From 54cd0324ea426c512e44ff839dffe12099bebe7c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 30 Oct 2026 23:31:42 +0000
Subject: [PATCH 1/3] Fix mxcli v0.29 compatibility; doctor advises the latest
 mxcli

On mxcli v0.29.0, which doctor --install fetches by default, four
instruments misread the new output:

- fix property-sets MIXED rows: doctor now classifies them as "mixed"
  instead of rc 4 "could not classify".
- The repair exits 1 while only MIXED remains. The apply step no longer
  lets exec.sh --patch roll back a repair that landed.
- fix hashes now verifies MPR v1 with new wording. exec.sh reads both
  forms, so --patch on Mendix < 10.18 is verified again.
- SHOW/list modules "Protected AddOn|Solution" in Source (v0.28+):
  page-scope and the rehost module list keep first-party Protected
  modules.

Also in this change:
- wf-add-path-terminators.py refuses below Mendix 10.21.
- module-close notes the v0.29 docker check default.
- The stale v0.24 pin advice is gone.
- New: the normal doctor run advises when the project mxcli is behind
  the latest release, respects MXCLI_VERSION pins, stays quiet offline
  and never fails.

Golden input was captured from the real v0.28.0/v0.29.0 binaries
(CAPTURE files hold the sha256s and mutation steps). Against master the
new cases fail: exec-hash-verify 4, property-sets 7, mxpatch 1,
page-scope-protected 3, rehost-list-modules 1, doctor-mxcli-latest 8.

Field run: page-scope.sh and doctor.sh against the real v0.29.0 and
v0.28.0 binaries on the captured model. Master page-scope FAULTs on the
Protected model and the fix counts its page. The doctor advice read
v0.29.0 from the live release redirect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018LeNWZV2sVH62vkgfYh5u5
---
 CHANGELOG.md                                  |   1 +
 bin/doctor.sh                                 | 102 +++++++++++++++---
 bin/sync-project.sh                           |   9 +-
 pipelines/mendix-mpr/lib/own-modules.awk      |   9 +-
 project-bin/exec.sh                           |   9 +-
 project-bin/module-close.sh                   |   3 +
 project-bin/page-scope.sh                     |  14 ++-
 project-bin/wf-add-path-terminators.py        |  33 +++++-
 skills/harness-architecture.md                |   2 +-
 skills/rehost-app.md                          |   2 +-
 skills/report-schema.md                       |   2 +-
 tests/wave2/fixtures/mxpatch/CAPTURE.txt      |  18 ++++
 .../fixtures/mxpatch/verify-stale-v0.29.0.err |   1 +
 .../mxpatch/verify-stale-v0.29.0.exit         |   1 +
 .../fixtures/mxpatch/verify-stale-v0.29.0.out |   6 ++
 .../mxpatch/verify-v1-mismatch-v0.29.0.err    |   1 +
 .../mxpatch/verify-v1-mismatch-v0.29.0.exit   |   1 +
 .../mxpatch/verify-v1-mismatch-v0.29.0.out    |   6 ++
 .../fixtures/mxpatch/verify-v1-v0.29.0.err    |   1 +
 .../fixtures/mxpatch/verify-v1-v0.29.0.exit   |   1 +
 .../fixtures/mxpatch/verify-v1-v0.29.0.out    |   4 +
 .../fixtures/property-sets/CAPTURE-v0.29.txt  |  31 ++++++
 .../property-sets/fix-help-v0.28.0.txt        |  23 ++++
 .../property-sets/fix-help-v0.29.0.txt        |  23 ++++
 .../fix-property-sets-help-v0.28.0.txt        |  41 +++++++
 .../fix-property-sets-help-v0.29.0.txt        |  60 +++++++++++
 .../ps-after-apply-both-v0.29.0.err           |   1 +
 .../ps-after-apply-both-v0.29.0.exit          |   1 +
 .../ps-after-apply-both-v0.29.0.out           |   5 +
 .../property-sets/ps-apply-both-v0.29.0.err   |   1 +
 .../property-sets/ps-apply-both-v0.29.0.exit  |   1 +
 .../property-sets/ps-apply-both-v0.29.0.out   |   8 ++
 .../property-sets/ps-dryrun-both-v0.29.0.err  |   1 +
 .../property-sets/ps-dryrun-both-v0.29.0.exit |   1 +
 .../property-sets/ps-dryrun-both-v0.29.0.out  |   9 ++
 .../property-sets/ps-dryrun-mixed-v0.29.0.err |   1 +
 .../ps-dryrun-mixed-v0.29.0.exit              |   1 +
 .../property-sets/ps-dryrun-mixed-v0.29.0.out |   5 +
 .../property-sets/version-v0.28.0.txt         |   1 +
 .../property-sets/version-v0.29.0.txt         |   1 +
 .../fixtures/rehost-list-modules/CAPTURE.txt  |   6 ++
 ...-modules-marketplace-protected-v0.29.0.txt |   8 ++
 .../list-modules-protected-v0.29.0.txt        |   8 ++
 tests/wave2/fixtures/show-modules/CAPTURE.txt |  15 +++
 ...modules-marketplace-protected-v0.29.0.exit |   1 +
 ...-modules-marketplace-protected-v0.29.0.out |   6 ++
 .../show-modules-protected-v0.28.0.exit       |   1 +
 .../show-modules-protected-v0.28.0.out        |   6 ++
 .../show-modules-protected-v0.29.0.exit       |   1 +
 .../show-modules-protected-v0.29.0.out        |   6 ++
 .../show-modules-source-v0.29.0.exit          |   1 +
 .../show-modules-source-v0.29.0.out           |   6 ++
 .../show-pages-in-myfirstmodule-v0.29.0.out   |   5 +
 tests/wave2/test-doctor-mxcli-latest.sh       |  82 ++++++++++++++
 tests/wave2/test-exec-hash-verify.sh          |  22 +++-
 tests/wave2/test-mxpatch.sh                   |   8 ++
 tests/wave2/test-page-scope-protected.sh      |  59 ++++++++++
 tests/wave2/test-property-sets.sh             |  37 ++++++-
 tests/wave2/test-rehost-list-modules.sh       |   5 +
 59 files changed, 690 insertions(+), 34 deletions(-)
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/property-sets/CAPTURE-v0.29.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-help-v0.28.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-help-v0.29.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.28.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.29.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.err
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/property-sets/version-v0.28.0.txt
 create mode 100644 tests/wave2/fixtures/property-sets/version-v0.29.0.txt
 create mode 100644 tests/wave2/fixtures/rehost-list-modules/list-modules-marketplace-protected-v0.29.0.txt
 create mode 100644 tests/wave2/fixtures/rehost-list-modules/list-modules-protected-v0.29.0.txt
 create mode 100644 tests/wave2/fixtures/show-modules/CAPTURE.txt
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.exit
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.out
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.exit
 create mode 100644 tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.out
 create mode 100644 tests/wave2/fixtures/show-modules/show-pages-in-myfirstmodule-v0.29.0.out
 create mode 100755 tests/wave2/test-doctor-mxcli-latest.sh
 create mode 100755 tests/wave2/test-page-scope-protected.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b057dda..fcdf4954 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(doctor, exec, page-scope, rehost, wf-add-path-terminators, module-close): **mxcli v0.29 compatibility, and doctor advises the latest mxcli**: on v0.29.0 (which `--install` fetches by default) four instruments read new output wrong. (1) `fix property-sets` prints `MIXED` rows and exits 1: doctor reported "could not classify" (rc 4, shown as info by sync) — now result `mixed`, a WARN naming the rows and saying the repair cannot clear them; (2) the repair also exits 1 while a MIXED name remains, so `--fix-property-sets` rolled back a repair that had landed — the apply step now passes when only MIXED is left (FAILED still fails); (3) `fix hashes` now verifies MPR v1 with new text, which exec.sh read as an error, so every `--patch` on a Mendix < 10.18 project went unverified — both v1 forms are read; (4) since v0.28 `SHOW MODULES` / `list modules` write `Protected AddOn|Solution` in Source, so a first-party module set to Protected dropped out of page-scope (FAULT, 0 modules) and out of the rehost module list — the export level no longer counts as an origin. `wf-add-path-terminators.py` refuses below Mendix 10.21 (the terminator type does not exist there; written in, the project will not load), module-close notes that v0.29 `docker check` checks the stored project (a CE0463 it now reports is real), and the stale "stay on v0.24" pin advice is replaced. **New:** the normal doctor run compares the project mxcli with the latest release (redirect of the asset URL, 5 s, nothing downloaded): WARN with release link and upgrade path when behind, a note when `MXCLI_VERSION` pins it, one quiet note offline, never a FAIL; `MXTK_NO_LATEST_CHECK=1` skips it. Golden input captured from the real v0.28.0/v0.29.0 binaries on the mxpatch fixture model and mutated copies (CAPTURE files); against master the new cases fail (exec-hash-verify 4, property-sets 7, mxpatch 1, page-scope-protected 3, rehost-list-modules 1, doctor-mxcli-latest 8). Field run: page-scope and doctor against real v0.29.0/v0.28.0 binaries in a cloud session — mxcli v0.29 audit (2026-10-30)
 - fix(doctor, sync-project, speed-setup): **doctor says when the speed fixes never reached a project**: `bin/exec.sh`, `bin/_common.sh` or `bin/lint-gate.sh` without the 2026-10-29 speed code (marker per file) gives a Machine health warning "speed fixes not active", and the Recommended fix leads with the exact `sync-project.sh --upgrade-bin ...` command (exec.sh always with its `_common.sh`; each copy backed up) before any other advice, because every other number measures the old scripts; `sync-project.sh` names the speed fixes on a hand-edited exec.sh / _common.sh that has the exit-code fix but not the speed work; `skills/speed-setup.md` has Claude show each local edit in one line and ask before replacing. Field: an English colleague's ExpenseTracker analysis after the toolkit update still showed a full mxbuild on every change (45.5 min, 57% of all exec time) with 15 drifted scripts in bin/; reproduced here with the real pre-#587 exec.sh / _common.sh / lint-gate.sh — doctor names all three, sync names exec.sh and refreshes the two unedited ones — Maurits (mauritscgvisser)
 - fix(doctor, speed-setup): **doctor no longer says "None needed" next to a verdict of "5x slower"**: when process starts are fast but one bench step is 5x+ the reference and 2 s+ slower, the Recommended fix names that step (slow git status: `git config core.untrackedCache true` / `core.fsmonitor true`, no admin rights); a project inside a OneDrive / Dropbox / Google Drive / iCloud folder gets a Machine health warning and "move the project to a local folder" as the fix; low-memory advice now offers "restart the computer" before `--cleanup`; the bench's git step runs one untimed warm-up so a stale index after a copy or clone no longer reads as slow (field, ab-581/gk: 18.3 s cold, 31 ms warm); `skills/speed-setup.md` tells Claude never to say deno, mxbuild or helper process to a user. Field run: ab-581/gk on Linux, bench 14.7 s vs 10.9 s, "None needed" correctly; a project under a OneDrive path, move advice shown — Maurits (mauritscgvisser)
 - fix(gate-check, gate-cache): **the closeout verdict cache also keys on file CONTENT, so an overwrite that keeps an old mtime (`cp -p`, `rsync -t`, `tar x`, `unzip`, `touch -d`) can no longer replay a stale verdict**: a signed triage.md copied over a FAIL one still printed the cached Stage 0 FAIL (PR #589 review); the cache now stores one `find | sort | xargs cksum | cksum` signature of the project files (skipping .git, node_modules, .mxtk, mprcontents, deployment, *.mpr, files over 1 MB) and any difference, or a signature that cannot be computed, re-evaluates; new `tests/wave2/test-gate-cache.sh` (hit, edit/delete/waiver miss, cp -p miss, TTL 0, 'not evaluated' line); `MXTK_GATE_CACHE_TRACE=1` prints `gate-cache: hit|miss` on --closeout. Field run: ab-581/base copy (197 MB, 633 hashed files) - signature 28 ms, cache hit 1464 -> 1498 ms vs 2567-2786 ms full evaluation - PR #589 reviewer, OlafFede (#583) — OlafFede (#583)
diff --git a/bin/doctor.sh b/bin/doctor.sh
index 4601ae8d..1c3e0ae5 100755
--- a/bin/doctor.sh
+++ b/bin/doctor.sh
@@ -83,7 +83,18 @@ set -u
 # script and the repair inherits exec.sh's snapshot, mxbuild gate and restore.
 if [ "${2:-}" = "--property-sets-apply-step" ]; then
   { [ -n "${3:-}" ] && [ -x "$3" ]; } || { echo "--property-sets-apply-step: no runnable mxcli given" >&2; exit 2; }
-  exec "$3" fix property-sets -p "$1"
+  # mxcli v0.29.0+ also exits 1 while a MIXED name remains (cmd_fix_property_sets.go: "Exits 1
+  # when a unit could not be repaired, when a MIXED name remains"), even when every repair it made
+  # landed. mxcli leaves MIXED units untouched, so that exit is not a failed repair: report 0 and
+  # let the gate decide, else exec.sh --patch rolls the good repairs back. FAILED still exits 1.
+  _psa_o="$("$3" fix property-sets -p "$1" 2>&1)"; _psa_r=$?
+  printf '%s\n' "$_psa_o"
+  if [ "$_psa_r" -eq 1 ] && printf '%s\n' "$_psa_o" | grep -q '^  MIXED ' \
+     && ! printf '%s\n' "$_psa_o" | grep -qE '^  FAILED |could not be normalized'; then
+    echo "(exit 1 was for the MIXED name(s) above only — mxcli leaves those as they are; the repair stands)"
+    exit 0
+  fi
+  exit "$_psa_r"
 fi
 
 TOOLKIT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -201,6 +212,10 @@ probe_runs() {
 # What the dry-run prints and how it exits is mxcli's cmd/mxcli/cmd_fix_property_sets.go at
 # v0.26.0: exit 0 = nothing to do; exit 1 = a `  NEEDS ` or `  FAILED ` row per unit, OR an
 # error such as "project not found" (both exit 1, so the rows decide, never the code alone).
+# v0.29.0 adds `  MIXED ` rows (ako/mxcli#1505): a property name some elements of a type carry and
+# others lack — Mendix's merge engine cannot compare those revisions, and mxcli leaves them alone
+# (no measured value fills them). Exit 1 with only MIXED rows is result "mixed": a merge hazard
+# the repair cannot clear, reported, never "could not classify" (captured 2026-10-30).
 # Anything else is "could not classify", never clean. Support is read from `mxcli fix --help`
 # listing the subcommand: `mxcli fix property-sets --help` exits 0 on v0.24/v0.25 too (cobra
 # prints the parent's help for an unknown subcommand), so it cannot be the probe. Golden
@@ -209,7 +224,7 @@ probe_runs() {
 # The result is recorded in <project>/.claude/.property-sets-receipt (machine-local, like the
 # doctor receipt): line 1 "<date> <time> <result> <detail>", line 2 "mxcli: <--version line>".
 # Line 2 is what --if-stale and --quick compare: the check is owed again when mxcli changes.
-# Only a settled answer is recorded — clean, unproven, needs, failed, or unsupported (the support probe
+# Only a settled answer is recorded — clean, unproven, needs, failed, mixed, or unsupported (the support probe
 # ran and the subcommand is absent). An error or a timeout is never written, and --if-stale
 # skips the run only on a recorded clean/unproven/unsupported, so a one-off failure (locked model,
 # unreadable version, a probe that crashed) is re-checked on the next sync instead of being
@@ -250,19 +265,23 @@ ps_bounded() {
   rm -f "$_pb_f"
   return "$_pb_rc"
 }
-# ps_classify <exit> <output> — sets PS_RESULT (clean|needs|failed|error) and PS_DETAIL.
+# ps_classify <exit> <output> — sets PS_RESULT (clean|needs|failed|mixed|error) and PS_DETAIL.
 ps_classify() {
   _psc_checked="$(printf '%s\n' "$2" | grep -m1 -E '^Checked [0-9]+ unit' || true)"
   _psc_needs="$(printf '%s\n' "$2" | grep -c '^  NEEDS ' || true)"
   _psc_failed="$(printf '%s\n' "$2" | grep -c '^  FAILED ' || true)"
+  _psc_mixed="$(printf '%s\n' "$2" | grep -c '^  MIXED ' || true)"
+  _psc_mx=""; [ "$_psc_mixed" -gt 0 ] && _psc_mx=", $_psc_mixed MIXED property name(s) mxcli leaves alone"
   if [ "$1" -eq 0 ] && printf '%s\n' "$2" | grep -q 'no readable Mendix version'; then
     PS_RESULT=error; PS_DETAIL="mxcli read no Mendix version from the model, so nothing was checked"
   elif [ "$1" -eq 0 ]; then
     PS_RESULT=clean; PS_DETAIL="${_psc_checked:-exit 0}"
   elif [ "$1" -eq 1 ] && [ "$_psc_needs" -gt 0 ]; then
-    PS_RESULT=needs; PS_DETAIL="$_psc_needs unit(s) need their property set completed, $_psc_failed cannot be normalized"
+    PS_RESULT=needs; PS_DETAIL="$_psc_needs unit(s) need their property set completed, $_psc_failed cannot be normalized$_psc_mx"
   elif [ "$1" -eq 1 ] && [ "$_psc_failed" -gt 0 ]; then
-    PS_RESULT=failed; PS_DETAIL="$_psc_failed unit(s) hold a value in a key this Mendix version does not declare"
+    PS_RESULT=failed; PS_DETAIL="$_psc_failed unit(s) hold a value in a key this Mendix version does not declare$_psc_mx"
+  elif [ "$1" -eq 1 ] && [ "$_psc_mixed" -gt 0 ]; then
+    PS_RESULT=mixed; PS_DETAIL="$_psc_mixed property name(s) differ between elements of one type (MIXED) — no measured value fills them"
   else
     PS_RESULT=error
     PS_DETAIL="exit $1: $(printf '%s\n' "$2" | grep -v -e '^[[:space:]]*$' -e '^WARNING: This is a' | head -1)"
@@ -289,7 +308,7 @@ ps_unproven_warn() {
   note "the proof is Mendix's own: mx diff <base>.mpr <mine>.mpr out.json with this version's mx; exit 0 is clean."
 }
 ps_write_receipt() {
-  case "$PS_RESULT" in clean|unproven|needs|failed|unsupported) ;; *) return 0 ;; esac
+  case "$PS_RESULT" in clean|unproven|needs|failed|mixed|unsupported) ;; *) return 0 ;; esac
   [ -n "$PS_VER" ] || return 0
   [ -n "$PROJECT_DIR" ] && [ -d "$PROJECT_DIR" ] || return 0
   mkdir -p "$PROJECT_DIR/.claude" 2>/dev/null || return 0
@@ -341,14 +360,16 @@ ps_check() {
       else
         ok "property sets: $PS_DETAIL — every unit has the property names Studio Pro writes"
       fi ;;
-    needs|failed)
+    needs|failed|mixed)
       warn "property sets: $PS_DETAIL — Studio Pro's merge/diff can throw on these"
-      printf '%s\n' "$PS_OUT" | grep -E '^  (NEEDS|FAILED) ' | head -10 | while IFS= read -r l; do note "$l"; done
-      _psk_rows="$(printf '%s\n' "$PS_OUT" | grep -cE '^  (NEEDS|FAILED) ' || true)"
+      printf '%s\n' "$PS_OUT" | grep -E '^  (NEEDS|FAILED|MIXED) ' | head -10 | while IFS= read -r l; do note "$l"; done
+      _psk_rows="$(printf '%s\n' "$PS_OUT" | grep -cE '^  (NEEDS|FAILED|MIXED) ' || true)"
       [ "$_psk_rows" -gt 10 ] && note "  … $((_psk_rows - 10)) more"
       [ "$PS_RESULT" = needs ] && note "repair (snapshot + mxbuild gate + restore): bin/doctor.sh --fix-property-sets ${PROJECT_DIR:-<project>}"
       [ "$(printf '%s\n' "$PS_OUT" | grep -c '^  FAILED ' || true)" -gt 0 ] && \
-        note "FAILED units are left alone by mxcli and make the guarded repair roll back — resolve them first." ;;
+        note "FAILED units are left alone by mxcli and make the guarded repair roll back — resolve them first."
+      [ "$(printf '%s\n' "$PS_OUT" | grep -c '^  MIXED ' || true)" -gt 0 ] && \
+        note "MIXED names are left alone by mxcli and --fix-property-sets cannot clear them. Report them with your Mendix version (mendixlabs/mxcli asks for exactly that); until a value is measured, a merge touching these units can throw." ;;
     *) warn "property sets: could not classify the check — $PS_DETAIL (not recorded; the next run re-checks)"
        printf '%s\n' "$PS_OUT" | grep -v '^[[:space:]]*$' | head -5 | while IFS= read -r l; do note "  $l"; done ;;
   esac
@@ -375,7 +396,7 @@ ps_apply() {
   ps_check
 }
 ps_exit_code() {
-  case "$PS_RESULT" in clean|unproven) echo 0 ;; not-run) echo 2 ;; unsupported) echo 3 ;; needs|failed) echo 1 ;; *) echo 4 ;; esac
+  case "$PS_RESULT" in clean|unproven) echo 0 ;; not-run) echo 2 ;; unsupported) echo 3 ;; needs|failed|mixed) echo 1 ;; *) echo 4 ;; esac
 }
 
 # --property-sets / --fix-property-sets: only this check, then exit. Stands alone so
@@ -409,7 +430,7 @@ if [ -n "$PS_MODE" ]; then
     PS_VER="$(ps_version "$PMXCLI_PROBE")"
     if [ -n "$PS_VER" ] && ! ps_stale; then
       PS_RESULT="$(sed -n '1s/^[^ ]* [^ ]* \([^ ]*\).*/\1/p' "$(ps_receipt)")"
-      # Only a settled "nothing to do here" short-circuits; needs/failed re-check every time.
+      # Only a settled "nothing to do here" short-circuits; needs/failed/mixed re-check every time.
       case "$PS_RESULT" in
         clean|unsupported)
           ok "already checked for $PS_VER: $(sed -n 1p "$(ps_receipt)")"
@@ -425,6 +446,52 @@ if [ -n "$PS_MODE" ]; then
   exit "$(ps_exit_code)"
 fi
 
+# mxcli_latest_advice <version line> — installed vs the latest mxcli release. Advice only: never a
+# FAIL, never blocks, never downloads. A pin ($MXCLI_VERSION) is respected — noted, not nagged.
+# Latest is read from the redirect of releases/latest/download/<asset> (one request, not followed,
+# 5 s cap); offline or no curl is one quiet note. MXTK_MXCLI_LATEST=vX.Y.Z supplies the
+# answer without the network (fixtures, air-gapped machines); MXTK_NO_LATEST_CHECK=1 skips it.
+# MXTK_MXCLI_FLOOR is the oldest release this toolkit's instruments are checked against.
+MXTK_MXCLI_FLOOR="${MXTK_MXCLI_FLOOR:-v0.28.0}"
+mxtk_semver_lt() {   # <a> <b> — 0 when vA.B.C < vX.Y.Z; 1 otherwise or unparseable
+  printf '%s %s\n' "${1#v}" "${2#v}" | awk '{
+    n = split($1, a, "."); m = split($2, b, ".")
+    if (n < 3 || m < 3) exit 1
+    for (i = 1; i <= 3; i++) { if (a[i] + 0 < b[i] + 0) exit 0; if (a[i] + 0 > b[i] + 0) exit 1 }
+    exit 1 }'
+}
+mxcli_latest_advice() {
+  [ "${MXTK_NO_LATEST_CHECK:-0}" = 1 ] && return 0
+  _ml_have="$(printf '%s\n' "$1" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+  [ -n "$_ml_have" ] || return 0
+  _ml_new="${MXTK_MXCLI_LATEST:-}"
+  if [ -z "$_ml_new" ] && command -v curl >/dev/null 2>&1; then
+    # The redirect of the asset URL --install itself uses (not followed: nothing is downloaded).
+    # Not releases/latest: a proxy that allows release downloads can refuse that page (403,
+    # measured in a cloud sandbox 2026-10-30, where this redirect answered v0.29.0).
+    _ml_new="$(curl -sS --max-time 5 -o /dev/null -w '%{redirect_url}' \
+      https://github.com/mendixlabs/mxcli/releases/latest/download/mxcli-linux-amd64 2>/dev/null \
+      | sed -n 's|.*/releases/download/\(v[0-9][0-9.]*\)/.*|\1|p')"
+  fi
+  if [ -z "$_ml_new" ]; then
+    note "latest mxcli release: not checked (offline, or no curl) — installed $_ml_have"
+    return 0
+  fi
+  if ! mxtk_semver_lt "$_ml_have" "$_ml_new"; then
+    ok "mxcli $_ml_have is the latest release"
+  elif [ -n "${MXCLI_VERSION:-}" ]; then
+    note "mxcli pinned by MXCLI_VERSION=$MXCLI_VERSION; latest is $_ml_new — move when the team chooses"
+  else
+    warn "mxcli $_ml_have is behind the latest release $_ml_new (advice only — nothing is blocked)"
+    note "what's new: https://github.com/mendixlabs/mxcli/releases/tag/$_ml_new"
+    note "upgrade: move the old binary aside (mv mxcli mxcli.$_ml_have), then bin/doctor.sh --install ${PROJECT_DIR:-<project>}"
+    note "to stay on $_ml_have deliberately: set MXCLI_VERSION=$_ml_have and this becomes a note"
+  fi
+  mxtk_semver_lt "$_ml_have" "$MXTK_MXCLI_FLOOR" && \
+    note "this toolkit's instruments are checked against $MXTK_MXCLI_FLOOR and later; $_ml_have output may not parse"
+  return 0
+}
+
 # recommended_fix — ONE block that ends both the normal run and --bench: the first option that works on THIS
 # machine, in this order. Read-only, cheap probes; never installs anything and never asks for IT's help.
 #   0. MH_STALE (machine_health): the project runs older local copies of the speed scripts -> upgrade them
@@ -1333,10 +1400,10 @@ if [ "$INSTALL" -eq 1 ]; then
     # 2026-08-31): mxcli-{darwin|linux}-{amd64|arm64}, mxcli-windows-amd64.exe. Windows gets
     # the .exe name so Git Bash's transparent foo -> foo.exe mapping serves the project
     # convention ./mxcli unchanged. $MXCLI_VERSION pins a release tag (e.g. v0.16.0) for
-    # teams that standardise; default is latest. v0.25.0 froze `mdl 1`: DESCRIBE output and
-    # `-c` input changed shape (navigation, DynamicClasses, `show entity` refused). The
-    # toolkit's instruments read both shapes, so a project mid-build may stay on its version
-    # (MXCLI_VERSION=v0.24.0) and move when it chooses.
+    # teams that standardise; default is latest. The toolkit's instruments are checked against
+    # $MXTK_MXCLI_FLOOR (v0.28.0) through v0.29.0 (golden captures, 2026-10-30); a project
+    # mid-build may stay on its version (MXCLI_VERSION=<its ./mxcli --version>) and move when
+    # it chooses. The normal doctor run says when the installed mxcli is behind the latest.
     # Git Bash on Windows ARM64 runs emulated, so `uname -m` says x86_64 there. On Windows the
     # real hardware shows in the `uname -s` suffix (...-ARM64) and in PROCESSOR_ARCHITEW6432
     # (set for emulated processes) / PROCESSOR_ARCHITECTURE; those win over `uname -m`.
@@ -1395,7 +1462,7 @@ if [ "$INSTALL" -eq 1 ]; then
         note "  $_STEP. mxcli (~90 MB) -> $PROJECT_DIR/$MXCLI_DEST"
         note "     the MDL CLI every session here uses; from $MXCLI_URL"
         [ -z "${MXCLI_VERSION:-}" ] && note "     (latest release — set MXCLI_VERSION=vX.Y.Z to pin the team's version;"
-        [ -z "${MXCLI_VERSION:-}" ] && note "      a project already building on v0.24 can stay there: MXCLI_VERSION=v0.24.0)"
+        [ -z "${MXCLI_VERSION:-}" ] && note "      a project mid-build can stay on its version: MXCLI_VERSION=<its ./mxcli --version>)"
       fi
       if [ "$NEED_TOOLCHAIN" -eq 1 ]; then
         _STEP=$((_STEP + 1))
@@ -1855,6 +1922,7 @@ if [ -n "$PROJECT_DIR" ]; then
       if [ "$MXCLI_EXIT" -eq 0 ]; then
         ok "mxcli runs ($PROBE_HOW): $(probe_line)"
         note "at: $PMXCLI_PROBE"
+        [ "$QUICK" != 1 ] && mxcli_latest_advice "$(probe_line)"
       else
         bad "mxcli exists but cannot run (exit $MXCLI_EXIT): $PMXCLI_PROBE"
         printf '%s\n' "$PROBE_OUT" | grep -v '^[[:space:]]*$' | head -3 | while IFS= read -r l; do note "  $l"; done
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index d981b29c..1063e2fa 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1699,8 +1699,13 @@ if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
       3) echo "   (the project's mxcli predates 'fix property-sets', v0.26.0 — upgrade it before a Team Server merge)" ;;
       4) _ps_why="$(printf '%s\n' "$_ps_out" | sed -n 's/^  WARN  property sets: //p' | head -1)"
          echo "   could not check property sets: ${_ps_why:-see above} — not recorded; the next sync re-checks" ;;
-      1) warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
-              "bin/doctor.sh --fix-property-sets '$PROJECT_DIR'" ;;
+      1) if printf '%s\n' "$_ps_out" | grep -q '  NEEDS '; then
+           warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
+                "bin/doctor.sh --fix-property-sets '$PROJECT_DIR'"
+         else  # only FAILED / MIXED rows (mxcli v0.29+): nothing the guarded repair can clear
+           warn "property sets: Studio Pro's merge/diff can throw on this model (see above)." \
+                "--fix-property-sets cannot clear these rows; doctor's notes above say what can"
+         fi ;;
       *) echo "   property-set check exited $_ps_rc — see above" ;;
     esac
   fi
diff --git a/pipelines/mendix-mpr/lib/own-modules.awk b/pipelines/mendix-mpr/lib/own-modules.awk
index 986a0896..7d7a6f00 100644
--- a/pipelines/mendix-mpr/lib/own-modules.awk
+++ b/pipelines/mendix-mpr/lib/own-modules.awk
@@ -1,12 +1,17 @@
 # own-modules.awk — print the own modules of a `mxcli list modules` capture, one per line.
 #   awk -F'|' -f lib/own-modules.awk list-modules.txt
-# Own module = empty Source column (Marketplace modules carry "Marketplace vX"), System excluded.
+# Own module = empty Source column, or only "Protected <kind>" (Marketplace modules carry
+# "Marketplace vX"), System excluded.
 # Rows are the table lines after the `|---` separator, so a leading WARNING / "Connected to:" line
 # and the trailing "(N modules)" line are skipped whether or not they are present.
-# Golden input: tests/wave2/fixtures/rehost-list-modules/ (verbatim mxcli v0.25.0 and v0.26.0).
+# Golden input: tests/wave2/fixtures/rehost-list-modules/ (verbatim mxcli v0.25.0, v0.26.0, v0.29.0).
 /^\|-/ { body = 1; next }
 body && NF > 3 {
   name = $2; src = $3
   gsub(/ /, "", name); gsub(/ /, "", src)
+  # mxcli v0.28+ (mendixlabs/mxcli#1498) adds "Protected AddOn|Solution" to Source, after any
+  # "Marketplace vX": the module's export level, not its origin. Drop it before deciding.
+  n = split(src, part, ","); src = ""
+  for (i = 1; i <= n; i++) if (part[i] !~ /^Protected/) src = src part[i]
   if (src == "" && name != "System" && name != "") print name
 }
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 581387f5..b0322884 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -1824,7 +1824,10 @@ fi
 # The contract is captured, not assumed (tests/wave2/fixtures/mxpatch/, v0.25.0 and v0.26.0
 # verbatim): exit 0 + "The ContentsHash index matches every unit file." (or "is an MPR v1
 # project") = clean; exit 1 + the "N mismatch(es), N missing file(s), N orphan file(s)."
-# summary = issues, one "  MISMATCH|MISSING|ORPHAN" row each; exit 1 WITHOUT the summary is an
+# summary = issues, one "  MISMATCH|MISSING|ORPHAN" row each. From v0.29.0 (ako/mxcli#1159) an
+# MPR v1 model is verified too: clean = "Every unit's ContentsHash matches its stored
+# contents.", issues = a bare "N mismatch(es)." summary with "  MISMATCH  <id> [<type>]" rows
+# (no file path: v1 keeps unit contents inside the .mpr); exit 1 WITHOUT the summary is an
 # error ("project not found") — never read the exit code alone. Support is read from
 # `mxcli fix --help` listing `hashes`, the way doctor.sh probes property-sets: on v0.24.0
 # `mxcli fix hashes --help` exits 0 with the parent's help, so it cannot be the probe.
@@ -1840,9 +1843,9 @@ hv_supported() {   # 0 listed, 1 absent, 2 the help itself failed
 hv_run() {         # <outfile> — sets HV_STATE clean|issues|error and HV_RC
   HV_RC=0
   "$PMXCLI" fix hashes -p "$MPR" > "$1" 2>&1 < /dev/null || HV_RC=$?
-  if [ "$HV_RC" -eq 0 ] && grep -qE 'ContentsHash index matches every unit file|is an MPR v1 project' "$1"; then
+  if [ "$HV_RC" -eq 0 ] && grep -qE "ContentsHash index matches every unit file|is an MPR v1 project|Every unit's ContentsHash matches its stored contents" "$1"; then
     HV_STATE=clean
-  elif [ "$HV_RC" -eq 1 ] && grep -qE '^[0-9]+ mismatch\(es\), [0-9]+ missing file\(s\), [0-9]+ orphan file\(s\)\.' "$1"; then
+  elif [ "$HV_RC" -eq 1 ] && grep -qE '^[0-9]+ mismatch\(es\)(, [0-9]+ missing file\(s\), [0-9]+ orphan file\(s\))?\.' "$1"; then
     HV_STATE=issues
   else
     HV_STATE=error
diff --git a/project-bin/module-close.sh b/project-bin/module-close.sh
index cdeb0f15..299380da 100755
--- a/project-bin/module-close.sh
+++ b/project-bin/module-close.sh
@@ -39,6 +39,9 @@ lint=$("$MX" lint -p "$MPR" 2>&1 | grep -v WARNING)
 mine=$(printf '%s\n' "$lint" | grep -A1 '⚠' | grep -B1 -E "\b$mod\." | grep '⚠' || true)
 nmine=$(printf '%s' "$mine" | grep -c '⚠' || true)
 score=$(bash bin/metrics-ledger.sh score 2>&1 | tail -1)
+# mxcli v0.29.0 changed what this checks (ako/mxcli#568, #646): `docker check` now checks the
+# project as stored, so a stale widget definition (CE0463) that passed here on v0.28 is reported
+# now. That is a real finding about the model, not a toolkit regression: `mxcli fix widgets`.
 chk=$("$MX" docker check -p "$MPR" ${MXB:+--mxbuild-path "$MXB"} 2>&1 | grep -v WARNING | tail -3)
 # `Gate mode: check` (exec.sh): the module's execs were `mx check`ed, which compiles no Java. The
 # module boundary is one of the natural places for the full build, so run it here when the stamp
diff --git a/project-bin/page-scope.sh b/project-bin/page-scope.sh
index b8d7af6e..731aed52 100755
--- a/project-bin/page-scope.sh
+++ b/project-bin/page-scope.sh
@@ -19,8 +19,9 @@
 #   inScope   every page in the scanned modules, as Module.Page
 #               ./mxcli -p <mpr> -c "SHOW PAGES IN <Module>"     (per module)
 #   modules   the caller's arguments; with none given, first-party modules from
-#               ./mxcli -p <mpr> -c "SHOW MODULES"               (Source column empty,
-#               minus System/Administration/Atlas* — harness-architecture.md §7)
+#               ./mxcli -p <mpr> -c "SHOW MODULES"               (Source column empty
+#               or only "Protected <kind>", minus System/Administration/Atlas* —
+#               harness-architecture.md §7)
 #   roles     role -> page sets, from each page's own `grant view on page ... to ...;`
 #               ./mxcli -p <mpr> describe --format elk page <QN> (mdlSource grants —
 #               the same statements page-audit-rules.js security/grant-view parses)
@@ -54,7 +55,7 @@ NO_ROLES=0
 while [ $# -gt 0 ]; do
   case "$1" in
     --no-roles) NO_ROLES=1; shift ;;
-    -h|--help)  sed -n '2,46p' "$0"; exit 0 ;;
+    -h|--help)  sed -n '2,47p' "$0"; exit 0 ;;
     --*) echo "unknown argument: $1" >&2; exit 2 ;;
     *)   MODULES="$MODULES $1"; shift ;;
   esac
@@ -157,6 +158,10 @@ def first_party_modules():
         src  = cell(l, m_src.start())
         if not IDENT.match(name) or name.lower() in HEADER_WORDS:
             continue
+        # mxcli v0.28+ (mendixlabs/mxcli#1498) also writes "Protected AddOn|Solution" here,
+        # comma-joined after any "Marketplace vX" — the module's export level, not where it
+        # came from. A first-party module set to Protected is still first-party.
+        src = ", ".join(p for p in src.split(", ") if not p.startswith("Protected "))
         if src:
             continue                          # marketplace/import — carries a source
         if name in ("System", "Administration") or name.startswith("Atlas"):
@@ -167,7 +172,8 @@ def first_party_modules():
 module_source = "arguments"
 if not MODULES:
     MODULES = first_party_modules()
-    module_source = ("SHOW MODULES — rows with an empty Source column, minus "
+    module_source = ("SHOW MODULES — rows with an empty Source column (or only "
+                     "\"Protected <kind>\", mxcli v0.28+), minus "
                      "System/Administration/Atlas* (harness-architecture.md §7)")
 if not MODULES:
     fault("SHOW MODULES yielded no first-party module — every row carries a Source or is "
diff --git a/project-bin/wf-add-path-terminators.py b/project-bin/wf-add-path-terminators.py
index 14cd094e..892cf8b3 100755
--- a/project-bin/wf-add-path-terminators.py
+++ b/project-bin/wf-add-path-terminators.py
@@ -47,10 +47,16 @@
 before the patch and 16 of 16 after, six of them open concurrently at the split. Native
 `mx check`: 0 errors both times.
 
+MENDIX 10.21 AND LATER ONLY. Workflows$EndOfParallelSplitPathActivity was introduced in Mendix
+10.21.0 (mendixmodelsdk versionInfo; mxcli ako/mxcli#1163, #1774). Written into an older model
+it makes the project unloadable (TypeCacheUnknownTypeException) -- so below 10.21 this tool
+refuses, exit 3, nothing written. mxcli v0.22.0 and later write the terminator themselves
+(BUG-121 is fixed upstream), so on a current mxcli this tool normally finds nothing to add.
+
 NEVER run this against a model Studio Pro has open, or while the app is running -- see
 project-bin/snapshot-mpr.sh. Concurrent writers corrupt the .mpr.
 """
-import os, sys, uuid
+import os, sqlite3, sys, uuid
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import mxpatch
 from mxpatch import get, is_doc
@@ -74,6 +80,22 @@ def make_terminator(n):
     ]
 
 
+TERMINATOR_SINCE = (10, 21)
+
+
+def product_version(mpr):
+    """The model's Mendix version as a tuple of ints, or None when it cannot be read."""
+    try:
+        db = sqlite3.connect("file:%s?mode=ro" % mpr, uri=True)
+        try:
+            v = db.execute("select _ProductVersion from _MetaData").fetchone()[0]
+        finally:
+            db.close()
+        return tuple(int(x) for x in str(v).split(".")[:3])
+    except Exception:
+        return None
+
+
 def walk(node, state):
     """Recurse the unit, appending a terminator to every unterminated split path."""
     if is_doc(node):
@@ -119,6 +141,15 @@ def main():
         model, unit = mxpatch.resolve_unit(args, "Workflows$Workflow")
     except mxpatch.PatchError as e:
         sys.exit("wf-add-path-terminators: %s" % e)
+    pv = product_version(model.mpr)
+    if pv is not None and pv[:2] < TERMINATOR_SINCE:
+        print("REFUSED -- this model is Mendix %s; %s arrived in 10.21.0. Written here it makes the"
+              % (".".join(map(str, pv)), TERMINATOR))
+        print("project unloadable (TypeCacheUnknownTypeException). Nothing written. Below 10.21 a")
+        print("parallel split path has no terminator node at all.")
+        sys.exit(3)
+    if pv is None:
+        print("note: the model's Mendix version could not be read; this tool needs 10.21 or later.")
     doc = unit.doc
     state = {"paths": 0, "added": 0, "already": 0, "n": 0}
     walk(doc, state)
diff --git a/skills/harness-architecture.md b/skills/harness-architecture.md
index 75a1c471..1d6df08b 100644
--- a/skills/harness-architecture.md
+++ b/skills/harness-architecture.md
@@ -341,7 +341,7 @@ the one place the value is configured.
 |---|---|
 | The model file | the single `*.mpr` in the project root, via `find_mpr()`; zero or many = hard fail, `MPR_FILE` overrides |
 | App port + ownership | `APP_PORT` / `APP_OWNERSHIP` from `.claude/loop/stack.env`, published by `test-stack-up.sh`; refuse `unverified` unless `ALLOW_UNVERIFIED_APP=1` |
-| First-party modules | `SHOW MODULES`, take rows whose **Source column is empty**, then subtract the Mendix-shipped set (System, Administration, Atlas/theme modules, and any marketplace module carrying a source) |
+| First-party modules | `SHOW MODULES`, take rows whose **Source column is empty** or reads only "Protected AddOn/Solution" (mxcli v0.28+: the export level, not an origin), then subtract the Mendix-shipped set (System, Administration, Atlas/theme modules, and any marketplace module carrying a source) |
 | Personas / roles | the navigation profile's roots plus page permissions — the roles that can actually reach a page. Never a role-name list carried from another project |
 | Selectors | `.mx-name-<widgetName>`, where `<widgetName>` comes from `DESCRIBE PAGE` on **this** project's page. Never invented, never carried between projects — a widget name is whatever the page's author typed |
 | Journey preconditions | measured by `fixture-manifest.sh` (0 sufficient · 1 short · 2 could not measure), then the residue interviewed per `fixture-seeding.md` |
diff --git a/skills/rehost-app.md b/skills/rehost-app.md
index d53276c9..7a1e6c6e 100644
--- a/skills/rehost-app.md
+++ b/skills/rehost-app.md
@@ -64,7 +64,7 @@ document in the source catalog for the modules run).
 MXCLI=<path to mxcli> pipelines/mendix-mpr/rehost-extract.sh <source.mpr> <target.mpr> <out-dir> [Module ...]
 ```
 
-Read the script header for outputs. Defaults: every own module (empty Source column), System
+Read the script header for outputs. Defaults: every own module (empty Source column, or only "Protected …"), System
 excluded. Switches:
 - `REHOST_REUSE_MDL=1` — reuse `<out>/mdl/<M>.mdl` from an earlier run; use it on every rerun after
   fixing the check/exec side, because the describes are the slow part.
diff --git a/skills/report-schema.md b/skills/report-schema.md
index 5d1eb1a1..098fb6db 100644
--- a/skills/report-schema.md
+++ b/skills/report-schema.md
@@ -206,7 +206,7 @@ literal copied from another project's report is a fabricated measurement.
 | `run.env.baseUrl` | Host + `APP_PORT` from `.claude/loop/stack.env`, **with the ownership check below**. Never a literal port. There is no default port you may assume. |
 | `run.env.user` | The identity the harness actually authenticated as (`TEST_USER`, resolved by `tests/e2e/config.js`) — **not** the journey's `persona` field, which is a label the runner never authenticates with. When they differ, that difference is itself a finding. |
 | `run.env.userFallbackUsed` | `true` whenever the harness fell back from the intended user to an admin identity. A silent admin degrade bypasses exactly the role grants the run exists to test. |
-| `checks[].module` | A module name from `SHOW MODULES`. An **empty Source column = first-party**; a populated one is a marketplace/imported module and is not yours to report on. |
+| `checks[].module` | A module name from `SHOW MODULES`. An **empty Source column = first-party** (so is one reading only "Protected AddOn/Solution", mxcli v0.28+: an export level, not an origin); any other value is a marketplace/imported module and is not yours to report on. |
 | `checks[].detail` selectors | `.mx-name-<widgetName>`, where `<widgetName>` is read from `DESCRIBE PAGE <Module>.<Page>` — or from a widget dump of the live page (`e2e-harness-base.md` step 1). **Never invented, never carried between projects.** |
 | `walks[].steps[].page.qualifiedName` | Resolved by intersection against the model catalog — see *Page resolution is an intersection*. Never typed by hand. |
 | `checks[].requirement`, `coverage[].brd` | BRD ids and pointers that resolve in **this** project's `analysis/**/F<NNN>.brd.json`. A pointer that does not resolve is worse than `null`. |
diff --git a/tests/wave2/fixtures/mxpatch/CAPTURE.txt b/tests/wave2/fixtures/mxpatch/CAPTURE.txt
index 60800e7b..51269f72 100644
--- a/tests/wave2/fixtures/mxpatch/CAPTURE.txt
+++ b/tests/wave2/fixtures/mxpatch/CAPTURE.txt
@@ -79,3 +79,21 @@ CROSS-CHECK of the hash routine, not committed (19 MB): on the mxcli repo's
 testdata/expr-checker model, base64(SHA-256(file)) disagrees with the stored ContentsHash on
 exactly the 67 units `mxcli-v0.26.0 fix hashes` lists as MISMATCH (identical UUID sets), and
 agrees on the other 302; on testdata/pedapp it agrees on all 369.
+
+v0.29.0 ADDITIONS (captured 2026-10-30, Linux x86-64, for the mxcli v0.29 compatibility fix)
+  v0.29.0  "mxcli version v0.29.0 (2026-10-30T17:00:32Z)"  sha256 7ecb06658afb265f0e3b9ed23e3903592cc2629d53f7baa9dc0837a982c103b3
+  v0.28.0  "mxcli version v0.28.0 (2026-10-23T14:29:27Z)"  sha256 7a1cb61f9e5e28c09f3c1247446cc611f6deca781355b93c5c6a29fd29d4e3ee
+  (same anonymous release-asset downloads as above)
+  verify-v1-v0.29.0              the MPR v1 model above (sha256 1657525904741f17fd71141e1bd792168271
+                                 b76c7c0e75ad3a9042db74b74dce): v0.29.0 now VERIFIES v1 (ako/mxcli
+                                 #1159) — "Every unit's ContentsHash matches its stored
+                                 contents.", exit 0. v0.28.0 still printed the "is an MPR v1
+                                 project" line of verify-v1-v0.26.0.
+  verify-v1-mismatch-v0.29.0     a copy of that model with the Projects$Project unit's
+                                 ContentsHash set to 'A'*43+'=' via sqlite: "  MISMATCH  <id>
+                                 [<type>]" (no file path) + "1 mismatch(es)." (no missing/orphan
+                                 counts), exit 1. v0.28.0 on the same copy: exit 0, nothing seen.
+  verify-stale-v0.29.0           the verify-stale mutation above on model/, under v0.29.0: the v2
+                                 contract is unchanged (same rows, same summary, exit 1).
+  THE v0.29.0 CONTRACT adds: exit 0 + "Every unit's ContentsHash matches its stored contents."
+  = clean; exit 1 + "N mismatch(es)." = issues (MPR v1).
diff --git a/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.err b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.exit b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.out b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.out
new file mode 100644
index 00000000..cf145600
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-stale-v0.29.0.out
@@ -0,0 +1,6 @@
+Checked 27 unit(s) in TestApp.mpr against 27 .mxunit file(s).
+  MISMATCH  84776610-13b2-48cb-a265-d5e984d63129  mprcontents/84/77/84776610-13b2-48cb-a265-d5e984d63129.mxunit [DomainModels$DomainModel]
+            stored AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=, file 1tF/YLIYmzkcB4ZkTyr7T0ENwLh+koaNmllfUhr+1Yg=
+
+1 mismatch(es), 0 missing file(s), 0 orphan file(s).
+Run 'mxcli fix hashes -p stale/TestApp.mpr --repair' to rewrite the mismatched hashes from the files.
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.err b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.exit b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.out b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.out
new file mode 100644
index 00000000..b871aa9b
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-mismatch-v0.29.0.out
@@ -0,0 +1,6 @@
+Checked 20 unit(s) in App.mpr (MPR v1) against the contents stored beside them.
+  MISMATCH  5e6c513a-a0ee-4102-8da9-e2b4eb894686 [Projects$Project]
+            stored AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=, contents iGlXFo3kKfH3fEwvUl3MgmLHihJp3Mw/RNhs5P0Q5Sw=
+
+1 mismatch(es).
+Run 'mxcli fix hashes -p v1bad/App.mpr --repair' to rewrite the mismatched hashes from the stored contents.
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.err b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.exit b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.out b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.out
new file mode 100644
index 00000000..21796451
--- /dev/null
+++ b/tests/wave2/fixtures/mxpatch/verify-v1-v0.29.0.out
@@ -0,0 +1,4 @@
+Checked 20 unit(s) in App.mpr (MPR v1) against the contents stored beside them.
+
+0 mismatch(es).
+Every unit's ContentsHash matches its stored contents.
diff --git a/tests/wave2/fixtures/property-sets/CAPTURE-v0.29.txt b/tests/wave2/fixtures/property-sets/CAPTURE-v0.29.txt
new file mode 100644
index 00000000..9acad8a1
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/CAPTURE-v0.29.txt
@@ -0,0 +1,31 @@
+tests/wave2/fixtures/property-sets/ — v0.28.0 / v0.29.0 additions (captured 2026-10-30, Linux x86-64)
+
+Captured, never hand-written. Binaries: the public mendixlabs/mxcli release assets
+(mxcli-linux-amd64), downloaded anonymously:
+  v0.29.0  "mxcli version v0.29.0 (2026-10-30T17:00:32Z)"  sha256 7ecb06658afb265f0e3b9ed23e3903592cc2629d53f7baa9dc0837a982c103b3
+  v0.28.0  "mxcli version v0.28.0 (2026-10-23T14:29:27Z)"  sha256 7a1cb61f9e5e28c09f3c1247446cc611f6deca781355b93c5c6a29fd29d4e3ee
+
+  version-v0.2{8,9}.0.txt                 `mxcli version`
+  fix-help-v0.2{8,9}.0.txt                `mxcli fix --help`, cut at "Global Flags:" as the others
+  fix-property-sets-help-v0.2{8,9}.0.txt  `mxcli fix property-sets --help`, same cut
+
+THE MODEL: tests/wave2/fixtures/mxpatch/model/ (provenance in its CAPTURE.txt; Mendix 11.14.0),
+rebuilt with executescript — its mprcontents/ is byte-identical to the committed one (diff -r).
+  "full"  = that model after `mxcli-v0.29.0 fix property-sets -p TestApp.mpr` (completes the
+            DomainModel unit 84776610-…, +7 keys).
+  "mixed" = "full", then the LanguageCode key removed from the FIRST Texts$Translation element of
+            unit 25d3e460-c53d-419e-a2a9-e1428f40b14f (Microflows$Microflow) with mxpatch.py's
+            Model.write_unit (ContentsHash kept in step; `fix hashes` clean). Found by trying
+            key removals until v0.29.0 reported MIXED: Studio Pro writes the same names on every
+            element of a type, so 260 of 261 Translations carrying it is the hazard.
+  "both"  = the original model (DomainModel still incomplete) with the same removal.
+
+THE CAPTURES (<name>.out = stdout, .err = stderr, .exit = exit code; each on a fresh copy):
+  ps-dryrun-mixed-v0.29.0      fix property-sets --dry-run on "mixed": only a MIXED row + its
+                               summary paragraph, exit 1 (no NEEDS, no FAILED row)
+  ps-dryrun-both-v0.29.0       --dry-run on "both": NEEDS + MIXED, exit 1
+  ps-apply-both-v0.29.0        fix property-sets (write) on "both": FIXED + "Completed 1 unit(s)"
+                               + MIXED, exit 1 — the repair landed and the command still exits 1
+  ps-after-apply-both-v0.29.0  --dry-run after that write: MIXED only, exit 1
+  For contrast (not committed): v0.28.0 on "mixed" prints "Every unit already has the property
+  names Studio Pro writes." and exits 0; on "both" it reports NEEDS only (+3 keys), exit 1.
diff --git a/tests/wave2/fixtures/property-sets/fix-help-v0.28.0.txt b/tests/wave2/fixtures/property-sets/fix-help-v0.28.0.txt
new file mode 100644
index 00000000..46222917
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-help-v0.28.0.txt
@@ -0,0 +1,23 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  hashes            Verify (and with --repair, rewrite) the MPR v2 ContentsHash index
+  property-sets     Give every stored unit the property names Studio Pro writes (unblocks mx diff / merge)
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/fix-help-v0.29.0.txt b/tests/wave2/fixtures/property-sets/fix-help-v0.29.0.txt
new file mode 100644
index 00000000..f7d55d11
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-help-v0.29.0.txt
@@ -0,0 +1,23 @@
+Run Mendix's own model-fixing tools and keep the project's storage format.
+
+'mx update-widgets' and 'mx rename-design-properties' both do work that only
+Mendix can do, and both rewrite an MPR v2 project into the single-file v1 format
+as a side effect — measured on 11.12.1, rename-design-properties turned 1,866
+.mxunit files into 0 and a 69 KB index into 39 MB.
+
+These subcommands run the tool, read its result back out, restore the v2
+storage, and write the changed units into it with mxcli's own writer. The fix
+persists; the format survives. An MPR v1 project is passed straight through.
+
+Usage:
+  mxcli fix [command]
+
+Available Commands:
+  design-properties Update renamed design properties (clears CE6087) without collapsing MPR v2
+  hashes            Verify (and with --repair, rewrite) the .mpr's ContentsHash index
+  property-sets     Give every stored unit the property names Studio Pro writes (unblocks mx diff / merge)
+  widgets           Resync widget definitions (clears CE0463) without collapsing MPR v2
+
+Flags:
+  -h, --help   help for fix
+
diff --git a/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.28.0.txt b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.28.0.txt
new file mode 100644
index 00000000..0191668c
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.28.0.txt
@@ -0,0 +1,41 @@
+Normalize the property names of every unit already in the project.
+
+Mendix's merge and diff engine compares two revisions of an element by its
+property NAMES and throws when they differ:
+
+  Objects with ID … of type Microflows$RestOperationCallAction do not have
+  the same properties.
+
+The model is valid — mx check passes and Studio Pro opens it — but every diff,
+merge and the Version Control panel fail once Studio Pro has saved the
+document with its full property set.
+
+Every mxcli write already gives a unit that set for the project's Mendix
+version: missing keys are added with the value Mendix gives an absent one, and
+empty keys the version does not declare yet are dropped. A unit written by an
+older mxcli and never rewritten since keeps its gaps. This command applies the
+same normalization to every stored unit, and writes the units whose property
+names change. It adds and removes keys only: no element $ID moves and no
+existing GUID changes. The one GUID it adds is on a project user role that has
+none (older mxcli wrote them without): the role's own $ID, the value a role
+mxcli creates gets — without it the build invents a random GUID each time and
+the runtime can only find the role's row by name. A second run writes nothing.
+
+A unit holding a value in a key the project's version does not declare is
+reported and left alone — dropping the value would change the model. Like every
+mxcli write, the repair is refused while Studio Pro has the project open.
+
+Exits 1 when a unit could not be repaired, or, with --dry-run, when one needs it.
+
+Usage:
+  mxcli fix property-sets [flags]
+
+Examples:
+  mxcli fix property-sets -p app.mpr --dry-run
+  mxcli fix property-sets -p app.mpr
+
+Flags:
+      --dry-run          report the units that would change, write nothing
+  -h, --help             help for property-sets
+  -p, --project string   path to the Mendix project (.mpr)
+
diff --git a/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.29.0.txt b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.29.0.txt
new file mode 100644
index 00000000..015d7a5c
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/fix-property-sets-help-v0.29.0.txt
@@ -0,0 +1,60 @@
+Normalize the property names of every unit already in the project.
+
+Mendix's merge and diff engine compares two revisions of an element by its
+property NAMES and throws when they differ:
+
+  Objects with ID … of type Microflows$RestOperationCallAction do not have
+  the same properties.
+
+The model is valid — mx check passes and Studio Pro opens it — but every diff,
+merge and the Version Control panel fail once Studio Pro has saved the
+document with its full property set.
+
+Every mxcli write already gives a unit that set for the project's Mendix
+version: missing keys are added with the value Mendix gives an absent one, and
+empty keys the version does not declare yet are dropped. A unit written by an
+older mxcli and never rewritten since keeps its gaps. This command applies the
+same normalization to every stored unit, and writes the units whose property
+names change. It adds and removes keys only: no element $ID moves and no
+existing GUID changes. The one GUID it adds is on a project user role that has
+none (older mxcli wrote them without): the role's own $ID, the value a role
+mxcli creates gets — without it the build invents a random GUID each time and
+the runtime can only find the role's row by name. A second run writes nothing.
+
+The repair works from its own commit on: a merge whose base is an older
+revision still fails on every document that was incomplete there and that both
+branches changed. Run it once on the main branch, in a commit of its own, and
+branch from there. To get an older branch past such a merge: abort it (git
+merge --abort); list the documents with --dry-run on a checkout of the merge
+base; put the ones your branch changed back to their merge-base version (git
+checkout <base> -- <unit file>, then mxcli fix hashes --repair) and commit;
+merge again in Studio Pro; redo those edits. Never delete and re-create an
+entity, attribute or association to get past it: its GUID is the database's
+identity for it.
+
+A unit holding a value in a key the project's version does not declare is
+reported and left alone — dropping the value would change the model. Like every
+mxcli write, the repair is refused while Studio Pro has the project open.
+
+The keys it adds come from values measured on Mendix versions. A key no
+measurement covers on the project's version is not filled, but it is found:
+Studio Pro writes the same property names on every element of a type, so a
+name some elements of a type carry and others lack is listed as MIXED, with the
+units on the smaller side, and left as it is. Report those with your Mendix
+version so the value can be measured.
+
+Exits 1 when a unit could not be repaired, when a MIXED name remains, or, with
+--dry-run, when a unit needs the repair.
+
+Usage:
+  mxcli fix property-sets [flags]
+
+Examples:
+  mxcli fix property-sets -p app.mpr --dry-run
+  mxcli fix property-sets -p app.mpr
+
+Flags:
+      --dry-run          report the units that would change, write nothing
+  -h, --help             help for property-sets
+  -p, --project string   path to the Mendix project (.mpr)
+
diff --git a/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.err b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.exit b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.out b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.out
new file mode 100644
index 00000000..73a0ef0a
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-after-apply-both-v0.29.0.out
@@ -0,0 +1,5 @@
+Checked 27 unit(s) in TestApp.mpr against the Mendix 11.14.0 property sets.
+
+Property names that differ between elements of one type (no value measured on Mendix 11.14.0 fills them):
+  MIXED     Texts$Translation.LanguageCode: on 260 of 261 element(s); without it: 25d3e460-c53d-419e-a2a9-e1428f40b14f [Microflows$Microflow ZzMxcliProbe_List]
+1 property name(s) left as they are. Mendix's merge engine cannot compare a revision of these elements with one that has the other set of names. mxcli fills a key only with the value Studio Pro was measured writing on a Mendix version; report the names above with your Mendix version so it can be measured.
diff --git a/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.err b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.exit b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.out b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.out
new file mode 100644
index 00000000..4cb5b61d
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-apply-both-v0.29.0.out
@@ -0,0 +1,8 @@
+Checked 27 unit(s) in TestApp.mpr against the Mendix 11.14.0 property sets.
+  FIXED     84776610-13b2-48cb-a265-d5e984d63129 [DomainModels$DomainModel]: +7 key(s), -0 key(s)
+
+Completed 1 unit(s): 7 key(s) added, 0 stripped.
+
+Property names that differ between elements of one type (no value measured on Mendix 11.14.0 fills them):
+  MIXED     Texts$Translation.LanguageCode: on 260 of 261 element(s); without it: 25d3e460-c53d-419e-a2a9-e1428f40b14f [Microflows$Microflow ZzMxcliProbe_List]
+1 property name(s) left as they are. Mendix's merge engine cannot compare a revision of these elements with one that has the other set of names. mxcli fills a key only with the value Studio Pro was measured writing on a Mendix version; report the names above with your Mendix version so it can be measured.
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.err b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.exit b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.out b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.out
new file mode 100644
index 00000000..38906e1f
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-both-v0.29.0.out
@@ -0,0 +1,9 @@
+Checked 27 unit(s) in TestApp.mpr against the Mendix 11.14.0 property sets.
+  NEEDS     84776610-13b2-48cb-a265-d5e984d63129 [DomainModels$DomainModel]: +7 key(s), -0 key(s)
+
+Would complete 1 unit(s): 7 key(s) added, 0 stripped.
+Run 'mxcli fix property-sets -p r/TestApp.mpr' to write them.
+
+Property names that differ between elements of one type (no value measured on Mendix 11.14.0 fills them):
+  MIXED     Texts$Translation.LanguageCode: on 260 of 261 element(s); without it: 25d3e460-c53d-419e-a2a9-e1428f40b14f [Microflows$Microflow ZzMxcliProbe_List]
+1 property name(s) left as they are. Mendix's merge engine cannot compare a revision of these elements with one that has the other set of names. mxcli fills a key only with the value Studio Pro was measured writing on a Mendix version; report the names above with your Mendix version so it can be measured.
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.err b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.err
new file mode 100644
index 00000000..2bac62da
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.err
@@ -0,0 +1 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.exit b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.exit
new file mode 100644
index 00000000..d00491fd
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.exit
@@ -0,0 +1 @@
+1
diff --git a/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.out b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.out
new file mode 100644
index 00000000..73a0ef0a
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/ps-dryrun-mixed-v0.29.0.out
@@ -0,0 +1,5 @@
+Checked 27 unit(s) in TestApp.mpr against the Mendix 11.14.0 property sets.
+
+Property names that differ between elements of one type (no value measured on Mendix 11.14.0 fills them):
+  MIXED     Texts$Translation.LanguageCode: on 260 of 261 element(s); without it: 25d3e460-c53d-419e-a2a9-e1428f40b14f [Microflows$Microflow ZzMxcliProbe_List]
+1 property name(s) left as they are. Mendix's merge engine cannot compare a revision of these elements with one that has the other set of names. mxcli fills a key only with the value Studio Pro was measured writing on a Mendix version; report the names above with your Mendix version so it can be measured.
diff --git a/tests/wave2/fixtures/property-sets/version-v0.28.0.txt b/tests/wave2/fixtures/property-sets/version-v0.28.0.txt
new file mode 100644
index 00000000..bfa3e6bb
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/version-v0.28.0.txt
@@ -0,0 +1 @@
+mxcli version v0.28.0 (2026-10-23T14:29:27Z)
diff --git a/tests/wave2/fixtures/property-sets/version-v0.29.0.txt b/tests/wave2/fixtures/property-sets/version-v0.29.0.txt
new file mode 100644
index 00000000..92849e35
--- /dev/null
+++ b/tests/wave2/fixtures/property-sets/version-v0.29.0.txt
@@ -0,0 +1 @@
+mxcli version v0.29.0 (2026-10-30T17:00:32Z)
diff --git a/tests/wave2/fixtures/rehost-list-modules/CAPTURE.txt b/tests/wave2/fixtures/rehost-list-modules/CAPTURE.txt
index 781a32db..e20c16f6 100644
--- a/tests/wave2/fixtures/rehost-list-modules/CAPTURE.txt
+++ b/tests/wave2/fixtures/rehost-list-modules/CAPTURE.txt
@@ -17,3 +17,9 @@ field-service-template-9.24.2.txt
   not depend on a fixed number of leading lines.
   59 modules: 16 "Marketplace vX", System, and 42 with an empty Source column (own).
   (#293's capture note said "45 own"; counting the Source column gives 42.)
+
+v0.29.0 additions (2026-10-30; binary sha256 in fixtures/property-sets/CAPTURE-v0.29.txt):
+  list-modules-protected-v0.29.0.txt              `mxcli-v0.29.0 -p prot/TestApp.mpr list modules`
+  list-modules-marketplace-protected-v0.29.0.txt  the same on mkt/TestApp.mpr
+  Models: fixtures/mxpatch/model/ with MyFirstModule set Protected, and additionally marked a
+  Marketplace module v2.1.0 — exact mutations in fixtures/show-modules/CAPTURE.txt.
diff --git a/tests/wave2/fixtures/rehost-list-modules/list-modules-marketplace-protected-v0.29.0.txt b/tests/wave2/fixtures/rehost-list-modules/list-modules-marketplace-protected-v0.29.0.txt
new file mode 100644
index 00000000..975acdda
--- /dev/null
+++ b/tests/wave2/fixtures/rehost-list-modules/list-modules-marketplace-protected-v0.29.0.txt
@@ -0,0 +1,8 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+Connected to: mkt/TestApp.mpr (Mendix 11.14.0)
+| Module        | Source                              | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|-------------------------------------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule | Marketplace v2.1.0, Protected AddOn | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |                                     | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/rehost-list-modules/list-modules-protected-v0.29.0.txt b/tests/wave2/fixtures/rehost-list-modules/list-modules-protected-v0.29.0.txt
new file mode 100644
index 00000000..dcf42e20
--- /dev/null
+++ b/tests/wave2/fixtures/rehost-list-modules/list-modules-protected-v0.29.0.txt
@@ -0,0 +1,8 @@
+WARNING: This is a vibe-coded PoC, alpha quality, use with caution.
+Connected to: prot/TestApp.mpr (Mendix 11.14.0)
+| Module        | Source          | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|-----------------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule | Protected AddOn | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |                 | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/show-modules/CAPTURE.txt b/tests/wave2/fixtures/show-modules/CAPTURE.txt
new file mode 100644
index 00000000..3ec4487f
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/CAPTURE.txt
@@ -0,0 +1,15 @@
+tests/wave2/fixtures/show-modules/ — provenance (captured 2026-10-30, Linux x86-64)
+
+Captured, never hand-written. Binaries and their sha256: fixtures/property-sets/CAPTURE-v0.29.txt.
+Model: fixtures/mxpatch/model/ (Mendix 11.14.0; MyFirstModule + System), rebuilt; then on copies,
+written with project-bin/mxpatch.py (ContentsHash kept in step; `fix hashes` clean afterwards):
+  "protected"   Projects$ModuleSettings unit d121ee37-f102-56ae-b644-160f1d340296 (MyFirstModule's):
+                ExportLevel 'Source' -> 'Protected' (ProtectedModuleType was already 'AddOn')
+  "marketplace" "protected", then Projects$ModuleImpl 16747dc6-b6b7-42ae-aabf-255dca2aeeaf:
+                FromAppStore false -> true, AppStoreVersion '' -> '2.1.0'
+  mxcli -p <copy>/TestApp.mpr -c 'show modules' (stdout; .exit = exit code):
+    show-modules-source-v0.29.0                 the model as committed: Source empty
+    show-modules-protected-v0.2{8,9}.0          "protected": Source "Protected AddOn" (v0.28.0 and
+                                                v0.29.0 alike — mendixlabs/mxcli#1498, since v0.28)
+    show-modules-marketplace-protected-v0.29.0  "marketplace": "Marketplace v2.1.0, Protected AddOn"
+  show-pages-in-myfirstmodule-v0.29.0.out       mxcli -c 'SHOW PAGES IN MyFirstModule' on "protected"
diff --git a/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.exit b/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.out b/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.out
new file mode 100644
index 00000000..5c8f58c8
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-marketplace-protected-v0.29.0.out
@@ -0,0 +1,6 @@
+| Module        | Source                              | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|-------------------------------------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule | Marketplace v2.1.0, Protected AddOn | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |                                     | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.exit b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.out b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.out
new file mode 100644
index 00000000..c54c52bc
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.28.0.out
@@ -0,0 +1,6 @@
+| Module        | Source          | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|-----------------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule | Protected AddOn | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |                 | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.exit b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.out b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.out
new file mode 100644
index 00000000..c54c52bc
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-protected-v0.29.0.out
@@ -0,0 +1,6 @@
+| Module        | Source          | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|-----------------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule | Protected AddOn | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |                 | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.exit b/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.exit
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.out b/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.out
new file mode 100644
index 00000000..ff89597e
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-modules-source-v0.29.0.out
@@ -0,0 +1,6 @@
+| Module        | Source | Entities | Enums | Pages | Snippets | Microflows | Nanoflows | Workflows | Constants | JavaActions | PubREST | PubOData | ConOData | BizEvents | ExtDB |
+|---------------|--------|----------|-------|-------|----------|------------|-----------|-----------|-----------|-------------|---------|----------|----------|-----------|-------|
+| MyFirstModule |        | 3        | 0     | 1     | 0        | 10         | 1         | 1         | 0         | 0           | 0       | 1        | 0        | 0         | 0     |
+| System        |        | 39       | 15    | 0     | 0        | 0          | 0         | 0         | 0         | 1           | 0       | 0        | 0        | 0         | 0     |
+
+(2 modules)
diff --git a/tests/wave2/fixtures/show-modules/show-pages-in-myfirstmodule-v0.29.0.out b/tests/wave2/fixtures/show-modules/show-pages-in-myfirstmodule-v0.29.0.out
new file mode 100644
index 00000000..745dc0a2
--- /dev/null
+++ b/tests/wave2/fixtures/show-modules/show-pages-in-myfirstmodule-v0.29.0.out
@@ -0,0 +1,5 @@
+| Qualified Name         | Module        | Name     | Excluded | Folder | Title    | url | Params |
+|------------------------|---------------|----------|----------|--------|----------|-----|--------|
+| MyFirstModule.Home_Web | MyFirstModule | Home_Web | false    |        | Homepage |     | 0      |
+
+(1 pages)
diff --git a/tests/wave2/test-doctor-mxcli-latest.sh b/tests/wave2/test-doctor-mxcli-latest.sh
new file mode 100755
index 00000000..0fb150ee
--- /dev/null
+++ b/tests/wave2/test-doctor-mxcli-latest.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Fixture for doctor.sh's "advise latest, respect pins" check (mxcli v0.29 compat, 2026-10-30):
+# the normal doctor run compares the project's mxcli with the latest release and ADVISES —
+# a WARN with the upgrade path when behind, a plain note when MXCLI_VERSION pins it, one quiet
+# note when the latest cannot be read. Never a FAIL, never a download.
+#
+# usage: bash tests/wave2/test-doctor-mxcli-latest.sh [/path/to/bin/doctor.sh]
+#
+# Golden input: the stub mxcli prints the captured `mxcli --version` of the real release
+# binaries (fixtures/property-sets/version-v0.2{4,8,9}.0.txt). MXTK_MXCLI_LATEST stands in for
+# the network answer, so no request leaves the machine; the offline case points curl at
+# nothing via MXTK_MXCLI_LATEST unset + a PATH without curl.
+# Positive control: against master's doctor.sh (no advice) 4 pass, 8 fail — only D, G, H and
+# A's "never a FAIL" pass, as they assert an absence.
+set -uo pipefail
+TK="$(cd "$(dirname "$0")/../.." && pwd)"
+DOCTOR="${1:-$TK/bin/doctor.sh}"
+case "$DOCTOR" in /*) ;; *) DOCTOR="$PWD/$DOCTOR" ;; esac
+FIX="$TK/tests/wave2/fixtures/property-sets"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/doctor-latest.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+export MXTK_NO_GUIDE=1 MXTK_DOCTOR_SKIP_DOCKER=1 MXTK_LEAKGUARD_DENYFILE="$WORK/deny"
+unset MXCLI_VERSION MXTK_NO_LATEST_CHECK
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+
+P="$WORK/proj"; mkdir -p "$P"; : > "$P/App.mpr"
+cat > "$P/mxcli" <<STUB
+#!/usr/bin/env bash
+case "\${1:-}" in --version|version) cat "$FIX/version-\$(cat "$P/.ver").txt" ;; esac
+exit 0
+STUB
+chmod +x "$P/mxcli"
+run() { echo "$1" > "$P/.ver"; shift; ( cd "$WORK" && env "$@" bash "$DOCTOR" "$P" ) > "$WORK/out" 2>&1; }
+out() { grep -E "mxcli|latest|MXCLI_VERSION|upgrade|what's new" "$WORK/out" | head -12; }
+
+echo "== A: behind, not pinned: WARN, release link, upgrade path, how to pin =="
+run v0.28.0 MXTK_MXCLI_LATEST=v0.29.0
+grep -q "WARN  mxcli v0.28.0 is behind the latest release v0.29.0 (advice only" "$WORK/out" && ok "WARN names both versions" || bad "A: no WARN" "$(out)"
+grep -q "releases/tag/v0.29.0" "$WORK/out" && ok "links the release notes" || bad "A: no link" "$(out)"
+grep -q "bin/doctor.sh --install $P" "$WORK/out" && ok "names the upgrade command" || bad "A: no upgrade command" "$(out)"
+grep -q "set MXCLI_VERSION=v0.28.0" "$WORK/out" && ok "says how to stay deliberately" || bad "A: no pin hint" "$(out)"
+grep -qE "FAIL .*(latest|behind)" "$WORK/out" && bad "A: advice became a FAIL" "$(out)" || ok "never a FAIL"
+
+echo "== B: behind, pinned by MXCLI_VERSION: a note, no WARN =="
+run v0.28.0 MXTK_MXCLI_LATEST=v0.29.0 MXCLI_VERSION=v0.28.0
+grep -q "mxcli pinned by MXCLI_VERSION=v0.28.0; latest is v0.29.0" "$WORK/out" && ! grep -q "WARN  mxcli v0.28.0 is behind" "$WORK/out" \
+  && ok "pin respected: noted, not nagged" || bad "B" "$(out)"
+
+echo "== C: on the latest: ok line =="
+run v0.29.0 MXTK_MXCLI_LATEST=v0.29.0
+grep -q "ok    mxcli v0.29.0 is the latest release" "$WORK/out" && ok "ok line" || bad "C" "$(out)"
+
+echo "== D: newer than 'latest' (a pre-release build): not called behind =="
+run v0.29.0 MXTK_MXCLI_LATEST=v0.28.0
+grep -q "is behind" "$WORK/out" && bad "D: called behind" "$(out)" || ok "not behind"
+
+echo "== E: below the toolkit's floor (v0.24.0): the floor is named =="
+run v0.24.0 MXTK_MXCLI_LATEST=v0.29.0
+grep -q "checked against v0.28.0 and later; v0.24.0 output may not parse" "$WORK/out" && ok "floor note" || bad "E" "$(out)"
+
+echo "== F: latest unknown (no curl, no MXTK_MXCLI_LATEST): one quiet note =="
+NOCURL="$WORK/nocurl"; mkdir -p "$NOCURL"
+for t in bash sh env cat grep sed awk head tail tr cut sort uniq wc date uname mktemp rm mkdir dirname basename find ls printf readlink pwd chmod touch cp mv tee od id ps sleep kill git timeout stat file; do
+  _p="$(command -v "$t" 2>/dev/null)" && ln -sf "$_p" "$NOCURL/$t"
+done
+. "$TK/bin/lib/portable.sh"; require_py >/dev/null 2>&1 && _p="$(command -v "$PY" 2>/dev/null)" && ln -sf "$_p" "$NOCURL/$(basename "$_p")"
+run v0.28.0 PATH="$NOCURL"
+grep -q "latest mxcli release: not checked (offline, or no curl) — installed v0.28.0" "$WORK/out" && ! grep -q "is behind" "$WORK/out" \
+  && ok "offline: one note, no WARN" || bad "F" "$(out)"
+
+echo "== G: MXTK_NO_LATEST_CHECK=1 skips it [guard] =="
+run v0.28.0 MXTK_MXCLI_LATEST=v0.29.0 MXTK_NO_LATEST_CHECK=1
+grep -qE "latest release|is behind" "$WORK/out" && bad "G: ran anyway" "$(out)" || ok "skipped"
+
+echo "== H: --quick never makes the request [guard] =="
+echo v0.28.0 > "$P/.ver"; ( cd "$WORK" && MXTK_MXCLI_LATEST=v0.29.0 bash "$DOCTOR" --quick "$P" ) > "$WORK/out" 2>&1
+grep -qE "latest release|is behind" "$WORK/out" && bad "H: --quick ran it" "$(out)" || ok "--quick: not run"
+
+echo ""
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-exec-hash-verify.sh b/tests/wave2/test-exec-hash-verify.sh
index d5fec7bd..871a7709 100755
--- a/tests/wave2/test-exec-hash-verify.sh
+++ b/tests/wave2/test-exec-hash-verify.sh
@@ -19,7 +19,9 @@
 # F2), the fresh-hash baseline line (C), the repaired-by-rewrite line (K), the
 # MXPATCH_BACKUP_DIR hand-off (K) and case M fail: 29 pass, 14 fail. Against 4878984 only
 # case M fails (38 pass, 5 fail): a rewritten unit left stale again was "pre-existing".
-# Exit codes alone in A, C, F, G, H, J, K, L are guards.
+# Exit codes alone in A, C, F, G, H, J, K, L are guards. Cases N-P replay v0.29.0 (captured
+# 2026-10-30, fixtures/mxpatch/CAPTURE.txt): against exec.sh before the v0.29 compat fix N's row
+# and O's exit, unit and row fail, 45 pass 4 fail (the v1 baseline read as an error: nothing verified).
 set -uo pipefail
 
 EXEC_SH="${1:?usage: test-exec-hash-verify.sh /path/to/exec.sh}"
@@ -197,6 +199,24 @@ grep -q '1 new issue' "$WORK/out.M" && ok "counted as 1 new issue" || bad "M: no
 lastrow | grep -q 'patch refused.*hashes: baseline 1 mismatch (pre-existing), verify 1 new' && ok "BUILD-LOG row: verify 1 new" || bad "M: row" "$(lastrow)"
 built && bad "M: mxbuild ran on a model the verify had already refused" || ok "gate not spent"
 
+echo "== N: v0.29.0 verifies MPR v1: its clean text is clean, not an error (mxcli v0.29 compat) =="
+# v0.28.0 said "is an MPR v1 project ... no ContentsHash index to verify"; v0.29.0 (ako/mxcli#1159)
+# checks every unit and says "Every unit's ContentsHash matches its stored contents." Read as an
+# error, the baseline went NOT RUN and every --patch on a Mendix < 10.18 project was unverified.
+RC=$(STUB_VER=v0.29.0 HV_SEQ=verify-v1-v0.29.0,verify-v1-v0.29.0 run N)
+[ "$RC" -eq 0 ] && kept && ok "exit 0, kept" || bad "N rc=$RC" "$(tail -12 "$WORK/out.N")"
+lastrow | grep -q 'hashes: baseline clean, verify clean' && ok "BUILD-LOG row: baseline clean, verify clean" || bad "N: row" "$(lastrow)"
+
+echo "== O: v0.29.0, MPR v1: clean -> a v1 MISMATCH ('N mismatch(es).', no file path): restored =="
+RC=$(STUB_VER=v0.29.0 HV_SEQ=verify-v1-v0.29.0,verify-v1-mismatch-v0.29.0 run O)
+[ "$RC" -eq 1 ] && ! kept && ok "exit 1, restored" || bad "O rc=$RC (expected 1: the patch left a stale v1 ContentsHash)" "$(tail -10 "$WORK/out.O")"
+grep -q 'MISMATCH  5e6c513a-a0ee-4102-8da9-e2b4eb894686' "$WORK/out.O" && ok "names the mismatched unit" || bad "O: unit not named"
+lastrow | grep -q 'hashes: baseline clean, verify 1 new' && ok "BUILD-LOG row: verify 1 new" || bad "O: row" "$(lastrow)"
+
+echo "== P: the v0.29.0 MPR v2 contract is unchanged: clean -> stale fails =="
+RC=$(STUB_VER=v0.29.0 HV_SEQ=verify-clean-v0.26.0,verify-stale-v0.29.0 run P)
+[ "$RC" -eq 1 ] && ! kept && ok "exit 1, restored" || bad "P rc=$RC"
+
 echo "== F2: NOT RUN is in the BUILD-LOG row too [guard] =="
 RC=$(STUB_VER=v0.24.0 HV_SEQ= run F2)
 lastrow | grep -q 'hashes: NOT RUN (mxcli has no fix hashes' && ok "row says NOT RUN" || bad "F2: row" "$(lastrow)"
diff --git a/tests/wave2/test-mxpatch.sh b/tests/wave2/test-mxpatch.sh
index 092bc387..c3033fe7 100755
--- a/tests/wave2/test-mxpatch.sh
+++ b/tests/wave2/test-mxpatch.sh
@@ -274,6 +274,14 @@ OUT="$(cd "$M" && "$PY" "$BIN/wf-add-path-terminators.py" TestApp.mpr MyFirstMod
 OUT="$(cd "$M" && "$PY" "$BIN/wf-add-path-terminators.py" TestApp.mpr MyFirstModule.Approval --expect-paths 2 --apply 2>&1)"; RC=$?
 [ "$RC" -eq 0 ] && [ "$(idx "$M")" = "checked 27" ] && ok "terminators: --expect-paths 2: applied, index clean" || bad "expect-paths rc=$RC" "$OUT"
 
+echo "== E: terminators refuse a model below Mendix 10.21 (the type does not exist there; mxcli v0.29 compat) =="
+M="$WORK/e"; model "$M"
+"$PY" -c 'import sqlite3,sys; c=sqlite3.connect(sys.argv[1]); c.execute("update _MetaData set _ProductVersion=?",("10.20.0",)); c.commit()' "$M/TestApp.mpr"
+F0="$(filesum "$M/$(upath $WF)")"
+OUT="$(cd "$M" && "$PY" "$BIN/wf-add-path-terminators.py" TestApp.mpr MyFirstModule.Approval --expect-paths 2 --apply 2>&1)"; RC=$?
+[ "$RC" -eq 3 ] && [ "$(filesum "$M/$(upath $WF)")" = "$F0" ] && printf '%s' "$OUT" | grep -q "Mendix 10.20.0.*arrived in 10.21.0" \
+  && ok "terminators on 10.20.0: refused, exit 3, nothing written" || bad "10.20 guard rc=$RC" "$OUT"
+
 echo ""
 echo "PASS: $PASS  FAIL: $FAIL"
 [ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-page-scope-protected.sh b/tests/wave2/test-page-scope-protected.sh
new file mode 100755
index 00000000..2f304b64
--- /dev/null
+++ b/tests/wave2/test-page-scope-protected.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Fixture for project-bin/page-scope.sh's module derivation on mxcli v0.28+ (mendixlabs/mxcli
+# #1498): SHOW MODULES writes "Protected AddOn|Solution" in the Source column for a module
+# whose export level is Protected. That is not where the module came from, so a first-party
+# Protected module stays in the page denominator; "Marketplace vX, Protected …" stays out.
+#
+# usage: bash tests/wave2/test-page-scope-protected.sh [/path/to/project-bin/page-scope.sh]
+#
+# Golden input is captured (fixtures/show-modules/CAPTURE.txt): the stub mxcli replays real
+# `show modules` / `SHOW PAGES IN` output of v0.28.0 and v0.29.0. No real model or mxcli runs.
+# Positive control: against page-scope.sh before the v0.29 compat fix, A and B FAULT (exit 2,
+# "SHOW MODULES yielded no first-party module") and D's provenance lacks the Protected clause —
+# 3 pass, 3 fail. Field run: the same fix on
+# the "protected" model with the real v0.29.0 binary wrote MyFirstModule.Home_Web; master
+# FAULTed (2026-10-30).
+set -uo pipefail
+TK="$(cd "$(dirname "$0")/../.." && pwd)"
+SUBJECT="${1:-$TK/project-bin/page-scope.sh}"
+case "$SUBJECT" in /*) ;; *) SUBJECT="$PWD/$SUBJECT" ;; esac
+FX="$TK/tests/wave2/fixtures/show-modules"
+. "$TK/bin/lib/portable.sh"; require_py || { echo "SKIP: no Python"; exit 0; }
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/ps-prot.XXXXXX")"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+ok()  { PASS=$((PASS+1)); printf '  ok   %s\n' "$1"; }
+bad() { FAIL=$((FAIL+1)); printf '  FAIL %s\n' "$1"; [ -n "${2:-}" ] && printf '%s\n' "$2" | sed 's/^/       /'; return 0; }
+
+P="$WORK/proj"; mkdir -p "$P/bin"; : > "$P/App.mpr"
+cp "$SUBJECT" "$P/bin/page-scope.sh"; cp "$TK/project-bin/_common.sh" "$P/bin/_common.sh"
+cat > "$P/mxcli" <<STUB
+#!/usr/bin/env bash
+case "\$*" in
+  *"SHOW MODULES"*)   cat "$FX/\$(cat "$P/.cap").out"; exit "\$(cat "$FX/\$(cat "$P/.cap").exit")" ;;
+  *"SHOW PAGES IN MyFirstModule"*) cat "$FX/show-pages-in-myfirstmodule-v0.29.0.out"; exit 0 ;;
+esac
+exit 0
+STUB
+chmod +x "$P/mxcli"
+run() { echo "$1" > "$P/.cap"; rm -f "$P/.claude/loop/page-scope.json"
+  ( cd "$P" && PROJECT_ROOT="$P" MPR_FILE=App.mpr MXCLI_BIN="$P/mxcli" bash bin/page-scope.sh --no-roles ) > "$WORK/out" 2>&1; }
+scope() { "$PY" -c 'import json,sys; print(" ".join(json.load(open(sys.argv[1]))["inScope"]))' "$P/.claude/loop/page-scope.json" 2>/dev/null; }
+
+echo "== A: v0.29.0, first-party module set to Protected: still in scope =="
+run show-modules-protected-v0.29.0; RC=$?
+[ "$RC" -eq 0 ] && [ "$(scope)" = "MyFirstModule.Home_Web" ] && ok "exit 0, MyFirstModule.Home_Web in scope" || bad "A rc=$RC scope='$(scope)'" "$(cat "$WORK/out")"
+echo "== B: the same on v0.28.0 =="
+run show-modules-protected-v0.28.0; RC=$?
+[ "$RC" -eq 0 ] && [ "$(scope)" = "MyFirstModule.Home_Web" ] && ok "exit 0, in scope" || bad "B rc=$RC" "$(cat "$WORK/out")"
+echo "== C: Marketplace v2.1.0, Protected AddOn: out of scope (still a marketplace module) [guard] =="
+run show-modules-marketplace-protected-v0.29.0; RC=$?
+[ "$RC" -eq 2 ] && grep -q "yielded no first-party module" "$WORK/out" && ok "FAULT: no first-party module (the marketplace one is excluded)" || bad "C rc=$RC" "$(cat "$WORK/out")"
+[ ! -e "$P/.claude/loop/page-scope.json" ] && ok "nothing written" || bad "C wrote a scope"
+echo "== D: Source empty (as committed): in scope [guard] =="
+run show-modules-source-v0.29.0; RC=$?
+[ "$RC" -eq 0 ] && [ "$(scope)" = "MyFirstModule.Home_Web" ] && ok "exit 0, in scope" || bad "D rc=$RC" "$(cat "$WORK/out")"
+grep -q 'empty Source column (or only' "$P/.claude/loop/page-scope.json" 2>/dev/null && ok "provenance names the rule, Protected included" || bad "D provenance" "$(cat "$P/.claude/loop/page-scope.json" 2>/dev/null | head -30)"
+
+echo ""
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]
diff --git a/tests/wave2/test-property-sets.sh b/tests/wave2/test-property-sets.sh
index b81035c0..be5b5b81 100755
--- a/tests/wave2/test-property-sets.sh
+++ b/tests/wave2/test-property-sets.sh
@@ -17,7 +17,10 @@
 #                                          reads `fix --help` instead
 #   dry-run-not-found-v0.26.0.{txt,exit}   `fix property-sets -p <missing> --dry-run`: exit 1
 #                                          with no unit rows — why exit 1 alone is not "needs"
-# NOT captured: the clean / NEEDS / FAILED reports, which need a real model. The stub below
+#   ps-{dryrun-mixed,dryrun-both,apply-both,after-apply-both}-v0.29.0.{out,err,exit}
+#                                          REAL v0.29.0 runs on a real model with MIXED rows —
+#                                          provenance in CAPTURE.txt beside them (case P11)
+# NOT captured: the v0.26.0 clean / NEEDS / FAILED reports, which need a real model. The stub below
 # prints them from the format strings in mxcli v0.26.0 cmd/mxcli/cmd_fix_property_sets.go
 # (fixPropertySets: "Checked %d unit(s) in %s against the Mendix %d.%d.%d property sets.",
 # "  %-9s %s%s: +%d key(s), -%d key(s)", "  FAILED    %s%s: %v"). A field run owes the real ones.
@@ -61,6 +64,11 @@ case "${1:-}" in
         for a in "$@"; do [ "$a" = --dry-run ] && dry=1; [ "$prev" = -p ] && mpr="$a"; prev="$a"; done
         b="$(basename "$mpr")"
         echo "WARNING: This is a vibe-coded PoC, alpha quality, use with caution." >&2
+        # v0.29.0 states replay real captures (CAPTURE.txt); "both" -> its write leaves "mixed".
+        rp() { cat "$F/$1-v0.29.0.out"; return "$(cat "$F/$1-v0.29.0.exit")"; }
+        if [ "$dry" = 0 ] && [ "$(cat "$D/.stub-state")" = both ]; then
+          echo mixed > "$D/.stub-state"; rp ps-apply-both; exit $?
+        fi
         if [ "$dry" = 0 ]; then
           echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."
           echo "  FIXED     0d6c3a3e-0000-4000-8000-000000000001 [Microflows\$Microflow Orders.ACT_Save]: +4 key(s), -0 key(s)"
@@ -78,6 +86,8 @@ case "${1:-}" in
                   echo "  FAILED    0d6c3a3e-0000-4000-8000-000000000002 [Pages\$Page Orders.Order_Edit]: key Foo holds a value"
                   echo "1 unit(s) could not be normalized and were left as they are."; exit 1 ;;
           notfound) cat "$F/dry-run-not-found-v0.26.0.txt"; exit 1 ;;
+          mixed) rp ps-dryrun-mixed; exit $? ;;
+          both)  rp ps-dryrun-both; exit $? ;;
           noversion) echo "$b has no readable Mendix version; nothing is normalized without one."; exit 0 ;;
           slow) exec sleep 6; echo "Checked 3 unit(s) in $b against the Mendix 11.12.1 property sets."; exit 0 ;;
         esac ;;
@@ -299,6 +309,31 @@ psl="$(printf '%s\n' "$OUT" | grep -i 'property')"
 printf '%s' "$psl" | grep -q "could not check property sets: could not classify" && ! printf '%s' "$psl" | grep -q "fix-property-sets\|⚠️\|WARN  " \
   && ok "sync, check errored (exit 4): neutral line, no repair advice, no warning" || bad "sync error case" "$psl"
 
+echo "== P11 mxcli v0.29.0 MIXED rows (real captures): a merge hazard, not 'could not classify' =="
+# Against doctor.sh before the v0.29 compat fix: the MIXED-only dry-run is rc 4 "could not
+# classify", and the repair's exit 1 (for MIXED alone) rolls the completed NEEDS repair back.
+# Measured 2026-10-30: master 74 passed, 7 failed; this fix 81 passed, 0 failed.
+P="$(mkproj mixed)"; echo v0.29.0 > "$P/.stub-ver"; echo mixed > "$P/.stub-state"
+OUT="$("$DOCTOR" --property-sets "$P" 2>&1)"; RC=$?
+[ "$RC" -eq 1 ] && printf '%s' "$OUT" | grep -q "WARN  property sets: 1 property name(s) differ between elements of one type (MIXED)" \
+  && ok "MIXED only: exit 1, WARN names it" || bad "MIXED only: rc=$RC" "$OUT"
+printf '%s' "$OUT" | grep -q 'MIXED     Texts\$Translation.LanguageCode: on 260 of 261' && ok "the MIXED row is shown" || bad "MIXED row not shown" "$OUT"
+printf '%s' "$OUT" | grep -q "fix-property-sets cannot clear them" && ! printf '%s' "$OUT" | grep -q "repair (snapshot" \
+  && ok "says the repair cannot clear it, offers no repair" || bad "MIXED remedy" "$OUT"
+sed -n 1p "$P/.claude/.property-sets-receipt" 2>/dev/null | grep -q " mixed " && ok "receipt records mixed" || bad "receipt" "$(cat "$P/.claude/.property-sets-receipt" 2>&1)"
+P="$(mkproj both)"; echo v0.29.0 > "$P/.stub-ver"; echo both > "$P/.stub-state"; mkdir -p "$P/bin"; cp "$WORK/fix-noexec/bin/exec.sh" "$P/bin/"
+OUT="$("$DOCTOR" --fix-property-sets "$P" 2>&1)"; RC=$?
+printf '%s' "$OUT" | grep -q "the repair was not kept" && bad "NEEDS + MIXED: the completed repair was rolled back" "$OUT" \
+  || ok "NEEDS + MIXED: the repair step's exit 1 for MIXED alone does not fail the patch"
+printf '%s' "$OUT" | grep -q "FIXED     84776610" && printf '%s' "$OUT" | grep -q "re-checking" && ok "repair ran and was re-checked" || bad "repair/re-check" "$OUT"
+[ "$RC" -eq 1 ] && sed -n 1p "$P/.claude/.property-sets-receipt" | grep -q " mixed " && ok "after the repair: mixed left, exit 1" || bad "post-repair rc=$RC" "$(cat "$P/.claude/.property-sets-receipt" 2>&1)"
+S5="$WORK/syncmixed"; mkdir -p "$S5"; : > "$S5/App.mpr"
+MXTK_NO_GUIDE=1 "$TK/bin/init-project.sh" "$S5" >/dev/null 2>&1
+mkstub "$S5"; echo v0.29.0 > "$S5/.stub-ver"; echo mixed > "$S5/.stub-state"
+psl="$("$SYNC" "$S5" 2>&1 | grep -i 'property')"
+printf '%s' "$psl" | grep -q "⚠️  property sets: Studio Pro's merge/diff can throw" && ! printf '%s' "$psl" | grep -q "Repair, gated" \
+  && ok "sync, MIXED only: a sync warning, no repair command it cannot honour" || bad "sync MIXED" "$psl"
+
 echo "== P10 (#236) sync names a pre-fix bin/model-stamp.sh =="
 grep -v 'GIT_WORK_TREE' "$TK/project-bin/model-stamp.sh" > "$S/bin/model-stamp.sh"; chmod +x "$S/bin/model-stamp.sh"
 OUT="$("$SYNC" "$S" --dry-run --no-refresh 2>&1)"
diff --git a/tests/wave2/test-rehost-list-modules.sh b/tests/wave2/test-rehost-list-modules.sh
index 23875d57..459b855d 100755
--- a/tests/wave2/test-rehost-list-modules.sh
+++ b/tests/wave2/test-rehost-list-modules.sh
@@ -5,6 +5,9 @@
 #
 #   T1  mxcli v0.26.0 capture (WARNING + "Connected to:" lead lines): own = Billing, Orders
 #   T2  mxcli v0.25.0 capture: same result
+#   T2b/T2c mxcli v0.29.0 captures (2026-10-30): an own module whose export level is Protected
+#       ("Protected AddOn" in Source, mendixlabs/mxcli#1498) is still own; "Marketplace v2.1.0,
+#       Protected AddOn" is not. Against own-modules.awk before the v0.29 compat fix T2b fails.
 #   T3  field-service template capture (table starts on line 1, 59 modules): 42 own, none of
 #       them System or a Marketplace module. The table starts on line 1 here, so a parse that
 #       skips a fixed number of lines would drop a data row (the old `NR>3` did).
@@ -33,6 +36,8 @@ own()  { awk -F'|' -f "$LIB" "$1" | tr '\n' ' ' | sed 's/ $//'; }
 
 r=$(own "$FX/list-modules-v0.26.0.txt"); [ "$r" = "Billing Orders" ] && ok "T1 v0.26.0: $r" || bad "T1 v0.26.0: got '$r'"
 r=$(own "$FX/list-modules-v0.25.0.txt"); [ "$r" = "Billing Orders" ] && ok "T2 v0.25.0: $r" || bad "T2 v0.25.0: got '$r'"
+r=$(own "$FX/list-modules-protected-v0.29.0.txt"); [ "$r" = "MyFirstModule" ] && ok "T2b v0.29.0, own module set to Protected: still own" || bad "T2b v0.29.0 Protected: got '$r'"
+r=$(own "$FX/list-modules-marketplace-protected-v0.29.0.txt"); [ -z "$r" ] && ok "T2c v0.29.0, 'Marketplace v2.1.0, Protected AddOn': not own" || bad "T2c: got '$r'"
 
 n=$(awk -F'|' -f "$LIB" "$FX/field-service-template-9.24.2.txt" | wc -l | tr -d ' ')
 leak=$(awk -F'|' -f "$LIB" "$FX/field-service-template-9.24.2.txt" | while read -r m; do

From 9df586a691f9d71b4ffbe6d61fb0744bdf4607da Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 00:04:46 +0000
Subject: [PATCH 2/3] Use a here-string for the MIXED-only check in
 sync-project

`printf | grep -q` under pipefail can SIGPIPE printf and flip the
result; test-pipefail-grep-q.sh flagged sync-project.sh:1702. Same
pattern as the rest of the file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018LeNWZV2sVH62vkgfYh5u5
---
 bin/sync-project.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index 1063e2fa..3b6b8c41 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -1699,7 +1699,7 @@ if [ "$WIRED" -eq 1 ] && [ -x "$SCRIPT_DIR/doctor.sh" ] \
       3) echo "   (the project's mxcli predates 'fix property-sets', v0.26.0 — upgrade it before a Team Server merge)" ;;
       4) _ps_why="$(printf '%s\n' "$_ps_out" | sed -n 's/^  WARN  property sets: //p' | head -1)"
          echo "   could not check property sets: ${_ps_why:-see above} — not recorded; the next sync re-checks" ;;
-      1) if printf '%s\n' "$_ps_out" | grep -q '  NEEDS '; then
+      1) if grep -q -- '  NEEDS ' <<<"$_ps_out"; then
            warn "property sets: Studio Pro's merge/diff can throw on this model (see above). Repair, gated:" \
                 "bin/doctor.sh --fix-property-sets '$PROJECT_DIR'"
          else  # only FAILED / MIXED rows (mxcli v0.29+): nothing the guarded repair can clear

From 9bb03e4c678230d22a1f5fe29f0d8834c4b4cf4f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 07:44:04 +0000
Subject: [PATCH 3/3] Address #603 review: the latest-version check ignores
 ~/.curlrc

A ~/.curlrc with `location` made curl follow the asset redirect and
download the whole binary: 106,696,864 bytes measured, then "not
checked". `curl -q` as the first argument skips .curlrc. Measured with
HOME pointing at a .curlrc that sets `location`: without -q, 106696864
bytes downloaded and no redirect_url; with -q, 0 bytes and the
redirect names v0.29.0.

test-doctor-mxcli-latest 12/0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018LeNWZV2sVH62vkgfYh5u5
---
 bin/doctor.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/bin/doctor.sh b/bin/doctor.sh
index 1c3e0ae5..562dc366 100755
--- a/bin/doctor.sh
+++ b/bin/doctor.sh
@@ -466,10 +466,11 @@ mxcli_latest_advice() {
   [ -n "$_ml_have" ] || return 0
   _ml_new="${MXTK_MXCLI_LATEST:-}"
   if [ -z "$_ml_new" ] && command -v curl >/dev/null 2>&1; then
-    # The redirect of the asset URL --install itself uses (not followed: nothing is downloaded).
+    # The redirect of the asset URL --install itself uses (not followed: nothing is downloaded;
+    # -q first, so a ~/.curlrc with `location` cannot make curl follow it and fetch ~100 MB).
     # Not releases/latest: a proxy that allows release downloads can refuse that page (403,
     # measured in a cloud sandbox 2026-10-30, where this redirect answered v0.29.0).
-    _ml_new="$(curl -sS --max-time 5 -o /dev/null -w '%{redirect_url}' \
+    _ml_new="$(curl -q -sS --max-time 5 -o /dev/null -w '%{redirect_url}' \
       https://github.com/mendixlabs/mxcli/releases/latest/download/mxcli-linux-amd64 2>/dev/null \
       | sed -n 's|.*/releases/download/\(v[0-9][0-9.]*\)/.*|\1|p')"
   fi