The field run that motivated it is cited in CHANGELOG.md.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-bin/coverage-preflight.sh"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v jq >/dev/null 2>&1 || { echo "SKIP: jq not installed (the engine needs it)"; exit 0; }
+export MXTK_ROOT="${MXTK_ROOT:-$(cd "$(dirname "$SUT")/.." && pwd)}"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/cov-ledger-dir.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+# Two BRDs, 4 leaves each; Orders owns FA01, Billing owns FB02.
+mk_project() {
+  local r="$1"
+  mkdir -p "$r/analysis/src/knowledge-base/brd" "$r/architecture/modules/Orders" "$r/architecture/modules/Billing"
+  printf '{"id":"FA01","title":"Alpha","useCases":[{"id":"UC1","name":"Place order"}]}\n' \
+    > "$r/analysis/src/knowledge-base/brd/FA01-alpha.brd.json"
+  printf '{"id":"FB02","title":"Beta","useCases":[{"id":"UC1","name":"Send invoice"}]}\n' \
+    > "$r/analysis/src/knowledge-base/brd/FB02-beta.brd.json"
+}
+ledger() {   # ledger <file> [omit-usecase]
+  {
+    echo "## BUILDABLE"; echo ""
+    echo "| pointer | type | title | slice | writeMode | acceptance | status |"
+    echo "|---|---|---|---|---|---|---|"
+    [ "${2:-}" = "omit-usecase" ] || echo "| \`/useCases/0/*\` (2) | usecase | UC1 | 1.1 | test | e2e | not-built |"
+    echo ""; echo "## NON-BUILDABLE"; echo ""
+    echo "| pointer | category | reason |"
+    echo "|---|---|---|"
+    echo "| \`/id\` | provenance | metadata |"
+    echo "| \`/title\` | provenance | metadata |"
+  } > "$1"
+}
+run() { PROJECT_ROOT="$1" bash "$SUT" --summary --module "$2" >"$WORK/out" 2>&1; echo $?; }
+
+# --- 1. directory form beside an index file: each BRD against its own ledger ------------------
+P="$WORK/p1"; mk_project "$P"
+mkdir -p "$P/architecture/modules/Orders/coverage-ledger"
+ledger "$P/architecture/modules/Orders/coverage-ledger/FA01-alpha.md"
+printf '# Coverage ledger — Orders (index)\n\n- FA01 → coverage-ledger/FA01-alpha.md\n' \
+  > "$P/architecture/modules/Orders/coverage-ledger.md"
+rc=$(run "$P" Orders)
+[ "$rc" -eq 0 ] && ok "dir form beside an index file is clean (rc 0)" || bad "dir form not clean" "rc=$rc $(tr '\n' ' ' < "$WORK/out" | cut -c1-300)"
+grep -q 'ledger: architecture/modules/Orders/coverage-ledger$' "$WORK/out" \
+  && ok "the directory is chosen over the index file" || bad "index file measured instead of the directory"
+grep -q '1 of 2 BRD(s) measured' "$WORK/out" \
+  && ok "denominator stated: 1 of 2 BRDs measured" || bad "no measured-of denominator"
+grep -q 'no ledger here.*FB02-beta' "$WORK/out" \
+  && ok "the other module's BRD is named, not measured" || bad "other module's BRD not named"
+if grep -qE 'UNCLAIMED: +[1-9]' "$WORK/out"; then
+  bad "a BRD was measured against the wrong ledger (the 2026-09-26 false red)"
+else
+  ok "no BRD measured against the index"
+fi
+
+# --- 2. a finding in a per-BRD ledger passes through as rc 1 ---------------------------------
+ledger "$P/architecture/modules/Orders/coverage-ledger/FA01-alpha.md" omit-usecase
+rc=$(run "$P" Orders)
+[ "$rc" -eq 1 ] && ok "an UNCLAIMED leaf in a per-BRD ledger reports rc 1" || bad "finding did not pass through" "rc=$rc"
+
+# --- 3. a ledger file named after no BRD is a fault ------------------------------------------
+ledger "$P/architecture/modules/Orders/coverage-ledger/FA01-alpha.md"
+ledger "$P/architecture/modules/Orders/coverage-ledger/FZ99-ghost.md"
+rc=$(run "$P" Orders)
+[ "$rc" -eq 2 ] && grep -q 'FZ99-ghost' "$WORK/out" \
+  && ok "orphan ledger file faults (rc 2) and is named" || bad "orphan ledger not faulted" "rc=$rc"
+rm -f "$P/architecture/modules/Orders/coverage-ledger/FZ99-ghost.md"
+
+# --- 4. a directory matching no BRD cannot evaluate ------------------------------------------
+P4="$WORK/p4"; mk_project "$P4"
+mkdir -p "$P4/architecture/modules/Billing/coverage-ledger"
+ledger "$P4/architecture/modules/Billing/coverage-ledger/FA01-alpha.md"
+mv "$P4/analysis/src/knowledge-base/brd/FA01-alpha.brd.json" "$P4/analysis/src/knowledge-base/brd/FC03-gamma.brd.json"
+rc=$(run "$P4" Billing)
+[ "$rc" -eq 2 ] && ok "a directory with no ledger for any BRD faults (rc 2), never a clean 0" || bad "unmatched directory read as clean" "rc=$rc"
+
+# --- 5. the single-file form still works (regression) ----------------------------------------
+P5="$WORK/p5"; mk_project "$P5"
+ledger "$P5/architecture/modules/Orders/coverage-ledger.md"
+rm "$P5/analysis/src/knowledge-base/brd/FB02-beta.brd.json"
+rc=$(run "$P5" Orders)
+[ "$rc" -eq 0 ] && grep -q 'ledger: architecture/modules/Orders/coverage-ledger.md' "$WORK/out" \
+  && ok "single-file ledger still measured (rc 0)" || bad "single-file form regressed" "rc=$rc"
+
+# --- 6. an empty directory is not a ledger: falls through to the file ------------------------
+mkdir -p "$P5/architecture/modules/Orders/coverage-ledger"
+rc=$(run "$P5" Orders)
+[ "$rc" -eq 0 ] && grep -q 'ledger: architecture/modules/Orders/coverage-ledger.md' "$WORK/out" \
+  && ok "empty directory falls through to the file" || bad "empty directory shadowed the file" "rc=$rc"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-design-audit-css-corpus.sh b/tests/wave2/test-design-audit-css-corpus.sh
new file mode 100755
index 0000000..979a669
--- /dev/null
+++ b/tests/wave2/test-design-audit-css-corpus.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Usage: bash test-design-audit-css-corpus.sh [path-to-design-audit.js]
+#
+# Fixture for project-tests/e2e/design-audit.js's defined-class corpus (classesInCss) — the set
+# every rung-6/7 class verdict (invented, unmatched, never-promoted) is measured against.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): the harvester read
+# selectors at brace depth 0 only. Atlas emits `spacing-outer-bottom-large` ONLY inside three
+# breakpoint @media blocks, so the audit called it "invented" on every page that used it — the
+# very class skills/design-spacing.md prescribes for section rhythm. Same blind spot for any
+# rule under @supports / @layer.
+#
+# Golden input is a VERBATIM capture of a real mxbuild theme.compiled.css
+# (fixtures/design-audit-css/theme-excerpt.css — header says where from). It carries the real
+# traps next to the defect: a url("./fonts/….ttf") in @font-face, @keyframes percent selectors,
+# a multi-line depth-0 selector list. The two synthetic cases at the end are marked as such:
+# they guard declaration values (quoted dots, a brace inside a string) that the capture lacks.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/design-audit.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+GOLDEN="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fixtures/design-audit-css/theme-excerpt.css"
+[ -f "$GOLDEN" ] || { echo "FAIL — golden capture missing: $GOLDEN"; exit 1; }
+
+# design-audit.js runs on load, so lift the two functions out of its text instead of requiring it.
+IFS= read -r -d '' JS <<'EOF' || true
+const fs = require('fs');
+const [sut, golden] = process.argv.slice(2);
+const js = fs.readFileSync(sut, 'utf8');
+const lift = (name) => {
+  const i = js.indexOf(`function ${name}(`);
+  if (i < 0) { console.log(`LIFT-FAIL ${name}`); process.exit(3); }
+  let d = 0, j = js.indexOf('{', i);
+  for (; j < js.length; j++) { if (js[j] === '{') d++; else if (js[j] === '}' && --d === 0) break; }
+  return js.slice(i, j + 1);
+};
+const classesInCss = new Function(`${lift('harvest')}\n${lift('classesInCss')}\nreturn classesInCss;`)();
+const show = (label, text) => console.log(`${label} ${[...classesInCss(text)].sort().join(' ')}`);
+show('GOLDEN', fs.readFileSync(golden, 'utf8'));
+// SYNTHETIC — declaration values the golden capture does not carry.
+show('SYN-QUOTED', '.real { content: ".not-a-class"; background: url(\'img/x.png\'); }');
+show('SYN-BRACE', '.a { content: "{"; } .b { color: red; }');
+EOF
+OUT="$(printf '%s' "$JS" | node - "$SUT" "$GOLDEN")"
+rc=$?
+[ "$rc" -eq 0 ] || { echo "FAIL — harness could not load classesInCss from $SUT (rc=$rc)"; echo "$OUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+has()  { printf ' %s ' "$(line "$1")" | grep -q " $2 "; }
+
+G="$(line GOLDEN)"
+if has GOLDEN spacing-outer-bottom-large; then ok "class defined only inside @media is in the corpus (the 2026-09-26 false 'invented')"
+else bad "@media-only class missing from the corpus" "$G"; fi
+if has GOLDEN mx-menubar; then ok "class defined inside @supports is in the corpus"
+else bad "@supports class missing" "$G"; fi
+if has GOLDEN mx-datagrid-table-resizing; then ok "depth-0 multi-line selector list still harvested"
+else bad "depth-0 selector regressed" "$G"; fi
+if has GOLDEN ttf || has GOLDEN fonts; then bad "url() fragment in @font-face harvested as a class" "$G"
+else ok "url(\"./fonts/….ttf\") in @font-face defines no class"; fi
+n=$(printf '%s\n' "$G" | wc -w | tr -d ' ')
+[ "$n" -eq 3 ] && ok "golden capture yields exactly 3 classes (no at-rule prelude or keyframe step leaked)" \
+  || bad "golden capture yields $n classes, want 3" "$G"
+
+S="$(line SYN-QUOTED)"
+[ "$S" = "real" ] && ok "quoted dot and url() in declaration values define nothing (synthetic)" || bad "declaration value leaked" "$S"
+S="$(line SYN-BRACE)"
+[ "$S" = "a b" ] && ok "a brace inside a string does not open a rule (synthetic)" || bad "string brace mis-parsed" "$S"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-design-audit-nav-map.sh b/tests/wave2/test-design-audit-nav-map.sh
new file mode 100755
index 0000000..79eee31
--- /dev/null
+++ b/tests/wave2/test-design-audit-nav-map.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Usage: bash test-design-audit-nav-map.sh [path-to-design-audit.js]
+#
+# Fixture for project-tests/e2e/design-audit.js's navigation map (parseNavigation) — the route
+# table rung 7 (a11y, overflow, structure) uses to reach each page in the running app. A page
+# with no route is a FAULT row "this check never ran", so a parser that misses items silently
+# turns the whole runtime rung into faults.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): the item regex required
+# `;` straight after the page name. Real `describe navigation` output puts `icon <ref>` there
+# (and `icon <ref>` before the `(` of a group), so 0 of 4 menu pages were routed and rung 7 ran
+# on none of 7 in-scope pages.
+#
+# Golden input is a VERBATIM capture (fixtures/design-audit-nav/). The last case is SYNTHETIC and
+# marked: an icon-less item and a microflow item, the shapes the capture lacks.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/design-audit.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+GOLDEN="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/fixtures/design-audit-nav/describe-navigation-responsive.txt"
+[ -f "$GOLDEN" ] || { echo "FAIL — golden capture missing: $GOLDEN"; exit 1; }
+
+# design-audit.js runs on load, so lift the function out of its text instead of requiring it.
+IFS= read -r -d '' JS <<'JS' || true
+const fs = require('fs');
+const [sut, golden] = process.argv.slice(2);
+const js = fs.readFileSync(sut, 'utf8');
+const i = js.indexOf('function parseNavigation(');
+if (i < 0) { console.log('LIFT-FAIL parseNavigation'); process.exit(3); }
+let d = 0, j = js.indexOf('{', i);
+for (; j < js.length; j++) { if (js[j] === '{') d++; else if (js[j] === '}' && --d === 0) break; }
+const parse = new Function(`${js.slice(i, j + 1)}\nreturn parseNavigation;`)();
+const show = (label, txt) => {
+  const m = parse(txt);
+  console.log(`${label} n=${m.size} ` + [...m].map(([k, v]) => `${k}=${v.group}>${v.item}`).join(' | '));
+};
+show('GOLDEN', fs.readFileSync(golden, 'utf8'));
+// SYNTHETIC — shapes the capture does not carry.
+show('SYN', "  menu 'Ops' (\n    menu item 'Plain' page Mod.Plain_Page;\n    menu item 'Run' microflow Mod.ACT_Run icon Atlas_Core.Atlas.play;\n  );\n");
+JS
+OUT="$(printf '%s' "$JS" | node - "$SUT" "$GOLDEN")"
+rc=$?
+[ "$rc" -eq 0 ] || { echo "FAIL — harness could not load parseNavigation from $SUT (rc=$rc)"; echo "$OUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+G="$(printf '%s\n' "$OUT" | sed -n 's/^GOLDEN //p')"
+S="$(printf '%s\n' "$OUT" | sed -n 's/^SYN //p')"
+
+case "$G" in n=4\ *) ok "golden capture routes all 4 menu pages (the 2026-09-26 zero)";; *) bad "golden capture: want n=4" "$G";; esac
+case "$G" in *"Disbursement.Case_Overview=Work>Cases"*) ok "quoted icon ref (\"list-bullets\") does not break the item";; *) bad "Case_Overview route wrong" "$G";; esac
+case "$G" in *"MockServices.MockConsole_Overview=Configure>Mock console"*) ok "group caption read past its icon clause";; *) bad "group with icon not read" "$G";; esac
+case "$G" in *"MyFirstModule.Home_Web=Work>Home"*) ok "item routed under its own group, not the previous one";; *) bad "Home_Web route wrong" "$G";; esac
+case "$S" in *"Mod.Plain_Page=Ops>Plain"*) ok "icon-less item still parses (synthetic)";; *) bad "icon-less item regressed" "$S";; esac
+case "$S" in *"microflow:Mod.ACT_Run=Ops>Run"*) ok "microflow item with icon parses (synthetic)";; *) bad "microflow item missed" "$S";; esac
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-journey-control-exit.sh b/tests/wave2/test-journey-control-exit.sh
new file mode 100755
index 0000000..6d5a469
--- /dev/null
+++ b/tests/wave2/test-journey-control-exit.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Usage: bash test-journey-control-exit.sh [path-to-journey-runner.js]
+#
+# Fixture for project-tests/e2e/journey-runner.js's exit code — runExitCode(), which decides
+# what verify-module's two journey rungs report.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): the walk's rule —
+# exit 1 on any FAIL or INVALID — was applied to the --positive-control run too. A control
+# run's FAIL rows are its mutants being caught, so a control that proved 7 of 7 rungs exited 1,
+# verify-module graded the rung FINDING, and the module read INCOMPLETE on every run: a rung
+# that could not go green, and so said nothing when it went red.
+#
+# Golden input is CAPTURED: fixtures/journey-control/{control,walk}-run.json are that build's
+# journey-findings-control.json (476 rows: PASS 468, FAIL 7, INVALID 1; 7 of 7 rungs proven) and
+# journey-findings.json (79 rows, all PASS), trimmed to rung/name/verdict — `detail` (screenshot
+# names, trace sequences) and `walks` are dropped because runExitCode never reads them. Cases 3-6
+# derive a broken run from the captured one by editing single rows, which is the shape each
+# failure takes in the field.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/journey-runner.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FIX="$HERE/fixtures/journey-control"
+[ -f "$FIX/control-run.json" ] && [ -f "$FIX/walk-run.json" ] || { echo "FAIL — golden capture missing under $FIX"; exit 1; }
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+for f in helpers.js otel.js config.js; do
+  [ -f "$E2E/$f" ] || { echo "FAIL — $f not beside $SUT"; exit 1; }
+done
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+# The runner resolves a project at require time: an .mpr two levels up and an asserted port.
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/journey-exit.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$E2E/helpers.js" "$E2E/otel.js" "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+IFS= read -r -d '' JS <<'EOF' || true
+const fix = process.argv[2];
+const R = require('./journey-runner.js');
+if (typeof R.runExitCode !== 'function') { console.log('NOFN'); process.exit(0); }
+const ctl = require(fix + '/control-run.json'), walk = require(fix + '/walk-run.json');
+const clone = o => JSON.parse(JSON.stringify(o));
+const say = (k, pc, run) => console.log(`${k} ${R.runExitCode(pc, run.results, run.mutants)}`);
+say('CTL', true, ctl);
+say('WALK', false, walk);
+// 3. one mutant NOT caught: its [control] row goes FAIL and the ledger loses a proof.
+let c = clone(ctl); c.results.find(r => r.rung === 'control').verdict = 'FAIL'; c.mutants.proven--;
+say('MISS', true, c);
+// 4. a rung the journey cannot express: unsupported, INVALID control row, proven < expected.
+c = clone(ctl); c.results.find(r => r.rung === 'control').verdict = 'INVALID';
+c.mutants.proven--; c.mutants.supported--; say('UNSUP', true, c);
+// 5. login refused: no mutant ran at all — nothing proven is not "all proven".
+say('NONE', true, { results: [{ rung: 'ui', name: 'login', verdict: 'INVALID' }],
+                    mutants: { expected: 0, supported: 0, proven: 0, unsupported: [] } });
+// 6. the walk keeps its rule: one FAIL, then one INVALID, each exits 1.
+let w = clone(walk); w.results[0].verdict = 'FAIL'; say('WFAIL', false, w);
+w = clone(walk); w.results[0].verdict = 'INVALID'; say('WINV', false, w);
+EOF
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 node - "$FIX" 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+if printf '%s\n' "$OUT" | grep -qx NOFN; then
+  bad "journey-runner.js exports no runExitCode — the exit rule is the walk's, applied to both runs"
+  echo ""; echo "PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+[ -n "$(line CTL)" ] || { echo "FAIL — harness could not require $SUT"; echo "$OUT" | tail -5; exit 1; }
+
+[ "$(line CTL)" = 0 ]  && ok "captured control run (7 of 7 proven, 7 mutant FAILs, 1 INVALID) exits 0" \
+                       || bad "a control that proved every rung exits non-zero (the 2026-09-26 FINDING)" "$(line CTL)"
+[ "$(line WALK)" = 0 ] && ok "captured walk (79 PASS) exits 0" || bad "clean walk exits non-zero" "$(line WALK)"
+[ "$(line MISS)" = 1 ] && ok "a mutant that was not caught fails the control" || bad "uncaught mutant exits 0" "$(line MISS)"
+[ "$(line UNSUP)" = 1 ] && ok "an unproven (unsupported) rung fails the control" || bad "unproven rung exits 0" "$(line UNSUP)"
+[ "$(line NONE)" = 1 ] && ok "a control where no mutant ran (login refused) fails" || bad "zero-mutant control exits 0" "$(line NONE)"
+[ "$(line WFAIL)" = 1 ] && [ "$(line WINV)" = 1 ] && ok "the walk still exits 1 on a FAIL and on an INVALID" \
+                       || bad "the walk's rule changed" "FAIL→$(line WFAIL) INVALID→$(line WINV)"
+
+if awk '/process\.exit\(/ && /runExitCode\(POSITIVE_CONTROL/ {f=1} END{exit !f}' "$SUT"; then
+  ok "main exits through runExitCode(POSITIVE_CONTROL, …)"
+else
+  bad "main does not exit through runExitCode — the tested rule is not the one that runs"
+fi
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-model-stamp.sh b/tests/wave2/test-model-stamp.sh
index a97e6a8..fca0e6c 100755
--- a/tests/wave2/test-model-stamp.sh
+++ b/tests/wave2/test-model-stamp.sh
@@ -83,5 +83,35 @@ before="$(cat .claude/settings.json)"; "$TK/bin/install-claude-permissions.sh" "
 "$TK/bin/install-claude-permissions.sh" "$P" --uninstall >/dev/null
 "$py" -c "import json,sys;d=json.load(open('.claude/settings.json'));cmds=[h['command'] for g in d['hooks']['SessionStart'] for h in g['hooks']];sys.exit(0 if d['permissions'].get('deny',[])==[] and cmds==['sh .claude/bootstrap-mxcli.sh || true'] and d['permissions']['allow'][0]=='Bash(./mxcli:*)' else 1)" && ok "uninstall removes only what it added" || bad "uninstall wrong: $(cat .claude/settings.json)"
 
+echo "T9 two-tree with NO root symlink: --git-dir and git-worktree commits are checked, not waved through"
+# 2026-09-26: with GIT_DIR exported (a worktree commit, or `git --git-dir=…`) `git -C app` saw
+# app/ as the work-tree top, the pathspecs matched nothing, and check --staged passed.
+Q="$WORK/q"; mkdir -p "$Q/bin" "$Q/app/mprcontents"
+( cd "$Q" && git init -q . && git config user.email t@t && git config user.name t
+  cp "$TK/project-bin/_common.sh" "$TK/project-bin/model-stamp.sh" "$TK/project-bin/install-project-hooks.sh" bin/
+  printf mpr > app/App.mpr; printf u1 > app/mprcontents/a.mxunit; printf '/.claude/\n' > .gitignore
+  ./bin/install-project-hooks.sh >/dev/null
+  git add -A >/dev/null; MODEL_UNVERIFIED_OK=1 git commit -qm init 2>/dev/null
+  git worktree add -q "$WORK/q-wt" 2>/dev/null )
+cd "$Q" && printf u1b > app/mprcontents/a.mxunit && git add app
+git --git-dir=.git commit -qm x 2>/dev/null && bad "--git-dir commit waved an unverified model through" || ok "--git-dir commit refused the unverified model"
+git reset -q
+cd "$WORK/q-wt" && printf u1c > app/mprcontents/a.mxunit && git add app
+git commit -qm x 2>/dev/null && bad "worktree commit waved an unverified model through" || ok "worktree commit refused the unverified model"
+./bin/model-stamp.sh write pass "fixture" >/dev/null
+git commit -qm x 2>/dev/null && ok "worktree commit of the verified model accepted" || bad "worktree refused its verified model"
+
+echo "T10 no model yet (requirements-driven Stages P-4): non-model commits pass; a stray staged model does not"
+R="$WORK/r"; mkdir -p "$R/bin"
+cd "$R" && git init -q . && git config user.email t@t && git config user.name t
+cp "$TK/project-bin/_common.sh" "$TK/project-bin/model-stamp.sh" "$TK/project-bin/install-project-hooks.sh" bin/
+PROJECT_ROOT="$R" ./bin/install-project-hooks.sh >/dev/null
+echo intake > intake.md && git add intake.md bin
+PROJECT_ROOT="$R" git commit -qm intake 2>/dev/null && ok "pre-model intake commit accepted" || bad "pre-model intake commit refused (no .mpr found)"
+out="$(PROJECT_ROOT="$R" ./bin/model-stamp.sh check 2>&1)"; rc=$?
+[ "$rc" -eq 0 ] && echo "$out" | grep -q "no model in this project yet" && ok "check says there is no model yet" || bad "check rc=$rc" "$out"
+mkdir -p app/mprcontents && printf u > app/mprcontents/x.mxunit && git add app
+PROJECT_ROOT="$R" git commit -qm stray 2>/dev/null && bad "staged mprcontents with no .mpr committed" || ok "staged model with no .mpr refused"
+
 echo; echo "model-stamp: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-monkey-left-app.sh b/tests/wave2/test-monkey-left-app.sh
new file mode 100755
index 0000000..654260e
--- /dev/null
+++ b/tests/wave2/test-monkey-left-app.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Usage: bash test-monkey-left-app.sh [path-to-monkey.js]
+#
+# Fixture for project-tests/e2e/monkey.js's leftApp() and SIGN_OUT — the two guards that keep
+# the harness's own moves from being scored as app crashes.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26, seed 410855898): a
+# backAfterSubmit round clicked "Switch theme" (a control that pushes no history entry), so
+# Back left the app for login.html, then about:blank. The oracle scored each non-app page
+# "blank page", every later round on the target scored it again, and the second target was
+# never reached: 13 observations, 10 crash-class, one target unfuzzed, no app defect. With the
+# Back fix in place, a reloadMidFlow round clicked the shell's "Sign out" and lost the target
+# the same way. After both fixes the same seed read 26 observations, 0 crash-class.
+#
+# Golden input is CAPTURED: the URLs below are the ones that run's probe log recorded
+# (url=… on each CRASH row, and the app routes it navigated), and the labels are the two
+# controls clicked in it. The origin is the run's own baseUrl.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/monkey.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+E2E="$(cd "$(dirname "$SUT")" && pwd)"
+for f in helpers.js otel.js config.js; do
+  [ -f "$E2E/$f" ] || { echo "FAIL — $f not beside $SUT"; exit 1; }
+done
+CFG="$E2E/project.config.template.js"
+[ -f "$CFG" ] || CFG="$HERE/../../project-tests/e2e/project.config.template.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+# monkey.js resolves a project at require time: an .mpr two levels up and an asserted port.
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/monkey-left.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/tests/e2e"; : > "$WORK/Fixture.mpr"
+cp "$SUT" "$E2E/helpers.js" "$E2E/otel.js" "$E2E/config.js" "$WORK/tests/e2e/"
+cp "$CFG" "$WORK/tests/e2e/project.config.js"
+
+# An old monkey runs main on require and would launch a browser: bound it.
+IFS= read -r -d '' JS <<'EOF' || true
+const M = require('./monkey.js');
+if (typeof M.leftApp !== 'function' || !(M.SIGN_OUT instanceof RegExp)) { console.log('NOFN'); process.exit(0); }
+const base = 'http://localhost:8080';
+const L = (k, url, b) => console.log(`${k} ${M.leftApp(url, b === undefined ? base : b)}`);
+L('LOGIN', 'http://localhost:8080/login.html');
+L('LOGINQ', 'http://localhost:8080/login.html?profile=Responsive');
+L('BLANK', 'about:blank');
+L('EMPTY', '');
+L('ROOT', 'http://localhost:8080/');
+L('BARE', 'http://localhost:8080');
+L('INDEX', 'http://localhost:8080/index.html');
+L('CASES', 'http://localhost:8080/p/cases');
+L('MOCK', 'http://localhost:8080/p/mock-console');
+L('OTHER', 'http://localhost:80801/p/cases');
+L('SLASHBASE', 'http://localhost:8080/p/cases', base + '/');
+const S = t => console.log(`S:${t} ${M.SIGN_OUT.test(t)}`);
+['Sign out', 'Log off', 'Logout', 'Switch theme', 'Signature', 'Log in'].forEach(S);
+process.exit(0);
+EOF
+OUT="$(cd "$WORK/tests/e2e" && printf '%s' "$JS" | APP_PORT=1 timeout 30 node - 2>&1)"
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+if printf '%s\n' "$OUT" | grep -qx NOFN || [ -z "$(line LOGIN)" ]; then
+  bad "monkey.js exports no leftApp/SIGN_OUT (or ran main on require) — a round that leaves the app is scored as an app crash"
+  printf '%s\n' "$OUT" | tail -3 | sed 's/^/         /'
+  echo ""; echo "PASS=$PASS FAIL=$FAIL"; exit 1
+fi
+
+[ "$(line LOGIN)" = true ] && [ "$(line LOGINQ)" = true ] && ok "login.html (captured, with and without a query) is outside the app" \
+  || bad "login.html counted as in-app — the 2026-09-26 cascade" "$(line LOGIN)/$(line LOGINQ)"
+[ "$(line BLANK)" = true ] && [ "$(line EMPTY)" = true ] && ok "about:blank (captured) and an empty url are outside the app" \
+  || bad "about:blank counted as in-app" "$(line BLANK)/$(line EMPTY)"
+[ "$(line ROOT)" = false ] && [ "$(line BARE)" = false ] && [ "$(line INDEX)" = false ] \
+  && ok "the app root, bare origin and index.html are in the app" || bad "app root counted as outside" "$(line ROOT)/$(line BARE)/$(line INDEX)"
+[ "$(line CASES)" = false ] && [ "$(line MOCK)" = false ] && ok "captured app routes (/p/cases, /p/mock-console) are in the app" \
+  || bad "an app route counted as outside — every round would re-land" "$(line CASES)/$(line MOCK)"
+[ "$(line OTHER)" = true ] && ok "a lookalike origin (port prefix match) is outside the app" || bad "prefix match leaks another origin in" "$(line OTHER)"
+[ "$(line SLASHBASE)" = false ] && ok "a baseUrl with a trailing slash still matches its routes" || bad "trailing-slash baseUrl breaks the match" "$(line SLASHBASE)"
+
+s() { printf '%s\n' "$OUT" | sed -n "s/^S:$1 //p"; }
+[ "$(s 'Sign out')" = true ] && [ "$(s 'Log off')" = true ] && [ "$(s 'Logout')" = true ] \
+  && ok "SIGN_OUT matches Sign out (captured), Log off, Logout" || bad "a sign-out label is not excluded" "$(s 'Sign out')/$(s 'Log off')/$(s 'Logout')"
+[ "$(s 'Switch theme')" = false ] && [ "$(s 'Signature')" = false ] && [ "$(s 'Log in')" = false ] \
+  && ok "SIGN_OUT leaves Switch theme (captured), Signature, Log in fuzzable" || bad "SIGN_OUT over-matches" "$(s 'Switch theme')/$(s 'Signature')/$(s 'Log in')"
+
+# The tested functions must be the ones the rounds use.
+awk '/hasNotText: *SIGN_OUT/ {f=1} END{exit !f}' "$SUT" && ok "round()'s button locator filters SIGN_OUT" \
+  || bad "the button locator does not filter SIGN_OUT — the tested regex is not the one that runs"
+awk '/goBack\(/ {b=1} b && /leftApp\(page\.url\(\)/ {l=1} l && /goForward\(/ {f=1} END{exit !f}' "$SUT" \
+  && ok "backAfterSubmit returns with Forward when Back left the app" || bad "backAfterSubmit does not check leftApp after Back"
+grep -q "'lost'" "$SUT" && ok "a target lost mid-run is reported with its unfuzzed round count, not silently re-scored" \
+  || bad "no 'lost' finding — an abandoned target reads as fuzzed"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-otel-capture-until.sh b/tests/wave2/test-otel-capture-until.sh
new file mode 100644
index 0000000..8f67596
--- /dev/null
+++ b/tests/wave2/test-otel-capture-until.sh
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Usage: bash test-otel-capture-until.sh [path-to-otel.js]
+#
+# Fixture for project-tests/e2e/otel.js capture()'s stopping condition, and the journey
+# runner's rung-2 use of it.
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): rung 2 called
+# capture(t0, { min: 1 }), which stops at the FIRST poll holding any span at all. The batch
+# exporter routinely flushes a step's HTTP/xas spans before its microflow spans, so 2 of 6
+# `spans.ordered` claims failed "actual (none)" over sequences Jaeger held a second later
+# (verified by querying Jaeger directly); the next run of the same journey was green. capture()
+# now takes `until(spans)`, and the runner waits for the claimed microflows.
+#
+# Golden input is a real Jaeger /api/traces response (fixtures/otel-capture/
+# jaeger-trace-refused-arm.json: one trace, 8 spans, Mendix 11.13.0 runtime → Jaeger v1.76 OTLP),
+# verbatim except `processes` dropped (capture() never reads it; it carries the host command
+# line) and the checkout path replaced by /work/app. The flush ORDER is the synthetic part: a
+# stubbed fetch serves the non-microflow spans on poll 1 and the whole trace from poll 2 —
+# the shape observed in the field, reproduced deterministically.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/otel.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+GOLDEN="$HERE/fixtures/otel-capture/jaeger-trace-refused-arm.json"
+[ -f "$GOLDEN" ] || { echo "FAIL — golden capture missing: $GOLDEN"; exit 1; }
+RUNNER="$(dirname "$SUT")/journey-runner.js"
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/otel-until.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+cp "$SUT" "$WORK/otel.js"
+# otel.js reads only otelService from the config at require time.
+echo "module.exports = { otelService: 'Fixture' };" > "$WORK/project.config.js"
+
+IFS= read -r -d '' JS <<'EOF' || true
+const fs = require('fs');
+const [sut, golden] = process.argv.slice(2);
+const full = JSON.parse(fs.readFileSync(golden, 'utf8'));
+const isMf = s => s.tags.some(t => t.key === 'mx.microflow.name');
+const firstFlush = { ...full, data: full.data.map(t => ({ ...t, spans: t.spans.filter(s => !isMf(s)) })) };
+let polls = 0;
+global.fetch = async () => { polls++; const body = polls === 1 ? firstFlush : full; return { json: async () => body }; };
+const O = require(sut);
+const claimed = ['MockServices.ACT_MockScenario_Arm', 'MockServices.VAL_MockScenario_Arm', 'MockServices.VAL_MockScenario_Payload'];
+const names = sp => O.microflowNames(sp).sort().join(',');
+(async () => {
+  const opts = { retries: 5, waitMs: 1 };
+  polls = 0; let sp = await O.capture(0, { ...opts, min: 1 });
+  console.log(`MIN1 polls=${polls} spans=${sp.length} mf=${names(sp) || '-'}`);
+  polls = 0; sp = await O.capture(0, { ...opts, min: 1, until: s => claimed.every(n => O.microflowNames(s).includes(n)) });
+  console.log(`UNTIL polls=${polls} spans=${sp.length} mf=${names(sp) || '-'}`);
+  polls = 0; sp = await O.capture(0, { ...opts, min: 1, until: s => O.microflowNames(s).includes('MockServices.NEVER') });
+  console.log(`NEVER polls=${polls} spans=${sp.length}`);
+})().catch(e => { console.log(`ERR ${e.message}`); process.exit(3); });
+EOF
+OUT="$(printf '%s' "$JS" | node - "$WORK/otel.js" "$GOLDEN")"
+rc=$?
+[ "$rc" -eq 0 ] || { echo "FAIL — harness could not drive capture() from $SUT (rc=$rc)"; echo "$OUT"; exit 1; }
+line() { printf '%s\n' "$OUT" | sed -n "s/^$1 //p"; }
+
+L="$(line MIN1)"
+case "$L" in "polls=1 spans=5 mf=-") ok "min:1 alone stops at the first flush with 0 microflow spans (the race, characterised)" ;;
+  *) bad "golden replay did not reproduce the first-flush shape" "$L" ;; esac
+L="$(line UNTIL)"
+case "$L" in "polls=2 spans=8 mf="*VAL_MockScenario_Payload*) ok "until: keeps polling until the claimed microflows are present (poll 2, 8 spans)" ;;
+  *) bad "until: did not wait for the claimed microflows (the 2026-09-26 false red)" "$L" ;; esac
+L="$(line NEVER)"
+case "$L" in "polls=5 spans=8") ok "an until that never holds returns what it has after the retry window — no hang, no fake pass" ;;
+  *) bad "unsatisfiable until misbehaved" "$L" ;; esac
+
+if [ -f "$RUNNER" ]; then
+  if awk '/RUNG 2: ordered spans/{f=1} f&&/O\.capture\(/{c=1} c&&/until:/{print "yes"; exit} /RUNG 3/{exit}' "$RUNNER" | grep -q yes; then
+    ok "journey-runner.js rung 2 passes until: to capture()"
+  else
+    bad "journey-runner.js rung 2 still captures with min:1 alone"
+  fi
+else
+  echo "  skip — journey-runner.js not beside $SUT"
+fi
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-report-normalize-two-tree.sh b/tests/wave2/test-report-normalize-two-tree.sh
new file mode 100644
index 0000000..f8bcea9
--- /dev/null
+++ b/tests/wave2/test-report-normalize-two-tree.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Usage: bash test-report-normalize-two-tree.sh [path-to-report-normalize.js]
+#
+# Fixture for project-tests/e2e/report-normalize.js's path resolution in the two-tree layout
+# (model under app/, docs/ architecture/ tests/e2e/ .claude/loop/ at the repo root — F-042).
+#
+# The defect (card-disbursement requirements-driven build, 2026-09-26): every INPUT resolved
+# against project.config's ROOT, which is app/ in a two-tree checkout. verify-module's report
+# step then showed 8 of 9 instruments FAULT ("design-audit.json does not exist", "no
+# coverage-ledger.md under architecture/modules/*/") over artefacts that were on disk, and wrote
+# the report into a stray app/docs/report.json — so the render step found nothing to render.
+# Case 1 is that shape in miniature; case 2 is the single-tree regression guard.
+#
+# The artefacts here are SYNTHETIC and minimal. That is deliberate and allowed: the field-proof
+# rule's "golden input is captured" governs parsers of tool output, and nothing below exercises a
+# parser — it lays out files and asserts WHERE the script reads and writes. The field run that
+# motivated it (0 checks → 205 checks read) is cited in CHANGELOG.md.
+
+set -uo pipefail
+
+SUT="${1:-}"
+[ -z "$SUT" ] && SUT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/report-normalize.js"
+if [ ! -f "$SUT" ]; then
+  echo "SKIP: subject not found at $SUT"
+  echo "SCORE: 0/0 — nothing to test"
+  exit 0
+fi
+command -v node >/dev/null 2>&1 || { echo "SKIP: node not installed"; exit 0; }
+CFG="$(cd "$(dirname "$SUT")" && pwd)/project.config.template.js"
+[ -f "$CFG" ] || CFG="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/project-tests/e2e/project.config.template.js"
+[ -f "$CFG" ] || { echo "FAIL — project.config.template.js not found beside $SUT"; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); echo "  ok   — $1"; }
+bad() { FAIL=$((FAIL+1)); echo "  FAIL — $1"; [ -n "${2:-}" ] && echo "         got: $2"; }
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/rn-two-tree.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+# lay_out <model-dir> <project-dir>: the harness and every non-model artefact under <project-dir>.
+lay_out() {
+  local m="$1" p="$2"
+  mkdir -p "$m" "$p/tests/e2e/artifacts" "$p/tests/e2e/journeys" "$p/architecture/modules/Orders" "$p/docs/conformance"
+  : > "$m/Orders.mpr"
+  cp "$SUT" "$p/tests/e2e/report-normalize.js"
+  cp "$CFG" "$p/tests/e2e/project.config.js"
+  echo '{"checks":[]}' > "$p/tests/e2e/artifacts/design-audit.json"
+  printf '# Coverage ledger — Orders\n' > "$p/architecture/modules/Orders/coverage-ledger.md"
+  printf 'module\tclaim\tstatus\n' > "$p/docs/conformance/report-2026-09-26.tsv"
+  echo '{"id":"J-01","steps":[]}' > "$p/tests/e2e/journeys/Orders.journey.json"
+}
+# reason <report.json> <instrument> → "<verdict>|<reason>"
+reason() { node -e 'const r=require(process.argv[1]); const x=r.instruments.find(i=>i.name===process.argv[2]); console.log(x ? `${x.verdict}|${x.reason||""}` : "ABSENT|")' "$1" "$2"; }
+
+# --- 1. two-tree: inputs found beside app/, output written at the repo root ------------------
+T="$WORK/two"; lay_out "$T/app" "$T"
+( cd "$T/tests/e2e" && JOURNEY_DIR="$T/tests/e2e/journeys" node report-normalize.js --out docs/report.json ) >"$WORK/out1" 2>&1
+if [ -s "$T/docs/report.json" ]; then ok "report written at the repo root's docs/report.json"
+else bad "no docs/report.json at the repo root" "$(tr '\n' ' ' < "$WORK/out1" | cut -c1-300)"; fi
+if [ -e "$T/app/docs" ]; then bad "stray app/docs/ created (the 2026-09-26 misplaced report)"; else ok "no stray app/docs/"; fi
+# Wherever it landed, still measure what it read — the misplaced write and the missed reads are
+# two defects, and the old code shows both.
+R="$T/docs/report.json"; [ -s "$R" ] || R="$T/app/docs/report.json"
+if [ -s "$R" ]; then
+  v="$(reason "$R" design-audit)"
+  case "$v" in *"does not exist"*|ABSENT*) bad "design-audit.json beside app/ read as missing" "$v" ;;
+                *) ok "tests/e2e/artifacts/design-audit.json found beside app/ ($v)" ;; esac
+  v="$(reason "$R" coverage-ledger)"
+  case "$v" in *"no coverage-ledger.md"*|ABSENT*) bad "architecture/modules ledger read as missing" "$v" ;;
+                *) ok "architecture/modules/*/coverage-ledger.md found beside app/" ;; esac
+  v="$(reason "$R" conformance)"
+  case "$v" in *"does not exist"*|ABSENT*) bad "docs/conformance report read as missing" "$v" ;;
+                *) ok "docs/conformance report found beside app/" ;; esac
+  node -e 'const r=require(process.argv[1]); process.exit(r.project && r.project.mprModifiedAt ? 0 : 1)' "$R" \
+    && ok "the .mpr is still resolved inside app/ (mprModifiedAt set)" || bad "the .mpr under app/ was lost"
+  node -e 'const r=require(process.argv[1]); const c=(r.coverage||[]).find(m=>m.module==="Orders"); process.exit(c && (c.journeys||[]).includes("J-01") ? 0 : 1)' "$R" \
+    && ok "JOURNEY_DIR (absolute, as verify-module passes it) is read: Orders lists J-01" \
+    || bad "journey contracts under JOURNEY_DIR not read"
+else
+  bad "no report to inspect — the five two-tree read assertions did not run"
+fi
+
+# --- 2. single tree (regression): everything at the root, nothing moves ----------------------
+S="$WORK/one"; lay_out "$S" "$S"
+( cd "$S/tests/e2e" && node report-normalize.js --out docs/report.json ) >"$WORK/out2" 2>&1
+if [ -s "$S/docs/report.json" ]; then
+  v="$(reason "$S/docs/report.json" design-audit)"
+  case "$v" in *"does not exist"*|ABSENT*) bad "single tree: design-audit.json read as missing" "$v" ;;
+                *) ok "single tree: report at docs/, design-audit.json found" ;; esac
+else
+  bad "single tree: no docs/report.json" "$(tr '\n' ' ' < "$WORK/out2" | cut -c1-300)"
+fi
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]