[MendixMau]

Direct lane

What changed and why (one paragraph):
When a document is created by several mdlsource/ scripts, re-running an older one silently reverted the newer one's work: exit 0, every gate green (#269). Three field apps had 99/579, 130/357 and 38/159 such documents. New project-bin/script-owners.sh maps each microflow, nanoflow, page and snippet to the scripts that create or restate it, in run order, and reads -- supersedes: / -- superseded-by: headers. Run order compares digit runs as numbers, so 2-core/ runs before 11-fixes/ and 9-a before 10-b; a leading done- is ignored. exec.sh records every kept write in a machine-local last-writer ledger, and restore-mpr.sh marks the ledger when it restores. Before a write, exec.sh prints:

• WARN (also in the BUILD-LOG detail) only when the script would revert a newer owner's write that is live;
• one NOTE line (not in BUILD-LOG) the first time a new owner restates a document an older script owns without a -- supersedes: header;
• nothing when neither script has ever run on this machine (the script is new).

It never refuses, and the exit codes (0/1/2/4/5) do not change. gate-check.sh prints the co-owned count when it is above 0. The #261 part (stale-DESCRIBE baseline) is a separate PR that lands after this one; together they supersede draft #311.

Fixes #269

Behaviour change to check in your project: exec.sh output can carry WARN: restatement: … and NOTE: new owner of … lines, and the BUILD-LOG detail cell WARN reverts: <docs>. Set MXTK_RESTATE_GUARD=off to skip the check. A new machine-local file appears: .claude/loop/script-owners/written.tsv. It is not committed, because that folder carries its own * .gitignore (the same pattern as app-restart.sh's .claude/loop/app-restart/).

How "is the newer owner's write live?" is decided, cheapest first:

1. If neither script has run, the script is new: no message and no DESCRIBE. A script has run when any of these holds:

   • it has a ledger row;
   • its file name has the done- prefix;
   • docs/BUILD-LOG.md has a row naming it in backticks whose result says applied (the done-drift-check.sh pattern).

   The last two are committed, so a fresh clone or cloud session (empty ledger) still WARNs on a replay over committed newer work. A script nobody has run yet (draft-ahead) stays quiet. None of this calls mxcli.

2. Otherwise read the ledger's last writer of the document, ignoring rows before the last RESTORE row. If it is this script, or a script that runs before it, nothing would be reverted.

3. Otherwise run one DESCRIBE. If the document is absent (a fresh model), there is nothing to revert.

4. With no ./mxcli to ask, it is a WARN.

DESCRIBE is capped at 5 calls per exec; any further documents print as CONFLICT (not checked). record compacts the ledger to the last row per (script, document) plus the last RESTORE row, through a temp file and mv, while exec.sh holds the exec lock. exec.sh's own rollback passes MXTK_RESTORE_SAME_LEDGER=1, because its snapshot predates nothing recorded; every other restore writes the marker.

Impact

Row	Answer
Process	Nothing new blocks. One optional header (-- supersedes:). gate-check gains one information line when the co-owned count is above 0.
Dependencies	Touches project-bin/exec.sh (one block after the pre-exec check, one record call after LOOK owed, one cell in the BUILD-LOG detail, one env var on its rollback), project-bin/restore-mpr.sh (the RESTORE row), bin/gate-check.sh, and bin/lib/install-manifest.sh (new installed script). New artifact: the ledger, machine-local and not committed (self-gitignored; init-project.sh does not ignore .claude/loop/, so the folder ignores itself, which also covers existing projects). The ledger's producers are exec.sh record (mandatory, after every kept write) and restore-mpr.sh; its consumer is script-owners.sh check. check also reads docs/BUILD-LOG.md (producer: exec.sh, every run) and the done- names (producer: the iterative-build-loop.md rename). The ledger cannot see Studio Pro edits or a git pull/git checkout of the .mpr; the header says so, and a post-merge/post-checkout hook is the follow-up. Branched from 88e9848; master has since moved to 9f3948c (#497) and the branch merges cleanly (git merge-tree). No new tools: bash 3.2, awk, grep, sed.
Context cost	none: no routed or always-loaded file touched (render-routing.sh --check: Baseline: 73804 words (budget 80000), base and head).
Behaviour	n/a: scripts only (the STOP-21 clause is in the #261 PR).
Runtime	Re-review, 600 scripts, same harness: master 9f3948c 1405-1440 ms, head 292ded7 1502-1545 ms, 0 DESCRIBE calls. First pass (stub mxcli and mxbuild, wall time, 5 runs each; base master 88e9848's exec.sh on a sole-owner script): 20 scripts: base 1406-1458 ms, head 1495-1523 ms. 600 scripts: base 1382-1443 ms, head 1485-1525 ms. That is about +90 ms per exec, with zero DESCRIBE calls (fixture-asserted). gate-check count takes 345 ms on 600 scripts, once per gate run.

Field evidence: no client project was run. Before the split, exec.sh ran with real mxcli v0.26.0 (check, exec, DESCRIBE) on a scratch copy of mxcli's public testdata/pedapp model. Replaying 01 over 02 printed WARN: restatement … newer owner mdlsource/02-A.mdl — replaying this script reverts it. A fresh-model rebuild in run order printed 0 WARN lines, including with a stale ledger, because DESCRIBE answered not-found. The not-found output (microflow, nanoflow, page, snippet) and two found documents are captured verbatim from that model in tests/wave2/fixtures/restatement-guard/. A field run on a real project is still owed.

Fails on master, passes on head: tests/wave2/test-restatement-guard.sh

Subject	Passed	Failed
head 292ded7	58	0
previous head 2a0886b (re-review cases)	56	2
master exec.sh	14	38
this PR's previous head 8ad0d77	23	28
head with master's restore-mpr.sh (control)	49	2

On 2a0886b, the 2 failures are the new fresh-clone cases: empty ledger plus done-09 (which supersedes 05), and empty ledger plus a BUILD-LOG applied row for 09; replaying 05 must WARN in both. Also new: 09 never run, and a rolled-back BUILD-LOG row, both stay quiet. exec.sh's own rollback must write no RESTORE row; a control with that flag removed fails exactly that assertion. The 28 failures on 8ad0d77 are every review finding: the run-order cases, NOTE vs WARN, new-script quiet, compaction, the RESTORE marker, the DESCRIBE cap, and live. The control's 2 failures are exactly the RESTORE-marker case: 05, then 09 (supersedes 05), replay 05, restore, replay 05 must WARN.

Re-review checks (head 292ded7): test-restatement-guard 58/0, test-exec-gate-retry 47/0, test-restore-mpr-arg 10/0, test-exec-gate-log 24/0. One batch run showed 23/1, the same intermittent failure as before; it did not reproduce in 3 serial reruns or 12 runs in parallel with master. check-scripts, check-portability (an awk -v backslash it flagged is fixed in 292ded7), render-routing --check (73804, unchanged), the leak guard, check-pr-discipline: all clean. The client grep is 0.

Scoped checks (head 2a0886b):

• Fixtures:

  • test-restore-mpr-arg 10/0
  • test-exec-change-class 21/0
  • test-exec-check-refusal 10/0
  • test-exec-cr-brief-warn 19/0
  • test-exec-crash-rollback 13/0
  • test-exec-gate-log 24/0 (one run showed 23/1, three reruns 24/0)
  • test-exec-gate-retry 47/0
  • test-exec-hash-verify 43/0
  • test-exec-lock-watch 84/0
  • test-exec-step-times 7/0
  • test-exec-subjects 6/0
  • test-exec-lint-autorestore 17/0
  • test-bug07-08 45/0
  • test-sync-only-bin 40/0
  • test-bug12-sync 62/0
  • test-bug03-gates 47/0
  • test-wrong-verdicts 20/0
  • test-manifest-clean-checkout 1/0

• Guards, all clean: check-scripts, check-portability, render-routing --check, the leak guard, check-pr-discipline. The client-name grep of added lines returns 0.

• No client data anywhere in the diff

• Size cap: 17 files, but 10 are captures or fixtures. Non-fixture lines: 350 (+347 −3).

• Test tier reached: T1/T2. A stub-mxcli fixture, plus real mxcli v0.26.0 on a public model before the split. No T3 field project.

• For a new/changed instrument:

  • Golden input is captured, not hand-written.
  • Both layouts: two-tree app/mdlsource/ is asserted.
  • Both platforms: bash 3.2 only, no sort -V, grep -rlF -f, awk ENVIRON. Checked by inspection; not run on macOS or Git Bash.

• For a new skill: n/a

• CHANGELOG.md line, credited to MendixMau (One document, several owning scripts: re-running an older mdlsource script silently reverts later changes #269)

• New bug entries: none

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code