Field harvest from a requirements-driven build: 26 instrument fixes, BUG-141 fix proven, BUG-142..154 by MendixMau · Pull Request #162 · MendixMau/mxcli-project-toolkit

MendixMau · 2026-09-27T10:10:58Z

Direct lane

What changed and why: This is what one requirements-driven card-disbursement build turned up while running the toolkit end to end, from Stage P through slice 2 of the build loop. The project uses the two-tree layout (.mpr under app/), Mendix 11.13.0 and mxcli v0.24.0. The PR has four parts:

26 instrument fixes in bin/, project-bin/ and project-tests/. Most are two-tree blind spots (lint-gate, project.config, report-normalize, check-design-reaches-app and verify-module's MXTK_ROOT), or instruments that could not go green or misread their input:
- conformance UNRUNNABLE vs ABSENT;
- otel paging and rung-2 flush;
- design-audit nav and at-rule parsing;
- coverage-preflight per-BRD ledgers;
- helpers.js logout() / navTo() on Mendix 11;
- journey-runner covered-widget clicks and named-control mutants.
BUG-141 fix proven. conditionOutcomeToGen() in mxcli writes Boolean, Enumeration and Void condition outcomes with no PersistentId. As a result, every workflow instance that has already passed a decision turns Incompatible on the next deploy.
- bug-logs/pending-github-issues/bug141-fix.patch is a 3-line fix plus a regression test. It applies with git am on mxcli main.
- Proven on the real model: outcome IDs went from 0/30 to 30/30, and mx check reports 0 errors.
- A paused instance survives a restart and runs on to Completed.
- Re-exec keeps every ID (54/54 and 84/84, via CarryPersistentIDs).
- The issue and patch are ready for upstream filing.
BUG-142..154 and five v0.24.0 retests in bug-logs/mxcli-bugs.md. The matching learned-* skill rows cover workflow, detection gaps, UI and testing.
Process: inbox notes are triaged into skills and deleted in the same commit, and 19 Unreleased CHANGELOG entries get their credit segment.

Instrument defects that need a design decision were filed as issues rather than patched: #146–#160.

Field evidence: every commit message names the run it came from. All of them are the same card-disbursement requirements-driven build, measured on toolkit master as of 2026-09-26:

verify-module rungs going from INCOMPLETE/FAULT to measured;
journeys J-01..J-09 green with named controls PROVEN;
BUG-141 as above.

Checklist

No client data anywhere in the diff: bin/check-no-client-data.sh is clean (693 files) and bin/check-no-private-citations.sh is clean.
Size cap: not met. The diff is 66 files and 5,895 lines; without fixtures, captures, CHANGELOG and the patch it is 49 files and about 1,700 lines. The commits are atomic, one concern each, so a split falls out along the commit boundaries:
1. fix(*): instruments and their tests/wave2 fixtures;
2. learn(bug-logs): BUG-141 patch, BUG-142..154, retests;
3. learn(skills): skill rows;
4. process(*): inbox and CHANGELOG.
Say the word and I'll restack it as four PRs. Otherwise, a rebase-merge keeps the atomic history; a squash-merge flattens it.
Test tier:
- T0 on the skill edits.
- T1: each changed instrument ships or updates its tests/wave2 fixture (15 fixture files).
- T2: the field run above.
- T3: left to CI.
New or changed instruments: the golden inputs are captures from the real model. Both layouts are probed, and the two-tree fixes are the point.
CHANGELOG: lines are appended and credited. bin/check-pr-discipline.sh origin/master is clean.
BUG numbers: the new entries carry BUG-142..154, not BUG-DRAFT-*. There is no collision against master today, but renumber at merge if master takes those numbers first.

Open decisions for the maintainer

Should the user-role fixup script become an instrument, or stay a skill recipe?
The T-32 / T-91 notes are logged from model evidence only; runtime proof is still owed.
CHANGELOG credit wording: "card-disbursement requirements-driven build".

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Generated by Claude Code

learned-mdl-preflight row 12's toString(Attr) fix no longer builds; check refuses function calls but passes if/then/else. Five-form probe attached. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

find_ledger() only tested for files, so a module that splits its ledger into coverage-ledger/<BRDID>.md with an index file beside it had every BRD measured against the index: all BRDs UNCLAIMED while coverage-check-all.sh reported the same files clean. The directory form now wins over the index file. Each BRD is measured against its own file, the denominator (N of M BRDs measured) is stated, BRDs owned by another module are named rather than measured, and an orphan ledger file or a directory matching no BRD is a FAULT (rc 2), never a clean 0. An empty directory falls through to the file form. Fixture: tests/wave2/test-coverage-preflight-ledger-dir.sh (10 assertions, 7 red against the previous script). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

classesInCss harvested selectors at brace depth 0 only, so a class Atlas defines only inside @media (spacing-outer-bottom-large, the class design-spacing.md prescribes) was reported invented/unmatched on every page using it. Comments and strings are now stripped and the prelude before every non-at-rule '{' is harvested. Field run on a real mxbuild theme.compiled.css: 2768 -> 3349 classes. New fixture over a verbatim capture: 7/7 green, 4 red on the old code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

The item regex required ';' right after the page name; real describe navigation output has 'icon <ref>' there, so no page was routed and rung 7 (a11y/overflow/structure) never ran. Split out parseNavigation and match up to the terminator. Field run: 0 -> 4 of 4 menu pages routed; rung 7 measured 4 of 7 pages. New fixture over a verbatim capture: 6/6 green, 5 red on the old regexes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…two-tree layout Every input resolved against project.config's ROOT, which is app/ in a two-tree checkout, so verify-module's report step marked 8 of 9 instruments FAULT over artefacts that existed and wrote the report into a stray app/docs/. Inputs now probe ROOT first, then the repo root; outputs go to the repo root. JOURNEY_DIR is honoured and relativised; projectId uses the config id. Field run: 0 -> 205 checks read, instrument FAULTs 8 -> 2 (both real). Fixture test-report-normalize-two-tree.sh: 8/8 on the fix, 6 red on the old code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…t flush capture(t0, { min: 1 }) stopped at the first poll holding any span. The batch exporter flushes a step's HTTP/xas spans before its microflow spans, so spans.ordered claims failed "actual (none)" over sequences Jaeger held a second later. capture() now takes until(spans); rung 2 passes "every claimed microflow is present". An unsatisfiable claim still fails after the normal retry window. Field run (Mendix 11.13.0 -> Jaeger v1.76 OTLP, card-disbursement build, 6 ordered claims): 2 of 6 red before, journey 79/0/0 after, positive control 7 of 7 rungs proven. Fixture test-otel-capture-until.sh over a real Jaeger /api/traces capture: 4/4 green on the fix, 3 red on the old code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…d the harness - conformance-check.sh: rows with no baseline line are baselined when first seen (a module built after the first run was never regression-guarded), and `--update-baseline --module X` keeps the other modules' rows. - journey-runner.js: a --positive-control run exits 0 when every rung's mutant was caught (runExitCode); the walk keeps exit-1-on-FAIL/INVALID. - monkey.js: Back leaving the app returns with Forward instead of scoring login.html/about:blank as a crash; sign-out buttons are not clicked; a lost target re-lands or reports how many rounds went unfuzzed; no main on require. Fixtures: test-conformance-baseline-scope.sh 7/7, test-journey-control-exit.sh 7/7 (captured control/walk findings), test-monkey-left-app.sh 11/11 (captured URLs and labels); each red against the previous script. Field run: card-disbursement requirements-driven build, MockServices module — conformance newly baselined 119 of 246, scoped update kept 207 other rows; control exit 0 at 7 of 7 rungs; monkey seed 410855898 10 -> 0 crash-class, 13 -> 26 observations, both targets fuzzed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…ces verify - design-audit raw-class rule contradicts design-spacing.md's page-header class - report-normalize --selftest broken independent of the two-tree fix - span claims cannot be negative-only (mustNotFire needs an ordered list) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…mutants; five inbox notes - fix(journey-runner): the outcome mutant breaks an exact `expect` as well as an `atLeast` floor, and the data-target mutant uses a numeric sentinel on a numeric key, so neither reports a working assertion as unproven. Field runs cited in CHANGELOG; journey-proof.md's mutant table updated. - Inbox: mxcli v0.24 REST/JSON/mapping/page-hook/OQL/test-endpoint notes; journey-runner persona and local acts; verify-module graph FAULT after test --attach; LOOK obligation reads the first VALID AT; wiring-sweep disabled-by-design and conditionally visible controls. From a card-disbursement requirements-driven build (rows 3.8-4.8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

A forced click skips Playwright's actionability check, so a toast or popup underlay over the widget received the click and the step read as done. The click action now hit-tests the widget's centre (elementFromPoint, 5 x 250 ms for animations) before clicking and throws "covered by .<class>". Field run on a card-disbursement build: popup-then-click journey 4/0 on the previous runner, FAIL "covered by .mx-underlay" on this one. Inbox: run --local starts with scheduled events off (ScheduledEventExecution). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

logout() read the CSRF token from mx.session.getCSRFToken(), which Mendix 11 does not have, so it posted the xas logout action with an empty token. The server still answers 200 {} and keeps the session. Every journey and probe therefore held a session until the timeout, and on a trial licence the session cap then refused the next sign-in. The token now falls back to mx.session.sessionData.csrftoken, and a missing token returns false instead of posting. Field run (card-disbursement requirements-driven build, row 5.7; mxcli v0.24.0, Mendix 11.13.0): 13 sessions had leaked from runs that all "logged out". After the fix, System.Session per role read 1 before sign-in, 2 while signed in and 1 after logout, for admin, operations and banker roles. Also: an inbox note on review-report.js vs coverage-check-all.sh's one-line-per-BRD output (permanent coverage FAULT on multi-ledger modules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

mxcli's conditionOutcomeToGen() writes Boolean, enumeration and void condition outcomes without a PersistentId. The runtime therefore gives them a new identity on every load, and every instance paused after a branch point turns Incompatible on the next deploy, including a restart with no model change. Green on every static rung and on any live run inside one deploy. - bug-logs/mxcli-bugs.md: BUG-141 with the three live reproductions, the BSON and metamodel evidence, the upstream one-line fix, and the admin-side plan until it ships. - bug-logs/pending-github-issues/: paste-ready upstream issue, not filed. - skills/learned-detection-gaps.md: register row, caught only across a restart. Field run: card-disbursement requirements-driven build, mxcli v0.24.0, Mendix 11.13.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…ts are checked Three defects in the model-verification pre-commit path: 1. check ended on find_mpr's "no .mpr found", so a project with no model yet (requirements-driven Stages P-4) could not commit its intake without MODEL_UNVERIFIED_OK=1. check now passes when no .mpr exists at the root or under app/ and no *.mpr / mprcontents/ path is staged. A staged model with no .mpr, and two .mpr files, still refuse. 2. With GIT_DIR exported (git worktree commits; git --git-dir=...), git's rule makes the cwd the work-tree top, so `git -C app` saw app/ as the top, the model pathspecs matched nothing and check --staged passed an unverified model. GIT_WORK_TREE/GIT_DIR/GIT_INDEX_FILE are now pinned to absolute paths before any `git -C`. 3. _common.sh root resolution tiers 2/3 now probe app/*.mpr like find_mpr, so a two-tree checkout with no root .mpr no longer climbs to a stray .mpr in an ancestor directory. Field run: two-tree field project (card-disbursement requirements-driven build), read-only: `model-stamp.sh paths` with GIT_DIR exported returned "<Model>.mpr mprcontents" before, "app/<Model>.mpr app/mprcontents" after; with a relative GIT_DIR, "fatal: not a git repository" before. Scratch probe (plain / --git-dir / GIT_DIR / worktree commits x single-tree / two-tree): old accepted unverified models via --git-dir and worktree and refused a verified one in a worktree; new refuses every unverified model and accepts the verified one. Pre-model repo: intake commit refused before, accepted after; staged mprcontents with no .mpr refused. Covered by tests/wave2/test-model-stamp.sh (new T9, T10). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…issing" The three manifest loops in bin/lib/closeout.sh (artifacts produced, the plain-words missing list, next-stage opt-in offers) ignored the modes column that artifact-check.sh's second pass honours. A requirements-driven Stage 0 PASS therefore said "still missing for this stage: app-report", a row only existing-app-change owes. A shared _co_owed test now applies the same rule (unknown mode owes every row). Field run (card-disbursement requirements-driven build, register + intake + triage copied to scratch): mxtk_plain_verdict 0 printed "still missing for this stage: app-report" before, "Nothing is holding it." after; the Stage 0 close-out listed app-report as PENDING before, N/A after. Covered by tests/wave2/test-closeout.sh (new T9). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…S.md The default allowlist omitted intake.md (init-project.sh scaffolds it at the root) and triage.md (artifact-manifest.tsv owes it at that exact path), so every scaffolded project failed the check from Stage 0 on. mxcli init's generated CLAUDE.md also tells agents to "Append to FINDINGS.md" at the root, which this check refused - two instructions in one CLAUDE.md that contradicted each other. Field run (card-disbursement requirements-driven build, read-only on the project root): "Stray docs in project root: intake.md triage.md", exit 1, before; "Project root clean", exit 0, after. No fixture covers this script. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…ensions The six scored dimensions are code-shaped and the skill never said a stack may replace them. A process-model source (EA XMI/BPEL) has no fields, FKs, enums, routes or specs; scoring those gives 0/0 = 100 and pads the average. New subsection: declare the stack's dimensions in the validator header and as the extraction-quality.json dimension keys; the source-derived expected counts, the 95% gate, the Suspicious-Zero Gate and the self-graded rule stay. From the card-disbursement requirements-driven build (its project-local EA XMI/BPEL validator scored six process-model dimensions). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

The runbook names toolkit scripts as bin/source-sufficiency.sh, bin/status.sh, etc., but a project's bin/ holds only the installed project-bin/* copies. A Stage 0 session on the card-disbursement requirements-driven build ran them from the project root and found no such files. One header line now resolves it: bare bin/<script> is the toolkit's, run from the CLAUDE.local.md "Toolkit root"; ./bin/ only for project-bin/*. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…root The describe hint and the owed source-ledger mark lines hard-coded analysis/knowledge-base/images/, so after --out <dir> the marks cited a manifest that did not exist and the re-check hint omitted the --out it needs. Both now derive from the directory the run wrote. Field run (card-disbursement requirements-driven build; sources and knowledge base copied to scratch, --out <kb>/images --check): old printed "--artifact analysis/knowledge-base/images/manifest.json" with "described 15 of 15"; new prints the --out manifest path and "--out <dir> --check". Default-root output is byte-identical, so tests/wave2/test-images-to-md.sh assertions (lines 180-189) are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…a sign-off The use-case status vocabulary (code-inferred / doc-confirmed / doc-conflict) had no honest value for a use case that is the build's own design on a documents-provenance BRD. The card-disbursement requirements-driven build had 21 of 45 such use cases and invented `proposed`; brd-report.sh accepted it silently. Check 6 now names the value and requires an openQuestions entry or a cited CONFIRMED register row for it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

… "." PROJECT_NAME was basename of the argument as typed, so a run from inside the project (`gate-check.sh . --html`) titled the board ". — Conversion Dashboard". Found by the card-disbursement requirements-driven build while screenshotting the dashboard. Field run: a scratch project checked with `.` and --html; the old script wrote "<title>. — Conversion Dashboard", the new one the directory's name. No verdict changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…r bare digits gate-check.sh reads the first cell of every PROJECT.md table row as the Stage field. The skill's example register numbered its rows 1-5, so a project following it had a `| 7 | Behaviour change ... |` row read as the cutover decision (Stage 7 FAIL before Stage 4), and a CONFIRMED `| 3 | ... |` row could satisfy the Stage 3 hard gate. The card-disbursement requirements-driven build cleared it by renumbering to OI-n. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

brd-to-build-plan Step 7 and learned-mdl-preflight told agents to create demo users with no password, in a `with roles "Module"."Role"` form. mxcli v0.24.0 requires PASSWORD: `CREATE DEMO USER '<name>' (<UserRole>)` fails with "mismatched input '(' expecting PASSWORD", so the instruction could not be followed. Verified by `mxcli check` on both forms and `mxcli syntax security demo-user` (card-disbursement requirements-driven build, 2026-09-25). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

lint-gate discovered the model with `ls $ROOT/*.mpr` only. In the two-tree layout it exited 2 on every exec and exec.sh logged "lint could not run", so the lint ratchet was off for a whole build without anyone deciding that. It now probes app/ next, the same one-level-down probe as _common.sh find_mpr; MPR stays relative to ROOT (app/<M>.mpr). Field run: the card-disbursement requirements-driven build patched its installed copy with this exact probe; the next exec logged "✓ lint: no rule rose vs baseline". Scratch probe (fake model, LINT_JSON to stop before mxcli): two-tree, the old script said "no .mpr found" and the new one got past discovery; single-tree, both unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

navTo() searched `.mx-navigationtree a` only. The `mxcli new` template's home page renders the menu as `.mx-navbar`, with the same a[title] anchors, so every journey on such a layout died at step 1 ("never appeared"). Field run: the card-disbursement requirements-driven build widened the selector to `.mx-navigationtree a, .mx-navbar a` in its installed copy; journey J-00 went from NOT-REACHED at step 1 to 15/15 green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

… sees it verify-module derives MXTK_ROOT from the CLAUDE.local.md "Toolkit root" row (3c04bd5) but never exported it. coverage-preflight.sh runs as a child process and reads it from the environment, so the coverage rung reported INSTRUMENT FAULT "coverage-check.sh not found" while the toolkit sat at the path just resolved. Field run: the card-disbursement requirements-driven build added this export to its installed copy; its coverage rung then read "LEVEL 1 · MEASURED" on all four modules (12-coverage.log). doctor.sh already names sqlite3, the finding's other half. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

probe() mapped any non-zero exit to ABSENT, so a malformed acceptance probe on a not-built ledger row scored ABSENT -> OK: a false green that says the model agrees with the ledger when mxcli never looked. mxcli v0.24.0 replies, verbatim (rc 1): Parse error: line 1:64 extraneous input '.' ... Error: no describable document named "DEMOUSER" found in the project; specify the type explicitly, ... A genuine miss is different and stays ABSENT: Error: constant not found: Nope.X Field run (card-disbursement requirements-driven build): the field model copied to scratch, a four-row ledger. Before: OK 4 (the DESCRIBE DEMOUSER and DESCRIBE JSONSTRUCTURE rows ABSENT/OK). After: OK 2, UNRUNNABLE 2; DESCRIBE CONSTANT Nope.X stays ABSENT/OK and DESCRIBE DEMO USER 'ops1' stays PRESENT/OK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…o-tree Pass 2 counted a design token as "arrived" when its NAME was in the built sheet. The mxcli new template for Mendix 11.13 ships its own --mxt-* bridge with its own values, so a design system authored on the same vocabulary read present while the app wore the template's teal. New pass 2b reads the winning bare-:root value (the same reading as pass 1) and compares it case/whitespace-insensitively; K < N is a WARN with up to four built-vs-designed samples, and a "tokens valued" summary line. The defaults (deployment/web, theme/web/custom-variables.scss, the theme/web and themesource globs of pass 4) were root-relative, so a two-tree checkout exited 2. They now resolve beside the .mpr: app/ when there is no root .mpr and app/*.mpr exists (find_mpr's probe). design/ and mdlsource/ stay at the repo root. Field run (card-disbursement requirements-driven build): the design system with a real mxbuild pre-port theme.compiled.css, two-tree layout. Old: defaults exit 2; with explicit paths "tokens arrived 41 of 62", clean, css-vars mode unknown. New, defaults: knobs 17 of 46, tokens arrived 41 of 62, tokens valued 8 of 62 (the project's hand count by value was 8), WARN naming --mxt-brand built #0f6e6b vs designed #4f46e5, css-vars mode true. Post-port, read-only against the project: 62 of 62 valued, clean. Fixture-shaped single-tree states unchanged (fixed rc 0, broken rc 1, same counts). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

… survives The condition-outcome PersistentId fix now ships as a git am-ready upstream commit (bug141-fix.patch): three addFreshPersistentID lines plus a test that fails on all three outcome types without them. Field run on the model that reproduced it: 0/30 -> 30/30 outcomes carry an ID, mx check 0 errors, and an instance paused past the decisions stays InProgress across a no-change restart and then runs to Completed. The ledger's open re-mint question is answered by measurement: re-running create or replace workflow kept 54/54 and then 84/84 IDs (CarryPersistentIDs), so adopting the fix re-IDs outcomes once, never again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

In the two-tree layout findRoot() walks up to app/, so id = basename(ROOT) was "app" and the default otelService was "app": every trace assertion queried a Jaeger service nobody emits. mxcli run --local --trace defaults OTEL_SERVICE_NAME to the .mpr name, so when ROOT's name is "app" the id is now the .mpr basename (falling back to the repo directory's name when there is no model yet). The lookup is inside a try, so require still never throws; a missing .mpr still throws where `mpr` is accessed. PROJECT_ID and NAME_OVERRIDE win as before; single-tree is unchanged. Field run (card-disbursement requirements-driven build): the installed copy printed "id app / displayName app"; the project worked around it with a hand NAME_OVERRIDE. Scratch probes: two-tree old id app, new id <Model>; single-tree id = dir name (unchanged); two-tree with no .mpr id = repo dir, `mpr` throws on access only. Against the field project's app/ (read-only, PROJECT_ROOT): id equals the model basename. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

skills/improvement-register.md defines a second table, Corrections (# | Date | Claim ... | Measurement that overturned it ... | Where the old claim still stands ...). map_header() gave none of its cells a finding or disposition field, so each correction rendered as a blank finding whose disposition read OPEN, with severity "(none)"; the page's open count overstated real open work by the number of corrections. A header that has a Claim column and no Finding/Disposition column is now the corrections table: its rows go to their own list, render in a "Corrections" section after the findings, print a "corrections N" line, and never enter the findings counts or the trend. Field run (card-disbursement requirements-driven build): the project's own docs/improvement-register.md copied to scratch and rendered there. Old: 45 rows parsed, open 10, severity (none)=7. New: 38 findings, open 3, severity P2=30 P1=8, corrections 7 listed separately. No fixture covers this script. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

The selftest's cases assert on two walkthrough instruments (full-app-walkthrough, mobile-fieldscan) and feed findingsMobile, but normalize() only emits walkthrough instruments the project config declares. The template declares one (mobile-fieldscan is commented out), and a real project may declare none, so the selftest could not pass on either: 2 FAIL then a TypeError on the template, 4 FAIL then "Cannot read properties of undefined (reading 'canExpressFault')" on the field project's config. selftest() now replaces WALKTHROUGHS and its map with the two declarations its cases use, for that process only. Field run (card-disbursement requirements-driven build), scratch copies with a two-tree layout and an empty .mpr: old, template config: 60 ok, 2 FAIL, TypeError, rc 1 old, field config: 41 ok, 4 FAIL, TypeError, rc 1 new, both configs: 139 ok, "all ok", rc 0 Left as is: the selftest still needs a .mpr above it, because INPUTS.mpr reads the config's mprName getter at load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

The "Why each line" table said on error continue is the only handler a rest call accepts and a block is CE6035. On Mendix 11.13 with mxcli v0.24 that is stale. Probe (card-disbursement requirements-driven build), on a scratch copy of the field model: three microflows in MyFirstModule, exec'd, then mx check (11.13.0). Baseline 1112 errors (theme CE6083 only, the copy has no theme dir), after 1113. The one new error is CE0644 "Error handling type must be 'Rollback' inside a looped activity" on the REST call inside a while; on error { ... } and on error without rollback { ... } outside a loop added nothing. The row now says so and points at learned-microflow-patterns.md's existing per-row-isolation lesson. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

mxcli test ... --attach adds and removes its MxTest microflows, so the .mpr mtime moves while the units come back byte-identical; the catalog then reads stale and verify-module.sh's graph sweep FAULTs on a module nobody touched. Order the loop: test --attach -> REFRESH CATALOG FULL -> verify-module.sh. graph-sweep.sh already prints the rebuild remedy; this puts the ordering where the --test-endpoint flag is documented. Field: the card-disbursement requirements-driven build, mxcli v0.24.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

…body scan The page body is bounded by counting braces per character. Braces inside a single-quoted MDL string were counted too, so an unbalanced one - a JSON payload preview written as Content: '{{ ... }' (the doubled brace is the escaped literal) - left the depth at +1 per preview; the scan ran on through the following pages and a page with one H1 was reported as declaring 3. The old up-front `--` strip had the same effect on a string holding `--`. Strings are now skipped across lines (a doubled quote is two toggles), `--` ends the line only outside a string, and /* */ block comments are skipped so an apostrophe in their prose opens no string. Field run (read-only) on the card-disbursement requirements-driven build: 18 pages across 87 scripts, 1 violation (StartRequest_NewEdit "declares 3 H1 titles", one H1 in DESCRIBE PAGE and on screen) -> 0 violations. Scratch probe: five pages incl. a multi-line '{{ ... }' preview, a `--` in a string and an apostrophe in a block comment - old 3 violations, new 1 (the genuine two-H1 page). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

In multi-ledger mode review-module.sh runs coverage-check-all.sh, which flattens each BRD's counters onto one `<BRD>: CLEAN - ...` line and dropped `leaves:`. review-report.js only read the one-counter-per-line format of coverage-check.sh --summary, so every counter was null and every one-ledger-per-BRD module carried `fault . review/coverage/<M>` over a clean count - a permanent false red readers learn to skip. coverage-check-all.sh now keeps `leaves:` on the line. review-report.js recognises the per-BRD lines and sums each counter; a counter stays null (unmeasured) when a BRD line is FAULT / NO LEDGER, lacks that counter, or the lines do not add up to the stated `N BRD(s) checked.` A coverage.txt from an older installed coverage-check-all.sh (no `leaves:`) still faults, and the reason now says to run bin/sync-project.sh. Field run on the card-disbursement requirements-driven build (read-only: coverage-check-all.sh over the real per-BRD ledgers, review-report.js on copies of the real review run dirs in scratch): current coverage.txt old fault new fault (+ names the stale copy) SystemCheck, new cca output old fault new pass, leaves 337 claimed 289 Integration, new cca output old fault new pass, leaves 610 claimed 564 both BRDs in one run old fault new pass, leaves 947, 2 ledgers single-ledger --summary output old pass new pass (unchanged) UNCLAIMED 3 / a FAULT line / a missing BRD line: fail / fault / fault. Known limit, unchanged: the coverage[] rollup still reads only the single-file coverage-ledger.md. Triaged inbox note deleted: review-report-multi-ledger-coverage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

learned-constants-and-secrets.md Step 3 prescribes a `__SET_ME__`-style sentinel for a secret every environment must override (it fails fast, naming the constant). The audit only knew SET vs EMPTY, so that exact default read MODEL-SECRET - the same verdict as a real password committed to the model - and a project following the skill had to waive it. A default of the shape `__[A-Za-z0-9_]+__` is now state SENTINEL, verdict SENTINEL: listed, counted in the summary and the JSON ("sentinel": n), never a finding, never consulting the waiver register. The test reads the value's shape only; still no value is printed. CLIENT-SECRET keeps precedence. --help range follows the longer header. Field run on a scratch copy of the card-disbursement requirements-driven build's model (mxcli v0.24.0): 7 constants; old 4 findings (the hub password constant MODEL-SECRET), new 3 findings + 1 SENTINEL; with the project's register copied in, old 4 waived, new 3 waived + 1 SENTINEL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

capture() asked Jaeger for `limit=400&lookback=1h` and kept the spans at or after t0. Jaeger answers the NEWEST `limit` traces and is silent about the rest, so whenever the app's own traffic (timers, health checks) put more than 400 traces between t0 and now, the older spans vanished without a word - a post-mortem capture read "0 errors" over real ERROR spans. fetchSince(t0) now pages backwards: while a page comes back full and its oldest span still starts after t0, it asks again with end = that start - 1us. Traces are deduped by id; the window is never narrower than the old lookback=1h; pages are capped at OTEL_MAX_PAGES (default 25) and the result carries `.pages`, plus `.truncated` when the cap stopped it before t0. A step's own capture (t0 seconds back) is still a single query. Field run, read-only against the running Jaeger of the card-disbursement requirements-driven build (the app itself not called): t0 -6s old 9 spans, 1 page new 8 spans, 1 page (window slid) t0 -5min old 462 spans new 1,267 spans, 3 pages t0 -15min old 462 spans, 0 errors new 15,439 spans, 24 errors, 11 pages OTEL_MAX_PAGES=2, t0 -15min: 874 spans, pages 2, TRUNCATED. The newest 400 traces spanned two minutes; 4,608 traces were in the 15-minute window. Fixture test-otel-capture-until.sh stubs fetch with a one-trace golden, so each retry is still exactly one fetch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Field run: the card-disbursement requirements-driven build's row 6.9 workflow construct probes (mxcli v0.24.0, Mendix 11.13.0, 2026-09-26), each on a scratch copy of the app: check --references, exec, native mx check, then DESCRIBE WORKFLOW read-back. Six probes, four controls. - Forward JUMP TO: meant as a known-bad control (the toolkit said CE6681); check, exec and mx check 0 errors, describe shows the real target. The table row and the section 21 jump table taught direction as a platform rule; it was the jump-named-after-its-target defect, fixed upstream in v0.21.0 (825873d6), which section 25 already said. - Interrupting boundary timer ending in jump to <earlier> or in end workflow comment: 0 errors, real jump read back. BUG-109 stamped no-longer-reproduces. - BUG-76 split: the bare-enum DECISION is refused by MDL-WF03 and, forced with --no-check, still gives StorageLoadException (rc 1); a Boolean decision with true/false outcomes builds at 0 errors with the expression intact. The string-labelled repro was not re-run, so the STOP stays for that shape. - create or modify workflow ... folder places the workflow (describe reads the folder back). - New: one interrupting boundary per activity (MDL-WF15 / CE6697) and no end workflow on a non-interrupting path (MDL-WF08 / CE1844), from mxcli check on a design draft. - New: SET TASK OUTCOME from a call with no signed-in user fails at runtime ("Only named users can complete user task") even after assigning the task; the run-as-session Java action took the proof test's call from 403 to 200. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Field run: the card-disbursement requirements-driven build (mxcli v0.24.0, Mendix 11.13.0, 2026-09-26/27), each from a failed exec gate or a live journey: - if with no else inside on error { }: check clean, exec.sh's mxbuild gate CE0079 / CE0773, script rolled back. - Java action parameter named Case: mxbuild CE7247 only (Context hit the same reserved list as an attribute). - A data grid on a page a role without read can open: a scratch mx check passed, the real exec gate failed with 8 x CE2729 and rolled back; cause of the difference not isolated, so the row says so. - [%CurrentUser%] in a sub-microflow shared with a published REST operation: every static rung, lint and all UI journeys green; the REST start answered 500 ("token cannot be used in a system session") until the account was looked up by login name, then 201 and the journey 92/92. Pattern added to learned-microflow-patterns. - CE7410 (task page without a WorkflowUserTask parameter) is now refused at check --references, even under --no-check (probe control c7): added to the workflow section 9 error table. - The calculated-by row told readers to verify with mx.data.get, which the React client disables; it now points at a live retrieve. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Field run: the card-disbursement requirements-driven build (Mendix 11.13.0, mxcli v0.24.0, 2026-09-25..27): - DG2 at 390px: DataGrid2 sets min-width: 0 on every .th/.td while the custom-content wrapper keeps min-width: auto. A blanket wrapper shrink spilled 20 of 20 status pills on one list page and 5 of 5 on the dashboard; scoping the shrink to text cells and flooring headers and id/pill/time cells at max-content measured 0 of 20 and 0 of 5, desktop widths unchanged. New section in learned-dg2-patterns (the on-demand grid skill, not the baseline CSS skill). - Atlas .btn { font-weight: normal } and .form-group row layout have no custom-variables knob: computed read 400 -> 500 after porting. - mxbuild --target=deploy during run --local drops dist/; runtime.log shows 404 on dist%2Findex.js while logins hang. - mx.data.get is disabled in the React client (page.evaluate error), so data assertions stay on mxcli oql --direct. - Box centres read 91/91 while the link text sat 12px high; glyph Range boxes read 79 vs 91, then 79/79 after the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Pass 2 of the card-disbursement requirements-driven build's findings: every row about mxcli itself was checked against bin/bug-lookup.sh, the ledger and skills/learned-*.md; what was missing lands here. New entries (mxcli v0.24.0, Mendix 11.13.0, none filed upstream): - BUG-142 ContentParams: bare attribute or quoted literal only; `if..then..else` passes check, fails CE1613 (supersedes BUG-23's fix; BUG-23 stub now points here) - BUG-143 theme seeder / Atlas map gaps - BUG-144 create user role omits CheckSecurity, GUID and three keys - BUG-145 grant merges; (read *) and the audit system members - BUG-146 diff false modifications - BUG-147 check/exec disagree on same-script documents - BUG-148 E007 on a quoted enum literal in last position - BUG-149 check/lint misfires; check-green/mxbuild-red constructs - BUG-150 DG2 and filter widget definition gaps - BUG-151 rest call body $Var sends the literal text - BUG-152 published REST / mappings / Java action gaps - BUG-153 oql HAVING without GROUP BY; date aggregates - BUG-154 MDL surface gaps Retests appended: BUG-08, BUG-77 (reproduced, trigger isolated), BUG-92, BUG-117, BUG-122; BUG-DRAFT-layout-merge-in-if-branch gains the error-handler-without-return shape. Field run: each row is a check / exec.sh (mxbuild gate) / lint A/B or a BSON read on a scratch copy of that build's model, 2026-09-25..26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Skill edits that point agents at the new ledger entries, from the card-disbursement requirements-driven build (mxcli v0.24.0, Mendix 11.13.0): - learned-mdl-preflight: STOP row 12 rewritten (net shorter) - ContentParams takes a bare attribute or a quoted literal only (BUG-142); row 14 notes a narrowing grant merges (BUG-145); row 23 notes diff's false -/~ lines (BUG-146) - learned-detection-gaps: ContentParams row widened to any object-bound dynamictext; reserved words cover entities; CE1870 row (BUG-149) - learned-datagrid-customcontent-binding: v0.24.0 note (BUG-142) - microflow-preflight: CONV013 false positive and doc-comment round-trip moved out of "Not verified"; error handler without return as the second merge-overlap shape; declare-before-while - testing-shape: --test-endpoint writes into the working model until a clean stop (T-99/T-120/T-177); run --local starts with scheduled events off, with a false-green register row - learned-mdl-cannot-express: tab badge, validate-while-typing, AppTitle, always-open nav groups, sidebar toggle / page-load / Marketplace layout; DG2 emptyplaceholder is CE0463 on v0.24.0 (BUG-150) - learned-page-patterns: control-bar attributes resolve against the grid entity; nested list view Editable; REPLACE is never re-run safe (BUG-08) - rest-integration-first-time-right: v0.24.0 bullets (BUG-151, BUG-152) - journey-proof: HAVING seed and date watermark traps (BUG-153) Inbox notes triaged and deleted: - 2026-09-26-contentparams-expressions-v024.md -> BUG-142, STOP row 12, detection-gaps row, customcontent-binding note - 2026-09-26-mxcli-v024-rest-json-page-field-notes.md -> testing-shape (item 1), BUG-151 (2), 634b5e0 (3), BUG-149 (4, 6), STOP row 23 already covers (5), BUG-152 (7), BUG-08 retest + page patterns (8), BUG-153 + journey-proof (9) - 2026-09-26-run-local-scheduled-events-off.md -> testing-shape section 5 and the register row Field run: the rows cite the check / exec.sh mxbuild gate / lint / BSON probes on scratch copies of that build's model, 2026-09-25..26, already recorded in the ledger commit. Baseline routing 78318 / 80000 words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Each was triaged earlier on this branch into a fix or a GitHub issue that carries its content: - design-audit-raw-class-vs-design-spacing -> #152 - journey-runner-persona-and-local-acts -> #149, #148 - look-obligation-reads-first-valid-at -> #155 - span-claims-cannot-be-negative-only -> #150 - verify-module-graph-fault-after-test-attach -> #153 and affb6f8 - wiring-sweep-disabled-by-design-and-conditional-controls -> #156 - report-normalize-selftest-broken -> 9ad87bd Nothing in the tree cites them (grep, excluding the inbox itself). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

bin/check-pr-discipline.sh rule 3 wants every added entry to end in ' — <credit>'. Nineteen entries on this branch (six from this findings pass, the rest from the same build's earlier commits) ended in "From a card-disbursement requirements-driven build (<row>)." instead, so the PR-discipline step would fail on the PR. Reworded mechanically to "… — card-disbursement requirements-driven build (<row>)"; no entry's content changed. Local run of check-pr-discipline.sh against origin/master: 10 uncredited entries before, clean after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Resolves the CHANGELOG.md Unreleased conflict by keeping both sides: every branch entry plus master's learned-microflow-patterns line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Master took #143 (module-rename field report) and #144 (wire-company-brain bash 3.2). Both conflicts were appends at the same point, kept both sides, ours first: - CHANGELOG.md, ## Unreleased: this branch's lines, then master's four. - bug-logs/mxcli-bugs.md: the "Second shape" addendum to BUG-DRAFT-layout-merge-in-if-branch, then master's new BUG-DRAFT-* entries. Master's new entries are BUG-DRAFT-*, so BUG-142..154 still do not collide (check-pr-discipline clean). Leak guard, private-citations and render-routing --check clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

check-portability failed PR CI: test-design-audit-css-corpus, test-design-audit-nav-map, test-journey-control-exit, test-monkey-left-app and test-otel-capture-until each opened a heredoc inside $(...), which bash 3.2's command-substitution scanner cannot parse. The node snippet is now read into $JS first and piped to `node -`, so argv, cwd, env and 2>&1 are unchanged (process.argv checked identical for both forms). check-portability: clean, 171 files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Two files conflicted, and both conflicts were additions on each side, so both sides are kept: - CHANGELOG.md: the Unreleased entries from both. - bug-logs/mxcli-bugs.md: the second-shape note on the MPR008 entry, plus master's new BUG-DRAFT sections. master claimed no BUG numbers from BUG-142 up, so there is no collision. Checked on the merged tree: - check-no-client-data: 716 files clean. - check-no-private-citations: clean. - render-routing --check: clean. - check-pr-discipline: clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

Brings in cdbd137, master's own fix for the check-portability violation in tests/wave2/test-mxbuild-version-match.sh that turned this PR's CI red on 3c26c7f, and the two upstream-log commits. CHANGELOG.md conflicted on additive lines only; both sides kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

CHANGELOG.md: kept both sides under Unreleased. bug-logs/mxcli-bugs.md and learned-mdl-preflight.md (STOP row 27) auto-merged; master's new entry is BUG-DRAFT-*, no collision with BUG-142..154. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pm41sykqDGcvioGzsY5H2N

claude added 30 commits September 26, 2026 01:21

claude added 20 commits September 27, 2026 08:22

Navigation Menu

Field harvest from a requirements-driven build: 26 instrument fixes, BUG-141 fix proven, BUG-142..154 - #162

Field harvest from a requirements-driven build: 26 instrument fixes, BUG-141 fix proven, BUG-142..154#162
MendixMau wants to merge 50 commits into
masterfrom
claude/exciting-brahmagupta-n1uggd

MendixMau commented Sep 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

MendixMau commented Sep 27, 2026

Direct lane

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants