diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00c531b8..2dd1392d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,10 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- new(exec, row-groups): **row-group gate**: `bin/row-groups.sh` plans scripts from the build plan (consecutive low-risk BUILD rows of one module, at most 4, in one script; security, workflow, agents, REST, Java, Marketplace and changes to built documents stay one row per script), and `exec.sh` refuses a split low-risk group, a mixed high-risk script, or the first script past a module with no `docs/progress/module-close/<Module>.md`. The gate checks a script that names its rows in a `-- rows:` header, or, when PROJECT.md says `Row groups: on`, its file name; otherwise it is skipped, because `brd-to-build-plan.md` numbers scripts on their own sequence (on the real SampleDashboards plan `16-cutover.mdl` is row 26 and was refused as row 16; `tests/wave2/test-row-groups.sh`). A row counts as built only when its State says built / done / complete / verified / proven / passed / applied (`planned`, `partial`, `**blocked**` and an empty State do not), or when an applied script's `-- rows:` header names it. Override: `MXTK_ROWS_OVERRIDE="<why>"` (ProcureFlow run 3 arm D: 0.93 → 0.48 scripts per row, 0 overrides; build to Test 2 12/12 in 322 min vs arm C stopped at row 121 after 650) — cook-off ProcureFlow run 2/3
+- fix(exec, lint): **lint prints and counts only the findings THIS script added, plus any earlier one still unfixed**, diffed against the previous exec (`.claude/loop/lint-prev-exec.json`); a finding that was reported and is neither fixed nor accepted into the baseline is carried (`.claude/loop/lint-unacked.json`) and stays "lint rose" on every later exec, and a diff that cannot run or cannot read `lint-last.json` (missing, unparseable, no `new_findings`), or itemises nothing with no previous exec to explain the rise, keeps the rise as lint-gate returned it (and does not advance `lint-prev-exec.json`, so the next exec still reads it as a rise), never "0 new" (`tests/wave2/test-exec-lint-diff.sh`); the baseline cannot be refreshed unattended, so "rose vs baseline" stayed true for every later exec (run 2 arm C: ROSE on 123 of 147 rows, ~60 lines each, 6 real SEC010 unread) — cook-off ProcureFlow run 2
+- new(reload): **`bin/reload.sh` hot-reloads instead of restarting** and finds the app URL from `APP_URL`, then `.docker/.env` `APP_PORT`, then CLAUDE.md (run 2 arm C: 176 app starts; run 3 arm D: 33, 1 failed); it and `bin/module-close.sh` find the `.mpr` and mxcli through `_common.sh`, so a two-tree checkout (`.mpr` under `app/`) works, and `reload.sh` reads the `.docker/` folder beside the `.mpr`, where mxcli writes it (`test-module-close.sh` C2, R1); `bin/module-close.sh` runs the module-close checks and lists pages still owed a LOOK; its report carries `<!-- mxtk-module-close: lint=N vm=RC -->`, and the row-group gate counts a module as closed only at `lint=0` or with a filled row in the report's Page | Role LOOK table, so a report with findings and no page looked at does not open the next module (`tests/wave2/test-row-groups.sh` M1, `test-module-close.sh` with a captured mxcli v0.28.0 lint) — cook-off ProcureFlow run 2/3
+- process(iterative-build-loop): **a script may carry several low-risk rows of one module; high-risk rows stay one per script**, and the module-close report is owed before the next module's scripts — cook-off ProcureFlow run 2/3
 - learn(page-patterns, file-upload-widget): **the last two unpromoted traps from the 2026-10-12 retro**: a snippet's top-level text has no context object, so wrap it in a DataView on the snippet parameter (`learned-page-patterns.md`); and on the Nova theme the File Uploader's three icon variables point at `/resources/images/` files nothing ships, so the icons are blank with three 404s while every gate stays green (`learned-file-upload-widget.md` traps table). The other retro facts were already covered: watch-mode and calculated attributes (`ui-loop.md`), Datagrid 2 / Atlas input traps (lint UI001), licence session cap. On-demand files, 0 baseline words. — retro 2026-10-12, Nova trap from AlvinnYeo (#282)
 - learn(microflow-patterns): **an object saved only through `commitInSeparateDatabaseTransaction` is still new in the user's request**; after browser Back the runtime checks Create on it, and a role without Create gets "Attempt to illegally add an object to the state" (HTTP 560) on every server-backed widget of the page. Fix: `rollback $X refresh` before the microflow ends; never grant Create or `commit` the request's copy. Added beside "Commit / Change / Rollback" (on demand; `rules-microflow.md` re-rendered). The proposed `learned-detection-gaps.md` register row is baseline text and waits for its A/B. — AlvinnYeo (#565)
 - learn(mendix-agent-ui): **new section "Stock popup variant (`layout-chat-popup`)"**: the popup header text is the popup page's Title; its `h4` is invisible by default (same colour as the header background) and is fixed with a token-scoped rule in `main.scss`, never a literal or `!important`; the width is a shared `!default` variable set in `custom-variables.scss`, and it also widens the sidebar chat. One checklist line added. The routing trigger is unchanged (that would add words to the mdl agent stub). On-demand file, 0 baseline words. — joshuamoesa (#574)
diff --git a/bin/lib/install-manifest.sh b/bin/lib/install-manifest.sh
index 4e3c2da0..c5627ca6 100644
--- a/bin/lib/install-manifest.sh
+++ b/bin/lib/install-manifest.sh
@@ -128,7 +128,7 @@ MXTK_AGENTS_STAGE_BUILD="mdl-agent.md gate-agent.md test-agent.md review-agent.m
 # runs it per module (informational; see project-bin/mf-canvas-facts.py header).
 # model-scope.py joined on 2026-10-21: it imports mxpatch.py (and through it mxunit_bson.py) from
 # its own directory. It puts back units a write changed only in XPath whitespace (mxcli#1596).
-MXTK_PROJECT_BIN="process-map.js process-map.template.html app-restart.sh test-scratch.sh script-owners.sh describe-baseline.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py model-scope.py mf-canvas-facts.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh harness-scan.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh progress-report.py done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh check-staged-secrets.sh"
+MXTK_PROJECT_BIN="reload.sh module-close.sh row-groups.sh process-map.js process-map.template.html app-restart.sh test-scratch.sh script-owners.sh describe-baseline.sh assemble-prototype.js prototype-route.js check-prototype-links.js wf-add-path-terminators.py wf-set-call-captions.py model-scope.py mf-canvas-facts.py mxunit_bson.py mxpatch.py _common.sh app-facts.sh _claims.sh snapshot-mpr.sh restore-mpr.sh exec.sh affected-tests.sh look-ledger.sh save-sp.sh restart-sp.sh check-sp-health.sh verify-module.sh harness-scan.sh test-stack-up.sh fixture-manifest.sh check-root-clean.sh lint-gate.sh lint-trend.sh metrics-ledger.sh metrics-trend.sh close-task.sh conformance-check.sh coverage-preflight.sh graph-sweep.sh review-module.sh coherence-cadence.sh build-plan-status.sh progress-report.py done-drift-check.sh page-scope.sh render-improvement-register.sh check-design-portability.sh check-design-reaches-app.sh check-page-shell.sh page-fidelity.js model-stamp.sh verify-model.sh install-project-hooks.sh mx-metadata-note.py session-check.sh constants-audit.sh context-pack.sh check-staged-secrets.sh"
 
 # Files in project-bin/ that are deliberately NOT installed into projects. The reverse check
 # below flags anything named by NEITHER list, so a new file in project-bin/ has to be either
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 11872c6f..ccbfc5a7 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -514,7 +514,7 @@ HDR2
   # The gate cell is read from GATE_STATE rather than passed in, so no caller
   # can omit it — a blank cell in this table reads as "fine", which is the exact
   # false-green the gate exists to prevent.
-  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${SCAN_NOTE:+ · $SCAN_NOTE}${RESTATE_NOTE:+ · $RESTATE_NOTE}${GATE_NOTE:+ · $GATE_NOTE}${MXB_LOG_NOTE:+ · $MXB_LOG_NOTE}${HV_NOTE:+ · $HV_NOTE}$_EXEC_APPROVAL_SUFFIX${STEP_TIMES:+ · steps: $STEP_TIMES}"
+  _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${SCAN_NOTE:+ · $SCAN_NOTE}${ROWS_NOTE:+ · $ROWS_NOTE}${RESTATE_NOTE:+ · $RESTATE_NOTE}${GATE_NOTE:+ · $GATE_NOTE}${MXB_LOG_NOTE:+ · $MXB_LOG_NOTE}${HV_NOTE:+ · $HV_NOTE}$_EXEC_APPROVAL_SUFFIX${STEP_TIMES:+ · steps: $STEP_TIMES}"
   printf '| %s | `%s` | %s | %s | %s |\n' \
     "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$LOG_NAME" \
     "${GATE_STATE:-not-run}" "$1" "$_detail" >> "$BUILD_LOG"
@@ -607,6 +607,28 @@ if [ "$PATCH_MODE" != "1" ]; then
   fi
 fi
 
+# ── Row-group gate (run 3, 2026-10-27) ──────────────────────────────────────
+# bin/row-groups.sh check: low-risk build-plan rows of one group go in ONE script; a high-risk row
+# (security, agents, workflow, REST, Java, changes to built documents) goes alone. Runs here, before
+# the lock and the snapshot, for every caller of exec.sh, agent or person. Run 2 arm C paid ~2 min of
+# instruments per exec on 147 rows. No build plan, or a script that names no row: skipped.
+# Override, with a reason that lands in the BUILD-LOG row: MXTK_ROWS_OVERRIDE="<why>".
+ROWS_NOTE=""
+if [ "$PATCH_MODE" != "1" ] && [ -x "$PROJECT_ROOT/bin/row-groups.sh" ]; then
+  _rg_rc=0; _rg_out="$("$PROJECT_ROOT/bin/row-groups.sh" check "$SCRIPT" 2>&1)" || _rg_rc=$?
+  if [ "$_rg_rc" = 1 ]; then
+    echo "$_rg_out"
+    if [ -z "${MXTK_ROWS_OVERRIDE:-}" ]; then
+      echo "✗ Row-group gate: refusing exec. NOTHING was locked, snapshotted or written."
+      echo "  See the groups: bin/row-groups.sh. Override with a reason: MXTK_ROWS_OVERRIDE=\"<why>\" ./bin/exec.sh $SCRIPT"
+      log_build "🚫 blocked" "row-group gate: $(printf '%s' "$_rg_out" | head -1 | tr '|' '/' | cut -c1-200) — nothing written"
+      exit 1
+    fi
+    echo "⚠ Row-group gate OVERRIDDEN: ${MXTK_ROWS_OVERRIDE}" >&2
+    ROWS_NOTE="rows override: $(printf '%s' "$MXTK_ROWS_OVERRIDE" | tr '|' '/')"
+  fi
+fi
+
 # ── Concurrent-writer guard ──────────────────────────────────────────────────
 # The .mpr must have exactly ONE writer. Two mxcli/SP writers on the same file
 # silently clobber each other and have caused near-total module loss.
@@ -972,6 +994,7 @@ fi
 # to stop. ~13 s measured on a 10k-finding project.
 LINT_RC=0; LINT_DETAIL="lint not-run"
 run_lint_gate() {
+  _noadv=""
   if [ -n "${SKIP_LINT:-}" ]; then
     LINT_DETAIL="lint SKIPPED (SKIP_LINT=$SKIP_LINT)"
     echo "  ⚠ lint ratchet skipped: SKIP_LINT=$SKIP_LINT"; return
@@ -1050,12 +1073,65 @@ run_lint_gate() {
          sed -n '/^!! A RULE COULD NOT READ/,/^$/p' "$_lo" | head -12 | sed 's/^/    /'
          echo "    Configure or fix the rule (see the message above); do not re-baseline over it."
        else
-         LINT_DETAIL="lint ROSE: ${_rules:-see output}${_blind:+; BLIND: $_blind}"
-         echo "  ✗ lint: rule(s) rose vs baseline — ${_rules:-see below}"
-         sed -n '/^FAIL/,$p' "$_lo" | head -60 | sed 's/^/    /'
+         # New THIS script (run 3, 2026-10-27). The baseline cannot be refreshed unattended, so
+         # "rose vs baseline" stays true for every later exec once one script adds a finding:
+         # run 2 arm C logged ROSE on 123 of 147 rows and printed ~60 lines each time, and the 6
+         # real SEC010 findings in it went unread. Compare with the previous exec's findings
+         # (.claude/loop/lint-prev-exec.json); only what this script added is printed and counts.
+         IFS= read -r -d '' _thispy <<'PY' || true
+import json, os, sys
+d = sys.argv[1]
+def load(n):
+    try: return {(r, f) for r, fs in (json.load(open(os.path.join(d, n))).get("new_findings") or {}).items() for f in fs}
+    except (OSError, ValueError): return set()
+# Unreadable lint-last.json, or one without a new_findings object: nothing to itemise, so print
+# nothing and let the shell keep the rise as lint-gate returned it (never downgrade to "0 new").
+try:
+    if not isinstance(json.load(open(os.path.join(d, "lint-last.json"))).get("new_findings"), dict): sys.exit(0)
+except (OSError, ValueError, AttributeError): sys.exit(0)
+cur = load("lint-last.json")
+added = cur - load("lint-prev-exec.json")
+# Carried: reported before, still in lint-last (so neither fixed nor accepted into the baseline).
+# Without it a finding an agent ignored once read "0 new" on every later exec (PR #581 review).
+carried = (load("lint-unacked.json") & cur) - added
+new = sorted(added | carried)
+# Rise reported but nothing itemised and no previous exec to explain it: not provably old debt.
+if not new and not os.path.exists(os.path.join(d, "lint-prev-exec.json")): sys.exit(0)
+try:
+    by_r = {}
+    for r, f in new: by_r.setdefault(r, []).append(f)
+    json.dump({"new_findings": by_r}, open(os.path.join(d, "lint-unacked.json"), "w"))
+except OSError:
+    pass
+by = {}
+for r, _ in new: by[r] = by.get(r, 0) + 1
+print(len(new), len(carried), " ".join(f"{r}:{n}" for r, n in sorted(by.items())))
+for r, f in new[:10]: print(f"    {r}  {f[:180]}" + ("   (carried: still unfixed)" if (r, f) in carried else ""))
+if len(new) > 10: print(f"    … {len(new) - 10} more in .claude/loop/lint-last.json")
+PY
+         _thispyexe="${PY:-$(resolve_py 2>/dev/null || true)}"
+         _thisnew=$([ -n "$_thispyexe" ] && "$_thispyexe" -c "$_thispy" "$PROJECT_ROOT/.claude/loop")
+         _thisn=$(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f1)
+         _thisc=$(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f2)
+         if [ -z "$_thisnew" ]; then
+           _noadv=1   # undiffed rise: keep prev-exec as is, or the next exec reads these as old debt
+           # No Python, or the diff failed: never read that as "0 new". Report the rise vs baseline.
+           LINT_DETAIL="lint rose: ${_rules:-see output} (per-script diff unavailable)"
+           echo "  ✗ lint: rule(s) rose vs baseline — ${_rules:-see below} (per-script diff unavailable)"
+           sed -n '/^FAIL/,$p' "$_lo" | head -60 | sed 's/^/    /'
+         elif [ "${_thisn:-0}" = 0 ]; then
+           LINT_RC=0
+           LINT_DETAIL="lint: 0 new this script (baseline debt: ${_rules:-see lint-last.json})"
+           echo "  ✓ lint: this script added no finding (older debt vs baseline unchanged)"
+         else
+         # "lint rose" stays the wording, as before this change (metrics and readers key on it).
+         LINT_DETAIL="lint rose: +${_thisn} new or unfixed (${_thisc:-0} carried from earlier execs): $(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f3-)"
+         echo "  ✗ lint: ${_thisn} finding(s) new this script or still unfixed from an earlier one — read each one:"
+         printf '%s\n' "$_thisnew" | tail -n +2
          echo "    Fix the script and re-run. Accepting the debt is the user's call, made in chat:"
          echo "    bin/lint-gate.sh --update-baseline --reason \"<why>\" (a security-tier rise also"
          echo "    needs --approved-in-chat). The acceptance is logged to .claude/lint-acceptances.tsv."
+         fi
        fi ;;
     *) LINT_DETAIL="lint could not run (lint-gate exit $LINT_RC)"; echo "  ⚠ $LINT_DETAIL"
        tail -5 "$_lo" | sed 's/^/    /' ;;
@@ -1064,6 +1140,8 @@ run_lint_gate() {
   # should know the files changed under them.
   [ -n "$_restored" ] && [ "$LINT_RC" -ne 3 ] && LINT_DETAIL="$LINT_DETAIL; toolkit lint rules auto-restored after a stock re-seed (${_restored})"
   rm -f "$_lo"
+  # The next exec compares against what lint saw now.
+  case "$LINT_RC" in 0|1) [ -n "${_noadv:-}" ] || cp "$PROJECT_ROOT/.claude/loop/lint-last.json" "$PROJECT_ROOT/.claude/loop/lint-prev-exec.json" 2>/dev/null || true ;; esac
 }
 # One place decides the applied-row wording, so both mxbuild-clean branches agree.
 log_applied() {  # $1 = mxbuild detail
diff --git a/project-bin/module-close.sh b/project-bin/module-close.sh
new file mode 100755
index 00000000..2d9f3d83
--- /dev/null
+++ b/project-bin/module-close.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# module-close.sh <Module> — the checks that run once per module, not once per script.
+#
+#   bin/module-close.sh Procurement
+#
+# Runs, in order, and writes one report: docs/progress/module-close/<Module>.md
+#   1. mxcli lint, whole model; the ⚠ lines that name this module are the module's findings
+#   2. model score (bin/metrics-ledger.sh score → mxcli report), once
+#   3. mxcli docker check (full mxbuild check)
+#   4. bin/verify-module.sh <Module> --quick (conformance, graph sweep, coverage; diagnostic only)
+#   5. bin/look-ledger.sh status: pages of this module still owed a LOOK
+# Then the lead does what no script can: open each owed page as each role that can reach it,
+# run the module's unhappy paths, and fix every ⚠ that is real. Record those in the same report.
+#
+# WHY (run 2, 2026-10-26, arm C). Lint and score ran after every exec (18.3 min) and the ratchet read
+# ROSE on 123 of 147 rows, because the baseline cannot be refreshed unattended. Nobody read it. Yet
+# the model at row 124 held 6 SEC010 ⚠ (agent-evidence lists empty for the roles that open the page).
+# Meanwhile verify-module, gate-check and the LOOK ledger ran 0 times: nothing called them.
+# One command at the module boundary makes the per-module pass cheap enough to actually run.
+#
+# Exit: 0 report written, no ⚠ for this module · 1 report written, findings to act on · 2 usage.
+# The report's first lines carry `<!-- mxtk-module-close: lint=N vm=RC -->`. bin/row-groups.sh (the
+# exec.sh row-group gate) lets the next module's scripts run when lint=0, or when the lead has filled
+# at least one row of section 6's Page | Role table. Findings and an empty table = not closed.
+set -u
+mod=${1:?usage: bin/module-close.sh <Module>}
+# The .mpr and mxcli resolve through _common.sh like every project-bin script, so a two-tree
+# checkout (.mpr under app/) and a multi-app folder work; `ls ./*.mpr` found neither (PR #581 review).
+. "$(dirname "$0")/_common.sh"
+cd "$PROJECT_ROOT" || exit 2
+MPR=$(find_mpr) || exit 2
+MX=$(find_project_mxcli 2>/dev/null || command -v mxcli) || { echo "module-close: no mxcli (project root or PATH)" >&2; exit 2; }
+out=docs/progress/module-close; mkdir -p "$out"; rep="$out/$mod.md"
+MXB=${MXTK_MXBUILD_PATH:-}
+t0=$(date +%s); now() { date '+%F %H:%M'; }
+
+lint=$("$MX" lint -p "$MPR" 2>&1 | grep -v WARNING)
+mine=$(printf '%s\n' "$lint" | grep -A1 '⚠' | grep -B1 -E "\b$mod\." | grep '⚠' || true)
+nmine=$(printf '%s' "$mine" | grep -c '⚠' || true)
+score=$(bash bin/metrics-ledger.sh score 2>&1 | tail -1)
+chk=$("$MX" docker check -p "$MPR" ${MXB:+--mxbuild-path "$MXB"} 2>&1 | grep -v WARNING | tail -3)
+vm=$(bash bin/verify-module.sh "$mod" --quick 2>&1); vm_rc=$?; vm=$(printf '%s\n' "$vm" | tail -15)
+look=$(bash bin/look-ledger.sh status 2>/dev/null | grep -E "\b$mod\." || true)
+
+{
+  echo "# Module close: $mod ($(now), $(( $(date +%s) - t0 )) s of instruments)"
+  echo
+  # Read by bin/row-groups.sh: lint=0, or a filled row in section 6, lets the next module's scripts run.
+  echo "<!-- mxtk-module-close: lint=$nmine vm=$vm_rc -->"
+  echo
+  echo "## 1. Lint ⚠ in $mod: $nmine"
+  echo; [ -n "$mine" ] && printf '%s\n' "$mine" | sed 's/^ */- /' || echo "none"
+  echo; echo "Whole model: $(printf '%s\n' "$lint" | grep -c '⚠') ⚠, $(printf '%s\n' "$lint" | grep -c 'ℹ') ℹ."
+  echo; echo "## 2. Score"; echo; echo "$score"
+  echo; echo "## 3. mx check"; echo; echo '```'; echo "$chk"; echo '```'
+  echo; echo "## 4. verify-module --quick (exit $vm_rc)"; echo; echo '```'; echo "$vm"; echo '```'
+  echo; echo "## 5. LOOK owed in $mod"; echo; [ -n "$look" ] && printf '%s\n' "$look" | sed 's/^/- /' || echo "none recorded"
+  echo; echo "## 6. Lead: roles × pages, unhappy paths, fixes"; echo
+  echo "| Page | Role | Seen (screenshot path) | Defect | Fixed in row/script |"
+  echo "|---|---|---|---|---|"
+} > "$rep"
+echo "module-close $mod: $nmine lint ⚠, verify-module exit $vm_rc, report $rep"
+[ "$nmine" -eq 0 ] || exit 1
diff --git a/project-bin/reload.sh b/project-bin/reload.sh
new file mode 100755
index 00000000..9655d3e2
--- /dev/null
+++ b/project-bin/reload.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# reload.sh — put the current model into THIS project's running Docker app, keeping its data.
+#
+#   bin/reload.sh            build the package, then hot-reload the model (no container restart)
+#   bin/reload.sh --css      styling only (theme/SCSS already compiled into the deployment)
+#   bin/reload.sh --restart  full build + container restart (after a Java/GenAI class change, or when
+#                            a reload left the app odd — run 1 cloud A-43: ClassNotFoundException)
+#
+# WHY (run 2, 2026-10-26, arm C). `mxcli docker reload` reaches the M2EE admin API by running curl
+# INSIDE the container (mxcli cmd/mxcli/docker/m2ee.go, v0.24 and v0.28 alike), and the
+# eclipse-temurin JRE image has no curl. Every reload failed with "sh: 1: curl: not found", so the
+# lead restarted the container after each change instead. `--direct` calls the same API over HTTP
+# from the host, through the mapped admin port, with no curl.
+#
+# What it saves is the restart and the wait for the port, not mxbuild: the package build stays.
+# So refresh the app when you need to LOOK or test, not after every apply.
+#
+# Falls back to --restart when the reload fails, and says so. Prints the path taken and seconds.
+# Exit: 0 app serving the new model · 1 not proven up · 2 usage.
+set -u
+# .mpr and mxcli resolve through _common.sh (two-tree: .mpr under app/). mxcli writes .docker/ beside
+# the .mpr (cmd/mxcli/docker/build.go: filepath.Dir(projectPath)/.docker), so that is where it is read.
+. "$(dirname "$0")/_common.sh"
+cd "$PROJECT_ROOT" || exit 2
+MPR=$(find_mpr) || exit 2
+MX=$(find_project_mxcli 2>/dev/null || command -v mxcli) || { echo "reload.sh: no mxcli (project root or PATH)" >&2; exit 2; }
+DK="$(dirname "$MPR")/.docker"
+MXB=${MXTK_MXBUILD_PATH:-}
+mxb() { [ -n "$MXB" ] && printf -- '--mxbuild-path\n%s\n' "$MXB"; }
+mode=reload
+case "${1:-}" in "") ;; --css) mode=css ;; --restart) mode=restart ;; *) sed -n 2,8p "$0"; exit 2 ;; esac
+
+# The admin port as mapped on the host (compose maps container 8090 to it).
+admin=$(cd "$DK" 2>/dev/null && docker compose port mendix 8090 2>/dev/null | sed 's/.*://')
+# URL: APP_URL, else the port mxcli docker publishes (.docker/.env APP_PORT), else CLAUDE.md, else 8080.
+# Run 2 arm D: the CLAUDE.md fallback missed the app on 8084 and waited 284 s.
+app_url=${APP_URL:-}
+[ -n "$app_url" ] || { p=$(grep -m1 '^APP_PORT=' "$DK/.env" 2>/dev/null | cut -d= -f2 | tr -d '"[:space:]'); [ -n "$p" ] && app_url=http://localhost:$p; }
+[ -n "$app_url" ] || app_url=$(grep -m1 -o 'http://localhost:[0-9]*' CLAUDE.md 2>/dev/null)
+app_url=${app_url:-http://localhost:8080}
+up() { for i in $(seq 1 90); do [ "$(curl -s -o /dev/null -w '%{http_code}' "$app_url/login.html")" = 200 ] && return 0; sleep 2; done; return 1; }
+
+t0=$(date +%s)
+if [ "$mode" != restart ] && [ -n "$admin" ]; then
+  args=(-p "$MPR" --direct --port "$admin"); [ "$mode" = css ] && args+=(--css) || { args+=(--skip-check); while IFS= read -r a; do args+=("$a"); done < <(mxb); }
+  if out=$("$MX" docker reload "${args[@]}" 2>&1); then
+    up && { echo "reload.sh: $mode via --direct OK in $(( $(date +%s) - t0 )) s"; exit 0; }
+  fi
+  echo "reload.sh: $mode failed, falling back to restart: $(printf '%s' "$out" | grep -v WARNING | tail -1)"
+fi
+[ -z "$admin" ] && echo "reload.sh: app not running (no admin port mapped); starting it"
+args=(-p "$MPR"); while IFS= read -r a; do args+=("$a"); done < <(mxb)
+"$MX" docker build "${args[@]}" 2>&1 | grep -E 'rror|BUILD|CE[0-9]' | tail -3
+"$MX" docker up -p "$MPR" --detach >/dev/null 2>&1 || (cd "$DK" && docker compose up -d >/dev/null 2>&1)
+up && { echo "reload.sh: restart OK in $(( $(date +%s) - t0 )) s"; exit 0; }
+echo "reload.sh: app not answering on $app_url after $(( $(date +%s) - t0 )) s"; exit 1
diff --git a/project-bin/row-groups.sh b/project-bin/row-groups.sh
new file mode 100755
index 00000000..4499d74c
--- /dev/null
+++ b/project-bin/row-groups.sh
@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# row-groups.sh — which build-plan rows go in ONE script, and the exec.sh gate that holds to it.
+#
+#   bin/row-groups.sh                 print the groups (plan the next script from this)
+#   bin/row-groups.sh check <script>  the gate exec.sh runs before anything is locked or written
+#
+# Reads architecture/build-plan.md live (no group file to go stale). A BUILD row is
+#   high  when its Skills column names security, agents, workflow, REST, Java or constants/secrets,
+#         or its Step names roles, security, Marketplace, Java, REST/API, or extensions/changes to
+#         built documents (the diff-before-apply cases). One row per script.
+#   low   otherwise: domain, CRUD microflows, pages. Consecutive low rows form a group (at most
+#         $MXTK_GROUP_MAX, default 4); any BRIEF/PROVE/LOOK row or high row ends the group.
+# A script names its rows in a header line `-- rows: 16,17,18,19`. Its file name (16-…mdl, or
+# 16-19-…mdl for 16 to 19) counts only when PROJECT.md says `Row groups: on`: brd-to-build-plan.md
+# numbers scripts on their own sequence (`060-crm-page-….mdl` under row 21, `01-{module}-domain.mdl`
+# per module), so on a project that has not opted in a file-name number is a script number, and a
+# script with no header is not checked (exit 3). Real case: on the SampleDashboards plan
+# (tests/wave2/fixtures/build-plan-claims-real.md) `16-cutover.mdl` is row 26, and reading it as
+# row 16 refused it for leaving rows 14 and 15 unbuilt.
+#
+# check refuses (exit 1) when the script
+#   - covers part of a low group and leaves other rows of it unbuilt (built = a State that starts
+#     built / done / complete / verified / proven / passed / applied, the same prefixes
+#     progress-report.py's classify_state counts; planned, partial, **blocked**, empty are not.
+#     Or a BUILD-LOG "applied" row for a script whose `-- rows:` header names the row, or, with
+#     `Row groups: on`, whose file name does), or
+#   - mixes a high row with any other row, or
+#   - starts past the last row of a module whose docs/progress/module-close/<Module>.md is missing
+#     or does not show the close was done (module = first word of a "### Phase N — <Module> …"
+#     heading that names a folder in architecture/modules/). Done = the summary line
+#     bin/module-close.sh writes says `lint=0`, or the report's "Page | Role" LOOK table has at
+#     least one filled row. A report with findings and an empty table is a run, not a close.
+#     The remedy is never blocked: run bin/module-close.sh <Module>, fix and re-run, or fill the table.
+# Override, with a reason that lands in the BUILD-LOG row: MXTK_ROWS_OVERRIDE="<why>".
+# exit 0 pass, 1 refused, 3 nothing to check (no plan, no rows header and no opt-in, or no BUILD row).
+#
+# WHY (run 2, 2026-10-26, arm C). 147 build-plan rows ran as ~137 scripts and ~185 execs; each exec
+# paid check, snapshot, baseline mxbuild, apply, mxbuild gate (~2 min of instruments). A prompt rule
+# reaches only agents that read the prompt; this gate reaches everyone who applies through exec.sh.
+set -u
+mode=${1:-plan}; script=${2:-}
+root=$(cd "$(dirname "$0")/.." && pwd)
+plan="$root/architecture/build-plan.md"; log="$root/docs/BUILD-LOG.md"
+[ -f "$plan" ] || { echo "row-groups: no architecture/build-plan.md — nothing to check"; exit 3; }
+[ "$mode" = check ] && { [ -n "$script" ] || { echo "usage: bin/row-groups.sh check <script.mdl>" >&2; exit 2; }; }
+
+# Python via _common.sh's resolve_py (runs each candidate; a name on PATH is not an interpreter).
+# No Python: exit 3, the same "nothing to check" exec.sh already passes through.
+. "$(dirname "$0")/_common.sh" 2>/dev/null || true
+PY=$(resolve_py 2>/dev/null) || { echo "row-groups: no Python 3 found (set PYTHON=/path/to/python3) — not checked" >&2; exit 3; }  # portability-ok: names in a diagnostic
+exec "$PY" - "$mode" "$plan" "$log" "$script" "${MXTK_GROUP_MAX:-4}" <<'PY'
+import os, re, sys
+mode, plan, log, script, gmax = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4], int(sys.argv[5])
+HIGH_SKILL = re.compile(r"security|agents?\b|mendix-agents|workflow|rest-|java|constants-and-secrets", re.I)
+HIGH_STEP = re.compile(r"\broles?\b|security|marketplace|\bjava\b|\brest\b|\bapi\b|extensions?\b|changes\b", re.I)
+
+root = os.path.dirname(os.path.dirname(plan))
+# PROJECT.md `Row groups: on` = this project's script file names carry build-plan row numbers.
+optin = False
+try:
+    for line in open(os.path.join(root, "PROJECT.md"), encoding="utf-8"):
+        m = re.match(r"^[*_ -]*Row groups:[*_ ]*`?([A-Za-z]+)", line)
+        if m: optin = m.group(1).lower() in ("on", "yes", "true"); break
+except OSError:
+    pass
+mods = {d for d in os.listdir(os.path.join(root, "architecture", "modules"))
+        if os.path.isdir(os.path.join(root, "architecture", "modules", d))} if os.path.isdir(os.path.join(root, "architecture", "modules")) else set()
+rows = []  # (n, kind, step, high, state)
+last_row = {}  # module -> last plan row of its phases
+cur_mod = None
+for line in open(plan, encoding="utf-8"):
+    h = re.match(r"#{2,4}\s*Phase\s+\d+\s*[—-]\s*(\w+)", line)
+    if h: cur_mod = h.group(1) if h.group(1) in mods else None; continue
+    if line.startswith("## "): cur_mod = None
+    c = [x.strip() for x in line.strip().strip("|").split("|")]
+    if len(c) >= 7 and c[0].isdigit() and c[1].isupper():
+        n, kind, step, skills, state = int(c[0]), c[1], c[2], c[5], c[6]
+        rows.append((n, kind, step, kind == "BUILD" and bool(HIGH_SKILL.search(skills) or HIGH_STEP.search(step)), state))
+        if cur_mod: last_row[cur_mod] = n
+
+groups, cur = [], []   # groups: list of (risk, [row numbers])
+for n, kind, step, high, state in rows:
+    if kind != "BUILD" or high or len(cur) == gmax:
+        if cur: groups.append(("low", cur)); cur = []
+    if kind == "BUILD":
+        if high: groups.append(("high", [n]))
+        else: cur.append(n)
+if cur: groups.append(("low", cur))
+info = {r[0]: r for r in rows}
+
+def is_built(st):
+    l = (st or "").strip().lower().replace("**", "")
+    if l.startswith(("not built", "not done", "not started")): return False
+    return l.startswith(("built", "done", "complete", "verified", "proven", "passed", "applied"))
+
+def header_rows(path):
+    try:
+        for line in open(path, encoding="utf-8"):
+            m = re.match(r"\s*--\s*rows?\s*:\s*([\d,\s–-]+)", line, re.I)
+            if m:
+                got = set()
+                for part in re.split(r"[,\s]+", m.group(1).strip()):
+                    if not part: continue
+                    a, _, b = part.replace("–", "-").partition("-")
+                    got.update(range(int(a), int(b or a) + 1))
+                return got
+    except (OSError, ValueError):
+        pass
+    return None
+
+def name_rows(name):
+    m = re.match(r"(\d+)(?:-(\d+)(?=-))?-", os.path.basename(name))
+    if not m: return set()
+    a, b = int(m.group(1)), int(m.group(2) or m.group(1))
+    return set(range(a, b + 1)) if b >= a and b - a < 20 else {a}
+
+built = {n for n, k, s, h, st in rows if is_built(st)}
+if os.path.exists(log):
+    scripts = {}  # basename -> path, done- prefix stripped (exec.sh's hint renames applied scripts)
+    for d, _, fs in os.walk(os.path.join(root, "mdlsource")):
+        for f in fs:
+            if f.endswith(".mdl"): scripts.setdefault(f[5:] if f.startswith("done-") else f, os.path.join(d, f))
+    for line in open(log, encoding="utf-8"):
+        if "applied" not in line: continue
+        for name in re.findall(r"`([^`]+\.mdl)`", line):
+            b = os.path.basename(name); b = b[5:] if b.startswith("done-") else b
+            got = header_rows(scripts[b]) if b in scripts else None
+            if got is None and optin: got = name_rows(b)
+            built.update(got or ())
+
+if mode != "check":
+    print("| Group | Rows | Risk | Steps |\n|---|---|---|---|")
+    for i, (risk, ns) in enumerate(groups, 1):
+        span = f"{ns[0]}–{ns[-1]}" if len(ns) > 1 else str(ns[0])
+        todo = "" if any(n not in built for n in ns) else " (built)"
+        print(f"| G{i} | {span}{todo} | {risk} | {'; '.join(info[n][2] for n in ns)} |")
+    one = sum(1 for r, ns in groups if len(ns) == 1)
+    print(f"\n{len(groups)} scripts for {sum(len(ns) for _, ns in groups)} BUILD rows ({one} single-row).")
+    sys.exit(0)
+
+# check
+mine = None
+try:
+    for line in open(script, encoding="utf-8"):
+        m = re.match(r"\s*--\s*rows?\s*:\s*([\d,\s–-]+)", line, re.I)
+        if m:
+            mine = set()
+            for part in re.split(r"[,\s]+", m.group(1).strip()):
+                if not part: continue
+                a, _, b = part.replace("–", "-").partition("-")
+                mine.update(range(int(a), int(b or a) + 1))
+            break
+except OSError:
+    pass
+if mine is None and not optin:
+    print("row-groups: script has no `-- rows:` header and PROJECT.md does not say `Row groups: on` — not checked")
+    sys.exit(3)
+if mine is None:
+    m = re.match(r"(\d+)(?:-(\d+)(?=-))?-", os.path.basename(script))
+    if not m: print("row-groups: script names no row — not checked"); sys.exit(3)
+    a, b = int(m.group(1)), int(m.group(2) or m.group(1))
+    mine = set(range(a, b + 1)) if b >= a else {a}
+mine &= {n for n, k, *_ in rows if k == "BUILD"}
+if not mine: print("row-groups: script names no BUILD row — not checked"); sys.exit(3)
+
+problems = []
+for risk, ns in groups:
+    hit = mine & set(ns)
+    if not hit: continue
+    if risk == "high" and len(mine) > 1:
+        problems.append(f"row {ns[0]} ({info[ns[0]][2]}) is high-risk: one row per script, here it shares with {sorted(mine - set(ns))}")
+    if risk == "low":
+        left = [n for n in ns if n not in mine and n not in built]
+        if left:
+            problems.append(f"rows {ns[0]}–{ns[-1]} are one low-risk group; this script leaves {left} unbuilt "
+                            f"({'; '.join(info[n][2] for n in left)}). Put them in this script")
+# WHY (run 2, arm D): module close was a prompt rule; D closed Audit and StyleGallery but went into
+# slice 2 without closing Procurement. A prompt reaches who reads it; this gate reaches every exec.
+# WHY content, not presence (PR #581 review): module-close.sh writes the report even when it finds
+# lint findings, and its LOOK table starts empty, so a gate on the file alone passed a module
+# whose pages nobody opened (run 3 arm D: 0 of 44 pages seen).
+def close_state(m):
+    p = os.path.join(root, "docs", "progress", "module-close", m + ".md")
+    if not os.path.exists(p): return "missing"
+    txt = open(p, encoding="utf-8").read()
+    s = re.search(r"mxtk-module-close:\s*lint=(\d+)", txt)
+    if s and int(s.group(1)) == 0: return "done"
+    in_table = False
+    for line in txt.splitlines():
+        cells = [c.strip() for c in line.strip().strip("|").split("|")]
+        if line.lstrip().startswith("|") and cells[:2] == ["Page", "Role"]: in_table = True; continue
+        if in_table:
+            if not line.lstrip().startswith("|"): break
+            if all(set(c) <= set("-: ") for c in cells): continue
+            if cells and cells[0]: return "done"
+    return f"open ({'lint=' + s.group(1) if s else 'no summary line'}, LOOK table empty)"
+start = min(mine)
+owed = [(m, close_state(m)) for m, last in sorted(last_row.items(), key=lambda kv: kv[1]) if last < start]
+owed = [(m, st) for m, st in owed if st != "done"]
+if owed:
+    problems.append(f"module close owed for {', '.join(m + ' (' + st + ')' for m, st in owed)} (all its rows are before row {start}). "
+                    f"Run bin/module-close.sh {owed[0][0]}, fix its findings and re-run, or record the pages you looked at "
+                    f"in the report's Page | Role table")
+if problems:
+    print("row-groups: " + "\n  ".join(problems)); sys.exit(1)
+print(f"row-groups: rows {sorted(mine)} OK"); sys.exit(0)
+PY
diff --git a/skills/iterative-build-loop.md b/skills/iterative-build-loop.md
index 229f677a..34f909b6 100644
--- a/skills/iterative-build-loop.md
+++ b/skills/iterative-build-loop.md
@@ -391,7 +391,19 @@ blank `mxcli new` app plus one entity and microflow, 4 cores, 3 runs each): `mx
 passed a Java compile error. So a check-only gate needs a full deploy whenever `javasource/` or
 `theme/` changed and at module close — a gate redesign, parked on #444.
 
-**Draft the ready set in parallel, apply serially.** The unit is the build-plan row. The ready
+**Draft the ready set in parallel, apply serially.** The unit is the build-plan row, and a script may
+carry several rows: low-risk rows of one module that are ready together (enumerations, entities and
+associations, CRUD pages over them, simple sub-microflows) go in **one script**, so the per-apply loop
+(check, apply, mxbuild gate, commit) is paid once for the group. Rows that touch security (roles, access
+rules), workflows, AI agents, REST, Java actions or a STOP rule 21 target stay **one row per script**:
+those are where a failed apply must roll back the least. `bin/row-groups.sh` prints the groups
+from the build plan; a script names its rows in a `-- rows: 16,17` header (its file name, `16-19-….mdl`,
+counts only with `Row groups: on` in PROJECT.md: `brd-to-build-plan.md` numbers scripts on their own
+sequence), and exec.sh refuses such a script when it splits a low-risk group or mixes a high-risk row in
+(override: `MXTK_ROWS_OVERRIDE="<why>"`, logged) (run 2, 2026-10-26: arm C wrote 0.93 scripts per row against the cloud's 0.34,
+and paid a 22-128 s loop per script). The same gate refuses the first such script past a module's last row
+until `docs/progress/module-close/<Module>.md` exists: run `bin/module-close.sh <Module>` and act on it
+(run 2, arm D skipped the Procurement close when it was only a prompt rule). The ready
 set is every `BUILD` row whose "Depends on" rows are all applied, minus overlapping writers: two
 rows whose scripts `create or replace`, `alter` or drop+create the same document (the row's
 written documents are listed in Produces, `brd-to-build-plan.md`) are never in one ready set,
@@ -402,8 +414,12 @@ refuses a second); after each apply, recompute the ready set. The failure this p
 that drafted one script at a time and sat idle while each draft finished. The risk it adds: a
 queued draft can restate a document as it was before a sibling apply — STOP rule 21's incident,
 where the second of two drop+creates of a shared seed aggregator silently dropped a seed call
-with `mx check` at 0 errors. So before applying a draft, if any apply has landed since it was
-drafted, run `mxcli diff -p <mpr> <script> --format struct` (`learned-mdl-preflight.md` STOP
+with `mx check` at 0 errors. So before applying a draft, if an apply that landed since it was
+drafted **wrote a document this draft also writes** (compare the `create or replace` / `alter` / `drop`
+targets of both scripts; a `grep` of the qualified names is enough), or the draft touches a STOP rule 21
+target, run `mxcli diff -p <mpr> <script> --format struct`. Drafts with no shared target skip the diff:
+it is the slowest read verb (14-21 s on a 21-module model; 53.5 s lead median late in run 2) and found
+0 stale restatements in 98 runs there (`learned-mdl-preflight.md` STOP
 rule 23; check each `-` line against `describe` per its BUG-146 note before re-drafting): any
 confirmed `-` line, or any target STOP rule 21 covers (aggregator, after-startup chain, navigation), means
 re-draft from a fresh `describe` — never patch. `exec.sh`'s own
diff --git a/tests/wave2/fixtures/module-close/lint-pedapp-v0.28.0.txt b/tests/wave2/fixtures/module-close/lint-pedapp-v0.28.0.txt
new file mode 100644
index 00000000..70f4ce53
--- /dev/null
+++ b/tests/wave2/fixtures/module-close/lint-pedapp-v0.28.0.txt
@@ -0,0 +1,19 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+Connected to: PedApp.mpr (Mendix 11.13.0)
+Cache invalid: project file modified
+Building catalog (full mode - includes activities/widgets)...
+MyFirstModule
+-------------
+  ⚠ Microflow 'ACT_Empty' has no activities [MPR002]
+      at MyFirstModule.ACT_Empty
+      → Add activities or remove the unused microflow
+
+  ⚠ Microflow name 'do_stuff' should use PascalCase with optional prefix (ACT_, SUB_, DS_, VAL_, SCH_, IVK_, BCO_, ACO_, BCR_, ACR_, BDE_, ADE_, BRO_, ARO_, OCH_, SE_, DL_, PWS_, ASU_, NAV_, LOGIN_) [MPR001]
+      at MyFirstModule.do_stuff
+      → DoStuff
+
+  ⚠ Microflow 'do_stuff' has no activities [MPR002]
+      at MyFirstModule.do_stuff
+      → Add activities or remove the unused microflow
+
+3 issues: 0 errors, 3 warnings, 0 info
diff --git a/tests/wave2/test-exec-lint-diff.sh b/tests/wave2/test-exec-lint-diff.sh
new file mode 100644
index 00000000..3fb39bac
--- /dev/null
+++ b/tests/wave2/test-exec-lint-diff.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Fixture for exec.sh's "lint: only what THIS script added" view (PR #581) and its carry-forward.
+#
+# usage: test-exec-lint-diff.sh /path/to/exec.sh
+#
+# run_lint_gate() is extracted from the given exec.sh and run against the real lint-gate.sh, with
+# lint output fed through LINT_JSON (no mxcli, no .mpr), one call per simulated exec.
+#   D1  a script adds a finding: rose, the finding is printed, LINT_RC 1
+#   D2  the next exec leaves it unfixed: still rose and printed (it went silent before: "0 new")
+#   D3  it is fixed: clean again
+#   D4  the user accepts it (lint-gate --update-baseline --reason): the next exec is clean
+#   D5  a rose exec lands in the metrics ledger as applied-lint-rose (status text exec.sh writes)
+#   D7  a rise while lint-last.json cannot be read: kept as a rise, never "0 new"
+#   D8  an exec after an undiffed rise (D7) still reads "lint rose"\n#   D6  the diff cannot run (no usable Python): reported as a rise vs baseline, never as "0 new"
+set -uo pipefail
+EXEC="${1:?usage: test-exec-lint-diff.sh /path/to/exec.sh}"
+TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+. "$TK/bin/lib/portable.sh"
+require_py
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/lint-diff.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
+
+P="$WORK/proj"; mkdir -p "$P/bin" "$P/.claude"
+cp "$TK/project-bin/lint-gate.sh" "$TK/project-bin/_common.sh" "$TK/project-bin/metrics-ledger.sh" "$P/bin/"
+printf 'mpr' > "$P/App.mpr"; printf '#!/bin/sh\nexit 0\n' > "$P/mxcli"; chmod +x "$P/mxcli" "$P/bin/"*.sh
+( . "$TK/bin/lib/install-lint-rules.sh"; mxtk_install_lint_rules "$TK" "$P" 0 "" ) >/dev/null 2>&1
+printf '| Toolkit root | `%s` |\n' "$TK" > "$P/CLAUDE.local.md"
+
+f() { printf '{"ruleId":"%s","severity":"warning","message":"%s","module":"Orders","document":"%s","documentType":"microflow","documentId":"id-%s","suggestion":"s"}' "$1" "$2" "$3" "$3"; }
+debt="$(f CONV010 old Old_Flow)"
+lint() { printf '{"violations":[%s],"summary":{}}' "$1" > "$WORK/lint.json"; }
+lint "$debt"; (cd "$P" && LINT_JSON="$WORK/lint.json" bash bin/lint-gate.sh --update-baseline >/dev/null 2>&1)
+
+fn="$WORK/run_lint_gate.sh"; sed -n '/^run_lint_gate() {/,/^}/p' "$EXEC" > "$fn"
+run_exec() { (cd "$P" && PROJECT_ROOT="$P" LINT_JSON="$WORK/lint.json" "$@" bash -c \
+  ". '$P/bin/_common.sh'; . '$fn'; LINT_RC=0; run_lint_gate; echo \"RESULT \$LINT_RC|\$LINT_DETAIL\"") 2>&1; }
+newf="$(f MPR001 "name do_stuff" do_stuff)"
+
+echo "D1 a script adds a finding"
+lint "$debt,$newf"; out=$(run_exec)
+{ printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && printf '%s' "$out" | grep -q 'MPR001'; } \
+  && ok "D1: rose, rc 1, MPR001 printed" || bad "D1" "$out"
+echo "D2 the next exec leaves it unfixed"
+out=$(run_exec)
+{ printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && printf '%s' "$out" | grep -q 'MPR001'; } \
+  && ok "D2: the unfixed finding is still rose and printed" || bad "D2: went silent" "$out"
+out=$(run_exec)
+printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && ok "D2: and on the exec after that" || bad "D2 third exec" "$out"
+echo "D3 it is fixed"
+lint "$debt"; out=$(run_exec)
+printf '%s' "$out" | grep -q 'RESULT 0|' && ok "D3: fixed → clean" || bad "D3" "$out"
+echo "D4 the user accepts it"
+lint "$debt,$newf"; run_exec >/dev/null
+(cd "$P" && LINT_JSON="$WORK/lint.json" REASON="accepted in chat" bash bin/lint-gate.sh --update-baseline --reason "accepted in chat" >/dev/null 2>&1)
+out=$(run_exec)
+printf '%s' "$out" | grep -q 'RESULT 0|' && ok "D4: accepted into the baseline → clean" || bad "D4" "$out"
+echo "D5 metrics ledger"
+(cd "$P" && bash bin/metrics-ledger.sh exec --script a.mdl --gate pass --result "⚠️ applied, LINT ROSE" --elapsed 5 --lint-rc 1 >/dev/null 2>&1)
+tail -1 "$P/.claude/loop/metrics-ledger.tsv" 2>/dev/null | grep -q 'applied-lint-rose' \
+  && ok "D5: a rose exec's status lands as applied-lint-rose" || bad "D5" "$(tail -2 "$P/.claude/loop/metrics-ledger.tsv" 2>/dev/null)"
+
+echo "D6 the per-script diff cannot run"
+lint "$debt,$(f MPR002 "empty flow" Empty_Flow)"
+out=$(run_exec env PY=/bin/false)
+printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && ok "D6: no diff → still a rise (rc 1), not a silent pass" || bad "D6: silent pass" "$out"
+echo "D8 an undiffed rise, then a normal exec: still a rise"
+out=$(run_exec)
+printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && ! printf '%s' "$out" | grep -q '0 new this script' \
+  && ok "D8: the exec after an undiffed rise is still lint rose" || bad "D8: findings became old debt" "$out"
+echo "D7 a rise, but lint-last.json is gone when the diff runs"
+lint "$debt,$(f MPR003 "bad name" Bad_Name)"
+printf '#!/bin/sh\nrm -f "%s/.claude/loop/lint-last.json"\nexec "%s" "$@"\n' "$P" "$PY" > "$WORK/py-nolast"; chmod +x "$WORK/py-nolast"
+rm -f "$P/.claude/loop/lint-prev-exec.json"
+out=$(run_exec env PY="$WORK/py-nolast")
+{ printf '%s' "$out" | grep -q 'RESULT 1|lint rose' && ! printf '%s' "$out" | grep -q '0 new this script'; } \
+  && ok "D7: unreadable lint-last.json → still a rise (rc 1), never '0 new'" || bad "D7: downgraded to 0 new" "$out"
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-module-close.sh b/tests/wave2/test-module-close.sh
new file mode 100644
index 00000000..034d5cf9
--- /dev/null
+++ b/tests/wave2/test-module-close.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/module-close.sh (PR #581).
+#
+# usage: test-module-close.sh /path/to/module-close.sh
+#
+# Golden input: tests/wave2/fixtures/module-close/lint-pedapp-v0.28.0.txt, `mxcli lint` from
+# mxcli v0.28.0 on a scratch copy of mxcli's testdata/pedapp with two bad microflows added in
+# MyFirstModule (3 warnings; the catalog's ✓ progress lines removed). The stub mxcli replays it.
+#   C1  the report carries the summary line bin/row-groups.sh reads (lint=N vm=RC), N counted from
+#       the real lint format; and bin/row-groups.sh reads it (open with findings, done at 0)
+#   C2  two-tree checkout (.mpr under app/, no root .mpr): the report is written, not "no .mpr here"
+#   R1  reload.sh (beside module-close.sh): both layouts; .docker/ is read beside the .mpr, where
+#       mxcli writes it (cmd/mxcli/docker/build.go)
+set -uo pipefail
+SUT="${1:?usage: test-module-close.sh /path/to/module-close.sh}"
+TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+LINT="$TK/tests/wave2/fixtures/module-close/lint-pedapp-v0.28.0.txt"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/module-close.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
+
+mkproj() {  # $1 dir, $2 where the .mpr goes ("" = root, "app" = two-tree)
+  local p="$1"
+  mkdir -p "$p/bin" "$p/${2:-.}"
+  cp "$SUT" "$p/bin/module-close.sh"; cp "$TK/project-bin/_common.sh" "$p/bin/"
+  : > "$p/${2:-.}/App.mpr"
+  # mxcli stub: `lint` replays the capture, `docker check` passes, and every call is logged.
+  printf '#!/bin/sh\necho "$*" >> "%s/mxcli.calls"\ncase "$1" in lint) cat "%s" ;; docker) echo "Build succeeded" ;; esac\n' "$p" "$LINT" > "$p/mxcli"
+  printf '#!/bin/sh\necho "score 71"\n' > "$p/bin/metrics-ledger.sh"
+  printf '#!/bin/sh\necho "verdict CLEAN"\nexit 0\n' > "$p/bin/verify-module.sh"
+  printf '#!/bin/sh\necho "owed MyFirstModule.Home_Web"\n' > "$p/bin/look-ledger.sh"
+  chmod +x "$p/mxcli" "$p/bin/"*.sh
+}
+
+echo "== C1 summary line, counted from real lint output"
+P="$WORK/single"; mkproj "$P" ""
+out=$(cd "$P" && bash bin/module-close.sh MyFirstModule 2>&1); rc=$?
+R="$P/docs/progress/module-close/MyFirstModule.md"
+{ [ "$rc" = 1 ] && grep -q '<!-- mxtk-module-close: lint=3 vm=0 -->' "$R"; } \
+  && ok "C1: MyFirstModule has 3 ⚠ in the capture → lint=3, exit 1" || bad "C1: rc=$rc" "$out$(cat "$R" 2>/dev/null | head -5)"
+out=$(cd "$P" && bash bin/module-close.sh Administration 2>&1); rc=$?
+{ [ "$rc" = 0 ] && grep -q 'mxtk-module-close: lint=0 ' "$P/docs/progress/module-close/Administration.md"; } \
+  && ok "C1: a module with no ⚠ → lint=0, exit 0" || bad "C1 clean: rc=$rc" "$out"
+# The consumer: bin/row-groups.sh reads the line this script wrote.
+mkdir -p "$P/architecture/modules/MyFirstModule" "$P/architecture/modules/Billing" "$P/mdlsource"
+cp "$TK/project-bin/row-groups.sh" "$P/bin/"
+{ printf '### Phase 1 — MyFirstModule\n\n| # | Kind | Step | Produces | Depends on | Skills | State |\n|---|---|---|---|---|---|---|\n'
+  printf '| 1 | BUILD | Home page | p | — | `mdl-pages.md` | done |\n\n'
+  printf '### Phase 2 — Billing\n\n| # | Kind | Step | Produces | Depends on | Skills | State |\n|---|---|---|---|---|---|---|\n'
+  printf '| 2 | BUILD | Invoice entity | e | 1 | `mdl-entities.md` | not built |\n'; } > "$P/architecture/build-plan.md"
+printf -- '-- rows: 2\n' > "$P/mdlsource/b.mdl"
+out=$(cd "$P" && bash bin/row-groups.sh check mdlsource/b.mdl 2>&1); rc=$?
+{ [ "$rc" = 1 ] && printf '%s' "$out" | grep -q 'MyFirstModule (open'; } \
+  && ok "C1: row-groups reads lint=3 + empty LOOK table as not closed" || bad "C1 consumer open: rc=$rc" "$out"
+printf '| Home_Web | User | look/home-user.png | none | — |\n' >> "$R"
+out=$(cd "$P" && bash bin/row-groups.sh check mdlsource/b.mdl 2>&1); rc=$?
+[ "$rc" = 0 ] && ok "C1: one filled LOOK row in the written report → closed" || bad "C1 consumer filled: rc=$rc" "$out"
+
+echo "== C2 two-tree checkout"
+P2="$WORK/two"; mkproj "$P2" app
+out=$(cd "$P2" && bash bin/module-close.sh MyFirstModule 2>&1); rc=$?
+{ [ -f "$P2/docs/progress/module-close/MyFirstModule.md" ] && grep -q -- '-p .*app/App.mpr' "$P2/mxcli.calls"; } \
+  && ok "C2: .mpr under app/ → report written, mxcli given app/App.mpr" || bad "C2: rc=$rc" "$out"
+
+
+echo "== R1 reload.sh, both layouts (stub docker, curl, mxcli)"
+RL="$(dirname "$SUT")/reload.sh"
+if [ -f "$RL" ]; then
+  mkdir -p "$WORK/stubs"
+  printf '#!/bin/sh\n[ "$1 $2" = "compose port" ] && echo "0.0.0.0:18090"\nexit 0\n' > "$WORK/stubs/docker"
+  printf '#!/bin/sh\necho "$*" >> "%s/curl.calls"\nprintf 200\n' "$WORK" > "$WORK/stubs/curl"
+  chmod +x "$WORK/stubs/docker" "$WORK/stubs/curl"
+  for lay in "" app; do
+    P3="$WORK/rl-${lay:-root}"; mkproj "$P3" "$lay"; cp "$RL" "$P3/bin/reload.sh"; chmod +x "$P3/bin/reload.sh"
+    mkdir -p "$P3/${lay:-.}/.docker"; printf 'APP_PORT=18080\n' > "$P3/${lay:-.}/.docker/.env"; : > "$WORK/curl.calls"
+    out=$(cd "$P3" && PATH="$WORK/stubs:$PATH" APP_URL= bash bin/reload.sh 2>&1); rc=$?
+    want="${lay:+app/}App.mpr"
+    { [ "$rc" = 0 ] && grep -q -- "docker reload -p .*$want --direct --port 18090" "$P3/mxcli.calls" && grep -q 'localhost:18080/login.html' "$WORK/curl.calls"; } \
+      && ok "R1 ${lay:-single tree}: reload --direct on $want, app URL from the .docker/.env beside it" \
+      || bad "R1 ${lay:-single tree}: rc=$rc" "$out$(cat "$P3/mxcli.calls" 2>/dev/null)"
+  done
+else
+  echo "  [skip] no reload.sh beside $SUT"
+fi
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-row-groups.sh b/tests/wave2/test-row-groups.sh
new file mode 100644
index 00000000..8644029b
--- /dev/null
+++ b/tests/wave2/test-row-groups.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/row-groups.sh check (the exec.sh row-group gate, PR #581).
+#
+# usage: test-row-groups.sh /path/to/row-groups.sh
+#
+# Golden input: tests/wave2/fixtures/build-plan-claims-real.md, a build plan captured from a real
+# field build (SampleDashboards). Its scripts are numbered on their own sequence, as
+# skills/brd-to-build-plan.md documents (`16-cutover.mdl` is row 26), so a file-name number is not a
+# row number. The gate runs on a script only when the script says its rows (`-- rows: 14,15`) or the
+# project opts in with `Row groups: on` in PROJECT.md (then its file names carry row numbers).
+#   G1  real plan, no opt-in: no script name in it is refused (16-cutover.mdl was, as row 16)
+#   G2  `-- rows:` header: the split-group refusal still works on the real plan
+#   G3  `Row groups: on`: a file-name number is read as the row again
+#   S1  built = an explicit built/done/applied State; planned, **blocked**, partial, empty are not
+#   M1  module close: the report must record 0 lint findings for the module, or a filled LOOK row
+set -uo pipefail
+SUT="${1:?usage: test-row-groups.sh /path/to/row-groups.sh}"
+TK="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GOLD="$TK/tests/wave2/fixtures/build-plan-claims-real.md"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/row-groups.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; }
+
+mkproj() {  # $1 dir; build plan from stdin
+  mkdir -p "$1/bin" "$1/architecture" "$1/docs" "$1/mdlsource"
+  cp "$SUT" "$1/bin/row-groups.sh"; cp "$TK/project-bin/_common.sh" "$1/bin/"; chmod +x "$1/bin/row-groups.sh"
+  : > "$1/App.mpr"; cat > "$1/architecture/build-plan.md"
+}
+chk() {  # $1 project, $2 script file name, rest: script body lines → "rc|output"
+  local p="$1" s="$2"; shift 2
+  printf '%s\n' "$@" > "$p/mdlsource/$s"
+  out=$(cd "$p" && bash bin/row-groups.sh check "mdlsource/$s" 2>&1); rc=$?
+}
+
+echo "== G1 real plan, no opt-in: file-name numbers are script numbers"
+P="$WORK/real"; mkproj "$P" < "$GOLD"
+refused=""
+for s in $(grep -o '`[0-9][0-9a-z]*-[a-z0-9-]*\.mdl`' "$GOLD" | tr -d '`' | sort -u); do
+  chk "$P" "$s" "-- $s"
+  [ "$rc" = 1 ] && refused="$refused $s"
+done
+[ -z "$refused" ] && ok "G1: no script of the real plan is refused by its file-name number" \
+  || bad "G1: refused by file-name number:$refused" "$out"
+chk "$P" "16-cutover.mdl" "-- cutover"
+[ "$rc" = 3 ] && ok "G1: 16-cutover.mdl (row 26) is not checked without a rows header (exit 3)" || bad "G1: 16-cutover.mdl rc=$rc" "$out"
+
+echo "== G2 rows header on the real plan"
+chk "$P" "09-snippets.mdl" "-- rows: 14" "create snippet ..."
+{ [ "$rc" = 1 ] && printf '%s' "$out" | grep -q '15, 16'; } && ok "G2: rows 14 alone leaves 15, 16 of its low group unbuilt → refused" || bad "G2: rc=$rc" "$out"
+chk "$P" "09-11-snippets-pages.mdl" "-- rows: 14,15,16"
+[ "$rc" = 0 ] && ok "G2: the whole group in one script passes" || bad "G2 whole group: rc=$rc" "$out"
+
+echo "== G3 opt-in: file names carry row numbers"
+P3="$WORK/optin"; mkproj "$P3" < "$GOLD"
+printf '# Project\n\n- Row groups: on — CONFIRMED\n' > "$P3/PROJECT.md"
+chk "$P3" "14-snippets.mdl" "create snippet ..."
+[ "$rc" = 1 ] && ok "G3: with Row groups: on, 14-snippets.mdl is row 14 and is refused (group 14-16)" || bad "G3: rc=$rc" "$out"
+printf '# Project\n\n- Row groups: off\n' > "$P3/PROJECT.md"
+chk "$P3" "14-snippets.mdl" "create snippet ..."
+[ "$rc" = 3 ] && ok "G3: Row groups: off → not checked" || bad "G3 off: rc=$rc" "$out"
+
+echo "== S1 what counts as built"
+plan_states() {  # $1 $2 $3 = states of rows 1..3 (one low group)
+  printf '## Phase 1 — Core\n\n| # | Kind | Step | Produces | Depends on | Skills | State |\n|---|---|---|---|---|---|---|\n'
+  printf '| 1 | BUILD | Order entity | e | — | `mdl-entities.md` | %s |\n' "not built"
+  printf '| 2 | BUILD | Order overview page | p | 1 | `mdl-pages.md` | %s |\n' "$1"
+  printf '| 3 | BUILD | Order edit page | p | 1 | `mdl-pages.md` | %s |\n' "$2"
+}
+for pair in "planned|**blocked**" "partial|" "in progress|open"; do
+  P4="$WORK/s1-$RANDOM"; plan_states "${pair%%|*}" "${pair#*|}" | mkproj "$P4"
+  chk "$P4" "a.mdl" "-- rows: 1"
+  { [ "$rc" = 1 ] && printf '%s' "$out" | grep -q '\[2, 3\]'; } && ok "S1: states '${pair%%|*}' / '${pair#*|}' are not built → split refused" \
+    || bad "S1: states '${pair%%|*}' / '${pair#*|}' rc=$rc" "$out"
+done
+P4="$WORK/s1-done"; plan_states "done 2026-10-01" "**built**" | mkproj "$P4"
+chk "$P4" "a.mdl" "-- rows: 1"
+[ "$rc" = 0 ] && ok "S1: 'done 2026-10-01' and '**built**' are built → row 1 alone passes" || bad "S1 done: rc=$rc" "$out"
+P4="$WORK/s1-log"; plan_states "planned" "planned" | mkproj "$P4"
+printf '| t | `a.mdl` | pass | ✅ applied | rows 2,3 |\n' > "$P4/docs/BUILD-LOG.md"
+printf -- '-- rows: 2,3\n' > "$P4/mdlsource/a.mdl"
+chk "$P4" "b.mdl" "-- rows: 1"
+[ "$rc" = 0 ] && ok "S1: rows a BUILD-LOG 'applied' script declared (-- rows: 2,3) count as built" || bad "S1 log: rc=$rc" "$out"
+
+echo "== M1 module close is read, not just found"
+mplan() {
+  printf '### Phase 1 — Orders\n\n| # | Kind | Step | Produces | Depends on | Skills | State |\n|---|---|---|---|---|---|---|\n'
+  printf '| 1 | BUILD | Order entity | e | — | `mdl-entities.md` | done |\n'
+  printf '| 2 | BUILD | Order page | p | 1 | `mdl-pages.md` | done |\n\n'
+  printf '### Phase 2 — Billing\n\n| # | Kind | Step | Produces | Depends on | Skills | State |\n|---|---|---|---|---|---|---|\n'
+  printf '| 3 | BUILD | Invoice entity | e | 2 | `mdl-entities.md` | not built |\n'
+  printf '| 4 | BUILD | Invoice page | p | 3 | `mdl-pages.md` | not built |\n'
+}
+P5="$WORK/mc"; mplan | mkproj "$P5"; mkdir -p "$P5/architecture/modules/Orders" "$P5/architecture/modules/Billing" "$P5/docs/progress/module-close"
+R="$P5/docs/progress/module-close/Orders.md"
+chk "$P5" "b.mdl" "-- rows: 3,4"
+{ [ "$rc" = 1 ] && printf '%s' "$out" | grep -q 'module close owed for Orders'; } && ok "M1: no report → refused" || bad "M1 none: rc=$rc" "$out"
+table='| Page | Role | Seen (screenshot path) | Defect | Fixed in row/script |
+|---|---|---|---|---|'
+printf '# Module close: Orders\n\n<!-- mxtk-module-close: lint=2 vm=0 -->\n\n## 6. Lead\n\n%s\n' "$table" > "$R"
+chk "$P5" "b.mdl" "-- rows: 3,4"
+{ [ "$rc" = 1 ] && printf '%s' "$out" | grep -q 'Orders'; } && ok "M1: report with 2 lint findings and an empty LOOK table → refused" || bad "M1 empty table: rc=$rc" "$out"
+printf '# Module close: Orders\n\n## 6. Lead\n\n%s\n' "$table" > "$R"
+chk "$P5" "b.mdl" "-- rows: 3,4"
+[ "$rc" = 1 ] && ok "M1: report with no summary line and an empty LOOK table → refused" || bad "M1 no marker: rc=$rc" "$out"
+printf '# Module close: Orders\n\n<!-- mxtk-module-close: lint=0 vm=0 -->\n\n## 6. Lead\n\n%s\n' "$table" > "$R"
+chk "$P5" "b.mdl" "-- rows: 3,4"
+[ "$rc" = 0 ] && ok "M1: report recording 0 lint findings → passes" || bad "M1 lint=0: rc=$rc" "$out"
+printf '# Module close: Orders\n\n<!-- mxtk-module-close: lint=2 vm=1 -->\n\n## 6. Lead\n\n%s\n| Order_Overview | User | look/orders-user.png | none | — |\n' "$table" > "$R"
+chk "$P5" "b.mdl" "-- rows: 3,4"
+[ "$rc" = 0 ] && ok "M1: findings but a filled LOOK row → passes (the lead recorded the pass)" || bad "M1 filled: rc=$rc" "$out"
+rm -f "$R"
+chk "$P5" "03-billing.mdl" "create entity ..."
+[ "$rc" = 3 ] && ok "M1: no rows header, no opt-in → the module-close part does not run either" || bad "M1 no opt-in: rc=$rc" "$out"
+
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]