ask 5: always run exec.sh, and what that does to guards, containers and the MCP path #69

What Studio needs

Every script run through project-bin/exec.sh, so every change to the model leaves a structured row instead of some runs being invisible.

Blast radius

Rating: changes existing behaviour. This is the riskiest of the nine and should go last.

The file format does not change, but what agents are allowed to do does. Raw mxcli exec writes a row unconditionally. exec.sh refuses or degrades in several cases, all of them real:

• Uncommitted model changes are refused before log_build is even defined, so a refused exec writes no row at all. An agent loop that does not commit per script gets refusals, not rows, and Studio shows "Not recorded".
• A Studio Pro lock, or a concurrent mxcli exec, refuse the same way.
• MxBuild not found makes find_mxbuild() return 1 and the gate column becomes skipped. In a Linux container without MxBuild, every row reads applied, UNVERIFIED. Studio's rung 2 would then be amber for the whole run, done-drift-check would never propose a done- rename because it excludes UNVERIFIED, and "always exec.sh" would look like a regression to the person using it.
• The --mcp write path has no exec.sh equivalent, and skills/learned-mdl-preflight.md prescribes it for iterative UI refinement. So "always" either bans MCP refinement or leaves it unrecorded.

The predictable human failure: an agent hits the uncommitted model guard mid loop, reaches for FORCE_EXEC=1 to keep going, and the guard that protects the MPR is now routinely bypassed.

Constraints if it goes ahead

• Do not touch the guards or the row format. The exec table is parsed by proof.ts parseExecRows, bin/status.sh, project-bin/done-drift-check.sh and pinned by tests/wave2/test-bug07-08.sh. Older project copies write a four column table that Studio's parser already does not match.
• Make "always" a routing and prompt rule in skills/iterative-build-loop.md and agents/mdl-agent.md, not a refusal inside the script. One PR, since both are stage mapped.
• Tell agents explicitly what to do when a guard fires: commit, wait, or stop and report. Never FORCE_EXEC by default.

Decision needed

1. Does the --mcp write path stay allowed, and if so is it accepted as unrecorded?
2. Must the agent commit before every exec, so the uncommitted model guard never fires?
3. Is gate=skipped acceptable in containers, or should find_mxbuild learn a container path first?
4. Which existing projects get --upgrade-bin exec.sh? It is reported as locally modified in every project on this machine.