Salvage from the Mac parking branch: existing-app-change skill, cloud-prompt correction, workflow §21, JUMP TO STOP row, BUG-140

CHANGELOG.md

@@ -13,6 +13,13 @@ Credit the person or project that surfaced the change — the credit line is the
 - process(post-mortem): `process/post-mortem-inverted-evidence-2026-09-02.md` — the build session's own failure analysis of the VBA migration, anonymised: the evidence hierarchy was inverted (a restorable `.bak` recorded as "unrecoverable" for five months while the analysis was derived from code and from BRDs derived from that code), absence recorded as a finding three times, presence counted instead of content read three times in one session, an intake claim propagated as fact, gates checking artifacts not truth, architecture derived from the lossy artifact, a ~130 that measured 19. Six toolkit changes, one per failure, each citing it: (F1) `query-the-model.md` gains the **evidence hierarchy** — production data > configuration tables > client statements > source code > our own earlier conclusions — and `source-formats.tsv` routes `.bak`/`.mdf`/`.bacpac`/`.dmp` to "restore and query", ranked top; (F2) `brd-validation.md` **check 7**: a negative claim names what was searched and carries an expiry, retired ≠ absent, a number carries its query or is marked estimate; (F3) **the ledger's verdict is hand-assigned**: `mark` now requires `--evidence "<finding → where>"`, and a pattern-covered file the artifact never names is a FAULT, not EXTRACTED-unverified — on the motivating corpus that turns 33 of 95 modules from a quiet count into 33 blocking rows, which is the honest state; (F6) `source-triage.md` anti-patterns "reading the interpreter as the specification", "conformance for correctness", "skipping the backup"; (fix 5) `bin/open-questions.sh` prints **RE-CHECK** — every source that arrived after the questions were answered and has no disposition yet, with the count of ANSWERED/ASSUMED/RAISED questions open against it (`recheck` in `--json`); (fix 6) `improvement-register.md` gains **Corrections**: a superseded claim, the measurement that overturned it, and where the old claim still stands. Fixture `test-source-ledger.sh` grows to 36 assertions — VB-USI (DafNe track), the build session's post-mortem
 - new(source-ledger): `bin/source-ledger.sh` + `bin/lib/source-inventory.py` + `bin/lib/source-formats.tsv` — **every source file must name the artifact that consumed it, or carry a person's waiver, before Stage 1 or 2 passes.** The incident: on a VBA migration the intake closed "documents not yet accounted for?" with *"the .pptx was already used by the triage pass"* — a claim about another document nobody checked; the triage was derived from the `.cls` exports, and the deck's 22 diagrams (the only statement of the workflow engine's X/M/E semantics) went unread for two months of BRDs, blueprint and build plan, reversing a CONFIRMED decision when finally opened. Three fixes, one shape each: (1) the Stage 0 inventory is now EVERY file under the source root minus a denylist — the extension allowlist that hid the deck had already been patched for `.yaml` (08-19) and code (08-31), and an allowlist is only ever as complete as the last incident; Office/PDF rows carry their embedded image and page counts, `init --refresh` appends files that arrive later; (2) a per-row disposition the gate greps — the artifact must exist, be non-empty and *name* the file, and for a container account for its pages and images — with `gate-check.sh --waive source/<file> --reason` as the one way to skip a file (the user's "if I agree to skip, skip"); (3) drift: files on disk with no inventory row block by name. Blocks Stages 1–2 (a file test, not a conversation test, so it clears skills-over-scripts); advises at Stage 0. Field-run on the motivating project (96 files): the intake's own claim replays as FAULT "never names the deck", the first extraction pass (3 of 22 images) replays as FAULT, the second passes, and 33 of 95 VBA modules turn out to be named in no analysis file at all. Fixture `tests/wave2/test-source-ledger.sh`, 32 assertions. Skill text: `source-triage.md` (Core Principle + anti-patterns), `interview-protocol.md` ("an answer that points at another document is a claim"), `conversion-runbook.md` Stage 0/1 rows, `document-discovery.md` completion rule — VB-USI (DafNe track)
 ## 2026-09-08
+- fix(commands): `mobile-dev-loop-prompt.md` no longer claims the build gate needs Studio Pro — the gate is `mxbuild`, a plain binary `exec.sh` invokes directly, and its only Studio Pro coupling is the `.mpr` lock check, a no-op where no Studio Pro exists; both mobile prompts, `testing-shape.md` and `e2e-harness-base.md` now know `mxcli run --local / --hub / --test-endpoint`, so a container stands the app up itself and publishes it at a public URL instead of hand-rolling a tunnel, and the harness `BASE_URL` no longer assumes `localhost:8080` (cherry-pick of 372e2ac, consistent with the cloud lane in `cloud-dev-environment.md` and the runbook's "Where you run this") — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- new(skills/existing-app-change.md): the entry mode the three existing ones did not cover — changing a live Mendix app that has no BRDs, no architecture document and no wireframes. The knowledge base comes from the model itself (**Path D**, `SHOW`/`DESCRIBE`, which cannot silently return zero the way a code extractor does), stages 2–4 run over the changed slice plus its **blast radius** (associations, writers, bound pages, module tangles, published services — the Stage 0 question with no equivalent elsewhere), the Track B regression baseline is the precondition rather than an option, every gate from Stage 5 on is also a regression gate, and the ledger denominator is the slice's leaves, said out loud. Routed as `ba,architect / P,0 / ondemand / spine`; `existing-app-assurance.md` now points here instead of back at the runbook — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- learn(workflow): `learned-workflow-patterns.md` §21 — a full v0.20.0 re-probe (2026-08-31, Mendix 11.13.0) rebuilt a 23-activity BPM-engine conversion workflow from pure MDL at 0 native errors: non-interrupting boundary timer and `wait for timer` cleared, `$Type` re-confirmed fixed, `DESCRIBE WORKFLOW` reads decisions/jumps/waits/boundary events back, `create or replace workflow` now refuses to delete an Event Sub-Process; four gaps remain (Event Sub-Process, End activities, body annotations, a three-fix `describe → exec` loop) and the `JUMP TO` trap is spelled out — mxcli names activities after the called microflow, a dangling target is stored as a self-reference, and `CE6681` names the wrong fault. Merged against master's newer state: the `DECISION` result is recorded as **disputed**, not cleared, because the toolkit's own same-day retest reproduced BUG-76 byte for byte with `decision '1 = 1'`; §8's version table, §10 step 5 and the Notes on scope updated accordingly — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- learn(preflight): STOP #24 — a `JUMP TO` target must be a real activity name and mxcli will not check it (passes `check --references` and `exec`, stored as a jump pointing at itself, `CE6681` at native check; `DESCRIBE` output walks you into it); the v0.16.0 `WITH`-clause gotcha is stamped as v0.16.0-only after 14/14 calls stored correctly on v0.20.0 — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- new(bug-logs): BUG-140 — a full page regeneration never wires a parameterized microflow datasource on a top-level `dataview` (CE1571 on 15 of 15 pages, even byte-identical to a working original; explicit `Params:` is accepted and dropped, enum literals are rejected outright); only implicit binding through one level of nesting works, proven on a throwaway page. Number 140 assigned at merge, clear of the 127+ block another branch was taking. Plus addenda where the branch's findings matched existing entries instead of new numbers: BUG-109 gets the general dangling-`jump to` case and its upstream issue #1005, BUG-110 its #1006 link and the second emitter defect #1007 (`annotation` statements `MDL-WF04` rejects), BUG-118 an earlier v0.18.0 two-entry `ContentParams` observation from a second project and the full-page-rewrite workaround; a "Cleared on v0.20.0" section records the workflow re-probe, with BUG-76 marked disputed against the same-day retest — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- fix(checkpoints): the last three `project-profile.md` references — a file no project has — now point at `PROJECT.md` → `## Decisions` (`checkpoint-design.md` Figma/brand answers, `checkpoint-scope.md` external refs, `checkpoint-architecture.md` NFRs; the third was not on the branch, found by grep at merge) — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
+- process(CLAUDE.md): "Testing this toolkit" now says there are two suites — `tests/run-tests.sh` is self-contained, each `tests/wave2/test-*.sh` takes its subject as `$1` and several take something other than `gate-check.sh` — so a permitted single-fixture run is invoked correctly the first time (checked still accurate: 24 fixtures, `run-all.sh` resolves the subject from the same `usage:` line) — Maurits Visser's Mac parking branch, salvaged by the toolkit merge queue
 - fix(gate-check): the source-ledger block for Stages 1–2 now respects a stage declared not required — `--adopt` at a later stage, `Waived stage N`, or an entry mode that skips it — instead of blocking before the verdict table was consulted (obligation and artifact checks already did); and the `source-ledger` manifest row's absence class is `report`, not `gate`, because nothing mandatory produces `analysis/source-ledger.html` (gate-check runs `check`, never `report`) and a row claiming to hold a gate shut over a file no step writes would sit PENDING on every migration project — the toolkit merge queue, reviewing the intake-gates branch
 - new(gate-check): `--closeout <root> <stage>` — the stage close-out / next-stage-open block (`bin/lib/closeout.sh`), generated from the register, the artifact manifest and the routing table, pasted as-is at every gate (runbook §1b rule 7; CAC-3 and CAC-5 open with it): artifacts produced, decisions made in the stage (first 15, every non-CONFIRMED row always), carried forward (open questions with the status word that keeps them open, ASSUMED rows, UNSYNCED markers), the gate line verbatim **and in plain words**, then what the next stage does, how it is worked and tested, its checkpoints, the top-5 governing skills from `skill-routing.tsv`, and the optional artifacts on offer. Field run on TFC-TCXGraphPOC Stages 2–4: surfaced a PENDING coverage ledger nothing had flagged, 2 UNSYNCED markers, 5 open questions with status words outside the closed vocabulary ("TO", "REVERSED", "PARKED"), and the hand-written `architecture/workflow-definition.md` as an opt-in-by-deed; fixture `tests/wave2/test-closeout.sh` (32 assertions) — TFC-TCXGraphPOC
 - new(gate-check): plain-words paragraph under every stage-query outcome (PASS, PENDING, FAIL, MANUAL, drift-blocked) — status in one sentence, what the gate needs, why specifically, what is still missing in plain names; asked for as "explain why a gate is blocked or what is pending, in human-understandable language" — TFC-TCXGraphPOC

CLAUDE.md

@@ -250,6 +250,13 @@ changed `bin/gate-check.sh` → also run `test-bug03-gates.sh`, `test-source-suf
 whatever else targets it). Grep `tests/wave2/` for the filename you changed if you're unsure
 which fixtures cover it.
 
+There are two separate suites. `tests/run-tests.sh [-v]` is self-contained (guard-script
+fixtures with no external argument). Each `tests/wave2/test-*.sh` fixture instead takes its
+subject-under-test as `$1` — read its own `usage:` comment rather than assuming a fixed target;
+several take something other than `gate-check.sh` (`exec.sh`, `sync-project.sh`,
+`check-docs-numbering.sh`, a skill file). Once you have permission for a single fixture (see
+below), run it as e.g. `bash tests/wave2/test-bug02-register.sh bin/gate-check.sh`.
+
 **Why:** this repo is routinely edited by more than one agent session at once (real incident,
 2026-08-19 — a peer session mid-edit reported known, unrelated failures already present in the
 shared working tree). A full-suite run over a moving target mixes someone else's in-flight

README.md

@@ -494,6 +494,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | CAC-6, after Stage 6 passes and before any cutover step — migration mode only, and a hard gate: every answer lands CONFIRMED, no ASSUMED defaults | `skills/checkpoints/checkpoint-cutover.md` |
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` |
+| Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over the changed slice plus its blast radius only, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` |
 | Any review pass that runs more than once — module-review, coherence, monkey, wiring-sweep: findings accumulate across runs, a per-run report cannot show a trend | `skills/improvement-register.md` |

ROUTING.md

@@ -50,6 +50,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Deciding who answers a question — before putting any batch to the user. gap/conflict/choice/user-only is what keeps a gate batch at four questions instead of 127 | `bin/question-kinds.sh` | ba | 1,2,3 | baseline |
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` | ba | P | ondemand |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` | all | P | ondemand |
+| Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over the changed slice plus its blast radius only, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` | ba,architect | P,0 | ondemand |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` | all | 7 | ondemand |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` | all | - | ondemand |
 | Any review pass that runs more than once — module-review, coherence, monkey, wiring-sweep: findings accumulate across runs, a per-run report cannot show a trend | `skills/improvement-register.md` | mdl,gate,test,review | 5,6 | ondemand |

agents/architect-agent.md

@@ -46,6 +46,7 @@ You own architecture and build-plan decisions for {{PROJECT}}. Hard rule: you ne
 | `skills/checkpoints/checkpoint-build.md` | CAC-5, after design sign-off and before the build plan — build order and slice boundaries. Opens with a brainstorm |
 | `project-bin/check-design-portability.sh` | Before porting ds.css into SCSS, and at the Stage-3 gate — greps the stylesheet for rules that cannot match the HTML Mendix emits (rem against the real root, table/th/td selectors, positional row selectors). mx check, mxcli check and mxcli lint are all blind to CSS |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim |
+| `skills/existing-app-change.md` | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over the changed slice plus its blast radius only, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance |
 | `skills/architecture-blueprint.md` | Diagramming target architecture — module defs, wiring, fit-gap, marketplace, security, NFRs, integrations |
 | `skills/modularize-domain.md` | Deciding module boundaries before "create module" |
 | `skills/design-artifacts.md` | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable |

agents/ba-agent.md

@@ -59,6 +59,7 @@ You run discovery and the interview gates for {{PROJECT}}. You never touch the `
 | `bin/brd-report.sh` | Reviewing what the BRDs actually say — the Stage 2 surface, for BRDs from any source. Reads every knowledge base at once, and keeps a section that is absent-because-not-applicable apart from one that is absent-because-expected |
 | `skills/bootstrap-project.md` | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim |
+| `skills/existing-app-change.md` | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over the changed slice plus its blast radius only, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance |
 | `skills/assess-migration.md` | Assessing or planning a migration up front, before any pipeline is chosen |
 | `skills/migration-pipeline.md` | Running the extraction pipeline |
 | `skills/migrate-general.md` | Migrating from a stack that has no dedicated pipeline |