From bc755edb39c6aa7125f7c0f896d4609a1cf2419e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 9 Sep 2026 09:41:41 +0000
Subject: [PATCH 1/4] page-fidelity: let a wireframe declare which text is
 bound data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The scorer already excludes <td>, because a wireframe's table cells are
sample rows and a page that correctly binds them contains none of that
literal text. The same is true of a bound value anywhere else, and there
the structure gives nothing away: an <h1> holding a record's number and
name looks exactly like an <h1> holding page copy.

Measured on a MOC/PSSR app replacement's project detail page: 54%, all
three misses being sample values the page could not contain — the
record's own title, and a mocked attachment's filename twice. The page
was right, the denominator was wrong, and that number was about to be
read off as a gate verdict.

So the marker is declared, not guessed. An element carrying
class="bound" leaves the text corpus and the class denominator. Guessing
was the alternative and it does not work: a heading is bound or it is
not, and only the person who drew the screen knows which.

Fixture grows to 18 assertions, including that a bound heading leaves
the DENOMINATOR and not merely the missed list — otherwise the score
would be 1 of 2 and still look clean. Known-bad control without the
marker fails 5 of 18. The same page scores 100% with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jj5uvTmmcBQT8Uu3asm21M
---
 CHANGELOG.md                                  |  1 +
 project-bin/page-fidelity.js                  | 23 ++++++++++++++++++-
 .../fixtures/page-fidelity-mocks/CAPTURE.md   |  8 +++++++
 .../page-fidelity-mocks/grouped-overview.html |  3 ++-
 tests/wave2/test-page-fidelity-mocks.sh       | 12 ++++++++++
 5 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2531c34..91670da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Kinds: `new` · `fix` · `learn` (a skill/learning) · `process` (rules, templat
 Credit the person or project that surfaced the change — the credit line is the thank-you.
 
 ## 2026-09-09
+- new(project-bin/page-fidelity.js): **`class="bound"` — the wireframe author saying "this text is a sample of bound data".** The scorer already had this concept and applied it structurally: `<td>` is excluded from the text corpus because a wireframe's table cells are sample ROWS and a page that correctly BINDS them contains none of that literal text. The same is true of a bound value anywhere else on the screen, and there the structure gives nothing away — an `<h1>` holding a record's number and name looks exactly like an `<h1>` holding page copy, and a chip holding a filename looks exactly like a chip holding a label. Measured on a MOC/PSSR app replacement's project detail page, 2026-09-09: **54%**, and all three misses were sample values the page could not contain — the record's own title, and a mocked attachment's filename, twice. The page was right; the denominator was wrong, and the number was about to be read off as a gate verdict. So the marker is **DECLARED, not guessed**: an element carrying `bound` leaves both the text corpus and the class denominator, and guessing was the alternative and does not work — a heading is bound or it is not, and only the person who drew the screen knows which. Put it on the smallest element that holds only the value (`<h1 class="bound">` leaves no heading behind; `<span class="bound">` inside a chip leaves the chip). Fixture grows to **18 assertions** including that a bound heading leaves the DENOMINATOR rather than merely stopping being reported as missed — otherwise the score would be 1 of 2 and still look clean. Known-bad control without the marker: **5 of 18 fail**. Same page scores 100% (3/3 headings, 2/2 content) with it — Maurits Visser, from a MOC/PSSR app replacement
 - process(bug-logs): BUG-114 filed upstream as mendixlabs/mxcli#1076 with BUG-118 as its second reproduction; both drafts and the ledger header stamped FILED — the toolkit merge queue
 - fix(project-bin/page-fidelity.js): **structure classed as bound data, and the score of record silently going `null%` again.** A wireframe's own `<style>` defines two very different kinds of class — BOUND-DATA MOCKS (a repeated region of sample rows, whose literal text a correctly *binding* page contains none of) and STRUCTURE (the wrapper, the page header, the toolbar — furniture the page script genuinely must declare) — and the classifier **drops a mock's whole subtree**, so a misclassified structural class deletes page content from the denominator. The test was `uses === 1 && kept < 0.4`, once-used AND dominant, which contradicts the paragraph directly above it stating that a mock is a **repeated** region: a once-used class whose subtree was *small* fell through the second conjunct and was dropped as sample data. Measured on a MOC/PSSR app replacement's project overview, 2026-09-09: `.page-head` (uses=1, kept=0.513) was deleted **with the page's only `<h1>` inside it**, `.toolbar` (uses=1, kept=0.825) with it, and every dimension reported `0 of 0` — which normalizes to **`null%`**, so the run printed a clean report over an empty corpus. That is the same silent-null failure this file's own header note says was worth fixing, arriving a second time through the other conjunct, on a page that scores **100%** once the page is not gutted. The threshold is **removed rather than retuned**: it was a guess, and any value for it splits once-used wrappers on a measurement that has nothing to do with whether their content is bound data; a repeated region is still a mock at any size, which is the half that was always right. New fixture `tests/wave2/test-page-fidelity-mocks.sh`, **14 assertions**, with two captured wireframe shapes and a `CAPTURE.md` stating that only literal text and class prefixes were changed. Its **first assertion is that the score is not `null`, not that it is high** — a null on a wireframe that draws an `<h1>` means the scorer gutted the page, whatever the eventual percentage. Proven against a known-bad control carrying the old rule: **8 of 14 fail** — Maurits Visser, from a MOC/PSSR app replacement
 - learn(workflow-structure-rules, learned-workflow-patterns): **two workflow signatures that `mxcli check` passes clean and the native build rejects**, plus a v0.21.0 re-probe of the four constructs a real approval chain needs. (1) **A user task's `PAGE` must take a `System.WorkflowUserTask` parameter, not the workflow's context entity** — a context-parameterised page passes `mxcli check --references`, execs, round-trips through `DESCRIBE`, and the native build then says *"The selected page 'X' should accept a parameter of type 'WorkflowUserTask', but expects parameters of types 'MOCProject' instead"*. (2) **A targeting microflow must accept TWO parameters, `System.Workflow` AND the context entity** — one parameter is the natural thing to write and it is wrong. Neither signature appears anywhere in `mxcli syntax workflow`, whose own targeting example is `TARGETING MICROFLOW HR.GetApprovers` with no signature stated. **The expensive half is the planning consequence: the task pages are a PREREQUISITE of the workflow row, not a later UI row** — a plan that builds the workflow at row 41 and its task pages at row 45 cannot make row 41 green, which is exactly how one project's Phase 7 was ordered. Also: with the signatures right, user task + targeting microflow, **multi-user task**, `CALL MICROFLOW` with a quoted `WITH`, and a **backward `JUMP TO`** inside an outcome all build clean on v0.21.0. That result is only worth having because **the same run included the construct known to be broken as a control**: a scripted `DECISION` passed `mxcli check`, printed `Created workflow`, and left the project unopenable (`StorageLoadException` → `BUILD FAILED`), so BUG-76 is open on v0.21.0 and the probe demonstrably distinguishes working from broken. A probe with no known-bad control cannot tell *"it works"* from *"the probe is blind"* — this repo has already published one wrong conclusion for that exact reason (BUG-121) — Maurits Visser, from a MOC/PSSR app replacement
diff --git a/project-bin/page-fidelity.js b/project-bin/page-fidelity.js
index d08ba4e..82d7efc 100755
--- a/project-bin/page-fidelity.js
+++ b/project-bin/page-fidelity.js
@@ -171,6 +171,27 @@ function contentOf(html) {
   // miss on a page whose real H1 is correct. Two faithful pages at 9%.
   s = dropBalanced(s, /<(div)[^>]*class="[^"]*\banno\b[^"]*"/i);
   s = dropBalanced(s, /<(table)[^>]*class="[^"]*\bbind\b[^"]*"/i);
+  // `.bound` — THE AUTHOR SAYING "this text is a sample of bound data".
+  //
+  // The scorer already has this concept and applies it structurally: `<td>` is excluded
+  // from the text corpus because a wireframe's table cells are sample rows, and a page that
+  // correctly BINDS them contains none of that literal text. The same is true of any bound
+  // value anywhere else on the screen, and there the structure gives nothing away — an
+  // `<h1>` holding a project's number and name looks exactly like an `<h1>` holding page
+  // copy, and a chip holding a filename looks exactly like a chip holding a label.
+  //
+  // Measured 2026-09-09 on a MOC/PSSR app replacement's project detail page: 54%, with all
+  // three misses being sample values a correctly binding page cannot contain — the record's
+  // own title, and a mocked attachment's filename, twice. The page was right; the
+  // denominator was.
+  //
+  // So this is DECLARED, not guessed. A wireframe marks its bound sample values
+  // `class="bound"` and they leave both the text corpus and the class denominator. Guessing
+  // was the alternative and it does not work: a heading is bound or it is not, and only the
+  // person who drew the screen knows which. Any element may carry it — the drop is on the
+  // tag the class sits on, so `<h1 class="bound">` leaves no heading behind and
+  // `<span class="bound">` inside a chip leaves the chip.
+  for (let i = 0; i < 12; i++) s = dropBalanced(s, /<([a-z][a-z0-9]*)[^>]*class="[^"]*\bbound\b[^"]*"/i);
   // A "this screen is descoped/annotation-only" banner is chrome, not page copy.
   s = dropBalanced(s, /<(div)[^>]*class="[^"]*alert[^"]*"(?=[\s\S]{0,400}?DESCOPED)/i);
   return s;
@@ -292,7 +313,7 @@ function wfFacts(file) {
                     ...grab(/<div class="muted"[^>]*>([\s\S]*?)<\/div>/gi)];
   const classes = new Set();
   for (const x of main.matchAll(/class="([^"]+)"/g))
-    x[1].split(/\s+/).forEach(c => { if (c && !/^(wf-|ann|crosscheck|alert-ic|x-btn|req)/.test(c)) classes.add(c); });
+    x[1].split(/\s+/).forEach(c => { if (c && c !== 'bound' && !/^(wf-|ann|crosscheck|alert-ic|x-btn|req)/.test(c)) classes.add(c); });
   // Classes confined to the wireframe's table.grid mock describe markup the
   // DATAGRID widget renders itself (wrapper, filter row, cell emphasis) — a page
   // cannot declare them. Curated: pill/status classes stay scored, because a page
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
index 1ff9e27..aa36195 100644
--- a/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
+++ b/tests/wave2/fixtures/page-fidelity-mocks/CAPTURE.md
@@ -26,6 +26,14 @@ class prefix (`ds-` -> `x-` for the design-system-looking names, so the fixture
 mistaken for a claim about any real design system). No line was reflowed, no block
 reordered, no selector altered, no structure simplified.
 
+**Two `class="bound"` elements were ADDED to `grouped-overview.html`**, and they are the one
+thing here that is not a reduction of the real file: an `<h2 class="bound">` holding a record's
+own title and a `<span class="bound">` holding a filename. They stand in for the real detail
+page's `<h1>` and file chip, which is where the defect was found (54%, all three misses being
+sample values a correctly binding page cannot contain). Reproduced on the overview fixture
+rather than adding a third wireframe, because the marker's behaviour has nothing to do with
+which screen carries it.
+
 **Counts measured on the REAL overview wireframe** (the numbers the defect was found on):
 
 | class | uses | subtree kept when dropped | old verdict | correct verdict |
diff --git a/tests/wave2/fixtures/page-fidelity-mocks/grouped-overview.html b/tests/wave2/fixtures/page-fidelity-mocks/grouped-overview.html
index 4a96d9a..4010c3d 100644
--- a/tests/wave2/fixtures/page-fidelity-mocks/grouped-overview.html
+++ b/tests/wave2/fixtures/page-fidelity-mocks/grouped-overview.html
@@ -22,9 +22,10 @@
 <div class="page-head"><div><h1>Demo</h1><p class="sub">Records across all sites</p></div>
   <div class="page-actions"><button class="x-btn">+ New record</button></div></div>
 <div class="toolbar">
-  <span class="grow"><input placeholder="Search records"></span>
+  <span class="grow"><input placeholder="Search records"><span class="bound">ISO14001_Transition.pdf</span></span>
   <select><option>Filter</option></select>
 </div>
+<h2 class="bound">864 · Environmental system improvement</h2>
 <div class="x-group-head">SITE-1</div>
 <div class="x-tablewrap"><table>
 <tr><th>Record (start – end)</th><th>Department</th><th>Track A</th><th>Track B</th><th></th></tr>
diff --git a/tests/wave2/test-page-fidelity-mocks.sh b/tests/wave2/test-page-fidelity-mocks.sh
index fe001fe..55b3002 100755
--- a/tests/wave2/test-page-fidelity-mocks.sh
+++ b/tests/wave2/test-page-fidelity-mocks.sh
@@ -90,6 +90,18 @@ echo "  -- the sample text inside a mock is not scored against the page"
 # missed content and the score would fall below 100%.
 hasnt "sample row text is not a missed content block" "$OUT" "Reclaimer refurbishment"
 
+echo "  -- a DECLARED bound value leaves the denominator"
+# grouped-overview.html carries an <h2 class="bound"> holding a record's own title and a
+# <span class="bound"> holding a filename. Both are sample values a correctly BINDING page
+# cannot contain, and the wireframe says so with the class. If either were scored, the page
+# would report them as missed heading/content and fall below 100%.
+hasnt "a bound heading is not a missed heading" "$OUT" "Environmental system improvement"
+hasnt "a bound value is not missed content"     "$OUT" "ISO14001_Transition.pdf"
+has   "the page still scores 100% with bound values present" "$OUT" "fidelity 100%"
+# The h2 must leave the HEADING DENOMINATOR, not merely stop being reported as missed —
+# otherwise the score would be 1 of 2 and still pass the two assertions above.
+has   "the bound heading is out of the denominator" "$OUT" "headings 1/1"
+
 echo "  -- a genuinely mocked list page still reports its mocks"
 OUT2=$(cd "$TMP" && node "$SUT" --no-log "$FIX/mocked-list.html" Demo_List "$FIX/demo-list.mdl" 2>&1)
 echo "$OUT2" | sed 's/^/    | /'

From 614accb4fb31573d0de5cf9fa012f8f4b79ba8a9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 9 Sep 2026 16:41:12 +0000
Subject: [PATCH 2/4] contrib/inbox: field evidence that ui-loop.md never
 triggers page-fidelity.js

From the moc-app-replacement project's overnight session: 4 of 8 admin
pages went unstyled and unreachable through two build scripts because
neither the per-script UI loop nor the module-close review actually ran
the fidelity harness that already exists in this toolkit. Proposes
adding an explicit "run page-fidelity.js now" step plus a reachability
question to ui-loop.md -- not applied directly, per this repo's own
baseline-test-before-rewrite rule for behaviour-shaping skills.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jj5uvTmmcBQT8Uu3asm21M
---
 ...-09-09-ui-loop-never-runs-page-fidelity.md | 80 +++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 contrib/inbox/2026-09-09-ui-loop-never-runs-page-fidelity.md

diff --git a/contrib/inbox/2026-09-09-ui-loop-never-runs-page-fidelity.md b/contrib/inbox/2026-09-09-ui-loop-never-runs-page-fidelity.md
new file mode 100644
index 0000000..a04c94f
--- /dev/null
+++ b/contrib/inbox/2026-09-09-ui-loop-never-runs-page-fidelity.md
@@ -0,0 +1,80 @@
+# `ui-loop.md`'s per-script look never runs the fidelity harness that already exists — a whole batch of built pages went unstyled and unmeasured until an end-of-session screenshot pass
+
+**From:** a change-governance (MOC/PSSR) app replacement project (2026-09-09, overnight session)
+**Date:** 2026-09-09
+**Kind:** learning / skill-draft
+**Field evidence:** confirmed finding on a real build, not a hypothesis. See numbers below.
+**Proposed target:** `skills/ui-loop.md` (the per-script cadence skill), possibly also
+`skills/module-review.md` stage 4's own instructions to actually invoke the harness it already
+requires as evidence
+
+---
+
+## What happened
+
+The project has `project-bin/page-fidelity.js` — a real, working, already-installed instrument
+that scores a built page against its wireframe (headings/actions/content/classes) and appends
+every run to `docs/PAGE-FIDELITY.tsv`, target ≥80%. It was never run against 4 of a module's
+8 pages (Employee/Section/Machine/ApproverList admin overview pages, `build-plan.md` row 62,
+built two build-scripts earlier). Nobody noticed, because `ui-loop.md`'s cadence — a screenshot
+and three subjective questions after each script — kept saying the pages "looked fine enough
+to keep going," and `module-review.md`'s stage-4 LOOK pass hadn't happened yet either (row 62b,
+the module's own regression harness, was also still `not built`).
+
+The user asked directly mid-session, after being shown an ad-hoc screenshot pass: **"why did
+our UI review not look at the pages? ... run UI improvements. Why is that so hard?"** — and was
+right to ask. Running the actual harness that day turned up:
+
+- `Employee_Overview`: **50%** fidelity (below target) — but the "content" miss driving that
+  score was the page's subtitle text differing from the wireframe's own **placeholder** copy
+  (the wireframe file's own header literally says "copy is placeholder; structure is the
+  deliverable"), and the built copy was arguably better (cites the real BR number). So the
+  score alone was not the actionable signal here — the harness's number needed a human reading
+  the "missed:" detail lines next to it, not blind score-chasing.
+- Two **real** defects the fidelity harness's page-vs-wireframe diff would NOT have caught,
+  because they're not about one page's shape: (a) the module's landing page (`Admin_Home`) had
+  navigation to only 1 of 5 admin screens — the other 4 were built, access-granted, and
+  completely unreachable from the UI; (b) a reused card-list snippet
+  (`SNIPPET_CardListRow`) had shipped with class names (`card-row`, `avatar`, `card-who`,
+  `role-tag`, `card-name`) that were never defined in the project's `ds.css` — every card on
+  every admin list rendered as raw unstyled concatenated text.
+
+## Why this is a process gap, not a one-off miss
+
+`ui-loop.md` already states the right cadence philosophy ("cheap enough to run ten times per
+module... a defect that survives into the next script costs more to find and more to place")
+but its actual four-step loop is entirely subjective (screenshot + three eyeballed questions).
+It never tells the agent to run the ONE instrument in the repo built specifically to answer
+"does this page match its wireframe" with a number and a denominator — `page-fidelity.js`
+already exists, is already wired into `docs/PAGE-FIDELITY.tsv`, and was simply never invoked
+until asked for explicitly, four build-scripts and one whole module later.
+
+Separately: neither the fidelity harness nor the eyeballed loop check **reachability**
+(can a user actually navigate to this page from anywhere) or **cross-page shared-component
+styling** (is every class this page's markup emits actually defined somewhere). Both defects
+found here are the "the individual page's own MDL and wireframe substantially agree, but the
+thing is still broken" class — orthogonal to what page-fidelity measures.
+
+## Suggested fix (not built — proposing, not shipping, per this project's own rule that
+skill authorship needs baseline-testing before a rewrite)
+
+1. Add a numbered step to `ui-loop.md`'s loop: **"If a wireframe exists for this page, run
+   `page-fidelity.js` now, not just at module close — read the score AND the 'missed:' detail
+   lines, and use judgement before rewriting copy to chase 100%; placeholder-vs-real-copy
+   divergence is not always a defect."**
+2. Add a fifth question to the loop's three, specifically aimed at what fidelity-scoring can't
+   see: **"Reachable? Can a real user actually navigate here through the built nav, not a
+   direct `/p/` link — click through it."** (This project also found that direct `/p/<Page>`
+   deep links don't work at all in this app's runtime, which made this check non-optional —
+   worth a separate bug-log entry, not repeated here.)
+3. Consider a periodic (not per-script) full sweep — screenshot + fidelity-score every built
+   page in the module, cross-checked against the shared stylesheet for any class a page's own
+   markup emits that the stylesheet doesn't define — run at least once **before** claiming a
+   module's Phase done, not deferred to whenever someone happens to ask. `module-review.md`
+   stage 4 may already intend this; if so, the gap is that nothing forces it to actually run
+   before a phase gets marked "done" in the build plan (this project's own build-plan rows 59-61
+   were marked done while row 62, the harness pass, sat at "not built" with no red flag raised).
+
+Per this toolkit's own skill-authoring rule 2 (`CLAUDE.md` "Authoring rules for
+behaviour-shaping skills") — baseline-test before rewriting a skill "because outcomes were
+bad" — this is a field-evidence writeup for triage to weigh, not a drop-in replacement text.

From 871e6fa0e5c4e8b9448128c04d8aad6dcc1983bf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 01:26:36 +0000
Subject: [PATCH 3/4] =?UTF-8?q?learn:=20the=20pixel,=20not=20the=20exit=20?=
 =?UTF-8?q?code=20=E2=80=94=20why=20the=20second=20UI=20pass=20worked=20an?=
 =?UTF-8?q?d=20the=20first=20did=20not?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A change-governance app went through two UI passes on the same day, on the same
design system. The user called the first "poor" and the second "much better".
The CSS authoring did not get better in between. The closing check did.

  Pass 1 verified that the SCRIPT EXECUTED.
  Pass 2 verified that THE PIXEL CHANGED.

Every green signal in pass 1 was true and irrelevant: mx check clean, lint
clean, MDL suite green, two journeys green, the design port reporting its
tokens correctly landed in the right file — over an app whose grid header was
white on white and whose entire table stylesheet had never matched an element.

New skill, learned-css-that-never-applied.md. Deliberately NOT a restatement of
ui-loop.md ("judge from the screenshot") or check-design-reaches-app.sh ("did
the classes arrive"). Both are right and both were already here. A screenshot
tells you something is wrong; it cannot tell you whether your rule matched
nothing, matched too much, or matched and lost. That is the missing rung.

Three ways a perfectly correct rule paints nothing, all three met in one run:

  1. MATCHES NOTHING. ds.css styled .ds-tablewrap / table.ds-table. DataGrid2
     renders a row as <div class="tr">; there is no <table> on any page. Not
     one table rule had ever applied, through a full design port and two build
     phases. Separately, three top-bar selectors were guessed in one sitting
     and all three matched zero elements; one read of the live element chain
     named the real carrier.
  2. MATCHES TOO MUCH. The instinct after (1) is to widen. .mx-page painted the
     nav bar with the page ground: white menu text on a white bar.
  3. LOSES THE CASCADE. .mx-listview-empty named the right element, sat ~11,000
     lines after Atlas, and still lost — Atlas's 0,2,1 against a bare class's
     0,1,0, so source order was never consulted. And that rule sets
     border-style:none/background:transparent: Atlas is ERASING the element,
     not failing to style it.

The diagnostic is two reads before touching the rule: computed style, then a
parentElement walk only if the element was not found. The three possible
answers have three different fixes, which is the point — a blind rewrite would
have been wrong in all four field misses, and in case 2 the rewrite WAS the
outage.

Completion criterion carries a denominator, per authoring rule 4: every
component class a pass claims to have shipped gets one computed-style read
against a named element in the running app, or is reported unverified. The run
that justifies that wording had row tone implemented, screenshotted, and
looking fine while rendering a rejected project amber — two value reads caught
it, the eye did not.

Also records the check that comes first and that no CSS instrument can see,
because nothing is wrong with the CSS: at the moment the user called the UI
poor, four complete semantic tint sets, a five-step elevation scale and a
styled empty state were all present, all correct, and bound to ZERO widgets.
The design system was finished and the app was grey. Measure it as "N of M
component classes have at least one carrier in the model" — a zero-carrier
class is never fixed by rewriting it, only by binding it. Three of the five
improvements the user reacted to were pure binding of CSS already in the file.

Second, into learned-mdl-cannot-express.md: when MDL cannot set a class, CSS
usually can. The spec carried per-row tone as an M-sized MDL task prescribing
DynamicRowClass — a property that exists in neither MDL nor Studio Pro, written
months earlier against an imagined API. Whatever class MDL CAN bind is a hook
the stylesheet reads from anywhere in that subtree, so :has() off the
already-bound DynamicCellClass gave three pages row tone with zero MDL. Written
as a positive recipe rather than a prohibition (authoring rule 3): the failure
it retires is stopping at "MDL has no such property" when the requirement was
never about MDL.

Routed baseline for mdl/review/gate at stages 5-6, on this repo's own rule that
a skill living only in the situational table goes unnoticed by projects not
hunting for it — and not being reached is exactly what this one records.
render-routing.sh --check: surfaces in sync, baseline 75206 words of 80000.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jj5uvTmmcBQT8Uu3asm21M
---
 CHANGELOG.md                             |   5 +
 README.md                                |   1 +
 ROUTING.md                               |   1 +
 agents/gate-agent.md                     |   1 +
 agents/mdl-agent.md                      |   1 +
 agents/review-agent.md                   |   1 +
 bin/gate-check.sh                        |   4 +-
 bin/lib/skill-routing.tsv                |   1 +
 skills/conversion-runbook.md             |   1 +
 skills/learned-css-that-never-applied.md | 208 +++++++++++++++++++++++
 skills/learned-mdl-cannot-express.md     |  49 ++++++
 11 files changed, 271 insertions(+), 2 deletions(-)
 create mode 100644 skills/learned-css-that-never-applied.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91670da..c76aa00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ moment updating it became a separate chore). One line per change:
 Kinds: `new` · `fix` · `learn` (a skill/learning) · `process` (rules, templates, CI).
 Credit the person or project that surfaced the change — the credit line is the thank-you.
 
+## 2026-09-10
+- learn(learned-css-that-never-applied): **the difference between a UI the user called "poor" and one they called "much better", same day, same design system, was that the first pass verified the SCRIPT EXECUTED and the second verified THE PIXEL CHANGED.** Everything green in the first pass was true and irrelevant. Three ways a perfectly correct rule paints nothing, all three met in one field run on a MOC/PSSR app replacement, 2026-09-10: **(1) matches nothing** — `ds.css` styled `.ds-tablewrap`/`table.ds-table`, but DataGrid2 renders a row as `<div class="tr">` and there is no `<table>` on any page, so not one table rule had EVER applied, through a full design port, two build phases, mxbuild clean, lint clean and two journeys green; and three top-bar selectors (`.navbar`, `header.navbar`, `.mx-layoutgrid-fluid`) were guessed in one sitting and all three matched zero elements, where one read of the live element chain named the real carrier `.mx-scrollcontainer-top.region-topbar`. **(2) matches too much** — the instinct after (1) is to widen, and `.mx-page { background }` painted the nav bar with it: white menu text on a white bar, an invisible top nav. **(3) matches and loses the cascade** — `.mx-listview-empty` named exactly the right element, sat ~11,000 lines after Atlas in the compiled sheet, and still lost: Atlas ships `.mx-listview > ul .mx-listview-empty { border-style: none; background-color: transparent }` at **0,2,1** against a bare class's **0,1,0**, so source order was never consulted; and that declaration means Atlas is *erasing* the element, not merely failing to style it. The diagnostic is two reads before you touch the rule — computed style, then (only if not found) a six-level `parentElement` walk printing tagName+classList — and the three possible answers have three different fixes, so **a blind rewrite would have been wrong in all four field misses, and in case (2) the rewrite WAS the outage**. Completion criterion carries a denominator: *every component class a pass claims to have shipped has one computed-style read against a named element in the running app, or is reported unverified* — the run that justifies it had row tone implemented, screenshotted and **looking fine while rendering a rejected project amber**, caught only by reading two values. Also records the check that comes first and no CSS instrument can see, because nothing is wrong with the CSS: `check-design-reaches-app.sh` counts classes that ARRIVED in the built sheet, and at the moment the user called the UI poor, four complete semantic tint sets, a five-step elevation scale and a styled empty state were all present, all correct, and referenced by **zero widgets** — the design system was finished and the app was grey. Measure it as *N of M component classes have at least one carrier in the model*; the fix for a zero-carrier class is never to rewrite it, it is to bind it. Three of the five improvements the user reacted to were pure binding of CSS already sitting in the file — Maurits Visser, from a MOC/PSSR app replacement
+- learn(learned-mdl-cannot-express): **when MDL cannot set a class, CSS usually can — check before you go looking for the property.** A UI spec carried per-row status tone on three grids as an `M`-sized MDL task prescribing `DynamicRowClass`, a property that exists in neither MDL nor Studio Pro; it had been written months earlier against an imagined API, the same defect as an instrument built against imagined input. The requirement was met with **zero MDL**, because whatever class MDL *can* bind is a hook the stylesheet reads from anywhere in that element's subtree: every grid already bound `DynamicCellClass: 'ds-statecell ds-statecell--<state>'`, so `.tr:has(.ds-statecell--rejected) > .td` gave three pages row tone with no script, no exec and no gate run. Same move fixed a second item the same day — `.ds-card > .ds-cardhead` is unwriteable from a page because a Mendix class lands on its own element only, and `.ds-card:has(> .ds-cardhead) { padding: 0 }` says it. Two caveats: **source order inside your own rule set becomes load-bearing** (an overview row carries two status cells, matched several rules at equal specificity, and rendered a rejected project amber until the rules were reordered weakest-claim-first), and degradation where `:has()` is unsupported is silent and benign — the selector never matches and you get today's appearance, which is why it must be confirmed by value read and not by eye — Maurits Visser, from a MOC/PSSR app replacement
+- process(skill-routing): `learned-css-that-never-applied` routed **baseline** for mdl/review/gate at stages 5–6, trigger-phrased on *"a style change that appears to have done nothing, or an app still grey after a design port every instrument called green"*. Baseline rather than situational on this repo's own rule that a skill living only in the situational table goes unnoticed by projects that are not hunting for it — and not being reached is precisely what this one records — Maurits Visser, from a MOC/PSSR app replacement
+
 ## 2026-09-09
 - new(project-bin/page-fidelity.js): **`class="bound"` — the wireframe author saying "this text is a sample of bound data".** The scorer already had this concept and applied it structurally: `<td>` is excluded from the text corpus because a wireframe's table cells are sample ROWS and a page that correctly BINDS them contains none of that literal text. The same is true of a bound value anywhere else on the screen, and there the structure gives nothing away — an `<h1>` holding a record's number and name looks exactly like an `<h1>` holding page copy, and a chip holding a filename looks exactly like a chip holding a label. Measured on a MOC/PSSR app replacement's project detail page, 2026-09-09: **54%**, and all three misses were sample values the page could not contain — the record's own title, and a mocked attachment's filename, twice. The page was right; the denominator was wrong, and the number was about to be read off as a gate verdict. So the marker is **DECLARED, not guessed**: an element carrying `bound` leaves both the text corpus and the class denominator, and guessing was the alternative and does not work — a heading is bound or it is not, and only the person who drew the screen knows which. Put it on the smallest element that holds only the value (`<h1 class="bound">` leaves no heading behind; `<span class="bound">` inside a chip leaves the chip). Fixture grows to **18 assertions** including that a bound heading leaves the DENOMINATOR rather than merely stopping being reported as missed — otherwise the score would be 1 of 2 and still look clean. Known-bad control without the marker: **5 of 18 fail**. Same page scores 100% (3/3 headings, 2/2 content) with it — Maurits Visser, from a MOC/PSSR app replacement
 - process(bug-logs): BUG-114 filed upstream as mendixlabs/mxcli#1076 with BUG-118 as its second reproduction; both drafts and the ledger header stamped FILED — the toolkit merge queue
diff --git a/README.md b/README.md
index 81b0d74..5b69d1e 100644
--- a/README.md
+++ b/README.md
@@ -751,6 +751,7 @@ The "When to use which skill" table above is *situational* — load a skill when
 | Before calling any module tested — what testing a module means, and the false-green register of confirmed ways a test reports green over a broken feature | `skills/testing-shape.md` |
 | Finishing any module — before calling it done. One command that runs every instrument and keeps "instrument faulted" apart from "feature failed"; in a wired project run the installed copy at bin/verify-module.sh | `project-bin/verify-module.sh` |
 | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude | `skills/tool-output-is-not-ground-truth.md` |
+| A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget | `skills/learned-css-that-never-applied.md` |
 | Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones | `skills/learned-detection-gaps.md` |
 | Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it | `skills/security-is-not-a-later-script.md` |
 | A CE error or behavior that looks like a known mxcli quirk rather than a modeling mistake — `bin/bug-lookup.sh CE0117` / `BUG-102` / "keyword" prints the matching ledger entries, so the session reads one entry, not the 32k-word ledger | `bin/bug-lookup.sh` |
diff --git a/ROUTING.md b/ROUTING.md
index 59bc0e1..864ae66 100644
--- a/ROUTING.md
+++ b/ROUTING.md
@@ -115,6 +115,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | After drafting and again after exec'ing any page script — scores the page MDL (or `mxcli describe` output on stdin) against its wireframe: headings/actions/content/classes, weighted. The scored companion to check-page-shell's binary gate; 32% median measured without it, 90% first-draft with it. Every run is appended to the project's docs/PAGE-FIDELITY.tsv — first non-stub row per page = first-build score of record vs the ≥80% target (forward-reference stubs score with --stub, exempt) | `project-bin/page-fidelity.js` | mdl,gate,review | 5 | baseline |
 | Designing the brand and ONE ANNOTATED WIREFRAME PER SCREEN before building pages — the design system alone is half the deliverable | `skills/design-artifacts.md` | architect | 3 | ondemand |
 | Before a wireframe or a design commits to a WIDGET — and when a page script hits a parse error that looks like a syntax mistake: the short list of things MDL cannot write at all, and the four-minute probe that answers it at Stage 3 instead of at build time | `skills/learned-mdl-cannot-express.md` | architect,design,mdl | 3,5 | ondemand |
+| A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget | `skills/learned-css-that-never-applied.md` | mdl,review,gate | 5,6 | baseline |
 
 #### Build — the loop itself
 
diff --git a/agents/gate-agent.md b/agents/gate-agent.md
index 4488812..8ca43fd 100644
--- a/agents/gate-agent.md
+++ b/agents/gate-agent.md
@@ -38,6 +38,7 @@ own bug log before running anything you have not run here before.
 | `skills/testing-shape.md` | Before calling any module tested — what testing a module means, and the false-green register of confirmed ways a test reports green over a broken feature |
 | `project-bin/verify-module.sh` | Finishing any module — before calling it done. One command that runs every instrument and keeps "instrument faulted" apart from "feature failed"; in a wired project run the installed copy at bin/verify-module.sh |
 | `skills/tool-output-is-not-ground-truth.md` | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude |
+| `skills/learned-css-that-never-applied.md` | A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget |
 | `skills/learned-detection-gaps.md` | Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones |
 | `skills/security-is-not-a-later-script.md` | Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it |
 | `bin/bug-lookup.sh` | A CE error or behavior that looks like a known mxcli quirk rather than a modeling mistake — `bin/bug-lookup.sh CE0117` / `BUG-102` / "keyword" prints the matching ledger entries, so the session reads one entry, not the 32k-word ledger |
diff --git a/agents/mdl-agent.md b/agents/mdl-agent.md
index 22a202a..df88bc1 100644
--- a/agents/mdl-agent.md
+++ b/agents/mdl-agent.md
@@ -53,6 +53,7 @@ a rule below names an asset (e.g. "the wireframe", "the brief"), it means the pa
 | `skills/module-review.md` | Reviewing any module before calling it done — the ONE pass: build, gate, prove, LOOK (is it logical, does it look right, does it match our design, over every page not just the tested ones), confirm with the denominator stated |
 | `project-bin/verify-module.sh` | Finishing any module — before calling it done. One command that runs every instrument and keeps "instrument faulted" apart from "feature failed"; in a wired project run the installed copy at bin/verify-module.sh |
 | `skills/tool-output-is-not-ground-truth.md` | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude |
+| `skills/learned-css-that-never-applied.md` | A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget |
 | `skills/learned-detection-gaps.md` | Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones |
 | `skills/security-is-not-a-later-script.md` | Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it |
 | `bin/bug-lookup.sh` | A CE error or behavior that looks like a known mxcli quirk rather than a modeling mistake — `bin/bug-lookup.sh CE0117` / `BUG-102` / "keyword" prints the matching ledger entries, so the session reads one entry, not the 32k-word ledger |
diff --git a/agents/review-agent.md b/agents/review-agent.md
index 4e0ae40..db69929 100644
--- a/agents/review-agent.md
+++ b/agents/review-agent.md
@@ -47,6 +47,7 @@ protects: you have no Write or Edit tool, and you never run `mxcli exec`.
 | `skills/testing-shape.md` | Before calling any module tested — what testing a module means, and the false-green register of confirmed ways a test reports green over a broken feature |
 | `project-bin/verify-module.sh` | Finishing any module — before calling it done. One command that runs every instrument and keeps "instrument faulted" apart from "feature failed"; in a wired project run the installed copy at bin/verify-module.sh |
 | `skills/tool-output-is-not-ground-truth.md` | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude |
+| `skills/learned-css-that-never-applied.md` | A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget |
 | `skills/learned-detection-gaps.md` | Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones |
 | `skills/security-is-not-a-later-script.md` | Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it |
 | `bin/status.sh` | The first command of every session, and any time someone asks "where are we" or "what next" — one screen: stage, done/overdue, the ONE next action, from the instruments, never from memory |
diff --git a/bin/gate-check.sh b/bin/gate-check.sh
index 19f0d03..29bc84c 100755
--- a/bin/gate-check.sh
+++ b/bin/gate-check.sh
@@ -1497,8 +1497,8 @@ stage_protocol_paths() {
     2)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-brd.md skills/checkpoints/checkpoint-architecture.md skills/kb-generation.md skills/brd-generation.md skills/brd-validation.md" ;;
     3)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-design.md skills/architecture-blueprint.md skills/modularize-domain.md skills/design-artifacts.md skills/brd-to-build-plan.md skills/workflow-structure-rules.md skills/learned-mdl-cannot-express.md" ;;
     4)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-build.md skills/agent-roles.md skills/module-brief.md skills/module-folder-convention.md skills/brd-to-build-plan.md skills/coverage-ledger.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md" ;;
-    5|build-ready) echo "skills/interview-protocol.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/ui-preflight-pages.md skills/design-spacing.md skills/ui-loop.md skills/learned-stylegallery.md skills/learned-mcp-patterns.md skills/module-review.md skills/testing-shape.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/monkey-test.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md" ;;
-    6)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/monkey-test.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md" ;;
+    5|build-ready) echo "skills/interview-protocol.md skills/grill-mode.md skills/agent-roles.md skills/module-brief.md skills/learned-mdl-preflight.md skills/module-folder-convention.md skills/learned-microflow-patterns.md skills/ui-preflight-pages.md skills/design-spacing.md skills/ui-loop.md skills/learned-stylegallery.md skills/learned-mcp-patterns.md skills/module-review.md skills/testing-shape.md skills/iterative-build-loop.md skills/mdl-cookbook-microflows.md skills/build/mdl/oneshot-mdl-method.md skills/learned-page-patterns.md skills/oneshot-page-structure-patterns.md skills/mendix-agents.md skills/mendix-agent-ui.md skills/mendix-agent-setup.md skills/fixture-seeding.md skills/journey-proof.md skills/monkey-test.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/learned-workflow-patterns.md skills/workflow-structure-rules.md skills/rest-integration-first-time-right.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/learned-sidebar-collapse-icons.md skills/learned-popup-navigation.md skills/learned-datagrid-customcontent-binding.md skills/learned-popup-feedback-pattern.md skills/learned-mdl-cannot-express.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-dg2-patterns.md skills/security-is-not-a-later-script.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/preview-over-hub-tunnel.md skills/walking-skeleton.md skills/platform-link.md" ;;
+    6)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/module-review.md skills/testing-shape.md skills/existing-app-assurance.md skills/qa-loop-goal-pattern.md skills/mendix-agent-setup.md skills/e2e-harness-base.md skills/learned-db-assertions.md skills/fixture-seeding.md skills/journey-proof.md skills/monkey-test.md skills/learned-skill-ux-audit.md skills/learned-skill-scope-delta.md skills/report-schema.md skills/harness-architecture.md skills/process-coherence-pass.md skills/e2e-evidence-report.md skills/record-demo-video.md skills/lint-that-actually-runs.md skills/improvement-register.md skills/journey-examples.md skills/wiring-sweep.md skills/workflow-structure-rules.md skills/bug-submission-checklist.md skills/empty-widget-triage.md skills/anonymize-client-app-for-demo.md skills/learned-css-that-never-applied.md skills/learned-detection-gaps.md skills/learned-local-db-confusion.md skills/full-harness-audit.md skills/test-result-audit.md skills/finding-disposition.md skills/handoff-to-studio-pro.md skills/preview-over-hub-tunnel.md skills/platform-link.md" ;;
     7)  echo "skills/interview-protocol.md skills/grill-mode.md skills/checkpoints/checkpoint-template.md skills/checkpoints/checkpoint-cutover.md skills/close-the-loop.md skills/handoff-to-studio-pro.md skills/platform-link.md" ;;
     *)  echo "" ;;
 # <!-- ROUTING:END -->
diff --git a/bin/lib/skill-routing.tsv b/bin/lib/skill-routing.tsv
index fc70342..f96ff06 100644
--- a/bin/lib/skill-routing.tsv
+++ b/bin/lib/skill-routing.tsv
@@ -172,6 +172,7 @@ corpus-extraction-integrity	skills/corpus-extraction-integrity.md	Extracting str
 anonymize-client-app-for-demo	skills/anonymize-client-app-for-demo.md	Turning a client-derived Mendix app into a clean, shareable demo with zero client fingerprint — branding, data, custom widgets	mdl,review	6	ondemand	build
 field-run	skills/field-run.md	Driving the whole toolkit pipeline on a real source to find what the written skills don't say — the toolkit is the subject, not the app it builds	all	-	ondemand	diagnose
 learned-mdl-cannot-express	skills/learned-mdl-cannot-express.md	Before a wireframe or a design commits to a WIDGET — and when a page script hits a parse error that looks like a syntax mistake: the short list of things MDL cannot write at all, and the four-minute probe that answers it at Stage 3 instead of at build time	architect,design,mdl	3,5	ondemand	design
+learned-css-that-never-applied	skills/learned-css-that-never-applied.md	A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget	mdl,review,gate	5,6	baseline	design
 learned-detection-gaps	skills/learned-detection-gaps.md	Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones	mdl,gate,review	5,6	baseline	diagnose
 learned-dg2-patterns	skills/learned-dg2-patterns.md	Building or altering any data grid — native DATAGRID vs pluggable DG2 decision rule, the ALTER PAGE INSERT corruption, sort-by and filter-binding traps	mdl	5	ondemand	build/pages
 security-is-not-a-later-script	skills/security-is-not-a-later-script.md	Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it	mdl,gate,review	5	baseline	build/security
diff --git a/skills/conversion-runbook.md b/skills/conversion-runbook.md
index 9524d68..ecf30ec 100644
--- a/skills/conversion-runbook.md
+++ b/skills/conversion-runbook.md
@@ -45,6 +45,7 @@ table; a skill missing here is a skill no agent will find.
 | Before calling any module tested — what testing a module means, and the false-green register of confirmed ways a test reports green over a broken feature | `skills/testing-shape.md` |
 | Finishing any module — before calling it done. One command that runs every instrument and keeps "instrument faulted" apart from "feature failed"; in a wired project run the installed copy at bin/verify-module.sh | `project-bin/verify-module.sh` |
 | Any time an exit code, a tool's output or a subagent's report is about to become a stated finding — verify before you conclude | `skills/tool-output-is-not-ground-truth.md` |
+| A style change that appears to have done nothing, or an app still grey after a design port every instrument called green — the three ways a correct rule paints nothing (matches nothing / matches chrome / loses the cascade), the two reads that tell them apart, and the class that arrived in the stylesheet and is bound to no widget | `skills/learned-css-that-never-applied.md` |
 | Before trusting a green check/exec/DESCRIBE result as proof, or when a runtime symptom appears over a fully green model — the register of constructs that pass early rungs and fail later ones | `skills/learned-detection-gaps.md` |
 | Creating any entity, or calling a module security-ready — entity and grants land in one script, and ready means SHOW SECURITY MATRIX proves it | `skills/security-is-not-a-later-script.md` |
 | A CE error or behavior that looks like a known mxcli quirk rather than a modeling mistake — `bin/bug-lookup.sh CE0117` / `BUG-102` / "keyword" prints the matching ledger entries, so the session reads one entry, not the 32k-word ledger | `bin/bug-lookup.sh` |
diff --git a/skills/learned-css-that-never-applied.md b/skills/learned-css-that-never-applied.md
new file mode 100644
index 0000000..10d4118
--- /dev/null
+++ b/skills/learned-css-that-never-applied.md
@@ -0,0 +1,208 @@
+# A style change that did nothing — read the computed style before rewriting the rule
+
+**Applies to:** any mxcli project with a ported design system.
+**Runs:** the moment a CSS change appears to have had no effect on screen, or the app still looks
+unstyled/grey after a design port that every instrument called green.
+**Cost:** ninety seconds per read. It is meant to be run before you touch the rule, every time.
+
+---
+
+## The one-line finding
+
+A change-governance app (2026-09-10) went through two UI passes. The first shipped an app the
+user called "poor". The second, same person, same day, same design system: "much better." Nothing
+about the CSS authoring got better in between. What changed was the closing check:
+
+> **Pass 1 verified that the SCRIPT EXECUTED. Pass 2 verified that THE PIXEL CHANGED.**
+> Every green signal in pass 1 was true and irrelevant.
+
+`mx check` clean, `mxcli lint` clean, the MDL suite green, two e2e journeys green, the design port
+reporting its tokens correctly landed in the right file — over an app whose grid header was white
+on white, whose cards were all one colour, and whose entire table stylesheet had never matched a
+single element.
+
+This skill is the rung that was missing. It is not "look at a screenshot" (`ui-loop.md` already
+says that, and it is right). A screenshot tells you something is wrong; it does not tell you
+whether your rule matched nothing, matched too much, or matched and lost.
+
+---
+
+## The three ways a perfectly correct rule paints nothing
+
+All three were met in one field run. They look identical on screen and have opposite fixes.
+
+| # | Failure | What you see | What is actually true |
+|---|---|---|---|
+| 1 | **Matches nothing** | the element is unstyled | the selector names a DOM the app does not render |
+| 2 | **Matches too much** | something *else* broke | the selector names an ancestor shared with chrome |
+| 3 | **Matches, loses the cascade** | the element is unstyled | the framework outranks you and is actively erasing it |
+
+### 1. Matches nothing — three of four misses in one run
+
+`design/ds.css` styled `.ds-tablewrap` and `table.ds-table`. The design system's own showcase page
+is HTML, so it really does render a `<table>`. The app renders DataGrid2, whose row is a
+`<div class="tr">` and whose cell is a `<div class="td">` — **there is no `<table>` element on any
+page**. Not one table rule had ever applied: through the full design port, two build phases,
+mxbuild clean, lint clean, both journeys green. That is why the grid header was white on white.
+
+Then, styling the top bar, three selectors were guessed in one sitting — `.navbar`,
+`header.navbar`, `.mx-layoutgrid-fluid` — and all three matched zero elements. The bar stayed
+flat and the rule looked "ignored". The real carrier was `.mx-scrollcontainer-top.region-topbar`,
+and it was found in one read of the live element chain, not by a fourth guess.
+
+> `project-bin/check-design-portability.sh` catches the `table`/`th`/`td` case statically and
+> should be run before porting. It cannot catch the guessed-carrier case, because
+> `.navbar` is a perfectly plausible class name — it just isn't this app's.
+
+### 2. Matches too much — the widened guess
+
+A page-ground rule `.mx-page { background: var(--bg) }` was added so white cards would stop
+sitting on white. The navigation bar lives inside that container, so it was painted too: white
+menu text on a now-white bar, an **invisible top nav**. Reverted after a screenshot.
+
+The instinct after failure 1 is to widen the selector until something matches. This is what that
+costs. A rule that paints nothing is visible in one screenshot; a rule that paints chrome is
+visible in one screenshot *of a different page*, which is how it ships.
+
+### 3. Matches, loses the cascade — and source order never got a say
+
+`.mx-listview-empty` named exactly the right element. It sat roughly **eleven thousand lines
+after** Atlas in the compiled sheet. It still lost, because Atlas ships:
+
+```css
+.mx-listview > ul .mx-listview-empty { border-style: none; background-color: transparent; }
+```
+
+That is **0,2,1** against a bare class's **0,1,0**. Specificity is decided before source order is
+consulted, so "mine is later" was never relevant. The fix was `.mx-listview > ul > li.mx-listview-empty`
+— **0,2,2**, one extra element and one extra class. No `!important`.
+
+**The general fact, which is worse than "the framework also styles this":** Atlas *erases*.
+`border-style: none; background-color: transparent` is not a default it forgot to remove — it is
+the framework deliberately blanking that element. A rule you add without outranking it is not
+"competing", it is being deleted.
+
+---
+
+## The diagnostic — two reads, before you touch the rule
+
+Run against the app that is actually running, as a real user role, on the page in question.
+
+**Rung A — what is this element's computed value, really?**
+
+```js
+const el = page.locator('<selector for the element you meant to style>').first();
+console.log(await el.evaluate(e => getComputedStyle(e).backgroundColor
+                                 + ' | ' + getComputedStyle(e).borderStyle));
+```
+
+**Rung B — only if Rung A found nothing: what IS the element chain?**
+Do not guess a second selector. Read the real one.
+
+```js
+const chain = await page.evaluate(() => {
+  const n = [...document.querySelectorAll('*')]
+    .find(e => e.children.length === 0 && e.textContent.trim() === '<visible text on the element>');
+  if (!n) return 'not found';
+  const out = [];
+  for (let e = n; e && out.length < 6; e = e.parentElement)
+    out.push(e.tagName + '.' + [...e.classList].join('.'));
+  return out;
+});
+console.log(JSON.stringify(chain, null, 1));
+```
+
+That printed, verbatim, on the field run:
+
+```
+["LABEL.", "LI.mx-listview-empty", "UL.",
+ "DIV.mx-listview.mx-name-lvSupportingDocument",
+ "DIV.mx-name-cardFileBody.ds-cardbody",
+ "DIV.mx-name-cardFile.ds-card.ds-section"]
+```
+
+— which names the carrier, names its ancestors (so you can write a `>` chain that outranks the
+framework), and shows your own `ds-*` classes are present two levels up, all in one read.
+
+**Then decide from what Rung A returned. The three answers have three different fixes:**
+
+| Rung A returned | Diagnosis | Fix |
+|---|---|---|
+| **your** value | the rule applied — your value is wrong | a design decision, not a CSS bug. Change the value. |
+| the **framework's** value | cascade loss (#3) | find the framework's selector in the compiled sheet, count its specificity, outrank it |
+| **element not found** | matches nothing (#1) | Rung B, then rewrite the selector to the real carrier |
+| your value, and *something else* also changed | matches too much (#2) | narrow to the content region; never leave it widened |
+
+**Never rewrite a rule that "does nothing" before Rung A.** Three of the four field misses were
+guessed selectors and the fourth was a cascade loss — a blind rewrite would have been the wrong
+move in all four, and in one case (#2) the rewrite *was* the outage.
+
+---
+
+## Close every claim with a computed-style read
+
+The rule that produced the second pass, stated as a completion criterion with a denominator:
+
+> **Every component class a pass claims to have shipped has at least one computed-style read
+> against a named element in the running app, or is reported as unverified. State it as
+> "N of M classes verified". "The script exited 0" is not a read, and "it looks right" is not a
+> read.**
+
+What that looked like on the field run — each of these is a line in the commit that shipped it,
+not a note in a doc:
+
+| Claim | The read that closed it |
+|---|---|
+| cards carry status tone | `rgb(255,250,240)`, left edge `rgb(184,121,10)`, **10 of 10 cards** |
+| card header bands bleed to the card edge | computed `padding: 0px` |
+| empty states are no longer white voids | `rgb(241,241,244)`, `dashed` |
+| the top bar has the deep-red gradient | `linear-gradient(rgb(212,36,23), rgb(168,20,16))` |
+| a rejected row outranks an awaiting one | project 859 `rgb(254,246,245)`, project 861 `rgb(255,250,240)` |
+
+The last row is the one that justifies the discipline. Row tone was implemented, screenshotted,
+and *looked* fine — and was wrong: a rejected project was rendering amber, because a row carrying
+two status cells matched two rules at equal specificity and the last one written won. The eye
+read "coloured rows, good". Two computed-style reads named the defect and the precedence order
+that fixed it. **Nothing but a value read would have caught that**, and it is exactly the class of
+error a customer notices first.
+
+---
+
+## Before any of this: the class that arrived and nobody used
+
+`project-bin/check-design-reaches-app.sh` counts how many component classes **arrived** in the
+built stylesheet. It cannot see a class that arrived perfectly and is bound to no widget.
+
+On the field run, at the moment the user said the UI was poor, `ds.css` already contained four
+complete semantic tint sets, a five-step elevation scale and a styled empty state. Every one of
+them was correct. Every one of them was referenced by **zero widgets**. The design system was
+finished and the app was grey.
+
+No CSS instrument can see this, because nothing is wrong with the CSS.
+
+> **Measure it as a ratio, not a list: of the M component classes defined in `ds.css`, how many
+> have at least one carrier in the model?** Get the M from the stylesheet and the carriers from
+> the model (`mxcli` catalog/`DESCRIBE`, or a grep of the executed MDL for `Class:` and
+> `DynamicClasses:`). Report "N of M classes have a carrier". A zero-carrier class is a finding,
+> and the fix is never to rewrite it — **it is to bind it.**
+
+Three of the five improvements the user reacted to were pure binding of CSS that had been sitting
+in the file, unreferenced, the whole time.
+
+---
+
+## Related
+
+- `ui-loop.md` — the per-script look. Tells you *that* a page is wrong. This skill starts where
+  that ends: which of the three failures you have, and what the value actually is.
+- `project-bin/check-design-portability.sh` — the static half of failure #1 (`table`/`th`/`td`,
+  `rem`, positional `nth-child`). Run before porting. Cannot see a guessed carrier.
+- `project-bin/check-design-reaches-app.sh` — did the tokens and classes reach the built sheet.
+  Necessary, and blind to the zero-carrier case above.
+- `learned-stylegallery.md` § "The Mendix DOM contract" / § "Every class states its carrier" —
+  the authoring-time counterpart: state a class's intended carrier when you write it, and this
+  whole diagnostic is needed less often.
+- `learned-mdl-cannot-express.md` § "When MDL cannot set a class, CSS often can" — the positive
+  pattern that came out of the same run.
+- `learned-detection-gaps.md` — the register this belongs to: constructs that pass every early
+  rung and fail at the last one.
diff --git a/skills/learned-mdl-cannot-express.md b/skills/learned-mdl-cannot-express.md
index 984163b..abf6270 100644
--- a/skills/learned-mdl-cannot-express.md
+++ b/skills/learned-mdl-cannot-express.md
@@ -97,8 +97,57 @@ Three rules for the blocked case:
    validation, storage, access checks, the file bytes actually in Mendix's file store. Recording
    "blocked" without that reads as "not started", and the next person rebuilds it.
 
+## When MDL cannot set a class, CSS often can — check before you go looking for the property
+
+Added 2026-09-10 from a change-governance app's UI pass. It is a positive recipe, not a
+prohibition, because the failure it retires is a *shape* failure: the work stops at "MDL has no
+such property" when the requirement was never really about MDL.
+
+A UI spec asked for per-row status tone on three grids and prescribed `DynamicRowClass` on the
+datagrid. **There is no such property** — not in MDL, not in Studio Pro. The item had been
+written months earlier against an imagined API and carried as an `M`-sized MDL task ever since
+(this is the same defect as an instrument built against imagined input; see the toolkit
+`CLAUDE.md` field-proof rules — probe first).
+
+The requirement was still met, with **zero MDL**, because of a fact worth generalising:
+
+> **Whatever class MDL *can* bind is a hook the stylesheet can read from anywhere in that
+> element's subtree.** `:has()` turns a child's class into a parent's selector.
+
+Every one of those grids already bound a per-cell class to its status column —
+`DynamicCellClass: 'ds-statecell ds-statecell--<state>'`, MDL that was in the model and working.
+So the row rule is:
+
+```css
+.ds-grid .table .tr:has(.ds-statecell--rejected) > .td { background: var(--surface-blocked); }
+```
+
+Three pages picked up row tone from MDL already present, with no script, no exec, no gate run.
+The same move fixed a second item in the same pass: a card's header band could not be made to
+bleed to the card edge, because `.ds-card > .ds-cardhead` is unwriteable from a page (a Mendix
+class lands on its own element only) — `.ds-card:has(> .ds-cardhead) { padding: 0 }` says it.
+
+**Before recording an MDL styling task as blocked or M-sized, ask the two questions in order:**
+
+1. Does the property exist at all? (`./mxcli syntax page.widgets`, then the probe above — do not
+   trust a spec that names one.)
+2. Is there **any** class MDL can already bind on, or inside, the element I want to style? If
+   yes, `:has()` / `>` / sibling selectors reach it from CSS and the MDL task disappears.
+
+Two caveats, both cheap:
+
+- **Source order inside your own rule set becomes load-bearing.** An element can match several
+  of these at equal specificity, and the last one written wins. On the field run a row carried
+  two status cells (two tracks), so a rejected project rendered amber until the rules were
+  reordered weakest-claim-first. Order them deliberately and say so in a comment.
+- **Degradation is silent and benign**: where `:has()` is unsupported the selector simply never
+  matches and you get today's appearance. Verify with a computed-style read, not by eye —
+  `learned-css-that-never-applied.md`.
+
 ## Related
 
+- `learned-css-that-never-applied.md` — the companion diagnosis: the rule above is only worth
+  writing if you then confirm it *matched*. Same field run.
 - `learned-detection-gaps.md` — the register of things that pass a rung and fail later; the
   `item …` parse-then-exec-fail case is one of its shapes.
 - `learned-mcp-patterns.md` — CLI, MCP and hand-rolled are **three co-equal write modes**. Every

From 74f4b6f6bafe697bae4946e1fdcb5688a87bb741 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 02:09:54 +0000
Subject: [PATCH 4/4] =?UTF-8?q?fix:=20lift=20the=20marketplace-install=20S?=
 =?UTF-8?q?TOP=20=E2=80=94=20#879=20was=20fixed=20upstream=20in=20v0.21.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This toolkit told four days of sessions that `mxcli marketplace install` would
corrupt their project. It stopped being true on 2026-09-06.

mendixlabs/mxcli#879 is closed in v0.21.0. Install no longer shells out to
`mx module-import`; it copies the module's units with mxcli's own writer, so
MPR v2 survives. The destructive path is opt-in behind --allow-format-change,
so the corruption can now only be produced deliberately.

Re-probed 2026-09-10 on a real 501-unit split-model project, four modules:

  501 -> 1075 .mxunit files     split format preserved
  .mpr 84 KB -> 156 KB          an index, not the 35 MB blob #879 produced
  native mxbuild                0 errors
  app boots; two e2e journeys unchanged (33/33, 12/12)

The cost of not re-probing is the finding here, not a footnote. The project
that found the fix carried "marketplace install is BLOCKED, needs a human in
Studio Pro" in its register for four days after it stopped being true — with
both .mpk files already downloaded and sitting in the project root the whole
time, because the blocker was never the download. retesting-learned-rules.md
exists for exactly this and nobody ran it. A STOP is a claim about a binary
version, and it expires.

So the entry now also carries the zero-risk way to re-probe a formerly
corrupting command on a REAL project, which is reusable well beyond this bug:
git clone --depth 1 file://$(pwd) into a scratch dir, install into the clone,
count .mxunit and run mx check there, decide from the measurement. Cheaper
than the documented recovery, and it answers what a changelog cannot.

The ledger entry is retitled RESOLVED with the old content kept verbatim below
a HISTORICAL RECORD heading, and the superseded prevention rule marked as
applying to v0.20.0 and earlier rather than deleted — a ledger entry that
vanishes reads as a bug never found, and projects pinned to older binaries
still need it.

THREE NEW TRAPS REPLACED THE OLD ONE. All live on v0.21.0, none self-announcing:

1. Marketplace packages do not carry their dependencies, and the failure does
   not say "module missing" — it says 406 individual CE1613 element errors.
   The entry carries the aggregation one-liner that turns that wall into a
   shopping list. Email Connector 6.4.3's closure is MxModelReflection +
   Encryption + CommunityCommons, which checks at 0 errors.

2. The two `mxcli fix` repairs the installer prints are mandatory, not
   advisory: 128 units and 12 units changed on the confirming run. Both
   subcommands exist precisely because Mendix's own tools would collapse
   MPR v2 without them.

3. A bundled widget can silently fail to land, and the installer cannot
   self-repair it. widgets/RichText.mpk landed on the probe and not on the
   real run — 33 widgets against 34, 3 x CE0462 over an otherwise clean model
   — and a re-run refuses with "already installed". Repair is to unzip it out
   of the .mpk the installer already downloaded. Count widgets/ before and
   after every install.

One thing genuinely still needs Studio Pro, and it is now scoped rather than
assumed: SAML + UserCommons install cleanly but leave CE0066 ("Entity access
is out of date"). There is no `mxcli fix security`, and forcing the recompute
with an MDL GRANT was tried and does not clear it.

bug-lookup.sh 879 now leads with the fix rather than the STOP.
render-routing.sh --check: surfaces in sync.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jj5uvTmmcBQT8Uu3asm21M
---
 CHANGELOG.md                    |   1 +
 bug-logs/mxcli-bugs.md          | 101 +++++++++++++++++++++++++++++++-
 skills/learned-mdl-preflight.md |   3 +-
 3 files changed, 102 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c76aa00..2f413d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Kinds: `new` · `fix` · `learn` (a skill/learning) · `process` (rules, templat
 Credit the person or project that surfaced the change — the credit line is the thank-you.
 
 ## 2026-09-10
+- fix(bug-logs/mxcli-bugs, learned-mdl-preflight): **the `marketplace install` STOP (#879) is LIFTED — fixed upstream in v0.21.0, and this toolkit told four days of sessions otherwise.** Install no longer shells out to `mx module-import`; it copies units with mxcli's own writer and MPR v2 survives, with the destructive path now opt-in behind `--allow-format-change` so the corruption can only be produced deliberately. Re-probed 2026-09-10 on a real 501-unit split-model project: **501 → 1075 `.mxunit`, `.mpr` 84 KB → 156 KB** (an index, not the 35 MB blob this bug used to produce), native mxbuild **0 errors**, app boots, two e2e journeys unchanged. **The cost of not re-probing is the finding, not a footnote:** v0.21.0 shipped 2026-09-06 and the project carried *"marketplace install is BLOCKED, needs a human in Studio Pro"* in its register until 2026-09-10 — with both `.mpk` files already downloaded and sitting in the project root the whole time, because the blocker was never the download. `retesting-learned-rules.md` exists for exactly this and nobody ran it; **a STOP is a claim about a binary version and it expires.** Also records the zero-risk way to re-probe a formerly-corrupting command on a real project — `git clone --depth 1 file://$(pwd) /tmp/probe`, install into the clone, count `.mxunit` and run `mx check` there, decide from the measurement — which is cheaper than the documented recovery and answers what a changelog cannot. **Three new traps replaced the old one, all live on v0.21.0 and none self-announcing:** (1) marketplace packages **do not carry their dependencies**, and the failure is not "module missing" but 406 individual `CE1613` element errors — the aggregation one-liner that turns that wall into a shopping list is in the entry, and the closure for Email Connector 6.4.3 is MxModelReflection + Encryption + CommunityCommons, which checks at 0; (2) the two `mxcli fix` repairs the installer prints are **mandatory, not advisory** — 128 units and 12 units changed on the confirming run, and both exist precisely because Mendix's own tools would collapse MPR v2 without them; (3) a **bundled widget can silently fail to land and the installer cannot self-repair it** — `widgets/RichText.mpk` landed on the probe and not on the real run (33 vs 34 widgets, 3 × CE0462 over an otherwise clean model), a re-run refuses with *"already installed"*, and the repair is to `unzip -o -j` it out of the `.mpk` the installer already downloaded, so **count `widgets/` before and after every install**. One thing genuinely still needs Studio Pro and is now scoped rather than assumed: SAML + UserCommons install cleanly but leave `CE0066` ("Entity access is out of date"), there is no `mxcli fix security`, and an MDL `GRANT` was tried and does not clear it — Maurits Visser, from a MOC/PSSR app replacement
 - learn(learned-css-that-never-applied): **the difference between a UI the user called "poor" and one they called "much better", same day, same design system, was that the first pass verified the SCRIPT EXECUTED and the second verified THE PIXEL CHANGED.** Everything green in the first pass was true and irrelevant. Three ways a perfectly correct rule paints nothing, all three met in one field run on a MOC/PSSR app replacement, 2026-09-10: **(1) matches nothing** — `ds.css` styled `.ds-tablewrap`/`table.ds-table`, but DataGrid2 renders a row as `<div class="tr">` and there is no `<table>` on any page, so not one table rule had EVER applied, through a full design port, two build phases, mxbuild clean, lint clean and two journeys green; and three top-bar selectors (`.navbar`, `header.navbar`, `.mx-layoutgrid-fluid`) were guessed in one sitting and all three matched zero elements, where one read of the live element chain named the real carrier `.mx-scrollcontainer-top.region-topbar`. **(2) matches too much** — the instinct after (1) is to widen, and `.mx-page { background }` painted the nav bar with it: white menu text on a white bar, an invisible top nav. **(3) matches and loses the cascade** — `.mx-listview-empty` named exactly the right element, sat ~11,000 lines after Atlas in the compiled sheet, and still lost: Atlas ships `.mx-listview > ul .mx-listview-empty { border-style: none; background-color: transparent }` at **0,2,1** against a bare class's **0,1,0**, so source order was never consulted; and that declaration means Atlas is *erasing* the element, not merely failing to style it. The diagnostic is two reads before you touch the rule — computed style, then (only if not found) a six-level `parentElement` walk printing tagName+classList — and the three possible answers have three different fixes, so **a blind rewrite would have been wrong in all four field misses, and in case (2) the rewrite WAS the outage**. Completion criterion carries a denominator: *every component class a pass claims to have shipped has one computed-style read against a named element in the running app, or is reported unverified* — the run that justifies it had row tone implemented, screenshotted and **looking fine while rendering a rejected project amber**, caught only by reading two values. Also records the check that comes first and no CSS instrument can see, because nothing is wrong with the CSS: `check-design-reaches-app.sh` counts classes that ARRIVED in the built sheet, and at the moment the user called the UI poor, four complete semantic tint sets, a five-step elevation scale and a styled empty state were all present, all correct, and referenced by **zero widgets** — the design system was finished and the app was grey. Measure it as *N of M component classes have at least one carrier in the model*; the fix for a zero-carrier class is never to rewrite it, it is to bind it. Three of the five improvements the user reacted to were pure binding of CSS already sitting in the file — Maurits Visser, from a MOC/PSSR app replacement
 - learn(learned-mdl-cannot-express): **when MDL cannot set a class, CSS usually can — check before you go looking for the property.** A UI spec carried per-row status tone on three grids as an `M`-sized MDL task prescribing `DynamicRowClass`, a property that exists in neither MDL nor Studio Pro; it had been written months earlier against an imagined API, the same defect as an instrument built against imagined input. The requirement was met with **zero MDL**, because whatever class MDL *can* bind is a hook the stylesheet reads from anywhere in that element's subtree: every grid already bound `DynamicCellClass: 'ds-statecell ds-statecell--<state>'`, so `.tr:has(.ds-statecell--rejected) > .td` gave three pages row tone with no script, no exec and no gate run. Same move fixed a second item the same day — `.ds-card > .ds-cardhead` is unwriteable from a page because a Mendix class lands on its own element only, and `.ds-card:has(> .ds-cardhead) { padding: 0 }` says it. Two caveats: **source order inside your own rule set becomes load-bearing** (an overview row carries two status cells, matched several rules at equal specificity, and rendered a rejected project amber until the rules were reordered weakest-claim-first), and degradation where `:has()` is unsupported is silent and benign — the selector never matches and you get today's appearance, which is why it must be confirmed by value read and not by eye — Maurits Visser, from a MOC/PSSR app replacement
 - process(skill-routing): `learned-css-that-never-applied` routed **baseline** for mdl/review/gate at stages 5–6, trigger-phrased on *"a style change that appears to have done nothing, or an app still grey after a design port every instrument called green"*. Baseline rather than situational on this repo's own rule that a skill living only in the situational table goes unnoticed by projects that are not hunting for it — and not being reached is precisely what this one records — Maurits Visser, from a MOC/PSSR app replacement
diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md
index a850f97..ed9cfbc 100644
--- a/bug-logs/mxcli-bugs.md
+++ b/bug-logs/mxcli-bugs.md
@@ -960,7 +960,100 @@ Then in Studio Pro: **App → Import module package →** select that `.mpk`. St
 
 ---
 
-## 🚨 CRITICAL: `mxcli marketplace install` collapses a split-model project to monolithic `.mpr` and deletes `mprcontents/` — breaks Studio Pro
+## ✅ RESOLVED v0.21.0 (was CRITICAL): `mxcli marketplace install` collapsed a split-model project to monolithic `.mpr` and deleted `mprcontents/`
+
+> **STATUS: FIXED UPSTREAM — https://github.com/mendixlabs/mxcli/issues/879 closed in v0.21.0.
+> Re-probed and confirmed 2026-09-10 on a real 501-unit split-model project. The STOP in
+> `skills/learned-mdl-preflight.md` is LIFTED.**
+>
+> `marketplace install` no longer shells out to `mx module-import`. It copies the module's units
+> with mxcli's own writer, so MPR v2 survives; the old destructive path is now **opt-in behind
+> `--allow-format-change`**, meaning the corruption below can only be produced deliberately.
+> mxcli's own help states it: *"A module is installed by copying its units with mxcli's own writer
+> rather than by running 'mx module-import'. That preserves the project's storage format."*
+>
+> **Measured on the confirming run** (change-governance app, mxcli v0.21.0, Mendix 11.14.0,
+> four modules installed): 501 → 1075 `.mxunit` files, `.mpr` 84 KB → **156 KB** — an index, not the
+> 35 MB blob this bug used to produce — native mxbuild **0 errors**, app boots, two e2e journeys
+> (33/33 and 12/12) unchanged.
+>
+> **The cost of not re-probing.** v0.21.0 shipped 2026-09-06. The project that found this fix was
+> still routing around the bug on 2026-09-10 and had carried "marketplace install is BLOCKED, needs
+> a human in Studio Pro" in its register for four days after it stopped being true — with both
+> `.mpk` files already downloaded and sitting in the project root the whole time. Nobody ran
+> `skills/retesting-learned-rules.md`, which exists for precisely this. **A STOP is a claim about a
+> binary version, and it expires.** Re-probe every STOP that costs a detour after any version bump.
+>
+> **How to re-probe an install safely, at zero risk** — the pattern that made it reasonable to test
+> a formerly-corrupting operation headlessly on a real project, and worth reusing for any
+> destructive-suspect command:
+>
+> ```bash
+> git clone --depth 1 file://$(pwd) /tmp/probe        # exact copy of the model, ~seconds
+> ./mxcli marketplace install <id> -p /tmp/probe/<app>.mpr
+> find /tmp/probe/mprcontents -name '*.mxunit' | wc -l   # vs the original count
+> ~/.mxcli/mxbuild/<ver>/modeler/mx check /tmp/probe/<app>.mpr
+> ```
+>
+> Measure on the clone, decide from the measurement, then do it for real. This is cheaper than the
+> recovery below and it answers the question the changelog cannot.
+
+---
+
+### THREE NEW TRAPS REPLACED THE OLD ONE (all found 2026-09-10, all still live on v0.21.0)
+
+The format corruption is gone. These are what actually bite now, and none of them announces itself.
+
+**1. Marketplace packages DO NOT carry their dependencies, and the error does not name them as
+missing modules — it names hundreds of individual elements.** Installing Email Connector 6.4.3 +
+SAML 4.2.3 alone produced **406 errors**, every one a `CE1613 "... no longer exists"`. Aggregating
+the referenced prefixes is what turns that wall into a shopping list:
+
+```bash
+mx check <app>.mpr 2>&1 | grep -oE "'[A-Za-z]+\.[A-Za-z_]+" | cut -d"'" -f2 | cut -d. -f1 \
+  | sort | uniq -c | sort -rn
+#  247 MxModelReflection   121 UserCommons   26 Encryption   12 CommunityCommons
+```
+
+Install the dependencies FIRST, then the module. For Email Connector 6.4.3 the closure is
+**MxModelReflection (69), Encryption (1011), CommunityCommons (170)** — that combination checks at
+**0 errors**. SAML 4.2.3 additionally pulls **UserCommons (223053)**.
+
+**2. The two `mxcli fix` repairs the installer prints are MANDATORY, not advisory.** The install
+output ends with *"Next, repair what a headless install leaves for Studio Pro to finish"* and it
+means it — on the confirming run `mxcli fix widgets` changed **128 units** (CE0463) and
+`mxcli fix design-properties` changed **12** (CE6087). Both preserve MPR v2 (they restore the split
+format after running Mendix's own tool, which would otherwise collapse it — that is the whole
+reason these subcommands exist). Skipping them leaves errors that look like the module is broken.
+
+**3. A bundled widget can silently fail to land, and the installer CANNOT self-repair it.** On the
+confirming run `widgets/RichText.mpk` (shipped inside the Email Connector package, 1 040 352 bytes)
+landed on the throwaway probe and **not** on the real project — 33 widgets against the probe's 34 —
+giving 3 × `CE0462 "Could not find widget 'Rich Text' in the 'widgets' directory"` over an otherwise
+clean model. Re-running the install does not fix it: it refuses with *"Module is already installed
+… In-place module updates are not applied automatically"*. The repair is to pull the file out of
+the `.mpk` the installer already downloaded:
+
+```bash
+ls widgets/ | wc -l                                    # BEFORE the install
+unzip -l <Module>.mpk | grep widgets/                  # what it should have written
+unzip -o -j <Module>.mpk "widgets/<Widget>.mpk" -d widgets/
+./mxcli fix widgets -p <app>.mpr
+```
+
+**Count `widgets/` before and after every install.** A missing bundled widget is indistinguishable
+from a broken module if you only read the error.
+
+**4. One thing genuinely still needs Studio Pro.** SAML 4.2.3 + UserCommons install cleanly and
+leave exactly one error: `CE0066 "Entity access is out of date. Please update security by clicking
+the 'Update security' button in the domain model editor"` on the UserCommons domain model. There is
+no `mxcli fix security`, and forcing a recompute with an MDL `GRANT` on a UserCommons entity was
+tried and **does not clear it**. Plan that module for a Studio Pro session; do not install it into a
+project that must stay buildable headlessly in the meantime.
+
+---
+
+### HISTORICAL RECORD (the bug as it was, kept because a ledger entry that vanishes reads as a bug never found)
 
 **FILED — https://github.com/mendixlabs/mxcli/issues/879 (2026-08-13).** Independently
 reconfirmed twice before filing: on PROJECT-F (mxcli v0.17.0, mxbuild/Studio Pro 11.13.0, real
@@ -994,7 +1087,11 @@ Cause: git tracked 369 `mprcontents/*.mxunit` that vanished + a 49 MB binary `.m
 ### Why it matters beyond SP
 The entire toolkit workflow assumes split format: mxcli's own MDL exec writes *into* `mprcontents/`, `exec.sh` commits `mprcontents/`, BUG-19 recovery does `git checkout HEAD -- mprcontents/`. A monolithic `.mpr` is off-workflow. **Normal `mxcli exec` (MDL) preserves the split format; only `marketplace install` / `mx module-import` collapses it.**
 
-### Prevention (the rule)
+### Prevention (the rule) — SUPERSEDED, applies to v0.20.0 and earlier ONLY
+> On v0.21.0+ this rule is retired; see the RESOLVED banner at the top of this entry. It is kept
+> verbatim for projects pinned to an older binary, and because the reasoning is what the fix
+> preserved.
+
 **On a split-model project (has an `mprcontents/` dir), do NOT use `mxcli marketplace install`.** Import marketplace modules through **Studio Pro** (Marketplace panel, or App → Import module package), which preserves `mprcontents/`. Reserve mxcli for MDL exec only.
 - Safe to use `mxcli marketplace download <id>` (writes a `.mpk` to disk, touches nothing in the model) — then GUI-import that `.mpk`.
 - Detection before it bites: if `find mprcontents -name '*.mxunit' | wc -l` drops to 0 and the `.mpr` balloons to MBs after an install, you hit this.
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index a2c7f19..a08942c 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -10,7 +10,8 @@
 - **Rule 17 (uppercase `AND`/`OR` + `!=`) is resolved** — builds at 0 errors; keep the lowercase habit only for projects pinned to older binaries.
 - **Rule 1c's class (ALTER PAGE `SET Editable`/conditional settings) is resolved** — `SET Editable = [expr] ON widget` stores correctly and the project loads.
 - **ALTER PAGE now requires the braced block form** `ALTER PAGE Mod.Page { SET … ON w; };` — the old flat `alter page X set … on w;` is a parse error. DataGrid2 columns are addressed by **derived** name (bound attribute, else caption — MDL-WIDGET16), and a bare column name in REPLACE is refused in favour of `grid.column`.
-- **Still corrupting, STOP stays:** workflow `DECISION` activities (BUG-76 — project unloadable, `EnumerationValueIdentifier`), and `marketplace install` on a split-model project (#879, unfixed in v0.19/v0.20).
+- **Still corrupting, STOP stays:** workflow `DECISION` activities (BUG-76 — project unloadable, `EnumerationValueIdentifier`).
+- ~~`marketplace install` on a split-model project (#879)~~ — **RESOLVED in v0.21.0, STOP LIFTED (probed 2026-09-10).** Install no longer shells out to `mx module-import`; it copies units with mxcli's own writer and MPR v2 survives. The destructive path is now opt-in behind `--allow-format-change`, so the failure can only happen on purpose. Measured on a real 501-unit project: 501 → 1075 `.mxunit`, `.mpr` 84 KB → 156 KB (an index, not the 35 MB blob #879 produced), native mxbuild **0 errors**. **Read `bug-logs/mxcli-bugs.md` → the #879 entry before your first install** — the corruption is gone, and three *new* operational traps replaced it (packages do not carry their dependencies; two `mxcli fix` repairs are mandatory, not advisory; a bundled widget can silently fail to land and the installer cannot self-repair it).
 - The 10–12-writes-per-session cap from BUG-97 is downgraded to snapshot-plus-read-back: 16 sequential writes were clean on v0.20.0.
 - **Rule 2 (settings/security-level writes) is resolved** — probe-verified 2026-08-31: `alter project security level production`, `alter project security demo users on`, `alter project security guest access off` (guest access is new v0.19 surface — anonymous access was previously read-only), `alter settings model FirstDayOfWeek = Monday` and `alter settings configuration … HttpPortNumber` all land, read back, and cold-load at 0 errors. **Project security setup is now a scriptable project-start step, not an end-of-build Studio Pro chore** — see `brd-to-build-plan.md` Step 5's scaffold row.