diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ae88844..c2e5509b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- perf(exec): **~55% fewer forks and ~60% fewer process starts per exec** (Windows: ~100 ms each; follow-up to #584/#585). Measured on a two-module Purchasing/Approval app (Mendix 11.13, `Gate mode: check`), Linux, `strace -f` counting clone+execve for one `./bin/exec.sh`: forks 733 → 335, execs 350-375 → 135, 3 runs each; verdicts, exit codes, output and the BUILD-LOG row are byte-identical. What changed: **exec.sh** resolves the model, platform, Python and toolkit root once and hands them down as exported memos (`MXTK_MPR_MEMO`, `MXTK_MODEL_DIR_MEMO`, `MXTK_PLATFORM`, `MXTK_PY_MEMO`), uses `EPOCHSECONDS` / `printf %(…)T` / `${x##*/}` instead of `date` / `basename` / `dirname`, reads PROJECT.md and CLAUDE.local.md fields in-shell, and parses lint-gate's output with ONE awk instead of ~10 grep/sed/tr/sort/paste; **_common.sh** waits for an unbounded gate with `wait` instead of a `sleep 1` process per second (10 on a warm build, 150+ on a cold Windows one), reads the model version with one Python start instead of two, and no longer starts basename/cut/sed/grep to match a Studio Pro folder to a version; **model-stamp.sh** asks git once (it asked 6 times), keeps the file list in an array instead of mktemp/paste/rm, reads the stamp once, and `clear` answers before any set-up; **snapshot-mpr.sh**, **look-ledger.sh**, **script-owners.sh**, **metrics-ledger.sh**, **row-groups.sh**, **build-plan-status.sh**, **lint-gate.sh**, **exec-approval.sh**, **mdl-scan.sh** drop their dirname/basename/date/ls|wc|tr/find|wc forks; lint-gate skips its rule-receipt Python while no rule file, receipt or disabled-list is newer than the last clean check. `MXTK_PROFILE=2` traces the scripts exec.sh starts as well (=1 counts only exec.sh's own commands, so a started script is one line there), and the profile lines now name the file. Reported by mkr87. — mkr87 (#584, #585)
 - new(doctor, init): **`bin/doctor.sh <project>` measures performance, not just presence**: a "Performance (measured)" section reads the last 20 `steps:` rows of the project's BUILD-LOG and reports the median exec time, the median gate and the slowest step against a normal machine (17-34 s per exec, gate 9-20 s), warning above 60 s per exec or 45 s gate with the lever to pull; on Windows with slow process starts it recommends (never requires) WSL2 or a dev container (Docker Engine in WSL2, Rancher Desktop, Podman Desktop). `Gate mode: check` is the default for every project, existing ones included after sync (`Gate mode: full` in PROJECT.md keeps a full build per exec). Windows field run (ExpenseTracker, Windows 11, Git Bash, 103 ms per process start): check-only execs took 90-103 s against 138-139 s with the full build (gate 60 s → 12-14 s); the 60-70 s of non-gate overhead is the next target. Reported by mkr87. — mkr87 (#584, #585)
 - new(exec): **check-only gate by default (`Gate mode: full` in PROJECT.md, or `MXTK_GATE_MODE=full`, opts out)**: each exec runs `mx check` (beside mxbuild, same version) instead of the full deploy build, converting its JSON into mxbuild's errors shape so the delta gate, rollback and report are unchanged. The full build still runs when Java/JavaScript/theme/widgets changed since the last full build, when the project has Java actions and the script drops or renames something (`drop … if exists`, the re-create idiom, does not count), on `--patch`, before any full build is recorded, and after 10 check-only passes in a row (`MXTK_CHECK_MAX`). The other full builds sit at the work's natural boundaries, as mxcli itself advises (`mx check` after every exec, mxbuild when packaging): a new pre-push hook and `module-close.sh` run `bin/verify-model.sh` when the stamp says the model was only `mx check`ed (the stamp now records `kind: check|full`; `model-stamp.sh check --full`), and `bin/verify-model.sh` closes a batch on demand. Commits stay allowed on a check stamp. Field run (purchase-requests app, Linux, Mendix 11.13.0): gate 20 s → 9-10 s; a push after check-only execs ran the full build (20 s) and re-stamped the model as full; a dropped attribute caught as 6 × CE1613 by `mx check` on the broken model. Golden input: captured `mx check -j` output in `tests/wave2/fixtures/mx-check/`. For #584/#585 (Windows, mkr87). — mkr87 (#584, #585)
 - perf(exec, doctor): **Windows exec overhead (#584/#585)**: exec.sh resolves mxbuild and the model version once per run and exports them (`MXBUILD_PATH`, `MXTK_MODEL_VERSION`) instead of re-probing per call; the build-plan page refresh runs in the background after the verdict (`MXTK_SYNC_REFRESH=1` waits); the first full build after an hour says a cold start can take 2-3 min; `MXTK_PROFILE=1` traces every command with a timestamp and prints the 15 slowest lines plus the step times; `bin/doctor.sh` measures process-start cost and above 30 ms names the antivirus exclusions to ask for (or WSL2/dev container); a missing lint baseline now says `bin/lint-gate.sh --update-baseline` instead of "lint could not run (exit 2)". Reported by mkr87. — mkr87 (#584, #585)
@@ -101,7 +102,6 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 - fix(exec): **a script restated from a stale DESCRIBE now WARNs instead of silently reverting an earlier exec** (#261). A script drafted from a DESCRIBE taken before an earlier script of the batch ran put four old messages back, with check, mxbuild and lint green. New `project-bin/describe-baseline.sh stamp` writes `-- baseline: <Doc> sha256=<hash>` (plus `-- baseline-mxcli: <version>`) from a DESCRIBE at draft time; `exec.sh` runs `verify` only for a script that carries the header, so other scripts cost one grep and no mxcli call. It reports DRIFT with the first lines of the diff, STALEHEADER, and RESTAMP after an mxcli upgrade (DESCRIBE text may change, so that is not called drift). A re-run by the script's own last recorded write (the #269 ledger) and a fresh model are not drift. Nothing is refused and the exit codes do not change. Preflight STOP 21 gains one clause (`-- supersedes:`, `stamp`, exec.sh only warns) and its trigger names `create or modify` (+24 words). Not-found DESCRIBE and `--version` output are captured from mxcli v0.26.0. Lands after the #269 PR; with it, supersedes draft #311. **Behaviour change to check in your project:** `exec.sh` output can carry `WARN: stale draft: …` lines, and the BUILD-LOG detail cell `WARN stale baseline: <docs>`; `MXTK_RESTATE_GUARD=off` skips the check. — AlvinnYeo (#261)
 - fix(exec): **re-running an older `mdlsource/` script over a newer owner's live work now WARNs instead of passing silently** (#269). Three field apps had 99/579, 130/357 and 38/159 documents created by more than one script, and a replay of an older one reverted the newer with exit 0 and every gate green. New `project-bin/script-owners.sh` maps each microflow, nanoflow, page and snippet to the scripts that create or restate it, in run order (digit runs compared as numbers, so `2-core/` runs before `11-fixes/`; `done-` ignored), and reads `-- supersedes:` / `-- superseded-by:` headers. `exec.sh` records every kept write in a machine-local last-writer ledger (`.claude/loop/script-owners/`, self-gitignored, compacted per write); `restore-mpr.sh` marks it on a manual restore. A replay WARNs only when the newer owner's write is live: ledger first, else one DESCRIBE per document, at most 5 per exec (the rest print `CONFLICT (not checked)`). A new owner without a supersedes header gets one `NOTE:` line on its first run, kept out of BUILD-LOG. Nothing is refused and the exit codes do not change. With no co-owner, `exec.sh` runs one grep over `mdlsource/` and no mxcli call. `gate-check.sh` prints the co-owned count when it is above 0. Part of the rebuilt draft #311 (with the #261 PR). **Behaviour change to check in your project:** `exec.sh` output can carry `WARN: restatement: …` and `NOTE: new owner of …` lines; the BUILD-LOG detail cell can carry `WARN reverts: <docs>`. Set `MXTK_RESTATE_GUARD=off` to skip the check. — MendixMau (#269)
 - fix(exec): **re-running an older `mdlsource/` script over a newer owner's live work now WARNs instead of passing silently** (#269). Three field apps had 99/579, 130/357 and 38/159 documents created by more than one script, and a replay of an older one reverted the newer with exit 0 and every gate green. New `project-bin/script-owners.sh` maps each microflow, nanoflow, page and snippet to the scripts that create or restate it, in run order (digit runs compared as numbers, so `2-core/` runs before `11-fixes/`; `done-` ignored), and reads `-- supersedes:` / `-- superseded-by:` headers. `exec.sh` records every kept write in a machine-local last-writer ledger (`.claude/loop/script-owners/`, self-gitignored, compacted per write); `restore-mpr.sh` marks it on a manual restore. A script counts as run when it has a ledger row, a `done-` name, or an applied `docs/BUILD-LOG.md` row, so a fresh clone or cloud session (empty ledger) still warns on a replay over committed newer work; a script nobody ran yet (draft-ahead) stays quiet. The ledger cannot see Studio Pro edits or a `git pull`/`checkout` of the `.mpr`. A replay WARNs only when the newer owner's write is live: ledger first, else one DESCRIBE per document, at most 5 per exec (the rest print `CONFLICT (not checked)`). A new owner without a supersedes header gets one `NOTE:` line on its first run, kept out of BUILD-LOG. Nothing is refused and the exit codes do not change. With no co-owner, `exec.sh` runs one grep over `mdlsource/` and no mxcli call. `gate-check.sh` prints the co-owned count when it is above 0. Part of the rebuilt draft #311 (with the #261 PR). **Behaviour change to check in your project:** `exec.sh` output can carry `WARN: restatement: …` and `NOTE: new owner of …` lines; the BUILD-LOG detail cell can carry `WARN reverts: <docs>`. Set `MXTK_RESTATE_GUARD=off` to skip the check. — MendixMau (#269)
-- fix(exec): **re-running an older `mdlsource/` script over a newer owner's live work now WARNs instead of passing silently** (#269). Three field apps had 99/579, 130/357 and 38/159 documents created by more than one script, and a replay of an older one reverted the newer with exit 0 and every gate green. New `project-bin/script-owners.sh` maps each microflow, nanoflow, page and snippet to the scripts that create or restate it, in run order (digit runs compared as numbers, so `2-core/` runs before `11-fixes/`; `done-` ignored), and reads `-- supersedes:` / `-- superseded-by:` headers. `exec.sh` records every kept write in a machine-local last-writer ledger (`.claude/loop/script-owners/`, self-gitignored, compacted per write); `restore-mpr.sh` marks it on a manual restore. A script counts as run when it has a ledger row, a `done-` name, or an applied `docs/BUILD-LOG.md` row, so a fresh clone or cloud session (empty ledger) still warns on a replay over committed newer work; a script nobody ran yet (draft-ahead) stays quiet. The ledger cannot see Studio Pro edits or a `git pull`/`checkout` of the `.mpr`. A replay WARNs only when the newer owner's write is live: ledger first, else one DESCRIBE per document, at most 5 per exec (the rest print `CONFLICT (not checked)`). A new owner without a supersedes header gets one `NOTE:` line on its first run, kept out of BUILD-LOG. Nothing is refused and the exit codes do not change. With no co-owner, `exec.sh` runs one grep over `mdlsource/` and no mxcli call. `gate-check.sh` prints the co-owned count when it is above 0. Part of the rebuilt draft #311 (with the #261 PR). **Behaviour change to check in your project:** `exec.sh` output can carry `WARN: restatement: …` and `NOTE: new owner of …` lines; the BUILD-LOG detail cell can carry `WARN reverts: <docs>`. Set `MXTK_RESTATE_GUARD=off` to skip the check. — MendixMau (#269)
 - fix(root): **the installed and toolkit copies of `_common.sh` now resolve the same project root from inside an app folder** (#489). With the cwd in `app/`, `app/javasource` or `apps/<X>/`, the installed copy (`<project>/bin/_common.sh`, tier 2) answered the project while the toolkit copy (tier 3) stopped at the folder holding the `.mpr`, so the same script wrote its look ledger, metrics ledger and BUILD-LOG to two roots depending on where it was run from. `mxtk_walk_root` now returns the project folder when the folder it stops at is `<p>/app` or `<p>/apps/<X>` and `<p>` is a marked project folder (an installed `bin/_common.sh`, or `.claude/` beside `PROJECT.md`); an unmarked app folder is still returned as itself, and so is an app folder that is a project of its own (its own install, or `.claude/` beside `PROJECT.md`); the folder names match in any letter case, and single-tree resolution is unchanged. Builtin tests only, no extra process. `find_mpr` now always prints an absolute path (a cwd-relative `MPR_FILE` broke once a caller did `cd "$PROJECT_ROOT"`), and with several apps and no `MPR_FILE`, sourcing `_common.sh` from inside one app's folder exports `MPR_FILE` as that app's model, so the pick survives exec.sh's `cd "$PROJECT_ROOT"` and reaches `snapshot-mpr.sh` (outside any one app nothing is picked and `find_mpr` still refuses; an explicit `MPR_FILE` or a root/`app/` model always wins; the pick is marked `MXTK_MPR_PICKED`, so a child script whose cwd is inside a different `apps/<X>/` re-derives instead of inheriting it, and `model-stamp.sh` says "(picked from your cwd)" when it refuses one). `lint-gate.sh` now honours `MPR_FILE` when `MPR` is unset and it resolves under the project root, so exec.sh run from inside one app no longer reaches its "several apps" refusal; an `MPR_FILE` that does not resolve there (cwd-relative, or absolute through a symlinked path) falls back to discovery as before, never to exit 2. An inherited pick from another project is dropped. **Behaviour change to check in your project:** a toolkit-copy script run from inside `app/` or `apps/<X>/` of a wired project now reads and writes state at the project root, as the installed copy already did; if `app/` (or `apps/<X>/`) holds `.mpr-snapshots/`, `docs/BUILD-LOG.md` or `.claude/loop/` from a toolkit-copy run, merge them into the project root. `find_mpr` with `MPR_FILE` set now prints an absolute path where it echoed a relative one. A project whose `bin/_common.sh` is hand-edited needs `sync-project.sh <project> --only-bin _common.sh --upgrade-bin _common.sh`, as for #420. `test-common-root-multiapp.sh` R8a, R9c-f, R13g, R17a-j and R18a-h (cwd in `app/`, `app/javasource`, `apps/A`, `apps/A/javasource`, a nested or wired app folder, `App/`, both copies; the cwd's app surviving a `cd` to the root and a child `snapshot-mpr.sh`; a child in another app re-deriving, R18h a child in another project): 67/67 with the fix; `test-lint-gate-accept.sh` T-MA (lint-gate with `MPR_FILE` in a multi-app folder) and T-MF (an unresolvable `MPR_FILE` falls back to discovery). — MendixMau (review 2026-10-20)
 - fix(portability): **`bug-lookup.sh --index` and `test-routing-tier.sh` no longer depend on sed expanding `\t`, and `check-portability.sh` flags `\t` in a sed pattern or replacement outside a bracket** (#488). BSD sed (macOS) reads `\t` there as the letter `t`, so `sed -E 's/^([0-9]+):## /\1\t/'` fed `awk -F'\t'` no tab and `--index` printed 222 empty lines; the line-count check passed anyway. The index is now one awk (same 222 lines, byte-identical on GNU), the fixture builds its sed script with a real tab (`TAB=$'\t'`), and `test-bug-lookup.sh` runs `--index` under a sed shim that reads `\t` as `t` (fails on master: 0 non-empty lines). The lint also had a blind spot: its comment filter dropped any line holding `:#`, so the bug-lookup line was never checked; it is now anchored on the line number. New rule over the current tree: the two sites on master, 0 elsewhere. `test-sed-tab-bracket.sh` T4. Simulated on Linux only; one macOS run is still owed. — MendixMau (review 2026-10-20)
 - fix(look hook, verify-module, coverage): **the look hook records from any cwd, and `verify-module.sh` loses four instrument faults** (#446). (a) The PostToolUse(Read) hook was `bash bin/look-ledger.sh seen || true`: from any cwd but the project root (a subagent in a private copy, a shell in `app/javasource`) it exited 127 and `|| true` hid it (field: 30 pages owed, 1 seen). `install-claude-permissions.sh` now writes it to `cd "$CLAUDE_PROJECT_DIR"` first; a missing script or failed run goes to stderr, and is logged once to `.claude/loop/look/hook.log` when that can be written. The installer (and `sync-project.sh`'s hook repair) rewrites the old form in place and removes duplicate look hooks, so one remains; `doctor.sh` flags any look hook not in the root-resolving form. (b) A module with 0 pages in the page scope reports journeys N/A instead of a FAULT (`page-scope.sh` now runs before the runtime rungs; same mxcli calls) — jopterhorst (comment on #446); a missing journey JSON names any `tests/<module>*.test.sh` that exist in another shape; missing e2e dependencies (playwright, axe-core, probed from `JOURNEY_RUNNER`/`MONKEY_JS`/`DESIGN_AUDIT_JS`'s folders) are one FAULT row with the one fix (`npm install playwright axe-core && npx playwright install chromium`), journeys and monkey SKIPPED as dependents of playwright, the design audit static-only; the coverage rung's budget is 1200 s (was 300); `summary.tsv` ends with a `verdict` row (CLEAN / FINDINGS / INCOMPLETE), absent when a run was cut short (`report-normalize.js` skips it); and `coverage-preflight.sh`'s PHANTOM CLAIM pass gives each BRD only the claims it can resolve (12-BRD bench: 16.1 s to 4.2 s), with identical verdicts except that false PHANTOMs for BRDs in another source folder or named only by `.id` are gone (exit can drop 1→0). Found while proving it: every rung's watchdog `sleep` kept the script's stdout open, so `verify-module.sh | tee` waited up to 30 minutes after the verdict; the watchdogs now drop fds 3/4 and take their sleep with them. **Behaviour change to check in your project:** a page-less module's `summary.tsv` has `journeys SKIPPED (N/A: ...)` and the run can exit 0; missing e2e dependencies add an `e2e harness dependency` FAULT row and SKIPPED journeys/monkey rows; `summary.tsv` gains a last `verdict` row; `coverage-preflight.sh` can exit 0 where it exited 1 (the false PHANTOMs above); `.claude/settings.json`'s look hook command changes. Fixtures: `test-look-hook-cwd.sh`, `test-verify-module-446.sh`, `test-coverage-phantom-scope.sh`. — MendixMau (field 2026-10-17), jopterhorst (page-less modules)
diff --git a/bin/doctor.sh b/bin/doctor.sh
index 5ee40623..a537ab9a 100755
--- a/bin/doctor.sh
+++ b/bin/doctor.sh
@@ -492,7 +492,7 @@ if [ -n "$_perf_log" ] && [ -f "$_perf_log" ] && grep -q 'steps: ' "$_perf_log"
     warn "slow execs — $_pmsg"
     [ "$_pgate" -gt "${MXTK_PERF_GATE_WARN:-45}" ] && note "The gate (mxbuild) dominates: 'Gate mode: check' in PROJECT.md runs mx check per exec and the full build before push."
     [ -n "$_spawn_ms" ] && [ "$_spawn_ms" -gt "${MXTK_SPAWN_WARN_MS:-30}" ] && note "Process starts are slow too (above): that is the machine, not the model — see the advice there."
-    note "Per-command profile of one exec: MXTK_PROFILE=1 ./bin/exec.sh <script> (prints the 15 slowest lines)."
+    note "Per-command profile of one exec: MXTK_PROFILE=1 ./bin/exec.sh <script> (prints the 15 slowest lines; MXTK_PROFILE=2 traces the scripts it starts too)."
   else
     ok "$_pmsg"
   fi
diff --git a/bin/exec-approval.sh b/bin/exec-approval.sh
index bfafd487..a9ef5001 100755
--- a/bin/exec-approval.sh
+++ b/bin/exec-approval.sh
@@ -48,8 +48,6 @@
 
 set -u
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
 PROJECT_DIR="${1:-}"
 ACTION="${2:-}"
 
@@ -129,9 +127,14 @@ if [ -z "$MODE" ] && [ -f "$PROJECT_DIR/PROJECT.md" ]; then
   # first occurrence wins so an appended log entry cannot silently retune the project. The whole
   # rest of the line is the value, so any trailing note is invalid → `ask`. (interview-mode.sh
   # allows a note after `steering` only; this read deliberately stays exact.)
-  FROM_MD=$(grep -iEm1 '^[[:space:]]*(-[[:space:]]*)?\**Exec approval\**[[:space:]]*:' "$PROJECT_DIR/PROJECT.md" 2>/dev/null \
-            | sed -E 's/.*[Aa]pproval\**[[:space:]]*:[[:space:]]*//' \
-            | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]*`')
+  # grep first, alone: most projects have no such line, and the sed | tr | tr behind it then
+  # ran over empty input (three process starts to produce nothing).
+  FROM_MD=""
+  _EA_LINE=$(grep -iEm1 '^[[:space:]]*(-[[:space:]]*)?\**Exec approval\**[[:space:]]*:' "$PROJECT_DIR/PROJECT.md" 2>/dev/null || true)
+  if [ -n "$_EA_LINE" ]; then
+    FROM_MD=$(printf '%s\n' "$_EA_LINE" | sed -E 's/.*[Aa]pproval\**[[:space:]]*:[[:space:]]*//' \
+              | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]*`')
+  fi
   if [ -n "$FROM_MD" ]; then
     if is_valid "$FROM_MD"; then
       MODE="$FROM_MD"; SOURCE="PROJECT.md"
diff --git a/bin/mdl-scan.sh b/bin/mdl-scan.sh
index 0cb6690f..85b244bd 100755
--- a/bin/mdl-scan.sh
+++ b/bin/mdl-scan.sh
@@ -52,7 +52,14 @@ done
 [ -f "$SCRIPT" ] && [ -r "$SCRIPT" ] || { echo "mdl-scan: cannot read script: $SCRIPT" >&2; exit 2; }
 if [ -n "$MPR" ] && [ ! -f "$MPR" ]; then echo "mdl-scan: -p: no such model: $MPR" >&2; exit 2; fi
 
-RULES="${MDL_SCAN_RULES:-$(cd "$(dirname "$0")" && pwd)/lib/mdl-scan-rules.tsv}"
+# The script's own folder, as a string op when $0 is already a path (a cd | dirname | pwd was
+# three process starts per exec); an absolute path stays as it was, a relative one is anchored.
+if [ -n "${MDL_SCAN_RULES:-}" ]; then RULES="$MDL_SCAN_RULES"
+else
+  _msd="${0%/*}"; [ "$_msd" != "$0" ] || _msd=.
+  case "$_msd" in /*) ;; *) _msd="$(cd "$_msd" && pwd)" ;; esac
+  RULES="$_msd/lib/mdl-scan-rules.tsv"
+fi
 [ -r "$RULES" ] || { echo "mdl-scan: rules file missing: $RULES" >&2; exit 2; }
 
 awk -F'\t' -v file="$SCRIPT" '
diff --git a/project-bin/_common.sh b/project-bin/_common.sh
index 35ba8d61..551e0956 100755
--- a/project-bin/_common.sh
+++ b/project-bin/_common.sh
@@ -68,13 +68,16 @@ mxtk_walk_root() {
       fi
       printf '%s\n' "$d"; return 0
     fi
-    d=$(dirname "$d")
+    p="${d%/*}"; [ "$p" != "$d" ] || break   # dirname without a process
+    d="$p"
   done
   return 1
 }
 _mxtk_resolve_root() {
-  local self_parent
-  self_parent=$(cd "$(dirname "${BASH_SOURCE[2]:-${BASH_SOURCE[1]:-${BASH_SOURCE[0]}}}")/.." 2>/dev/null && pwd)
+  local self_parent _src _sd
+  _src="${BASH_SOURCE[2]:-${BASH_SOURCE[1]:-${BASH_SOURCE[0]}}}"
+  _sd="${_src%/*}"; [ "$_sd" != "$_src" ] || _sd=.
+  self_parent=$(cd "$_sd/.." 2>/dev/null && pwd)
   # tier 2: the script sits in a real project's bin/ (a model in any of the three layouts)
   if [ -n "$self_parent" ] && _mxtk_has_model "$self_parent"; then
     printf '%s\n' "$self_parent"; return 0
@@ -180,7 +183,15 @@ mxtk_load_env
 # Refuses to guess between two .mpr files: picking the wrong one means writing
 # to, or restoring over, the wrong model. $MPR_FILE overrides.
 # ---------------------------------------------------------------------------
+# True when exec.sh's exported model path (MXTK_MPR_MEMO) was resolved for THIS project root and
+# MPR_FILE and still exists: a single model was found there, so the layout probes can be skipped.
+_mxtk_mpr_memo_ok() {
+  [ -n "${MXTK_MPR_MEMO:-}" ] && [ "${MXTK_MPR_MEMO_KEY:-}" = "$PROJECT_ROOT|${MPR_FILE:-}" ] && [ -f "$MXTK_MPR_MEMO" ]
+}
 find_mpr() {
+  # Run-scope memo: exec.sh resolves the model once and exports it, keyed on the project root
+  # and MPR_FILE, so the scripts it starts (and its own later calls) skip the glob probes.
+  if _mxtk_mpr_memo_ok; then printf '%s\n' "$MXTK_MPR_MEMO"; return 0; fi
   if [ -n "${MPR_FILE:-}" ]; then
     if [ ! -f "$PROJECT_ROOT/$MPR_FILE" ] && [ ! -f "$MPR_FILE" ]; then
       echo "ERROR: MPR_FILE='$MPR_FILE' does not exist" >&2
@@ -265,8 +276,13 @@ find_mpr() {
 # Resolve from the .mpr itself (which honours MPR_FILE) instead of from the repo.
 find_model_dir() {
   local mpr
+  # exec.sh exports the answer it already computed (MXTK_MODEL_DIR_MEMO) for the same model.
+  if _mxtk_mpr_memo_ok && [ -n "${MXTK_MODEL_DIR_MEMO:-}" ] && [ -d "$MXTK_MODEL_DIR_MEMO" ]; then
+    printf '%s\n' "$MXTK_MODEL_DIR_MEMO"; return 0
+  fi
   mpr=$(find_mpr) || return 1
-  (cd "$(dirname "$mpr")" && pwd)
+  local d="${mpr%/*}"; [ "$d" != "$mpr" ] || d=.; [ -n "$d" ] || d=/
+  (cd "$d" && pwd)
 }
 
 # ---------------------------------------------------------------------------
@@ -312,7 +328,7 @@ mxtk_platform() {
 # all accept and which survives being quoted inside a -c string.
 # ---------------------------------------------------------------------------
 native_path() {
-  case "$(mxtk_platform)" in
+  case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
     windows) cygpath -m "$1" 2>/dev/null || printf '%s\n' "$1" ;;
     *)       printf '%s\n' "$1" ;;
   esac
@@ -348,7 +364,7 @@ find_sp_app() {
 # picks the newest; find_mxbuild first looks for the one matching the model's version).
 mxtk_sp_list() {
   local list="" root seen=""
-  case "$(mxtk_platform)" in
+  case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
     macos)
       list=$(ls -d /Applications/Mendix\ Studio\ Pro*.app 2>/dev/null) || true
       [ -z "$list" ] && { echo "ERROR: no 'Mendix Studio Pro *.app' in /Applications" >&2; return 1; }
@@ -421,7 +437,7 @@ mxtk_is_elf() { [ -f "$1" ] && [ "$(head -c 4 "$1" 2>/dev/null | tr -d '\177')"
 # So on Windows, mxcli.exe is looked for first, explicitly.
 find_project_mxcli() {
   local c
-  if [ "$(mxtk_platform)" = windows ]; then
+  if [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = windows ]; then
     for c in "$PROJECT_ROOT/mxcli.exe" "$PROJECT_ROOT/mxcli"; do
       [ -x "$c" ] && ! mxtk_is_elf "$c" && { echo "$c"; return 0; }
     done
@@ -465,7 +481,7 @@ find_mxcli_cache() {
 # whether to pass the path through native_path first; this does no platform conversion.
 # ---------------------------------------------------------------------------
 mxtk_sqlite_ro_uri() {
-  local py="${PY:-$(resolve_py 2>/dev/null || true)}"
+  local py="${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}"
   [ -n "$py" ] || return 1
   "$py" -c "import os,sys,urllib.request as u
 print('file:'+u.pathname2url(os.path.abspath(sys.argv[1]))+'?mode=ro')" "$1" | tr -d '\r'
@@ -485,17 +501,26 @@ mxtk_model_version() {
   # Memo: exec.sh exports MXTK_MODEL_VERSION once per run, so the many find_mxbuild calls
   # in one exec (and the scripts it starts) do not each spawn sqlite3/python (#584: a
   # process start costs 58-94 ms on a Defender-scanned Windows machine).
-  if [ -z "$mpr" ] && [ -n "${MXTK_MODEL_VERSION:-}" ]; then printf '%s\n' "$MXTK_MODEL_VERSION"; return 0; fi
+  # Also for the run's own model path: exec.sh passes it explicitly (mxtk_ensure_mxbuild, the
+  # gate), and without this each of those calls started sqlite3 | head | tr again.
+  if [ -n "${MXTK_MODEL_VERSION:-}" ] && { [ -z "$mpr" ] || [ "$mpr" = "${MXTK_MPR_MEMO:-}" ]; }; then printf '%s\n' "$MXTK_MODEL_VERSION"; return 0; fi
   [ -n "$mpr" ] || mpr="$(find_mpr 2>/dev/null)" || return 1
   [ -f "$mpr" ] || return 1
   if command -v sqlite3 >/dev/null 2>&1; then
-    v=$(sqlite3 -readonly "$mpr" 'select _ProductVersion from _MetaData' 2>/dev/null | head -1 | tr -d '\r')
+    v=$(sqlite3 -readonly "$mpr" 'select _ProductVersion from _MetaData' 2>/dev/null) || true
+    v="${v%%$'\n'*}"; v="${v//$'\r'/}"   # head -1 | tr -d '\r' without two more processes
   fi
   if [ -z "$v" ]; then
-    py="${PY:-$(resolve_py 2>/dev/null || true)}"
-    [ -n "$py" ] && v=$("$py" -c "import sqlite3,sys
-c=sqlite3.connect(sys.argv[1],uri=True)
-print(c.execute('select _ProductVersion from _MetaData').fetchone()[0])" "$(PY="$py" mxtk_sqlite_ro_uri "$(native_path "$mpr")")" 2>/dev/null | head -1 | tr -d '\r')
+    py="${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}"
+    # One Python start, not two: the read-only URI (what mxtk_sqlite_ro_uri prints) is built
+    # in the same interpreter that opens it. On Windows there is usually no sqlite3 CLI, so
+    # this is the path, and a Python start costs more than any other process there.
+    if [ -n "$py" ]; then
+      v=$("$py" -c "import sqlite3,sys,os,urllib.request as u
+c=sqlite3.connect('file:'+u.pathname2url(os.path.abspath(sys.argv[1]))+'?mode=ro',uri=True)
+print(c.execute('select _ProductVersion from _MetaData').fetchone()[0])" "$(native_path "$mpr")" 2>/dev/null) || true
+      v="${v%%$'\n'*}"; v="${v//$'\r'/}"
+    fi
   fi
   case "$v" in
     [0-9]*.[0-9]*) printf '%s\n' "$v"; return 0 ;;
@@ -507,12 +532,15 @@ print(c.execute('select _ProductVersion from _MetaData').fetchone()[0])" "$(PY="
 # <version> (compared on major.minor.patch). Matches "11.12.2", "11.12.2.83245",
 # "Mendix Studio Pro 11.12.2.app", "Mendix Studio Pro 11.12.2 Beta.app"; never "11.12.20".
 mxtk_version_in_name() {
-  local base v3 re
-  base=$(basename "$1")
-  v3=$(printf '%s' "$2" | cut -d. -f1-3)
+  # In-shell (was basename + cut + sed + grep: four process starts per installed Studio Pro).
+  local base="$1" v3 re a b c _rest
+  while [ "${base%/}" != "$base" ] && [ -n "${base%/}" ]; do base="${base%/}"; done
+  base="${base##*/}"
+  IFS=. read -r a b c _rest <<< "$2"
+  v3="$a${b:+.$b}${c:+.$c}"
   [ -n "$v3" ] || return 1
-  re=$(printf '%s' "$v3" | sed 's/\./\\./g')
-  grep -Eq -- "(^|[^0-9.])${re}(\.[0-9]+)?([^0-9.]|\.[^0-9]|\$)" <<<"$base"
+  re="(^|[^0-9.])${v3//./\\.}(\\.[0-9]+)?([^0-9.]|\\.[^0-9]|\$)"
+  [[ $base =~ $re ]]
 }
 
 # mxtk_mxbuild_for_version <version> — an executable mxbuild whose install (Studio Pro
@@ -568,7 +596,7 @@ find_mxbuild() {
   fi
   local app cand="" cache
   if app=$(find_sp_app 2>/dev/null); then
-    case "$(mxtk_platform)" in
+    case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
       windows) cand="$app/modeler/mxbuild.exe" ;;
       *)       cand="$app/Contents/modeler/mxbuild" ;;
     esac
@@ -576,7 +604,7 @@ find_mxbuild() {
   fi
   if cache=$(find_mxcli_cache); then
     local cmxb
-    case "$(mxtk_platform)" in
+    case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
       windows) cmxb="$cache/modeler/mxbuild.exe" ;;
       *)       cmxb="$cache/modeler/mxbuild" ;;
     esac
@@ -605,7 +633,7 @@ _mxtk_java_want() {
 find_java_note() {
   [ -n "${JAVA_HOME:-}" ] && [ -d "$JAVA_HOME" ] && return 0
   local jhbin="${MXTK_JAVA_HOME_BIN:-/usr/libexec/java_home}" want used
-  [ "$(mxtk_platform)" = macos ] && [ -x "$jhbin" ] || return 0
+  [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = macos ] && [ -x "$jhbin" ] || return 0
   want=$(_mxtk_java_want)
   "$jhbin" -F -v "$want" >/dev/null 2>&1 && return 0
   used=$(find_java 2>/dev/null) || used="none found"
@@ -633,7 +661,7 @@ find_java() {
   # caller discards find_java's stderr. Platform-guarded: java_home is mac-only.
   # MXTK_JAVA_HOME_BIN overrides the binary (tests).
   local jhbin="${MXTK_JAVA_HOME_BIN:-/usr/libexec/java_home}" want
-  if [ "$(mxtk_platform)" = macos ] && [ -x "$jhbin" ]; then
+  if [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = macos ] && [ -x "$jhbin" ]; then
     want=$(_mxtk_java_want)
     jh=$("$jhbin" -F -v "$want" 2>/dev/null) && [ -n "$jh" ] && { echo "$jh"; return 0; }
     jh=$("$jhbin" 2>/dev/null) && [ -n "$jh" ] && { echo "$jh"; return 0; }
@@ -664,7 +692,7 @@ find_java() {
 find_java_exe() {
   local jh
   jh=$(find_java) || return 1
-  case "$(mxtk_platform)" in
+  case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
     windows) echo "$jh/bin/java.exe" ;;
     *)       echo "$jh/bin/java" ;;
   esac
@@ -787,7 +815,7 @@ mxtk_resume_leftover() {
 # A version mismatch ("The MPR file located at ... could not be opened: Project version ...")
 # matches neither form, so it is still never retried. No Python 3: false (no retry, as before).
 mxtk_mxbuild_infra_only() {
-  local _py="${PY:-$(resolve_py 2>/dev/null || true)}"
+  local _py="${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}"
   [ -s "$1" ] && [ -n "$_py" ] || return 1
   "$_py" -c '
 import json, re, sys
@@ -799,6 +827,15 @@ sys.exit(0 if m and all(ok.match(x) and not re.search(r"CE[0-9]{4}", x) for x in
 ' "$(native_path "$1")" 2>/dev/null
 }
 
+# _mxtk_slurp <var> <file> — what `var=$(cat file)` does (whole file, trailing newlines
+# stripped), without the subshell and the cat process. Empty when the file is unreadable.
+_mxtk_slurp() {
+  local _s=""
+  IFS= read -r -d '' _s < "$2" 2>/dev/null || true
+  while [ "${_s%$'\n'}" != "$_s" ]; do _s="${_s%$'\n'}"; done
+  printf -v "$1" '%s' "$_s"
+}
+
 # mxtk_gate_mxbuild <mpr> <timeout-seconds> <errors-file> - the exec gate's way to run
 # mxbuild: mxtk_mxbuild_error_count with this project's watcher paused around it, and ONE
 # retry when mxbuild exits 1 or 3 and left no sign of a model problem (no CE code in its
@@ -906,9 +943,17 @@ mxtk_mxbuild_error_count() {
   local _mb _jh _je _out _pid _waited=0 _exit=0 _py _count
 
   MXTK_MXBUILD_OUT=""; MXTK_MXBUILD_EXIT=""; MXTK_MXBUILD_WHY=""
-  _mb="$(find_mxbuild 2>/dev/null || true)"
-  _jh="$(find_java 2>/dev/null || true)"
-  _je="$(find_java_exe 2>/dev/null || true)"
+  # The overrides find_mxbuild / find_java answer first are read directly: exec.sh exports
+  # MXBUILD_PATH for the run, and a set JAVA_HOME is what find_java returns, so the common
+  # case starts no subshell (three before, each with its own probes behind it).
+  if [ -n "${MXBUILD_PATH:-}" ]; then _mb="$MXBUILD_PATH"; else _mb="$(find_mxbuild 2>/dev/null || true)"; fi
+  if [ -n "${JAVA_HOME:-}" ] && [ -d "$JAVA_HOME" ]; then
+    _jh="$JAVA_HOME"
+    case "${MXTK_PLATFORM:-$(mxtk_platform)}" in windows) _je="$_jh/bin/java.exe" ;; *) _je="$_jh/bin/java" ;; esac
+  else
+    _jh="$(find_java 2>/dev/null || true)"
+    _je="$(find_java_exe 2>/dev/null || true)"
+  fi
   if [ ! -x "$_mb" ] || [ ! -x "$_je" ]; then
     echo "?"; return 2
   fi
@@ -927,18 +972,22 @@ mxtk_mxbuild_error_count() {
   # because a large model's deploy build legitimately runs past any fixed default, and a
   # timed-out gate reads as "non-zero exit, no errors file" = FAIL = auto-restore of work
   # that was fine. doctor's self-test is the one caller that wants a bound (300s default).
-  while kill -0 "$_pid" 2>/dev/null; do
-    if [ "$_timeout" -gt 0 ] && [ "$_waited" -ge "$_timeout" ]; then
-      kill "$_pid" 2>/dev/null; wait "$_pid" 2>/dev/null
-      MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out"
-      MXTK_MXBUILD_EXIT=124
-      [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
-      echo "?"; return 3
-    fi
-    sleep 1; _waited=$((_waited + 1))
-  done
+  # Unbounded (the exec gate's default): nothing to poll for, so `wait` — a poll loop started a
+  # `sleep 1` process per second of build (10 on a warm Linux build, 150+ on a cold Windows one).
+  if [ "$_timeout" -gt 0 ]; then
+    while kill -0 "$_pid" 2>/dev/null; do
+      if [ "$_waited" -ge "$_timeout" ]; then
+        kill "$_pid" 2>/dev/null; wait "$_pid" 2>/dev/null
+        _mxtk_slurp MXTK_MXBUILD_OUT "$_out"; rm -f "$_out"
+        MXTK_MXBUILD_EXIT=124
+        [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
+        echo "?"; return 3
+      fi
+      sleep 1; _waited=$((_waited + 1))
+    done
+  fi
   wait "$_pid" || _exit=$?
-  MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out"
+  _mxtk_slurp MXTK_MXBUILD_OUT "$_out"; rm -f "$_out"
   MXTK_MXBUILD_EXIT="$_exit"
 
   if [ ! -s "$_ef" ] && [ "$_exit" -eq 0 ]; then
@@ -946,7 +995,7 @@ mxtk_mxbuild_error_count() {
     echo 0; return 0
   fi
 
-  _py="${PY:-$(resolve_py 2>/dev/null || true)}"
+  _py="${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}"
   if [ -z "$_py" ]; then
     [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
     echo "?"; return 1
@@ -973,7 +1022,7 @@ mxtk_mxbuild_error_count() {
 #    Project version '11.12.2' does not exactly match MxBuild version '11.14.0'. Use loose
 #    version check option for less strict version checking.","details":""}],"problems":[]}
 mxtk_mxbuild_why() {
-  local _py="${2:-${PY:-$(resolve_py 2>/dev/null || true)}}"
+  local _py="${2:-${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}}"
   [ -s "$1" ] && [ -n "$_py" ] || return 0
   "$_py" -c "import json,re
 d=json.load(open('$(native_path "$1")'))
@@ -1003,7 +1052,7 @@ mxtk_java_fp() {
     _l="$(git ls-files -co --exclude-standard -- javasource javascriptsource theme userlib widgets 2>/dev/null \
           | grep -v '^javasource/[^/]*/proxies/' || true)"
     { printf '%s\n' "$_l"; [ -z "$_l" ] || printf '%s\n' "$_l" | git hash-object --stdin-paths 2>/dev/null; } \
-      | cksum | awk '{print $1}' )
+      | cksum | { read -r _ck _; printf '%s\n' "$_ck"; } )
 }
 
 # mxtk_find_mx — the `mx` tool beside the resolved mxbuild (same version by construction).
@@ -1011,7 +1060,7 @@ mxtk_find_mx() {
   local _mb _d _c
   _mb="${MXBUILD_PATH:-$(find_mxbuild 2>/dev/null || true)}"
   [ -n "$_mb" ] || return 1
-  _d="$(dirname "$_mb")"
+  _d="${_mb%/*}"; [ "$_d" != "$_mb" ] || _d=.
   for _c in "$_d/mx" "$_d/mx.exe"; do [ -x "$_c" ] && { echo "$_c"; return 0; }; done
   return 1
 }
@@ -1021,7 +1070,7 @@ mxtk_find_mx() {
 #   {"errors":[...],"problems":[{"severity":"Error","errorCode","message","locations":[{module,document,element}]}]}
 # Golden input: tests/wave2/fixtures/mx-check/mx-check-11.13.0-CE1613.json (captured, mx 11.13.0).
 mxtk_mx_check_to_mxbuild() {
-  local _py="${3:-${PY:-$(resolve_py 2>/dev/null || true)}}"
+  local _py="${3:-${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}}"
   [ -n "$_py" ] || return 1
   "$_py" -c "import json,sys
 d=json.load(open(sys.argv[1]))
@@ -1048,17 +1097,19 @@ mxtk_mx_check_error_count() {
   rm -f "$_js"   # mx writes the file itself; an empty pre-existing one would read as "no output"
   "$_mx" check "$_mpr" -j "$(native_path "$_js")" > "$_out" 2>&1 < /dev/null &
   _pid=$!
-  while kill -0 "$_pid" 2>/dev/null; do
-    if [ "$_timeout" -gt 0 ] && [ "$_waited" -ge "$_timeout" ]; then
-      kill "$_pid" 2>/dev/null; wait "$_pid" 2>/dev/null
-      MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out" "$_js"
-      MXTK_MXBUILD_EXIT=124; [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
-      echo "?"; return 3
-    fi
-    sleep 1; _waited=$((_waited + 1))
-  done
+  if [ "$_timeout" -gt 0 ]; then   # unbounded: `wait`, no per-second sleep process
+    while kill -0 "$_pid" 2>/dev/null; do
+      if [ "$_waited" -ge "$_timeout" ]; then
+        kill "$_pid" 2>/dev/null; wait "$_pid" 2>/dev/null
+        _mxtk_slurp MXTK_MXBUILD_OUT "$_out"; rm -f "$_out" "$_js"
+        MXTK_MXBUILD_EXIT=124; [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
+        echo "?"; return 3
+      fi
+      sleep 1; _waited=$((_waited + 1))
+    done
+  fi
   wait "$_pid" || _exit=$?
-  MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out"
+  _mxtk_slurp MXTK_MXBUILD_OUT "$_out"; rm -f "$_out"
   MXTK_MXBUILD_EXIT="$_exit"
   if [ -s "$_js" ]; then _count=$(mxtk_mx_check_to_mxbuild "$_js" "$_ef"); fi
   rm -f "$_js"
@@ -1105,6 +1156,9 @@ _py_is_store_stub() {
 # and snapshots your changes when the mxbuild gate cannot read its results — it just has to say
 # so instead of dying. $PYTHON overrides the search.
 resolve_py() {
+  # Run-scope memo (exec.sh exports it): the probe below STARTS Python, which is the single
+  # costliest process start on Windows, and lint-gate / metrics-ledger / row-groups each did it.
+  if [ -n "${MXTK_PY_MEMO:-}" ]; then echo "$MXTK_PY_MEMO"; return 0; fi
   _c=""
   for _c in "${PYTHON:-}" python3 python py; do  # portability-ok: this IS the interpreter probe
     [ -n "$_c" ] || continue
@@ -1217,8 +1271,9 @@ find_toolkit_root() {
 # mxtk_sha256 — SHA-256 of stdin, whichever tool this machine has (sha256sum on
 # Linux/Git Bash, shasum on macOS, openssl as the last resort).
 mxtk_sha256() {
-  if command -v sha256sum >/dev/null 2>&1; then sha256sum | cut -d' ' -f1
-  elif command -v shasum >/dev/null 2>&1; then shasum -a 256 | cut -d' ' -f1
+  local _h _
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum | { read -r _h _; printf '%s\n' "$_h"; }
+  elif command -v shasum >/dev/null 2>&1; then shasum -a 256 | { read -r _h _; printf '%s\n' "$_h"; }
   else openssl dgst -sha256 | sed 's/^.*= //'
   fi
 }
@@ -1235,7 +1290,7 @@ mxtk_sha256() {
 # Per platform: lsof (macOS, Linux), then ss (Linux without lsof), netstat -ano + tasklist (Windows).
 mxtk_port_holder() {
   local p="$1" out pid="" name=""
-  case "$(mxtk_platform)" in
+  case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
     windows)
       pid="$(netstat -ano 2>/dev/null | tr -d '\r' | awk -v p=":$p" '$1=="TCP" && $4=="LISTENING" && substr($2, length($2)-length(p)+1)==p { print $5; exit }')"
       [ -n "$pid" ] && name="$(tasklist //FI "PID eq $pid" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)" ;;
@@ -1290,7 +1345,7 @@ mxtk_pid_in_tree() {
 mxtk_pid_args() {
   local pid="$1" out=""
   case "$pid" in ''|*[!0-9]*) return 1 ;; esac
-  case "$(mxtk_platform)" in
+  case "${MXTK_PLATFORM:-$(mxtk_platform)}" in
     linux)
       if [ -r "/proc/$pid/cmdline" ]; then out="$(tr '\0' '\n' < "/proc/$pid/cmdline" 2>/dev/null)"
       else out="$(ps -o args= -p "$pid" 2>/dev/null)"; fi ;;
@@ -1338,11 +1393,11 @@ EOF_ARGS
   # the rest of a longer, spaced path: "/work/a" must not match "…runtimelauncher.jar /work/a b/x"
   # (a foreign checkout read as ours, PR #319 review). Each <dir> arrives as ONE argument.
   line="$(printf '%s' "$args" | head -1 | tr -d '"')"
-  [ "$(mxtk_platform)" = windows ] && line="$(printf '%s' "$line" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
+  [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = windows ] && line="$(printf '%s' "$line" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
   for d in "$@"; do
     for cand in "${d%/}" "$(cd "$d" 2>/dev/null && pwd -P)"; do
       [ -n "$cand" ] || continue
-      [ "$(mxtk_platform)" = windows ] && cand="$(native_path "$cand" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
+      [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = windows ] && cand="$(native_path "$cand" | tr '\\' '/' | tr '[:upper:]' '[:lower:]')"
       case "$line" in
         *"runtimelauncher.jar $cand"|*"runtimelauncher.jar $cand/"|*"runtimelauncher.jar $cand -"*|*"runtimelauncher.jar $cand/ -"*) return 0 ;;
       esac
@@ -1367,7 +1422,7 @@ EOF_ARGS
 mxtk_pid_is_mxcli_run() {
   local a="" nl='
 '
-  if [ "$(mxtk_platform)" = windows ]; then
+  if [ "${MXTK_PLATFORM:-$(mxtk_platform)}" = windows ]; then
     a="$(tasklist //FI "PID eq $1" //FO CSV //NH 2>/dev/null | tr -d '\r' | head -1 | cut -d'"' -f2)"
     case "$(printf '%s' "$a" | tr '[:upper:]' '[:lower:]')" in mxcli.exe|mxcli) return 0 ;; esac
     return 1
diff --git a/project-bin/build-plan-status.sh b/project-bin/build-plan-status.sh
index 4fc5e038..827a6bef 100755
--- a/project-bin/build-plan-status.sh
+++ b/project-bin/build-plan-status.sh
@@ -88,13 +88,14 @@ MDLSOURCE="$ROOT/mdlsource"
 MODULES_DIR="$ROOT/architecture/modules"
 REGISTER="$ROOT/docs/improvement-register.md"
 BUILD_PLAN="$ROOT/architecture/build-plan.md"
-STAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+if [ -n "${EPOCHSECONDS:-}" ]; then TZ=UTC printf -v STAMP '%(%Y-%m-%dT%H:%M:%SZ)T' -1   # bash 5: no date process
+else STAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
 
 # PROJECT.md `Progress report: off | ask | auto` (default ask). off = this script never writes the
 # page; ask and auto only change what the agent does at a stage gate or module close (the skills
 # say: ask once, or open it), so the script treats them the same.
 report_name() {  # the page name lives in progress-report.py (REPORT_FILE); asked once, here
-  REPORT_FILE="$("${PY:-python3}" "$(dirname "${BASH_SOURCE[0]}")/progress-report.py" --print-name 2>/dev/null)"  # portability-ok: PY is resolve_py output; python3 only if unset
+  REPORT_FILE="$("${PY:-python3}" "${_bpd:-$(dirname "${BASH_SOURCE[0]}")}/progress-report.py" --print-name 2>/dev/null)"  # portability-ok: PY is resolve_py output; python3 only if unset
   [ -n "$REPORT_FILE" ] || REPORT_FILE="progress-report.html"
 }
 progress_report_setting() {
@@ -116,12 +117,21 @@ progress_report_setting() {
 PHASE_ROWS=""
 PHASE_COUNT=0
 if [ -d "$MDLSOURCE" ]; then
+  # Counted with globs: the find | wc | tr (and basename) per phase folder were five process
+  # starts each. dotglob + the symlink test keep find -type f's answer.
+  _dg=0; shopt -q dotglob && _dg=1
   for d in "$MDLSOURCE"/*/; do
     [ -d "$d" ] || continue
-    phase="$(basename "$d")"
-    total=$(find "$d" -maxdepth 1 -type f \( -name '*.mdl' -o -name '*.sql' \) | wc -l | tr -d ' ')
+    _dn="${d%/}"; phase="${_dn##*/}"
+    total=0; done_ct=0
+    shopt -s dotglob   # only for the file globs: the phase folders themselves stay non-hidden
+    for _pf in "$d"*.mdl "$d"*.sql; do
+      [ -f "$_pf" ] && [ ! -L "$_pf" ] || continue
+      total=$((total + 1))
+      case "${_pf##*/}" in done-*) done_ct=$((done_ct + 1)) ;; esac
+    done
+    [ "$_dg" = 1 ] || shopt -u dotglob
     [ "$total" -eq 0 ] && continue
-    done_ct=$(find "$d" -maxdepth 1 -type f \( -name 'done-*.mdl' -o -name 'done-*.sql' \) | wc -l | tr -d ' ')
     pct=$(( total > 0 ? done_ct * 100 / total : 0 ))
     status="pending"
     [ "$done_ct" -gt 0 ] && status="in-progress"
@@ -142,7 +152,7 @@ REVIEWED_COUNT=0
 if [ -d "$MODULES_DIR" ]; then
   for d in "$MODULES_DIR"/*/; do
     [ -d "$d" ] || continue
-    module="$(basename "$d")"
+    _dn="${d%/}"; module="${_dn##*/}"
     briefed="no"
     if [ -f "$d/module-brief.md" ]; then
       briefed="yes"
@@ -170,14 +180,13 @@ if [ -d "$MODULES_DIR" ]; then
     reviewed="not yet"
     if [ -f "$summary" ]; then
       REVIEWED_COUNT=$((REVIEWED_COUNT+1))
-      if grep -q $'\tFAULT\t' "$summary" 2>/dev/null; then
-        reviewed="INCOMPLETE (instrument fault)"
-      elif grep -q $'\tFINDING\t' "$summary" 2>/dev/null; then
-        reviewed="FINDINGS"
-      else
-        reviewed="CLEAN"
-      fi
-      age_s=$(( $(date +%s) - $(date -r "$summary" +%s 2>/dev/null || echo 0) ))
+      _sum=""; IFS= read -r -d '' _sum < "$summary" 2>/dev/null || true   # two greps over it, in-shell
+      case "$_sum" in
+        *$'\tFAULT\t'*) reviewed="INCOMPLETE (instrument fault)" ;;
+        *$'\tFINDING\t'*) reviewed="FINDINGS" ;;
+        *) reviewed="CLEAN" ;;
+      esac
+      age_s=$(( ${EPOCHSECONDS:-$(date +%s)} - $(date -r "$summary" +%s 2>/dev/null || echo 0) ))
       age_d=$(( age_s / 86400 ))
       reviewed="$reviewed (${age_d}d ago)"
     fi
@@ -432,9 +441,10 @@ PYEOF
 }
 
 if [ "$WRITE_JSON" -eq 1 ] || [ "$WRITE_HTML" -eq 1 ]; then
-  if [ -f "$(dirname "${BASH_SOURCE[0]}")/_common.sh" ]; then
+  _bpd="${BASH_SOURCE[0]%/*}"; [ "$_bpd" != "${BASH_SOURCE[0]}" ] || _bpd=.   # dirname without a process
+  if [ -f "$_bpd/_common.sh" ]; then
     # shellcheck disable=SC1091
-    . "$(dirname "${BASH_SOURCE[0]}")/_common.sh"
+    . "$_bpd/_common.sh"
   fi
   if ! type resolve_py >/dev/null 2>&1; then
     resolve_py() {
@@ -532,7 +542,7 @@ render_plan_section() {  # stdout: the plan section's HTML
     echo "<h2>The plan</h2><p class=empty>Nothing to show yet: ${PLAN_MSG:-build-plan.md was not read}.</p>"
     return 0
   fi
-  "$PY" - "$PLAN_JSON" "$MDLSOURCE" "${PHASE_DETAIL:-/dev/null}" "$ROOT" "$(dirname "${BASH_SOURCE[0]}")/progress-report.py" <<'PYEOF' || echo "<h2>The plan</h2><p class=empty>Could not render the plan section from build-plan.md.</p>"
+  "$PY" - "$PLAN_JSON" "$MDLSOURCE" "${PHASE_DETAIL:-/dev/null}" "$ROOT" "${_bpd:-$(dirname "${BASH_SOURCE[0]}")}/progress-report.py" <<'PYEOF' || echo "<h2>The plan</h2><p class=empty>Could not render the plan section from build-plan.md.</p>"
 import fnmatch, html, json, os, re, sys
 
 src, mdl, detail_out, proj, gen = sys.argv[1:6]
@@ -709,7 +719,7 @@ PYEOF
 # architecture/build-plan.html is left exactly where it is: not read, not rewritten, not deleted.
 if [ "$WRITE_HTML" -eq 1 ]; then
   SKIP_HTML=""
-  GEN="$(dirname "${BASH_SOURCE[0]}")/progress-report.py"
+  GEN="${_bpd:-$(dirname "${BASH_SOURCE[0]}")}/progress-report.py"
   report_name
   OUT="$ROOT/architecture/$REPORT_FILE"
   SETTING="$(progress_report_setting)"
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index ad0b22f0..581387f5 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -98,37 +98,50 @@
 #            MXTK_NO_INSTALL=1 (never download mxbuild; offline CI)
 #            MXTK_SCAN_OVERRIDE="<reason>" (the user only: run despite a blocking STOP-row scan hit, #349)
 set -e
-_T0=$(date +%s)
+_T0=${EPOCHSECONDS:-$(date +%s)}   # EPOCHSECONDS (bash 5): no process per timestamp
 # Per-step seconds (2026-10-16): the BUILD-LOG row used to carry only the total, so nobody could
 # say where an exec's time went (check, baseline, exec, gate, lint, score). step_done <name>
 # adds "<name> <s>s" since the previous mark; the run summary and the BUILD-LOG detail print it.
 # The gate mark sits right after the mxbuild run, before any pass/fail branch, so a rolled-back
 # run (the costliest ones) logs its gate seconds too.
 _TLAST=$_T0; STEP_TIMES=""
-step_done() { _tn=$(date +%s); STEP_TIMES="${STEP_TIMES:+$STEP_TIMES }$1 $((_tn - _TLAST))s"; _TLAST=$_tn; }
+step_done() { _tn=${EPOCHSECONDS:-$(date +%s)}; STEP_TIMES="${STEP_TIMES:+$STEP_TIMES }$1 $((_tn - _TLAST))s"; _TLAST=$_tn; }
 # MXTK_PROFILE=1 (#584/#585): one trace line per command with a wall-clock stamp, written to
 # .claude/loop/exec-profile-<pid>.log; at exit the slowest lines and the number of commands
 # are printed. Needs bash 4.1+ (BASH_XTRACEFD); bash 5 has EPOCHREALTIME (microseconds), 4.x
 # stamps whole seconds. macOS's bash 3.2 cannot send the trace to a file: it says so and runs.
-if [ "${MXTK_PROFILE:-0}" = "1" ] && { [ "${BASH_VERSINFO[0]:-0}" -lt 4 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]:-0}" -lt 1 ]; }; }; then
+# MXTK_PROFILE=2 (#584/#585 follow-up): the same trace for every bash script exec.sh starts
+# (model-stamp, snapshot-mpr, lint-gate, ...), through BASH_ENV, so the count covers the whole
+# run and not only this process. The count under =1 is exec.sh's own commands, which a script
+# it starts never adds to: a start shows up as ONE line there, however many commands it runs.
+_PROFILING=0; case "${MXTK_PROFILE:-0}" in 1|2) _PROFILING=1 ;; esac
+if [ "$_PROFILING" = "1" ] && { [ "${BASH_VERSINFO[0]:-0}" -lt 4 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]:-0}" -lt 1 ]; }; }; then
   echo "⚠ MXTK_PROFILE needs bash 4.1+ (this is $BASH_VERSION); running without a profile (brew install bash)." >&2
-  MXTK_PROFILE=0
+  _PROFILING=0; MXTK_PROFILE=0
 fi
-if [ "${MXTK_PROFILE:-0}" = "1" ]; then
+if [ "$_PROFILING" = "1" ]; then
   _PROF_DIR="$(pwd)/.claude/loop"; mkdir -p "$_PROF_DIR" 2>/dev/null || _PROF_DIR="${TMPDIR:-/tmp}"
   _PROF_LOG="$_PROF_DIR/exec-profile-$$.log"
   exec 7>"$_PROF_LOG"
   BASH_XTRACEFD=7
-  if [ -n "${EPOCHREALTIME:-}" ]; then PS4='+ ${EPOCHREALTIME} ${LINENO} '; else PS4='+ ${SECONDS}.000000 ${LINENO} '; fi
+  if [ -n "${EPOCHREALTIME:-}" ]; then PS4='+ ${EPOCHREALTIME} ${BASH_SOURCE##*/}:${LINENO} '; else PS4='+ ${SECONDS}.000000 ${BASH_SOURCE##*/}:${LINENO} '; fi
+  if [ "${MXTK_PROFILE:-0}" = "2" ]; then
+    _PROF_ENV="$_PROF_DIR/exec-profile-$$.env"
+    if [ -n "${EPOCHREALTIME:-}" ]; then printf '%s\n' "PS4='+ \${EPOCHREALTIME} \${BASH_SOURCE##*/}:\${LINENO} '" > "$_PROF_ENV"
+    else printf '%s\n' "PS4='+ \${SECONDS}.000000 \${BASH_SOURCE##*/}:\${LINENO} '" > "$_PROF_ENV"; fi
+    printf '%s\n' 'set -x' >> "$_PROF_ENV"
+    export BASH_XTRACEFD=7 BASH_ENV="$_PROF_ENV"
+  fi
   set -x
   _prof_report() {
     set +x
     exec 7>&-
+    [ -z "${_PROF_ENV:-}" ] || rm -f "$_PROF_ENV"
     echo ""
     echo "── MXTK_PROFILE: $(grep -c '^+' "$_PROF_LOG" 2>/dev/null || echo 0) traced commands · steps: ${STEP_TIMES:-none} · trace: $_PROF_LOG"
     # Each line's duration is the gap to the next traced line, so a slow child process shows
     # on the line that started it.
-    awk '/^\++ [0-9]+\.[0-9]+ [0-9]+ /{ t=$2; if (p!="") printf "%9.3f s  line %-5s %s\n", t-pt, pl, substr(p,1,110); pt=t; pl=$3; p=$0; sub(/^\++ [^ ]+ [^ ]+ /,"",p) }' \
+    awk '/^\++ [0-9]+\.[0-9]+ [^ :]*:[0-9]+ /{ t=$2; if (p!="") printf "%9.3f s  %-22s %s\n", t-pt, pl, substr(p,1,110); pt=t; pl=$3; p=$0; sub(/^\++ [^ ]+ [^ ]+ /,"",p) }' \
       "$_PROF_LOG" 2>/dev/null | sort -rn | head -15
   }
   trap _prof_report EXIT
@@ -424,15 +437,35 @@ if [ "$ADVISORY" = "--watch-compat" ]; then
   exit 0
 fi
 
-. "$(dirname "$0")/_common.sh"
+# Process-start budget (Windows: ~100 ms each): this script and the ones it starts avoid
+# dirname/basename/date forks, resolve the model, the platform and Python once per run and
+# hand the answers down through exported memos (MXTK_MPR_MEMO, MXTK_PLATFORM, MXTK_PY_MEMO).
+_XD="${0%/*}"; [ "$_XD" != "$0" ] || _XD=.
+. "$_XD/_common.sh"
+
+# _first_match <file> <ERE starting with ^ and holding one capture group> — sets _FM to the
+# capture of the FIRST line that matches, returns 1 when none does. The in-shell form of
+# `sed -n 's/…/\1/p' file | head -1` (two process starts per read; PROJECT.md is read this way
+# several times per exec). The file is slurped once and matched as one string: a per-line
+# loop would be no process but hundreds of traced commands. A capture must exclude $_NL.
+_NL=$'\n'
+_first_match() {
+  _FM=""; [ -r "$1" ] || return 1
+  local _fmt; IFS= read -r -d '' _fmt < "$1" || true
+  [[ "$_NL$_fmt" =~ $_NL${2#^} ]] || return 1
+  _FM="${BASH_REMATCH[1]}"
+}
 
 MPR="$(find_mpr)" || exit 1
-MPR_BASE="$(basename "$MPR")"
-NAME="$(basename "$MPR" .mpr)"
+MXTK_MPR_MEMO="$MPR"; MXTK_MPR_MEMO_KEY="$PROJECT_ROOT|${MPR_FILE:-}"
+MXTK_PLATFORM="$(mxtk_platform)"
+export PROJECT_ROOT MXTK_MPR_MEMO MXTK_MPR_MEMO_KEY MXTK_PLATFORM
+MPR_BASE="${MPR##*/}"
+NAME="${MPR_BASE%.mpr}"
 SCRIPT="${1:-}"
 [ $# -gt 0 ] && shift
 # Remaining args go to the patch script, after the model path. An MDL run takes none.
-LOG_NAME="$(basename "$SCRIPT")"
+LOG_NAME="${SCRIPT##*/}"
 [ "$PATCH_MODE" = "1" ] && LOG_NAME="patch: $LOG_NAME"
 
 if [ -z "$SCRIPT" ]; then
@@ -499,18 +532,28 @@ GATE_NOTE=""           # "retry after infra exit" when a gate mxbuild was run tw
 # per-project (same as bin/interview-mode.sh), so it has to be found in the toolkit, not here.
 # Never fatal: if it cannot be found, or errors, the row is written exactly as it always was.
 _EXEC_APPROVAL_SUFFIX=""
-for _ea in "${MXTK_ROOT:-}/bin/exec-approval.sh" \
-           "$(sed -nE 's/^\| *Toolkit root *\| *`([^`]+)`.*/\1/p' "$PROJECT_ROOT/CLAUDE.local.md" 2>/dev/null | head -1)/bin/exec-approval.sh"; do
+# The "Toolkit root" row of CLAUDE.local.md, read once in-shell (this used to be a sed|head
+# pair three times over: exec-approval, mdl-scan, doctor). First matching line wins, as before.
+_first_match "$PROJECT_ROOT/CLAUDE.local.md" '^\| *Toolkit root *\| *`([^`'"$_NL"']+)`' || true
+_TKR="$_FM"
+for _ea in "${MXTK_ROOT:-}/bin/exec-approval.sh" "$_TKR/bin/exec-approval.sh"; do
   [ -x "$_ea" ] || continue
   _ea_out="$("$_ea" "$PROJECT_ROOT" --explain 2>/dev/null)" || continue
-  _ea_mode="$(printf '%s\n' "$_ea_out" | sed -n 's/^mode: //p')"
-  _ea_from="$(printf '%s\n' "$_ea_out" | sed -n 's/^from: //p')"
+  _ea_mode=""; _ea_from=""
+  while IFS= read -r _l; do
+    case "$_l" in
+      "mode: "*) _ea_mode="${_ea_mode:+$_ea_mode
+}${_l#mode: }" ;;
+      "from: "*) _ea_from="${_ea_from:+$_ea_from
+}${_l#from: }" ;;
+    esac
+  done <<< "$_ea_out"
   [ "$_ea_mode" = "auto" ] && _EXEC_APPROVAL_SUFFIX=" · approval: auto ($_ea_from)"
   break
 done
 
 log_build() {   # $1=status  $2=detail
-  mkdir -p "$(dirname "$BUILD_LOG")"
+  [ -d "${BUILD_LOG%/*}" ] || mkdir -p "${BUILD_LOG%/*}"
   [ -f "$BUILD_LOG" ] || cat > "$BUILD_LOG" <<'HDR'
 # Build log — auto-appended by bin/exec.sh
 
@@ -529,7 +572,8 @@ HDR
   # One-time migration: logs written before the gate column existed keep their
   # 4-column header, and 5-column rows would render ragged under it. Start a
   # fresh table rather than rewrite history.
-  if ! grep -q '| when (ISO-8601 local) |' "$BUILD_LOG"; then
+  IFS= read -r -d '' _blog < "$BUILD_LOG" || true   # grep -q over the log, in-shell
+  if [[ "$_blog" != *'| when (ISO-8601 local) |'* ]]; then
     cat >> "$BUILD_LOG" <<'HDR2'
 
 <!-- gate column added; rows above this line predate it -->
@@ -542,8 +586,9 @@ HDR2
   # can omit it — a blank cell in this table reads as "fine", which is the exact
   # false-green the gate exists to prevent.
   _detail="$2${CHANGE_CLASS:+ · change: $CHANGE_CLASS}${CR_ID:+ · cr: $CR_ID}${SCAN_NOTE:+ · $SCAN_NOTE}${ROWS_NOTE:+ · $ROWS_NOTE}${RESTATE_NOTE:+ · $RESTATE_NOTE}${GATE_NOTE:+ · $GATE_NOTE}${MXB_LOG_NOTE:+ · $MXB_LOG_NOTE}${HV_NOTE:+ · $HV_NOTE}$_EXEC_APPROVAL_SUFFIX${STEP_TIMES:+ · steps: $STEP_TIMES}"
+  if [ -n "${EPOCHSECONDS:-}" ]; then printf -v _when '%(%Y-%m-%dT%H:%M:%S%z)T' -1; else _when="$(date '+%Y-%m-%dT%H:%M:%S%z')"; fi
   printf '| %s | `%s` | %s | %s | %s |\n' \
-    "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$LOG_NAME" \
+    "$_when" "$LOG_NAME" \
     "${GATE_STATE:-not-run}" "$1" "$_detail" >> "$BUILD_LOG"
   record_metrics "$1"
 }
@@ -562,7 +607,7 @@ record_metrics() {  # $1=status text (as given to log_build)
   [ -x "$PROJECT_ROOT/bin/metrics-ledger.sh" ] || return 0
   bash "$PROJECT_ROOT/bin/metrics-ledger.sh" exec \
     --script "$LOG_NAME" --gate "${GATE_STATE:-not-run}" --result "$1" \
-    --elapsed "$(( $(date +%s) - _T0 ))" --mxbuild-errors "${GATE_ERRORS:-}" \
+    --elapsed "$(( ${EPOCHSECONDS:-$(date +%s)} - _T0 ))" --mxbuild-errors "${GATE_ERRORS:-}" \
     --lint-rc "${LINT_RC_FOR_LEDGER:-}" --restored "${RESTORED:-0}" --scored "$SCORED" 2>/dev/null || true
 }
 # `mxcli report` scores the model (0-100, ≈7 s on an 876-flow model, 2026-10-12). Taken only
@@ -598,8 +643,7 @@ SCAN_NOTE=""; HV_NOTE=""   # HV_NOTE: the ContentsHash bracket's cell text, set
 RESTATE_NOTE=""            # the restatement warnings' cell text (#269, #261), set after the check
 if [ "$PATCH_MODE" != "1" ]; then
   _SCAN=""
-  for _s in "${MXTK_ROOT:-}/bin/mdl-scan.sh" \
-            "$(sed -nE 's/^\| *Toolkit root *\| *`([^`]+)`.*/\1/p' "$PROJECT_ROOT/CLAUDE.local.md" 2>/dev/null | head -1)/bin/mdl-scan.sh"; do
+  for _s in "${MXTK_ROOT:-}/bin/mdl-scan.sh" "$_TKR/bin/mdl-scan.sh"; do
     [ -f "$_s" ] && { _SCAN="$_s"; break; }
   done
   scan_ids() { printf '%s\n' "$_scan_out" | grep " \[$1\]\$" | sed -n 's/^\(STOP-[0-9a-z]*\) .*/\1/p' | sort -u | tr '\n' ' ' | sed 's/ $//'; }
@@ -641,6 +685,12 @@ fi
 # instruments per exec on 147 rows. No build plan, or a script that names no row: skipped.
 # Override, with a reason that lands in the BUILD-LOG row: MXTK_ROWS_OVERRIDE="<why>".
 ROWS_NOTE=""
+# Python is resolved once here and handed down (MXTK_PY_MEMO): row-groups, lint-gate and
+# metrics-ledger each probed it with a Python start of their own. Unset when there is none.
+if [ -z "${MXTK_PY_MEMO:-}" ]; then
+  MXTK_PY_MEMO="$(resolve_py 2>/dev/null || true)"
+  if [ -n "$MXTK_PY_MEMO" ]; then export MXTK_PY_MEMO; else unset MXTK_PY_MEMO; fi
+fi
 if [ "$PATCH_MODE" != "1" ] && [ -x "$PROJECT_ROOT/bin/row-groups.sh" ]; then
   _rg_rc=0; _rg_out="$("$PROJECT_ROOT/bin/row-groups.sh" check "$SCRIPT" 2>&1)" || _rg_rc=$?
   if [ "$_rg_rc" = 1 ]; then
@@ -668,10 +718,14 @@ fi
 # checkout the app lives under app/. Every mprcontents/ path below goes through
 # MODEL_DIR; see the find_model_dir header in _common.sh for what silently broke
 # when they did not.
-MODEL_DIR="$(find_model_dir 2>/dev/null || echo "$PROJECT_ROOT")"
+if MODEL_DIR="$(find_model_dir 2>/dev/null)"; then
+  export MXTK_MODEL_DIR_MEMO="$MODEL_DIR"   # the scripts exec.sh starts reuse it (find_model_dir)
+else
+  MODEL_DIR="$PROJECT_ROOT"
+fi
 
 LOCK="$PROJECT_ROOT/.mpr-snapshots/.exec.lock"
-mkdir -p "$(dirname "$LOCK")"
+mkdir -p "${LOCK%/*}"
 FORCE="${FORCE_EXEC:-0}"
 
 # 1. Studio Pro must not hold the project open (SP's in-memory model vs a direct
@@ -713,7 +767,7 @@ exec_lock_live() {  # $1 = pid from the lock; 0 iff that process is alive and pl
   case "$_args" in ""|*exec.sh*|*test-scratch.sh*) return 0 ;; esac   # test-scratch.sh holds it while copying
   return 1
 }
-exec_lock_try() { ( set -o noclobber; printf '%s %s %s\n' "$$" "$(date +%s)" "$LOG_NAME" > "$LOCK" ) 2>/dev/null; }
+exec_lock_try() { ( set -o noclobber; printf '%s %s %s\n' "$$" "${EPOCHSECONDS:-$(date +%s)}" "$LOG_NAME" > "$LOCK" ) 2>/dev/null; }
 exec_lock_release() {  # the trap: remove the lock only while it is still ours
   _own="$(cat "$LOCK" 2>/dev/null || true)"
   [ "${_own%% *}" = "$$" ] && rm -f "$LOCK"
@@ -733,13 +787,13 @@ exec_lock_release() {  # the trap: remove the lock only while it is still ours
 # (never clobbers; left on disk if that fails) if what was moved is not the one judged stale.
 # The holder removes the takeover file only while it still holds the line it wrote.
 exec_lock_takeover() {  # $1 = the stale lock line; 0 iff it was removed (or already gone)
-  _tk="$LOCK.takeover"; _mine="$$ $(date +%s)"
+  _tk="$LOCK.takeover"; _mine="$$ ${EPOCHSECONDS:-$(date +%s)}"
   if ! ( set -o noclobber; printf '%s\n' "$_mine" > "$_tk" ) 2>/dev/null; then
     _t="$(head -1 "$_tk" 2>/dev/null || true)"; _tpid="${_t%% *}"; _tsince="${_t#* }"
     case "$_tsince" in ''|*[!0-9]*) _tsince=0 ;; esac
     _tstale=0
     if [ -n "$_t" ]; then
-      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( $(date +%s) - _tsince )) -gt 10 ]; } && _tstale=1
+      { ! kill -0 "$_tpid" 2>/dev/null || [ $(( ${EPOCHSECONDS:-$(date +%s)} - _tsince )) -gt 10 ]; } && _tstale=1
     elif [ -n "$(find "$_tk" -mmin +1 2>/dev/null)" ]; then
       _tstale=1   # empty for over a minute: its creator died between the create and the write
     fi
@@ -768,7 +822,7 @@ for _try in 1 2 3 4 5 6; do
   if exec_lock_live "$_hpid"; then
     _hrest="${_held#* }"; _hsince="${_hrest%% *}"; _hscript="${_hrest#* }"
     _age=""
-    case "$_hsince" in ''|*[!0-9]*) ;; *) _age=" for $(( $(date +%s) - _hsince ))s" ;; esac
+    case "$_hsince" in ''|*[!0-9]*) ;; *) _age=" for $(( ${EPOCHSECONDS:-$(date +%s)} - _hsince ))s" ;; esac
     [ "$_hrest" = "$_held" ] && _hscript="?"
     echo "✗ Another session holds this project's exec lock (PID $_hpid, running$_age, script: $_hscript)."
     echo "  → Wait for it to finish, then re-run. Nothing was written."
@@ -786,7 +840,7 @@ if [ "$LOCK_TAKEN" != 1 ]; then
   echo "  → Wait for the other exec to finish, then re-run. Nothing was written."
   exit 1
 fi
-trap 'mxtk_resume_watchers; exec_lock_release; [ "${MXTK_PROFILE:-0}" != 1 ] || _prof_report' EXIT
+trap 'mxtk_resume_watchers; exec_lock_release; [ "$_PROFILING" != 1 ] || _prof_report' EXIT
 mxtk_resume_leftover "$PROJECT_ROOT"   # a watcher an earlier, SIGKILLed exec.sh left stopped
 
 # 3. A raw `mxcli exec` elsewhere on the machine is NOT this project's business. The old guard
@@ -1026,6 +1080,45 @@ fi
 LINT_RC=0; LINT_DETAIL="lint not-run"
 run_lint_gate() {
   _noadv=""
+  # Nested on purpose: the lint fixtures extract run_lint_gate() alone, so it carries its helper.
+  # _lint_scan <lint-gate output file> — ONE awk pass that replaces the ten-odd grep / sed /
+  # awk / tr / sort / paste processes this block started per exec (a rose run: ~25 process starts).
+  # It prints shell assignments, which are eval'd: _L_RULES ("RULE (+n) " per rose line),
+  # _L_BLIND / _L_REVERTED / _L_PROJREV (the rule or file ids named in the !! sections,
+  # comma-joined; _L_BLIND sorted and unique), _L_BLIND_STOCK, _L_BLIND_PROJ, _L_PASS, _L_NOBASE
+  # (0|1 line flags) and _L_SEC014 (the note lines, each indented four spaces).
+  _lint_scan() {
+    _L_RULES=""; _L_BLIND=""; _L_REVERTED=""; _L_PROJREV=""; _L_SEC014=""
+    _L_BLIND_STOCK=0; _L_BLIND_PROJ=0; _L_PASS=0; _L_NOBASE=0
+    [ -f "$1" ] || return 0
+    eval "$(awk '
+      function q(s) { gsub(/\047/, "\047\\\047\047", s); return "\047" s "\047" }
+      function startswith(s, p) { return substr(s, 1, length(p)) == p }
+      { line = $0 }
+      inA { if (line == "") inA = 0
+            else if (match(line, /^ +[A-Z][A-Z0-9-]*[0-9]+:/)) { id = substr(line, RSTART, RLENGTH); gsub(/[ :]/, "", id); nb++; blind[nb] = id } }
+      inR { if (line == "") inR = 0
+            else if (match(line, /^ +[A-Za-z0-9_.-]+\.star:/)) { id = substr(line, RSTART, RLENGTH); gsub(/[ :]/, "", id); rev = rev (rev == "" ? "" : ",") id } }
+      inP { if (line == "") inP = 0
+            else if (match(line, /^ +[A-Za-z0-9_.-]+\.star:/)) { id = substr(line, RSTART, RLENGTH); gsub(/[ :]/, "", id); prj = prj (prj == "" ? "" : ",") id } }
+      startswith(line, "!! A RULE COULD NOT READ") { inA = 1 }
+      startswith(line, "!! LINT RULES REVERTED TO STOCK") { inR = 1 }
+      startswith(line, "!! PROJECT-EDITED LINT RULE") { inP = 1 }
+      startswith(line, "BLIND \342\200\224 lint rules reverted to stock") { bs = 1 }
+      startswith(line, "BLIND \342\200\224 reverted: a project-edited") || startswith(line, "BLIND \342\200\224 a lint rule changed since the baseline") { bp = 1 }
+      startswith(line, "PASS") { ps = 1 }
+      startswith(line, "note: SEC014") { sec = sec "    " line "\n" }
+      index(line, "no baseline yet") { nobase = 1 }
+      line ~ /^ +[A-Z][A-Z0-9-]*[0-9]+ +[a-z]+ +[0-9]+ -> [0-9]+ +\(\+[0-9]+\)/ { rules = rules $1 " " $6 " " }
+      END {
+        # sort -u : insertion sort, then drop repeats
+        for (i = 2; i <= nb; i++) { v = blind[i]; j = i - 1; while (j >= 1 && blind[j] > v) { blind[j + 1] = blind[j]; j-- } blind[j + 1] = v }
+        for (i = 1; i <= nb; i++) if (i == 1 || blind[i] != blind[i - 1]) bl = bl (bl == "" ? "" : ",") blind[i]
+        print "_L_RULES=" q(rules); print "_L_BLIND=" q(bl); print "_L_REVERTED=" q(rev); print "_L_PROJREV=" q(prj)
+        print "_L_SEC014=" q(sec); print "_L_BLIND_STOCK=" (bs + 0); print "_L_BLIND_PROJ=" (bp + 0)
+        print "_L_PASS=" (ps + 0); print "_L_NOBASE=" (nobase + 0)
+      }' "$1")"
+  }
   if [ -n "${SKIP_LINT:-}" ]; then
     LINT_DETAIL="lint SKIPPED (SKIP_LINT=$SKIP_LINT)"
     echo "  ⚠ lint ratchet skipped: SKIP_LINT=$SKIP_LINT"; return
@@ -1047,13 +1140,13 @@ run_lint_gate() {
   # what is safe (stock or receipt-matching copies are restored; a hand edit is never lost),
   # so run it, then lint once more. A rule it will not restore stays BLIND, as before.
   _restored=""
+  _lint_scan "$_lo"
   if [ "$LINT_RC" -eq 1 ] && [ "${MXTK_NO_LINT_RESTORE:-}" != "1" ] \
-     && grep -q '^BLIND — lint rules reverted to stock' "$_lo"; then
+     && [ "$_L_BLIND_STOCK" = 1 ]; then
     _tk=""
     type find_toolkit_root >/dev/null 2>&1 && _tk="$(find_toolkit_root 2>/dev/null || true)"
     if [ -n "$_tk" ] && [ -f "$_tk/bin/lib/install-lint-rules.sh" ]; then
-      _restored=$(sed -n '/^!! LINT RULES REVERTED TO STOCK/,/^$/p' "$_lo" \
-                   | grep -oE '^ +[A-Za-z0-9_.-]+\.star:' | tr -d ' :' | paste -sd, -)
+      _restored="$_L_REVERTED"
       echo "  ↻ lint rules reverted to stock (mxcli's session-start refresh?): restoring the toolkit versions from $_tk"
       # Capture to a file first: piping the installer into head can stop it after 12 lines of output.
       _io="$(mktemp)"
@@ -1062,39 +1155,34 @@ run_lint_gate() {
       rm -f "$_io"
       LINT_RC=0
       bash "$PROJECT_ROOT/bin/lint-gate.sh" >"$_lo" 2>&1 || LINT_RC=$?
+      _lint_scan "$_lo"
     fi
   fi
   # lint-gate's non-blocking SEC014 note (#312: rule installed, decision not made) is otherwise
   # visible only on a failing run, because the capture above is shown only then. Always echo it.
-  [ -f "$_lo" ] && { grep '^note: SEC014' "$_lo" 2>/dev/null | sed 's/^/    /' || true; }
+  [ -z "$_L_SEC014" ] || printf '%s' "$_L_SEC014"
   case "$LINT_RC" in
     0) LINT_DETAIL="lint unchanged vs baseline"; echo "  ✓ lint: no rule rose vs baseline" ;;
     1) # Rule ids are matched as [A-Z][A-Z0-9-]*[0-9]+, not [A-Z]+[0-9]+: mxcli's built-in
        # rules include hyphenated ids (MDL-FLOW01), and the old pattern dropped them from every
        # row — three field apps logged 475 ROSE rows and not one named MDL-FLOW01 (2026-10-12).
-       _rules=$(grep -E '^ +[A-Z][A-Z0-9-]*[0-9]+ +[a-z]+ +[0-9]+ -> [0-9]+ +\(\+[0-9]+\)' "$_lo" \
-                 | awk '{printf "%s %s ", $1, $6}')
-       _blind=$(sed -n '/^!! A RULE COULD NOT READ/,/^$/p' "$_lo" \
-                 | grep -oE '^ +[A-Z][A-Z0-9-]*[0-9]+:' | tr -d ' :' | sort -u | paste -sd, -)
-       _reverted=$(sed -n '/^!! LINT RULES REVERTED TO STOCK/,/^$/p' "$_lo" \
-                    | grep -oE '^ +[A-Za-z0-9_.-]+\.star:' | tr -d ' :' | paste -sd, -)
-       if grep -q '^BLIND — lint rules reverted to stock' "$_lo"; then
+       _rules="$_L_RULES"; _blind="$_L_BLIND"; _reverted="$_L_REVERTED"
+       if [ "$_L_BLIND_STOCK" = 1 ]; then
          # `mxcli init` re-seeded the toolkit rules (#264): lint-gate did not lint. Logging this
          # as a rise blamed the next script for CONV010 26 -> 169 on flows it never touched.
          LINT_RC=3
          LINT_DETAIL="lint BLIND: rules reverted to stock (${_reverted:-see output}) — run sync-project.sh; delta not attributable"
          echo "  ✗ lint: toolkit rules reverted to stock (${_reverted:-see output}) — not linted, not a rise"
          sed -n '/^!! LINT RULES REVERTED TO STOCK/,/^BLIND/p' "$_lo" | head -16 | sed 's/^/    /'
-       elif grep -qE '^BLIND — (reverted: a project-edited|a lint rule changed since the baseline)' "$_lo"; then
+       elif [ "$_L_BLIND_PROJ" = 1 ]; then
          # A rule the project edited moved since the baseline (#524): mxcli's session-start
          # refresh re-seeded stock over it, or someone changed it. Not linted, not a rise.
-         _projrev=$(sed -n '/^!! PROJECT-EDITED LINT RULE/,/^$/p' "$_lo" \
-                     | grep -oE '^ +[A-Za-z0-9_.-]+\.star:' | tr -d ' :' | paste -sd, -)
+         _projrev="$_L_PROJREV"
          LINT_RC=3
          LINT_DETAIL="lint BLIND: project-edited rule(s) changed since the baseline (${_projrev:-see output}) — git checkout, or re-baseline; delta not attributable"
          echo "  ✗ lint: project-edited lint rule(s) changed since the baseline (${_projrev:-see output}) — not linted, not a rise"
          sed -n '/^!! PROJECT-EDITED LINT RULE/,/^BLIND/p' "$_lo" | head -16 | sed 's/^/    /'
-       elif [ -z "$_rules" ] && grep -q '^PASS' "$_lo"; then
+       elif [ -z "$_rules" ] && [ "$_L_PASS" = 1 ]; then
          # lint-gate exits 1 for PASS-BLIND too. Logging that as "ROSE: see output" made a rule
          # that inspected nothing look like a rise with no rule named — 20 such rows in two
          # field apps whose toolkit CONV020 (now MXTK-UX003) shipped unconfigured (#229). It is an instrument fault.
@@ -1140,10 +1228,9 @@ print(len(new), len(carried), " ".join(f"{r}:{n}" for r, n in sorted(by.items())
 for r, f in new[:10]: print(f"    {r}  {f[:180]}" + ("   (carried: still unfixed)" if (r, f) in carried else ""))
 if len(new) > 10: print(f"    … {len(new) - 10} more in .claude/loop/lint-last.json")
 PY
-         _thispyexe="${PY:-$(resolve_py 2>/dev/null || true)}"
+         _thispyexe="${PY:-${MXTK_PY_MEMO:-$(resolve_py 2>/dev/null || true)}}"
          _thisnew=$([ -n "$_thispyexe" ] && "$_thispyexe" -c "$_thispy" "$PROJECT_ROOT/.claude/loop")
-         _thisn=$(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f1)
-         _thisc=$(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f2)
+         _first="${_thisnew%%$'\n'*}"; _thisn="${_first%% *}"; _rest="${_first#* }"; _thisc="${_rest%% *}"
          if [ -z "$_thisnew" ]; then
            _noadv=1   # undiffed rise: keep prev-exec as is, or the next exec reads these as old debt
            # No Python, or the diff failed: never read that as "0 new". Report the rise vs baseline.
@@ -1156,15 +1243,15 @@ PY
            echo "  ✓ lint: this script added no finding (older debt vs baseline unchanged)"
          else
          # "lint rose" stays the wording, as before this change (metrics and readers key on it).
-         LINT_DETAIL="lint rose: +${_thisn} new or unfixed (${_thisc:-0} carried from earlier execs): $(printf '%s\n' "$_thisnew" | head -1 | cut -d' ' -f3-)"
+         LINT_DETAIL="lint rose: +${_thisn} new or unfixed (${_thisc:-0} carried from earlier execs): ${_rest#* }"
          echo "  ✗ lint: ${_thisn} finding(s) new this script or still unfixed from an earlier one — read each one:"
-         printf '%s\n' "$_thisnew" | tail -n +2
+         case "$_thisnew" in *$'\n'*) printf '%s\n' "${_thisnew#*$'\n'}" ;; esac
          echo "    Fix the script and re-run. Accepting the debt is the user's call, made in chat:"
          echo "    bin/lint-gate.sh --update-baseline --reason \"<why>\" (a security-tier rise also"
          echo "    needs --approved-in-chat). The acceptance is logged to .claude/lint-acceptances.tsv."
          fi
        fi ;;
-    2) if grep -q 'no baseline yet' "$_lo"; then
+    2) if [ "$_L_NOBASE" = 1 ]; then
          LINT_DETAIL="lint not measured: no lint baseline yet (bin/lint-gate.sh --update-baseline)"
          echo "  ⚠ lint: no baseline yet, so nothing to compare against. Take it once, after the scaffold:"
          echo "    bin/lint-gate.sh --update-baseline"
@@ -1261,10 +1348,13 @@ fi
 # exit code is whatever the rest of the chain decides. MXTK_RESTATE_GUARD=off skips it. Cost
 # without a co-owner: one grep over mdlsource/ for the restated names, no mxcli call.
 if [ "$PATCH_MODE" != "1" ] && [ "${MXTK_RESTATE_GUARD:-}" != "off" ] && [ -f "$SCRIPT" ] \
-   && [ -f "$(dirname "$0")/script-owners.sh" ]; then
-  _so_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$(dirname "$0")/script-owners.sh" check "$SCRIPT" "$PROJECT_ROOT" 2>/dev/null || true)"
-  _so_warn="$(printf '%s\n' "$_so_out" | grep -E '^(REVERT|UNCHECKED)	' || true)"
-  _so_note="$(printf '%s\n' "$_so_out" | grep '^NOTE	' || true)"
+   && [ -f "$_XD/script-owners.sh" ]; then
+  _so_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$_XD/script-owners.sh" check "$SCRIPT" "$PROJECT_ROOT" 2>/dev/null || true)"
+  _so_warn=""; _so_note=""
+  if [ -n "$_so_out" ]; then   # the common case is no output at all: no two grep pipelines to say so
+    _so_warn="$(printf '%s\n' "$_so_out" | grep -E '^(REVERT|UNCHECKED)	' || true)"
+    _so_note="$(printf '%s\n' "$_so_out" | grep '^NOTE	' || true)"
+  fi
   if [ -n "$_so_note" ]; then
     echo "NOTE: new owner of $(printf '%s\n' "$_so_note" | cut -f2 | sed 's/^[A-Z]* //' | LC_ALL=C sort -u | tr '\n' ' ')— older owner(s): $(printf '%s\n' "$_so_note" | cut -f3 | LC_ALL=C sort -u | tr '\n' ' '); add '-- supersedes: <older script>' (STOP 21)"
   fi
@@ -1285,9 +1375,9 @@ fi
 # `-- baseline:` header with a fresh DESCRIBE. Opt-in: a script with no header costs one grep and
 # no mxcli call. Rows print as WARN lines; DRIFT lands in the BUILD-LOG detail.
 if [ "$PATCH_MODE" != "1" ] && [ "${MXTK_RESTATE_GUARD:-}" != "off" ] && [ -f "$SCRIPT" ] \
-   && [ -f "$(dirname "$0")/describe-baseline.sh" ] && grep -qE '^[[:space:]]*--[[:space:]]*baseline:' "$SCRIPT"; then
+   && [ -f "$_XD/describe-baseline.sh" ] && grep -qE '^[[:space:]]*--[[:space:]]*baseline:' "$SCRIPT"; then
   _db_rc=0
-  _db_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$(dirname "$0")/describe-baseline.sh" verify "$SCRIPT" 2>&1)" || _db_rc=$?
+  _db_out="$(PROJECT_ROOT="$PROJECT_ROOT" bash "$_XD/describe-baseline.sh" verify "$SCRIPT" 2>&1)" || _db_rc=$?
   case "$_db_rc" in
     1)
       echo "WARN: stale draft: '-- baseline:' header no longer matches the model:"
@@ -1311,12 +1401,14 @@ fi
 # rules 6/7 hold — the remedy is performed, not blocked, and ALLOW_UNVERIFIED=1 says out
 # loud "write anyway"; that write then carries no verification stamp, so the pre-commit
 # hook refuses it until ./bin/verify-model.sh has seen it.
+# The version is read BEFORE mxtk_ensure_mxbuild so that call (which asks for it three times)
+# and every find_mxbuild after it hit the memo instead of starting sqlite3 each time.
+_mv="$(mxtk_model_version "$MPR" 2>/dev/null || true)"; [ -n "$_mv" ] && export MXTK_MODEL_VERSION="$_mv"
 MXBUILD="$(mxtk_ensure_mxbuild "$MPR" || true)"
 # Memo for the rest of this run and every script it starts (#584): find_mxbuild honours
 # MXTK_MXBUILD_MEMO, mxtk_model_version honours MXTK_MODEL_VERSION, so neither re-reads the .mpr
 # or re-probes the Studio Pro install per call. A run only ever gates one model version.
 [ -x "$MXBUILD" ] && export MXTK_MXBUILD_MEMO="$MXBUILD"
-_mv="$(mxtk_model_version "$MPR" 2>/dev/null || true)"; [ -n "$_mv" ] && export MXTK_MODEL_VERSION="$_mv"
 # Was: JAVA_HOME=$(/usr/libexec/java_home ...) — a macOS-only binary, so on Windows
 # JAVA_HOME came back empty, JAVA_EXE was the literal "/bin/java", the gate guard
 # below failed its -x test and the entire mxbuild block was skipped on every run.
@@ -1378,7 +1470,7 @@ RESTORE_TRIED=0
 restore_snapshot() {
   RESTORE_TRIED=1
   NEWEST_SNAP=$(ls -dt "$PROJECT_ROOT/.mpr-snapshots"/[0-9]*/ 2>/dev/null | head -1)
-  RESTORER="$(dirname "$0")/restore-mpr.sh"
+  RESTORER="$_XD/restore-mpr.sh"
   if [ -z "$NEWEST_SNAP" ] || [ ! -f "$NEWEST_SNAP/$MPR_BASE" ]; then
     echo "  ⚠  No usable snapshot to restore from — the model is left as the script wrote it."
   elif [ ! -f "$RESTORER" ]; then
@@ -1571,7 +1663,7 @@ is_subset_of() {
 # `doctor.sh --quick` here. It NEVER blocks (guard rules 6 and 7): it prints, and the exec goes on.
 _DR="$PROJECT_ROOT/.claude/.doctor-receipt"
 _DOCTOR=""
-for _c in "${MXTK_ROOT:-}/bin/doctor.sh" "$(sed -nE 's/^\| *Toolkit root *\| *`([^`]+)`.*/\1/p' "$PROJECT_ROOT/CLAUDE.local.md" 2>/dev/null | head -1)/bin/doctor.sh"; do
+for _c in "${MXTK_ROOT:-}/bin/doctor.sh" "$_TKR/bin/doctor.sh"; do
   [ -x "$_c" ] && { _DOCTOR="$_c"; break; }
 done
 if [ -n "$_DOCTOR" ] && [ "${SKIP_DOCTOR:-0}" != "1" ]; then
@@ -1622,15 +1714,26 @@ gate_kind_decide() {
   # javasource/*/proxies/ is excluded: mxbuild regenerates those from the model on every
   # full build, so counting them made each full build look like a Java change (field run).
   _gk_java_fp() { mxtk_java_fp "$PROJECT_ROOT"; }
+  # Same job as _first_match (top of file); nested because the gate-kind fixture extracts this
+  # function on its own, so it must not lean on a helper defined elsewhere in exec.sh.
+  _gk_first() {  # <file> <ERE from ^, one capture without newlines> -> _FM
+    _FM=""; [ -r "$1" ] || return 1
+    local _gkt _gknl=$'\n'; IFS= read -r -d '' _gkt < "$1" || true
+    [[ "$_gknl$_gkt" =~ $_gknl${2#^} ]] || return 1
+    _FM="${BASH_REMATCH[1]}"
+  }
   _gk_mode="${MXTK_GATE_MODE:-}"
-  [ -n "$_gk_mode" ] || _gk_mode="$(sed -n 's/^[*_ ]*Gate mode:[*_ ]*\([A-Za-z]*\).*/\1/p' "$PROJECT_ROOT/PROJECT.md" 2>/dev/null | head -1 | tr 'A-Z' 'a-z')"
+  if [ -z "$_gk_mode" ]; then
+    _gk_first "$PROJECT_ROOT/PROJECT.md" '^[*_ ]*Gate mode:[*_ ]*([A-Za-z]*)' || true
+    case "$_FM" in [Cc][Hh][Ee][Cc][Kk]) _gk_mode=check ;; *) _gk_mode="$_FM" ;; esac
+  fi
   # Default is check (2026-10-29, maintainer decision): nobody was going to add a line to
   # PROJECT.md, and the full build still runs at every boundary listed above. `Gate mode: full`
   # (or MXTK_GATE_MODE=full) keeps a full mxbuild on every exec.
   [ -n "$_gk_mode" ] || _gk_mode=check
   if [ "$_gk_mode" = "check" ]; then
-    _gk_checks="$(sed -n 's/^checks //p' "$_GK_STATE" 2>/dev/null | head -1)"
-    _gk_java="$(sed -n 's/^java //p' "$_GK_STATE" 2>/dev/null | head -1)"
+    _gk_first "$_GK_STATE" '^checks ([^'$'\n'']*)' || true; _gk_checks="$_FM"
+    _gk_first "$_GK_STATE" '^java ([^'$'\n'']*)' || true; _gk_java="$_FM"
     if [ "$PATCH_MODE" = "1" ]; then GATE_KIND_WHY="--patch is opaque"
     elif ! mxtk_find_mx >/dev/null 2>&1; then GATE_KIND_WHY="no mx tool beside $MXBUILD"
     elif [ -z "$_gk_checks" ] || [ -z "$_gk_java" ]; then GATE_KIND_WHY="no full build recorded yet"
@@ -2300,7 +2403,9 @@ fi
 # is no longer the one anything verified.
 if [ -x ./bin/model-stamp.sh ]; then
   if [ "$GATE_STATE" = "pass" ] && [ "$EXEC_STATUS" -eq 0 ]; then
-    MXTK_STAMP_KIND="$GATE_KIND" MXTK_STAMP_ERRORS="$GATE_ERRORS" ./bin/model-stamp.sh write pass "exec.sh $([ "$PATCH_MODE" = 1 ] && echo '--patch ')$(basename "$SCRIPT")$([ "$GATE_KIND" = check ] && echo ' (mx check)')" || true
+    _stamp_src="exec.sh "; [ "$PATCH_MODE" != 1 ] || _stamp_src="${_stamp_src}--patch "
+    _stamp_src="${_stamp_src}${SCRIPT##*/}"; [ "$GATE_KIND" != check ] || _stamp_src="$_stamp_src (mx check)"
+    MXTK_STAMP_KIND="$GATE_KIND" MXTK_STAMP_ERRORS="$GATE_ERRORS" ./bin/model-stamp.sh write pass "$_stamp_src" || true
   else
     ./bin/model-stamp.sh clear >/dev/null 2>&1 || true
   fi
@@ -2311,7 +2416,7 @@ fi
 # Only under `Gate mode: check`: the state file is what the pre-push hook and module-close.sh
 # look for, so a project that never opted in never gets their full-build step (#587 review).
 if [ "$GATE_STATE" = "pass" ] && [ "${_gk_mode:-}" = "check" ]; then
-  mkdir -p "$(dirname "$_GK_STATE")" 2>/dev/null || true
+  mkdir -p "${_GK_STATE%/*}" 2>/dev/null || true
   if [ "$GATE_KIND" = "full" ]; then
     printf 'checks 0\njava %s\n' "$(_gk_java_fp)" > "$_GK_STATE" 2>/dev/null || true
     touch "$PROJECT_ROOT/.claude/loop/mxbuild-warm" 2>/dev/null || true
@@ -2329,14 +2434,14 @@ fi
 # built every page and opened no screenshot of any). Written here, after the restore branch,
 # because a restored script built nothing. Never blocks this exec or the next one — only
 # gate-check.sh's Stage 5 "done" claim reads it. Not for --patch: a patch is opaque.
-if [ "$PATCH_MODE" = 0 ] && [ -f "$(dirname "$0")/look-ledger.sh" ]; then
-  bash "$(dirname "$0")/look-ledger.sh" owe "$SCRIPT" || true
+if [ "$PATCH_MODE" = 0 ] && [ -f "$_XD/look-ledger.sh" ]; then
+  bash "$_XD/look-ledger.sh" owe "$SCRIPT" || true
 fi
 # Last writer of each document this script names (script-owners.sh ledger), so a later check can
 # tell a replay that reverts nothing from one that does. Same place and reason as LOOK owed: a
 # restored or partial run exited above. No mxcli call: one awk over this script.
-if [ "$PATCH_MODE" = 0 ] && [ -f "$(dirname "$0")/script-owners.sh" ]; then
-  PROJECT_ROOT="$PROJECT_ROOT" bash "$(dirname "$0")/script-owners.sh" record "$SCRIPT" 2>/dev/null || true
+if [ "$PATCH_MODE" = 0 ] && [ -f "$_XD/script-owners.sh" ]; then
+  PROJECT_ROOT="$PROJECT_ROOT" bash "$_XD/script-owners.sh" record "$SCRIPT" 2>/dev/null || true
 fi
 
 # ── Build plan page ──────────────────────────────────────────────────────────
@@ -2344,17 +2449,17 @@ fi
 # (its only trigger used to be iterative-build-loop.md step 16, so a page written at Stage 4
 # stayed empty for the whole build). --refresh is quiet, writes only over a page that script
 # generated, and leaves the file alone when nothing but the timestamp would change.
-if [ -f "$(dirname "$0")/build-plan-status.sh" ]; then
+if [ -f "$_XD/build-plan-status.sh" ]; then
   # A crashed generator leaves one visible WARN line (the script prints it on stderr); never a failed step.
   # In the background (#584): the verdict is already known and nothing below reads the page,
   # so the exec does not wait for its python/node starts. MXTK_SYNC_REFRESH=1 waits (tests).
   if [ "${MXTK_SYNC_REFRESH:-0}" = "1" ]; then
-    { bash "$(dirname "$0")/build-plan-status.sh" "$PROJECT_ROOT" --refresh 2>&1 >/dev/null || true; } | grep -m1 '^WARN: ' || true
+    { bash "$_XD/build-plan-status.sh" "$PROJECT_ROOT" --refresh 2>&1 >/dev/null || true; } | grep -m1 '^WARN: ' || true
   else
     # stdout AND stderr go to a file: an inherited stderr kept a caller's `exec.sh 2>&1 | …` pipe
     # open until the refresh finished, which is how agent tools read output (#587 review).
     mkdir -p "$PROJECT_ROOT/.claude/loop" 2>/dev/null || true
-    ( { bash "$(dirname "$0")/build-plan-status.sh" "$PROJECT_ROOT" --refresh 2>&1 >/dev/null || true; } \
+    ( { bash "$_XD/build-plan-status.sh" "$PROJECT_ROOT" --refresh 2>&1 >/dev/null || true; } \
         | grep -m1 '^WARN: ' || true ) </dev/null >"$PROJECT_ROOT/.claude/loop/build-plan-refresh.warn" 2>&1 &
   fi
 fi
@@ -2366,7 +2471,7 @@ fi
 # reference test-stack-up.sh uses). Never blocks, never changes the exit code.
 watch_theme_changes() {  # prints up to 3 theme files newer than the run --local handshake
   _hs=""
-  for _d in "$(cd "$(dirname "$MPR")" && pwd)" "$MODEL_DIR"; do
+  for _d in "$(cd "${MPR%/*}" && pwd)" "$MODEL_DIR"; do
     [ -f "$_d/.mxcli/run-local.json" ] && { _hs="$_d/.mxcli/run-local.json"; break; }
   done
   [ -n "$_hs" ] || return 0
@@ -2433,8 +2538,14 @@ if [ "$LINT_RC" -eq 1 ]; then
   # pre-#443 code. The write is still kept. Read the same way as `Context packs:`; env
   # MXTK_LINT_GATE wins (doctor.sh passes soft: its repair must not read 1 as "not kept").
   _lgm="${MXTK_LINT_GATE:-}"
-  [ -n "$_lgm" ] || _lgm="$(sed -nE 's/^[*_ -]*Lint gate:[*_ ]*[`]?([A-Za-z-]+).*/\1/p' "$PROJECT_ROOT/PROJECT.md" 2>/dev/null | head -1)"
-  _lgm="$(printf '%s' "$_lgm" | tr 'A-Z' 'a-z')"
+  if [ -z "$_lgm" ]; then _first_match "$PROJECT_ROOT/PROJECT.md" '^[*_ -]*Lint gate:[*_ ]*[`]?([A-Za-z-]+)' || true; _lgm="$_FM"; fi
+  case "$_lgm" in
+    hard|soft|default|"") ;;
+    [Hh][Aa][Rr][Dd]) _lgm=hard ;;
+    [Ss][Oo][Ff][Tt]) _lgm=soft ;;
+    [Dd][Ee][Ff][Aa][Uu][Ll][Tt]) _lgm=default ;;
+    *) _lgm="$(printf '%s' "$_lgm" | tr 'A-Z' 'a-z')" ;;
+  esac
   case "$_lgm" in hard|soft|default|"") ;; *) echo "note: 'Lint gate: $_lgm' not recognised (hard | default)" ;; esac
   if [ "$_lgm" = hard ]; then
     echo "gate passed, LINT ROSE under 'Lint gate: hard' (exit 1: write kept, do not re-apply)"
@@ -2447,7 +2558,7 @@ fi
 echo ""
 echo "✓ Script applied to $MPR_BASE."
 echo ""
-_EL=$(( $(date +%s) - _T0 ))
+_EL=$(( ${EPOCHSECONDS:-$(date +%s)} - _T0 ))
 echo "  elapsed: ${_EL}s (check + snapshot + exec + mxbuild gate)"
 if [ -n "$STEP_TIMES" ]; then echo "  steps: $STEP_TIMES"; fi
 [ -n "$CHANGE_CLASS" ] && echo "  change class: $CHANGE_CLASS — test lane: $(change_lane)"
@@ -2489,12 +2600,12 @@ echo ""
 # a second project open in another window is unaffected.
 RESTART_SP="${SP_RESTART:-0}"
 
-if [ "$RESTART_SP" = "1" ] && [ -x "$(dirname "$0")/restart-sp.sh" ]; then
+if [ "$RESTART_SP" = "1" ] && [ -x "$_XD/restart-sp.sh" ]; then
   echo "→ Reopening Studio Pro..."
   # AUTO_SP=1: reaching here now requires an explicit SP_RESTART=1, so consent
   # was given deliberately rather than inferred from a keypress, and a second
   # confirm would only be unanswerable from a non-interactive caller.
-  if AUTO_SP=1 "$(dirname "$0")/restart-sp.sh"; then
+  if AUTO_SP=1 "$_XD/restart-sp.sh"; then
     echo ""
     echo "  ▶ Studio Pro is reopening with your changes. Click Run Locally when it finishes loading."
   else
diff --git a/project-bin/lint-gate.sh b/project-bin/lint-gate.sh
index 44c365e9..f3b320ed 100755
--- a/project-bin/lint-gate.sh
+++ b/project-bin/lint-gate.sh
@@ -77,7 +77,9 @@
 
 set -uo pipefail
 
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# dirname of this script without a process (a start costs ~100 ms on Windows).
+_lgd="${BASH_SOURCE[0]%/*}"; [ "$_lgd" != "${BASH_SOURCE[0]}" ] || _lgd=.
+ROOT="$(cd "$_lgd/.." && pwd)"
 cd "$ROOT" || exit 2
 
 # Python is resolved, not assumed: a bare `python3` is the Store alias stub on Windows and a
@@ -88,8 +90,8 @@ cd "$ROOT" || exit 2
 # overwriting it — deliberately, since projects harden their crash net. So every project that
 # has already tuned _common.sh would receive this script and have it die on line 1 with
 # "require_py: command not found". Measured on PROJECT-C before this fallback existed.
-if [ -f "$(dirname "${BASH_SOURCE[0]}")/_common.sh" ]; then
-  . "$(dirname "${BASH_SOURCE[0]}")/_common.sh"
+if [ -f "$_lgd/_common.sh" ]; then
+  . "$_lgd/_common.sh"
 fi
 if ! type require_py >/dev/null 2>&1; then
   require_py() {
@@ -117,6 +119,10 @@ require_py
 if [ -z "${MPR:-}" ] && [ -n "${MPR_FILE:-}" ]; then
   _m="${MPR_FILE#"$ROOT"/}"; [ -f "$ROOT/$_m" ] && MPR="$_m"
 fi
+# Under exec.sh the model was resolved once (MXTK_MPR_MEMO, relative to ROOT here): no ls probes.
+if [ -z "${MPR:-}" ] && type _mxtk_mpr_memo_ok >/dev/null 2>&1 && _mxtk_mpr_memo_ok; then
+  case "$MXTK_MPR_MEMO" in "$ROOT"/*) MPR="${MXTK_MPR_MEMO#"$ROOT"/}" ;; esac
+fi
 if [ -z "${MPR:-}" ]; then
   MPR="$(ls "$ROOT"/*.mpr 2>/dev/null | head -1)"
   MPR="$(basename "${MPR:-}")"
@@ -142,7 +148,8 @@ if [ -z "$MPR" ] || [ ! -f "$ROOT/$MPR" ]; then
   echo "lint-gate: no .mpr found in $ROOT, $ROOT/app or $ROOT/apps/<X> — set MPR=<name>.mpr" >&2
   exit 2
 fi
-if [ "$(ls "$ROOT"/*.mpr 2>/dev/null | wc -l | tr -d " ")" -gt 1 ] && [ -z "${MPR_EXPLICIT:-}" ]; then
+_rootmprs=("$ROOT"/*.mpr)   # a glob, not ls | wc | tr
+if [ -e "${_rootmprs[0]}" ] && [ "${#_rootmprs[@]}" -gt 1 ] && [ -z "${MPR_EXPLICIT:-}" ]; then
   echo "lint-gate: several .mpr files here; linting $MPR. Set MPR=<name>.mpr to choose." >&2
 fi
 VENDOR_FILE="$ROOT/.claude/lint-vendor-modules.txt"
@@ -196,7 +203,11 @@ fi
 # This script does not source _common.sh (see header); resolve the binary the same way it
 # does — mxcli.exe first on Git Bash, since the Dev Container may have left a Linux `mxcli`.
 MXCLI=""
-case "$(uname -s 2>/dev/null)" in MINGW*|MSYS*|CYGWIN*) [ -x ./mxcli.exe ] && MXCLI=./mxcli.exe ;; esac
+if [ -n "${MXTK_PLATFORM:-}" ]; then   # exec.sh already asked uname
+  [ "$MXTK_PLATFORM" = windows ] && [ -x ./mxcli.exe ] && MXCLI=./mxcli.exe
+else
+  case "$(uname -s 2>/dev/null)" in MINGW*|MSYS*|CYGWIN*) [ -x ./mxcli.exe ] && MXCLI=./mxcli.exe ;; esac
+fi
 [ -n "$MXCLI" ] || { [ -x ./mxcli ] && MXCLI=./mxcli; }
 [ -n "$MXCLI" ] || { echo "lint-gate: no runnable mxcli in $ROOT (Windows: mxcli.exe) — bin/doctor.sh --install --yes <project>" >&2; exit 2; }
 [ -e "$MPR" ]  || { echo "lint-gate: $MPR not found" >&2; exit 2; }
@@ -300,10 +311,36 @@ for name, want, k in rows:
         continue  # unchanged, or header kept: a hand edit, which install-lint-rules.sh reports
     print("%s\theader gone, md5 %s != receipt %s" % (name, got[:8], want[:8]))
 PY
-  ALLREV="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" DISABLED="$ROOT/.claude/lint-rules-disabled.txt" \
-    STOCK_LIST="$STOCK_LIST" ROOT="$ROOT" "$PY" -c "$_RCHK")"
-  REVERTED="$(printf '%s\n' "$ALLREV" | grep -v "$(printf '\t')proj-" | grep . || true)"
-  PROJREV="$(printf '%s\n' "$ALLREV" | grep "$(printf '\t')proj-" || true)"
+  # The check below is a Python start whose answer only changes when one of its inputs does. A
+  # clean answer leaves .claude/loop/.lint-receipt-ok behind, holding a content signature (one
+  # cksum pipeline) of everything the check reads: the receipt, the disabled list, the stock list
+  # and every rule file. While the signature is unchanged, the clean answer still stands. Content,
+  # not mtimes: `cp -p`, `rsync -t`, tar/unzip and in-place restores keep an old mtime (#590
+  # review). Any mismatch is never marked, so it is always re-checked.
+  _okm="$ROOT/.claude/loop/.lint-receipt-ok"; _rc_skip=0
+  _rc_sig="$(cksum "$RECEIPT" ${STOCK_LIST:+"$STOCK_LIST"} "$ROOT/.claude/lint-rules-disabled.txt" "$ROOT"/.claude/lint-rules/* 2>/dev/null | cksum)"
+  if [ -f "$_okm" ] && [ -n "$_rc_sig" ] && [ "$(cat "$_okm" 2>/dev/null)" = "$_rc_sig" ]; then
+    _rc_skip=1
+  fi
+  ALLREV=""; REVERTED=""; PROJREV=""
+  if [ "$_rc_skip" = 0 ]; then
+    if ALLREV="$(RECEIPT="$RECEIPT" RULES_DIR="$ROOT/.claude/lint-rules" DISABLED="$ROOT/.claude/lint-rules-disabled.txt" \
+        STOCK_LIST="$STOCK_LIST" ROOT="$ROOT" "$PY" -c "$_RCHK")" && [ -z "$ALLREV" ]; then
+      { mkdir -p "$ROOT/.claude/loop" && printf '%s\n' "$_rc_sig" > "$_okm"; } 2>/dev/null || true
+    fi
+    if [ -n "$ALLREV" ]; then   # the two greps only have something to sort when the check printed rows
+      _tab="$(printf '\t')"
+      while IFS= read -r _arl; do
+        [ -n "$_arl" ] || continue
+        case "$_arl" in
+          *"${_tab}proj-"*) PROJREV="${PROJREV:+$PROJREV
+}$_arl" ;;
+          *) REVERTED="${REVERTED:+$REVERTED
+}$_arl" ;;
+        esac
+      done <<< "$ALLREV"
+    fi
+  fi
   if [ -n "$REVERTED" ]; then
     TKR=""
     type find_toolkit_root >/dev/null 2>&1 && TKR="$(PROJECT_ROOT="$ROOT" find_toolkit_root 2>/dev/null || true)"
diff --git a/project-bin/look-ledger.sh b/project-bin/look-ledger.sh
index f0d0cc74..92d76447 100755
--- a/project-bin/look-ledger.sh
+++ b/project-bin/look-ledger.sh
@@ -56,7 +56,8 @@
 # the exec that called it. Bash 3.2 compatible.
 
 set -u
-. "$(dirname "$0")/_common.sh"
+_lsd="${0%/*}"; [ "$_lsd" != "$0" ] || _lsd=.   # dirname without a process
+. "$_lsd/_common.sh"
 
 LOOK_DIR="$PROJECT_ROOT/.claude/loop/look"
 OWED="$LOOK_DIR/owed.tsv"
@@ -85,15 +86,16 @@ look_pages_in() {
       n=split(s, w, /[[:space:]]+/)
       for (i=1; i<=n; i++) if (toupper(w[i])=="PAGE") { name=w[i+1]; break }
       sub(/[(;{].*$/, "", name); gsub(/"/, "", name)
-      if (name ~ /^[A-Za-z0-9_]+\.[A-Za-z0-9_]+$/) print name
-    }' "$1" 2>/dev/null | awk '!seen[$0]++'
+      if (name ~ /^[A-Za-z0-9_]+\.[A-Za-z0-9_]+$/ && !seen[name]++) print name
+    }' "$1" 2>/dev/null
 }
 
 cmd_owe() {
   local script="${1:-}" now iso p n=0
   [ -f "$script" ] || return 0
-  mkdir -p "$LOOK_DIR" 2>/dev/null || return 0
-  now=$(date +%s); iso=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  [ -d "$LOOK_DIR" ] || mkdir -p "$LOOK_DIR" 2>/dev/null || return 0
+  if [ -n "${EPOCHSECONDS:-}" ]; then now=$EPOCHSECONDS; TZ=UTC printf -v iso '%(%Y-%m-%dT%H:%M:%SZ)T' -1   # bash 5: no date process
+  else now=$(date +%s); iso=$(date -u +%Y-%m-%dT%H:%M:%SZ); fi
   while IFS= read -r p; do
     [ -n "$p" ] || continue
     printf '%s\t%s\t%s\t%s\n' "$now" "$iso" "$p" "${script#"$PROJECT_ROOT"/}" >> "$OWED" && n=$((n+1))
diff --git a/project-bin/metrics-ledger.sh b/project-bin/metrics-ledger.sh
index 19c63ab6..00febdcf 100755
--- a/project-bin/metrics-ledger.sh
+++ b/project-bin/metrics-ledger.sh
@@ -41,15 +41,16 @@
 # text mode). Keep bash-3.2 compatible.
 
 set -uo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+_mld="${BASH_SOURCE[0]%/*}"; [ "$_mld" != "${BASH_SOURCE[0]}" ] || _mld=.   # dirname without a process
+ROOT="$(cd "$_mld/.." && pwd)"
 PROJECT_ROOT="$ROOT"
 LOOP="$ROOT/.claude/loop"
 LEDGER="$LOOP/metrics-ledger.tsv"
 REPORT_LAST="$LOOP/report-last.json"
 LINT_LAST="$LOOP/lint-last.json"
 
-if [ -f "$(dirname "${BASH_SOURCE[0]}")/_common.sh" ]; then
-  . "$(dirname "${BASH_SOURCE[0]}")/_common.sh"
+if [ -f "$_mld/_common.sh" ]; then
+  . "$_mld/_common.sh"
 fi
 if ! type require_py >/dev/null 2>&1; then
   require_py() {
@@ -85,7 +86,7 @@ if [ "$MODE" = "score" ]; then
   if [ -z "$MXCLI" ] || [ ! -x "$MXCLI" ] || [ -z "$MPR" ]; then
     echo "metrics-ledger: no ./mxcli or no .mpr — score not taken" >&2; exit 3
   fi
-  mkdir -p "$LOOP"
+  [ -d "$LOOP" ] || mkdir -p "$LOOP"
   _tmp="$LOOP/.report-last.tmp"
   if ! "$MXCLI" report -p "$MPR" --format json >"$_tmp" 2>/dev/null; then
     rm -f "$_tmp"; echo "metrics-ledger: mxcli report failed — score not taken" >&2; exit 3
@@ -130,7 +131,7 @@ done
   echo "metrics-ledger: exec needs --script --gate --result --elapsed" >&2; exit 2; }
 
 MODEL_COMMIT="$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || echo "")"
-mkdir -p "$LOOP"
+[ -d "$LOOP" ] || mkdir -p "$LOOP"
 "$PY" - "$LEDGER" "$SCRIPT" "$GATE" "$RESULT" "$ELAPSED" "$MXB_ERR" "$LINT_RC" "$RESTORED" \
        "$SCORED" "$REPORT_LAST" "$LINT_LAST" "$MODEL_COMMIT" <<'PYEOF'
 import datetime, json, os, sys
diff --git a/project-bin/model-stamp.sh b/project-bin/model-stamp.sh
index 74037c9d..c35bf7b2 100755
--- a/project-bin/model-stamp.sh
+++ b/project-bin/model-stamp.sh
@@ -37,17 +37,28 @@
 # The stamp is machine-local (.claude/.model-verified, self-gitignored): a clone on
 # another machine starts unverified, which is the truth.
 set -e
-. "$(dirname "$0")/_common.sh"
+_msd="${0%/*}"; [ "$_msd" != "$0" ] || _msd=.   # dirname without a process
+. "$_msd/_common.sh"
+_NL=$'\n'
 
 STAMP="$PROJECT_ROOT/.claude/.model-verified"
 
+# `clear` needs nothing but the stamp path. Under exec.sh (a model resolved once for the run) it
+# answers before the model, git and fingerprint set-up below, which `clear` never reads.
+if [ "${1:-}" = clear ] && _mxtk_mpr_memo_ok; then
+  [ ! -e "$STAMP" ] || rm -f "$STAMP"
+  echo "  verification stamp cleared"; exit 0
+fi
+
 _real() {  # resolve symlinks by hand (GNU-only resolvers are absent on older macOS)
   local p="$1" d
   while [ -L "$p" ]; do
-    d="$(dirname "$p")"; p="$(readlink "$p")"
+    d="${p%/*}"; [ "$d" != "$p" ] || d=.
+    p="$(readlink "$p")"
     case "$p" in /*) ;; *) p="$d/$p" ;; esac
   done
-  printf '%s/%s\n' "$(cd "$(dirname "$p")" && pwd -P)" "$(basename "$p")"
+  d="${p%/*}"; [ "$d" != "$p" ] || d=.; [ -n "$d" ] || d=/
+  printf '%s/%s\n' "$(cd "$d" && pwd -P)" "${p##*/}"
 }
 
 # Pin git's view of the repository before any `git -C "$MODEL_DIR"` below.
@@ -98,8 +109,10 @@ _mxtk_several_apps() {
   [ "$(ls "$PROJECT_ROOT"/apps/*/*.mpr 2>/dev/null | wc -l | tr -d ' ')" -gt 1 ]
 }
 _several=0
-if [ "${1:-}" = "check" ] && [ -z "${MPR_FILE:-}" ] && _mxtk_several_apps; then _several=1; fi
-if [ "${1:-}" = "check" ] && [ -z "${MPR_FILE:-}" ] && { [ "$_several" = 1 ] || ! _mxtk_any_mpr; }; then
+# Under exec.sh the model was resolved once for this run (MXTK_MPR_MEMO): a single .mpr exists,
+# so neither the several-apps nor the no-model probe (six ls processes) can apply.
+if [ "${1:-}" = "check" ] && [ -z "${MPR_FILE:-}" ] && ! _mxtk_mpr_memo_ok && _mxtk_several_apps; then _several=1; fi
+if [ "${1:-}" = "check" ] && [ -z "${MPR_FILE:-}" ] && ! _mxtk_mpr_memo_ok && { [ "$_several" = 1 ] || ! _mxtk_any_mpr; }; then
   _q=0; for a in "$@"; do case "$a" in -q|--quiet) _q=1 ;; esac; done
   _staged=""
   if git -C "$PROJECT_ROOT" rev-parse --git-dir >/dev/null 2>&1; then
@@ -158,17 +171,30 @@ fi
 
 MPR="$(find_mpr)" || exit 1
 MPR="$(_real "$MPR")"
-MODEL_DIR="$(dirname "$MPR")"
+MODEL_DIR="${MPR%/*}"; [ "$MODEL_DIR" != "$MPR" ] || MODEL_DIR=.
 MPRC="$MODEL_DIR/mprcontents"
 
-in_git() { git -C "$MODEL_DIR" rev-parse --show-toplevel >/dev/null 2>&1; }
+# git's answers for the model folder, asked ONCE per run of this script (it used to ask
+# `rev-parse --show-toplevel` four to six times and `--show-prefix` twice: a process each).
+# Called in the main shell before any $(...) so the subshells see the cached values.
+_GI_DONE=""; _GI_IN=0; _GI_TOP=""; _GI_PFX=""
+_git_info() {
+  [ -z "$_GI_DONE" ] || return 0
+  _GI_DONE=1
+  local out
+  if out="$(git -C "$MODEL_DIR" rev-parse --show-toplevel --show-prefix 2>/dev/null)"; then
+    _GI_IN=1; _GI_TOP="${out%%$'\n'*}"
+    if [ "$_GI_TOP" != "$out" ]; then _GI_PFX="${out#*$'\n'}"; else _GI_PFX=""; fi
+  fi
+  return 0
+}
+in_git() { _git_info; [ "$_GI_IN" = 1 ]; }
 
 # Repo-relative paths (from the git top level), printed one per line.
 model_paths() {
-  local prefix
-  prefix="$(git -C "$MODEL_DIR" rev-parse --show-prefix)"
-  printf '%s%s\n' "$prefix" "$(basename "$MPR")"
-  [ -d "$MPRC" ] && printf '%smprcontents\n' "$prefix"
+  _git_info
+  printf '%s%s\n' "$_GI_PFX" "${MPR##*/}"
+  [ -d "$MPRC" ] && printf '%smprcontents\n' "$_GI_PFX"
   return 0
 }
 
@@ -185,14 +211,12 @@ model_paths() {
 # An empty path set is never a fingerprint: see _fp_worktree/_fp_staged below.
 MODEL_PATHS=()
 _load_model_paths() {
-  local p n=0
+  local n=0
   MODEL_PATHS=()
-  while IFS= read -r p; do
-    [ -n "$p" ] || continue
-    MODEL_PATHS[$n]="$p"; n=$((n + 1))
-  done <<EOF
-$(model_paths)
-EOF
+  _git_info
+  # The same two entries model_paths prints, without running it in a subshell.
+  [ -n "${MPR##*/}" ] && { MODEL_PATHS[$n]="${_GI_PFX}${MPR##*/}"; n=$((n + 1)); }
+  [ -d "$MPRC" ] && { MODEL_PATHS[$n]="${_GI_PFX}mprcontents"; n=$((n + 1)); }
   if [ "$n" -eq 0 ]; then
     echo "model-stamp: no model paths resolved for $MPR — refusing to fingerprint (a stamp over" >&2
     echo "  nothing would match every model state, which is worse than no stamp at all)." >&2
@@ -203,13 +227,16 @@ EOF
 
 _fp_worktree() {
   if in_git; then
-    local top lst; top="$(git -C "$MODEL_DIR" rev-parse --show-toplevel)"
+    local top f h n=0 k=0 files=() hashes=(); _git_info; top="$_GI_TOP"
     _load_model_paths || return 1
-    lst="$(mktemp "${TMPDIR:-/tmp}/model-stamp.XXXXXX")"
     # Tracked + untracked-not-ignored, minus anything deleted in the working tree. Newline
     # separated: `git hash-object --stdin-paths` has no -z, and unit file names carry none.
-    ( cd "$top" && git ls-files -c -o --exclude-standard -- "${MODEL_PATHS[@]}" 2>/dev/null \
-        | while IFS= read -r f; do [ -f "$f" ] && printf '%s\n' "$f"; done ) > "$lst"
+    # Held in an array, not a temp file: the file, its rm and the paste that rejoined it with
+    # the hashes were three more process starts per fingerprint.
+    while IFS= read -r f; do
+      [ -f "$top/$f" ] && files[${#files[@]}]="$f"
+    done < <(cd "$top" && git ls-files -c -o --exclude-standard -- "${MODEL_PATHS[@]}" 2>/dev/null)
+    n=${#files[@]}
     # An EMPTY list is not a fingerprint over nothing — that used to fall through to
     # `mxtk_sha256` over empty stdin, which is a CONSTANT, so a project whose mprcontents/
     # is gitignored fingerprinted identically no matter what the model contained, and every
@@ -222,8 +249,7 @@ _fp_worktree() {
     # hashes real bytes, not an empty list, so it carries none of the constant-hash risk
     # this guard exists to prevent. Only a genuinely unresolvable empty set (paths git
     # neither tracks NOR ignores — e.g. deleted mid-session) still refuses.
-    if [ ! -s "$lst" ]; then
-      rm -f "$lst"
+    if [ "$n" -eq 0 ]; then
       local ignored=1 p
       for p in "${MODEL_PATHS[@]}"; do
         ( cd "$top" && git check-ignore -q -- "$p" ) || { ignored=0; break; }
@@ -237,9 +263,9 @@ _fp_worktree() {
       echo "  a stamp over an empty set would match every model state." >&2
       return 1
     fi
-    ( cd "$top" && paste -d' ' <(git hash-object --stdin-paths < "$lst") "$lst" ) \
+    IFS=$'\n' read -r -d '' -a hashes < <(cd "$top" && printf '%s\n' "${files[@]}" | git hash-object --stdin-paths) || true
+    for f in "${files[@]}"; do printf '%s %s\n' "${hashes[$k]:-}" "$f"; k=$((k + 1)); done \
       | LC_ALL=C sort -k2 | mxtk_sha256
-    rm -f "$lst"
   else
     { cksum < "$MPR"; [ -d "$MPRC" ] && find "$MPRC" -type f -exec cksum {} + | LC_ALL=C sort -k3; } | mxtk_sha256
   fi
@@ -247,7 +273,7 @@ _fp_worktree() {
 
 _fp_staged() {
   in_git || { echo "model-stamp: not a git repository — --staged has no meaning" >&2; return 1; }
-  local top lst; top="$(git -C "$MODEL_DIR" rev-parse --show-toplevel)"
+  local top lst; _git_info; top="$_GI_TOP"
   _load_model_paths || return 1
   lst="$(mktemp "${TMPDIR:-/tmp}/model-stamp.XXXXXX")"
   ( cd "$top" && git ls-files -s -- "${MODEL_PATHS[@]}" \
@@ -264,9 +290,15 @@ _fp_staged() {
 
 fingerprint() { if [ "${1:-}" = "--staged" ]; then _fp_staged; else _fp_worktree; fi; }
 
-stamp_field() { sed -n "s/^$1: //p" "$STAMP" 2>/dev/null | head -1; }
+# The stamp is a handful of "key: value" lines. _sload reads it once; _sf <key> sets _SF to the
+# value of the FIRST line with that key (what `sed -n "s/^key: //p" | head -1` printed, at two
+# process starts per field and six fields per check).
+_stxt=""
+_sload() { _stxt=""; IFS= read -r -d '' _stxt < "$STAMP" 2>/dev/null || true; }
+_sf() { _SF=""; if [[ "$_NL$_stxt" =~ $_NL$1:\ ([^$_NL]*) ]]; then _SF="${BASH_REMATCH[1]}"; fi; return 0; }
 
 cmd="${1:-}"; shift || true
+case "$cmd" in fingerprint|write|check|paths) _git_info ;; esac
 case "$cmd" in
   fingerprint) fingerprint "${1:-}" ;;
   paths) model_paths ;;
@@ -276,7 +308,7 @@ case "$cmd" in
     # instead of writing a stamp with an empty fingerprint field.
     fp="$(fingerprint)"
     [ -n "$fp" ] || { echo "model-stamp: empty fingerprint — refusing to write a stamp" >&2; exit 1; }
-    mkdir -p "$(dirname "$STAMP")"
+    mkdir -p "${STAMP%/*}"
     { printf 'fingerprint: %s\n' "$fp"
       printf 'state: %s\n' "$state"
       printf 'source: %s\n' "$*"
@@ -287,7 +319,8 @@ case "$cmd" in
       # full = mxbuild deploy build (Java compiled); check = `mx check` only (exec.sh `Gate mode: check`).
       # The pre-push hook and module-close.sh run a full build when the stamp says check.
       printf 'kind: %s\n' "${MXTK_STAMP_KIND:-full}"
-      printf 'at: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+      if [ -n "${EPOCHSECONDS:-}" ]; then TZ=UTC printf 'at: %(%Y-%m-%dT%H:%M:%SZ)T\n' -1   # no date process (bash 5)
+      else printf 'at: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
     } > "$STAMP"
     # Machine-local, like the doctor receipt: never let it travel with the repo.
     if in_git && ! git -C "$PROJECT_ROOT" check-ignore -q .claude/.model-verified 2>/dev/null; then
@@ -303,7 +336,7 @@ case "$cmd" in
     say() { [ "$quiet" = 1 ] || echo "$@"; }
     if [ "$staged" = 1 ]; then
       in_git || exit 0
-      top="$(git -C "$MODEL_DIR" rev-parse --show-toplevel)"
+      _git_info; top="$_GI_TOP"
       _load_model_paths || exit 1
       if [ -z "$(cd "$top" && git diff --cached --name-only -- "${MODEL_PATHS[@]}")" ]; then
         say "  no model files staged — nothing to verify"; exit 0
@@ -317,9 +350,10 @@ case "$cmd" in
       say "    (nothing has run the mxbuild gate on this model here — ./bin/verify-model.sh runs it)"
       exit 1
     fi
-    st="$(stamp_field state)"; src="$(stamp_field source)"; at="$(stamp_field at)"
-    if [ "$(stamp_field fingerprint)" != "$fp" ]; then
-      if [ "$staged" = 1 ] && [ "$(_fp_worktree)" = "$(stamp_field fingerprint)" ] && [ "$st" = "pass" ]; then
+    _sload
+    _sf state; st="$_SF"; _sf source; src="$_SF"; _sf at; at="$_SF"; _sf fingerprint; sfp="$_SF"
+    if [ "$sfp" != "$fp" ]; then
+      if [ "$staged" = 1 ] && [ "$(_fp_worktree)" = "$sfp" ] && [ "$st" = "pass" ]; then
         say "  ✗ the verified model is in the working tree but the STAGED model differs from it"
         say "    (stage the whole model — $(model_paths | tr '\n' ' ')— or unstage the model files)"
       else
@@ -331,11 +365,13 @@ case "$cmd" in
     if [ "$st" != "pass" ]; then
       say "  ✗ $what is UNVERIFIED: last verification was '$st' ($src, $at)"; exit 1
     fi
-    if [ "$clean" = 1 ] && [ "$(stamp_field errors)" != "0" ]; then
-      say "  ✗ $what passed with pre-existing errors ($(stamp_field errors)) — not a clean stamp"; exit 1
+    if [ "$clean" = 1 ]; then
+      _sf errors
+      if [ "$_SF" != "0" ]; then say "  ✗ $what passed with pre-existing errors ($_SF) — not a clean stamp"; exit 1; fi
     fi
     # A stamp without a kind line predates `mx check` stamps: it was a full build.
-    if [ "$full" = 1 ] && [ "$(stamp_field kind)" = "check" ]; then
+    _sf kind
+    if [ "$full" = 1 ] && [ "$_SF" = "check" ]; then
       say "  ✗ $what was verified by mx check only ($src, $at) — no full build (Java compile) yet"; exit 1
     fi
     say "  ✓ $what verified ($src, $at)"
diff --git a/project-bin/row-groups.sh b/project-bin/row-groups.sh
index 83eef07e..81878366 100755
--- a/project-bin/row-groups.sh
+++ b/project-bin/row-groups.sh
@@ -40,14 +40,15 @@
 # reaches only agents that read the prompt; this gate reaches everyone who applies through exec.sh.
 set -u
 mode=${1:-plan}; script=${2:-}
-root=$(cd "$(dirname "$0")/.." && pwd)
+_rgd="${0%/*}"; [ "$_rgd" != "$0" ] || _rgd=.   # dirname without a process
+root=$(cd "$_rgd/.." && pwd)
 plan="$root/architecture/build-plan.md"; log="$root/docs/BUILD-LOG.md"
 [ -f "$plan" ] || { echo "row-groups: no architecture/build-plan.md — nothing to check"; exit 3; }
 [ "$mode" = check ] && { [ -n "$script" ] || { echo "usage: bin/row-groups.sh check <script.mdl>" >&2; exit 2; }; }
 
 # Python via _common.sh's resolve_py (runs each candidate; a name on PATH is not an interpreter).
 # No Python: exit 3, the same "nothing to check" exec.sh already passes through.
-. "$(dirname "$0")/_common.sh" 2>/dev/null || true
+. "$_rgd/_common.sh" 2>/dev/null || true
 PY=$(resolve_py 2>/dev/null) || { echo "row-groups: no Python 3 found (set PYTHON=/path/to/python3) — not checked" >&2; exit 3; }  # portability-ok: names in a diagnostic
 exec "$PY" - "$mode" "$plan" "$log" "$script" "${MXTK_GROUP_MAX:-4}" <<'PY'
 import os, re, sys
diff --git a/project-bin/script-owners.sh b/project-bin/script-owners.sh
index 09f38c8a..cd37f2dc 100755
--- a/project-bin/script-owners.sh
+++ b/project-bin/script-owners.sh
@@ -57,7 +57,10 @@
 # the hits, no mxcli. Producers/consumers: mdlsource/ (every build step) and the ledger (exec.sh
 # `record`, restore-mpr.sh) → exec.sh `check`, gate-check.sh `count`. bash 3.2, BSD awk, Git Bash.
 set -u
-HERE="$(cd "$(dirname "$0")" && pwd)"
+# HERE is only read by so_live (it sources _common.sh from there); resolved there, once, so
+# the cheap commands (check, record) do not pay a subshell for it.
+_so_self="${0%/*}"; [ "$_so_self" != "$0" ] || _so_self=.
+HERE=""
 
 usage() { sed -n '3,14p' "$0" | sed 's/^# \{0,1\}//' >&2; exit 2; }
 
@@ -104,6 +107,7 @@ _SO_AWK='
       if (!match(rest, /^[A-Za-z_][A-Za-z0-9_]*[ \t]*\.[ \t]*[A-Za-z_][A-Za-z0-9_]*/)) next
       name = substr(rest, 1, RLENGTH); gsub(/[ \t]/, "", name)
       if (INDEX) { k = toupper(kind) " " name; if (!((FILENAME, k) in seen)) { seen[FILENAME, k] = 1; print k "\t" FILENAME } }
+      else if (REC != "") { r = toupper(kind) " " name; if (!(r in recseen)) { recseen[r] = 1; print T "\t" REC "\t" r } }
       else printf "%s\t%s\t%d\t%s\n", toupper(kind), name, FNR, verb
     }'
 
@@ -119,8 +123,11 @@ _SO_ORDER='
     { n = split($0, a, "/"); sub(/^done-/, "", a[n]); k = pad(a[1]); for (i = 2; i <= n; i++) k = k "/" pad(a[i]); print k "\t" $0 }'
 
 so_docs() { awk -v INDEX=0 "$_SO_AWK" "$1"; }
-so_key() { basename "$1" | sed 's/^done-//'; }                          # header-name identity
-so_sortkey() { printf '%s/%s\n' "$(dirname "$1")" "$(so_key "$1")"; }   # ledger key
+so_key() { local b="${1##*/}"; printf '%s\n' "${b#done-}"; }           # header-name identity (basename | sed, in-shell)
+so_sortkey() {                                                          # ledger key: dirname/key, in-shell
+  local d="${1%/*}"; [ "$d" != "$1" ] || d=.; [ -n "$d" ] || d=/
+  local b="${1##*/}"; printf '%s/%s\n' "$d" "${b#done-}"
+}
 so_before() {  # true when path $1 runs strictly before path $2
   printf '%s\n%s\n' "$1" "$2" | awk "$_SO_ORDER" | awk -F'\t' 'NR == 1 { a = $1 } NR == 2 { exit !(a < $1) }'
 }
@@ -161,7 +168,7 @@ so_last_writer() {  # $1 = root, $2 = "KIND Module.Name"; rows before the last R
   awk -F'\t' -v d="$2" '$2 == "RESTORE" { w = "" } $3 == d { w = $2 } END { if (w != "") print w }' "$1/$LEDGER_REL"
 }
 so_has_run() {  # $1 = root, $2 = root-relative script path → true when it has run (see header)
-  local b; b="$(basename "$2")"
+  local b="${2##*/}"
   case "$b" in done-*) return 0 ;; esac
   if [ -f "$1/$LEDGER_REL" ] && awk -F'\t' -v k="$(so_sortkey "$2")" '$2 == k { f = 1; exit } END { exit !f }' "$1/$LEDGER_REL"; then
     return 0
@@ -170,7 +177,8 @@ so_has_run() {  # $1 = root, $2 = root-relative script path → true when it has
     awk -F'|' 'index($3, ENVIRON["SO_N"]) && $5 ~ /applied/ { f = 1; exit } END { exit !f }' "$1/docs/BUILD-LOG.md"
 }
 so_rel() {  # $1 = script, $2 = root → root-relative path, or "" outside the root
-  local abs; abs="$(cd "$(dirname "$1")" 2>/dev/null && pwd)/$(basename "$1")"
+  local abs d="${1%/*}"; [ "$d" != "$1" ] || d=.; [ -n "$d" ] || d=/
+  abs="$(cd "$d" 2>/dev/null && pwd)/${1##*/}"
   case "$abs" in "$2"/*) printf '%s\n' "${abs#"$2"/}" ;; *) echo "" ;; esac
 }
 # One DESCRIBE through the project's ./mxcli. Not found (captured, mxcli v0.26.0, all four kinds,
@@ -178,6 +186,7 @@ so_rel() {  # $1 = script, $2 = root → root-relative path, or "" outside the r
 # on stderr. A parse error or "no describable document" (v0.24.0) is a failed call, never absent.
 so_live() {  # $1 = root, $2 = KIND, $3 = Doc
   local out err rc=0 all
+  [ -n "$HERE" ] || HERE="$(cd "$_so_self" && pwd)"
   out="$(cd "$1" && PROJECT_ROOT="$1" && . "$HERE/_common.sh" >/dev/null 2>&1 \
          && mx="$(find_project_mxcli)" && mpr="$(find_mpr 2>/dev/null)" \
          && "$mx" -p "$mpr" -c "DESCRIBE $2 $3" 2>&1 </dev/null; echo "rc=$?")"
@@ -215,10 +224,13 @@ case "$cmd" in
     [ -f "${2:-}" ] || usage
     ROOT="$(so_root "")"; REL="$(so_rel "$2" "$ROOT")"
     [ -n "$REL" ] || exit 0          # a scratch script outside the project owns nothing
-    LD="$(dirname "$ROOT/$LEDGER_REL")"
+    LD="$ROOT/${LEDGER_REL%/*}"
     mkdir -p "$LD" 2>/dev/null || exit 0
     [ -f "$LD/.gitignore" ] || printf '*\n' > "$LD/.gitignore"
-    so_docs "$2" | awk -F'\t' -v k="$(so_sortkey "$REL")" -v t="$(date +%s)" '!s[$1 " " $2]++ { print t "\t" k "\t" $1 " " $2 }' >> "$ROOT/$LEDGER_REL"
+    _rk="$(so_sortkey "$REL")"
+    # One awk: the lexer prints the ledger row itself in REC mode (it used to pipe into a second
+    # awk that only prefixed the epoch and the key and dropped repeats).
+    awk -v INDEX=0 -v REC="$_rk" -v T="${EPOCHSECONDS:-$(date +%s)}" "$_SO_AWK" "$2" >> "$ROOT/$LEDGER_REL"
     # Compact: the last row per (script, document) and the last RESTORE row, order kept.
     T="$(mktemp "$LD/.written.XXXXXX")" || exit 0
     awk -F'\t' '{ k = ($2 == "RESTORE") ? "RESTORE" : $2 "\t" $3; last[k] = NR; line[NR] = $0; key[NR] = k }
diff --git a/project-bin/snapshot-mpr.sh b/project-bin/snapshot-mpr.sh
index 25b5d216..f24c1e54 100755
--- a/project-bin/snapshot-mpr.sh
+++ b/project-bin/snapshot-mpr.sh
@@ -20,7 +20,8 @@
 # Git commits at phase gates remain the real history — this only covers
 # mid-session corruption between commits.
 set -euo pipefail
-. "$(dirname "$0")/_common.sh"
+_sd="${0%/*}"; [ "$_sd" != "$0" ] || _sd=.   # dirname without a process (a start costs ~100 ms on Windows)
+. "$_sd/_common.sh"
 
 MODEL_DIR="$(find_model_dir)" || exit 1
 
@@ -36,7 +37,9 @@ MODEL_DIR="$(find_model_dir)" || exit 1
 # exists, on its next exec, instead of only the ones scaffolded after today.
 if [ -d "$PROJECT_ROOT/.git" ] || [ -f "$PROJECT_ROOT/.git" ]; then
   GI="$PROJECT_ROOT/.gitignore"
-  if ! { [ -f "$GI" ] && grep -qE '^/?\.mpr-snapshots/?$' "$GI"; }; then
+  _gitxt=""; [ ! -f "$GI" ] || IFS= read -r -d '' _gitxt < "$GI" || true   # grep -qE '^/?\.mpr-snapshots/?$', in-shell
+  _nl=$'\n'
+  if ! { [ -f "$GI" ] && [[ "$_nl$_gitxt$_nl" =~ $_nl/?\.mpr-snapshots/?$_nl ]]; }; then
     # Never fatal: this runs under set -e BEFORE the snapshot, and exec.sh calls it bare — an
     # unwritable .gitignore must not stop the snapshot (CLAUDE.md guard rule 7).
     if {
@@ -52,14 +55,14 @@ if [ -d "$PROJECT_ROOT/.git" ] || [ -f "$PROJECT_ROOT/.git" ]; then
   fi
 fi
 
-mkdir -p "$PROJECT_ROOT/.mpr-snapshots"
-DEST="$PROJECT_ROOT/.mpr-snapshots/$(date +%Y%m%d-%H%M%S)"
-mkdir -p "$DEST"
+if [ -n "${EPOCHSECONDS:-}" ]; then printf -v _stamp '%(%Y%m%d-%H%M%S)T' -1; else _stamp="$(date +%Y%m%d-%H%M%S)"; fi
+DEST="$PROJECT_ROOT/.mpr-snapshots/$_stamp"
+mkdir -p "$DEST"   # also creates .mpr-snapshots/
 
 MPR_COUNT=0
 for f in "$MODEL_DIR"/*.mpr; do
   [ -e "$f" ] || continue
-  cp "$f" "$DEST/$(basename "$f")"
+  cp "$f" "$DEST/${f##*/}"
   MPR_COUNT=$((MPR_COUNT + 1))
 done
 [ -d "$MODEL_DIR/mprcontents" ] && cp -r "$MODEL_DIR/mprcontents" "$DEST/mprcontents"
@@ -69,7 +72,7 @@ done
 # the pipeline status 1, and a bare assignment inherits it — so `set -e` killed the script
 # HERE, on the exact case the v1-aware refusal below names. That refusal was unreachable.
 if [ -d "$DEST/mprcontents" ]; then
-  UNIT_COUNT=$(find "$DEST/mprcontents" -name '*.mxunit' | wc -l | tr -d ' ')
+  UNIT_COUNT=$(( $(find "$DEST/mprcontents" -name '*.mxunit' | wc -l) ))   # arithmetic trims wc's padding
 else
   UNIT_COUNT=0
 fi
@@ -99,8 +102,13 @@ if [ "$UNIT_COUNT" -eq 0 ]; then
 fi
 
 # Prune: keep the 5 newest timestamped dirs.
-ls -dt "$PROJECT_ROOT"/.mpr-snapshots/*/ 2>/dev/null | tail -n +6 | while read -r old; do
-  rm -rf "$old"
-done
+# Count first with a glob: at five or fewer there is nothing to prune and no ls | tail needed.
+set -- "$PROJECT_ROOT"/.mpr-snapshots/*/
+if [ "$#" -gt 5 ]; then
+  ls -dt "$PROJECT_ROOT"/.mpr-snapshots/*/ 2>/dev/null | tail -n +6 | while read -r old; do
+    rm -rf "$old"
+  done
+  set -- "$PROJECT_ROOT"/.mpr-snapshots/*/
+fi
 
-echo "mpr snapshot ok [$MODEL_FORMAT] ($MPR_COUNT .mpr + $UNIT_COUNT units) — $(ls -d "$PROJECT_ROOT"/.mpr-snapshots/*/ 2>/dev/null | wc -l | tr -d ' ') kept in .mpr-snapshots/"
+echo "mpr snapshot ok [$MODEL_FORMAT] ($MPR_COUNT .mpr + $UNIT_COUNT units) — $# kept in .mpr-snapshots/"
diff --git a/tests/wave2/test-lint-receipt-revert.sh b/tests/wave2/test-lint-receipt-revert.sh
index ced73a01..8f9541e1 100755
--- a/tests/wave2/test-lint-receipt-revert.sh
+++ b/tests/wave2/test-lint-receipt-revert.sh
@@ -62,6 +62,22 @@ out=$(gate 2>&1); rc=$?
 [ "$rc" -eq 0 ] && ok "unchanged run passes (rc 0)" || bad "rc=$rc" "$out"
 case "$out" in *REVERTED*) bad "false receipt alarm on untouched rules" "$out" ;; *) ok "no receipt alarm" ;; esac
 
+echo "T1b a re-seed that keeps the old mtime (cp -p, tar, rsync -t) is still caught (#590 review)"
+RF="$P/.claude/lint-rules/conv010_act_microflow_content.star"
+cp -p "$RF" "$WORK/rf.keep"
+out=$(gate 2>&1)   # clean run: leaves the skip marker
+[ -f "$P/.claude/loop/.lint-receipt-ok" ] && ok "clean run leaves the skip marker" || bad "no skip marker after a clean run"
+touch -r "$P/.claude/lint-rules" "$WORK/dir.keep"
+# In place (same inode, no rename), then both the file's and the folder's old mtimes back:
+# exactly what cp -p / tar / rsync -t leave behind.
+sed '1,/^# --- end mxtk-lint-rule header ---$/d' "$RF" > "$WORK/rf.new" && cat "$WORK/rf.new" > "$RF"
+touch -r "$WORK/rf.keep" "$RF"; touch -r "$WORK/dir.keep" "$P/.claude/lint-rules"
+out=$(gate 2>&1); rc=$?
+case "$out" in *REVERTED*) ok "header stripped with the old mtime kept -> still REVERTED (marker not trusted on mtime)" ;; *) bad "old-mtime re-seed skipped the receipt check" "$out" ;; esac
+cat "$WORK/rf.keep" > "$RF"; touch -r "$WORK/rf.keep" "$RF"
+out=$(gate 2>&1)
+case "$out" in *REVERTED*) bad "restored rule still reported" "$out" ;; *) ok "restored rule: clean again" ;; esac
+
 echo "T2 re-seed: header gone on two rules, one rule removed -> BLIND, not a rise"
 strip_header "$P/.claude/lint-rules/conv010_act_microflow_content.star"
 strip_header "$P/.claude/lint-rules/data_change_microflows.star"