Guard against a leftover mxcli test injection (#244), app-restart pid check and test-scratch takeover (#304 review), lint-a-copy recipe (#240)

[MendixMau]

#244: AfterStartupMicroflow left on MxTest.RegisterEndpoint (BUG-157)

Problem. mxcli test and run --test-endpoint point after-startup at a generated MxTest.RegisterEndpoint (plain mxcli test: MxTest.TestRunner), which chains to the original. Only a clean exit restores the original. A run stopped by a signal leaves the setting on disk. The next injection then chains RegisterEndpoint to itself: StackOverflowError, and the runtime never starts. If the MxTest module was removed in the meantime, the build fails with CE1613 instead. This happened twice in one day on one machine, one app went down, and it happened again on a second project (AlvinnYeo, inbox note in #309, used as evidence only; #309 is not modified). Reading mxcli's v0.26.0 source (cmd/mxcli/testrunner) shows no self-wrap guard and no signal restore.

Fix.

• project-bin/test-scratch.sh and project-bin/app-restart.sh read the setting before starting.
  • The toolkit had no existing way to read settings. This reads the BSON string element AfterStartupMicroflow straight from the settings unit's bytes with od + awk. It needs no mxcli and no running app, and it works on both mprcontents and v1 .mpr.
  • When the value is MxTest.RegisterEndpoint or MxTest.TestRunner, both scripts refuse. The message prints the value HEAD has, plus three repairs: git checkout -- <unit>, alter settings runtime (AfterStartupMicroflow: '<HEAD value>') through exec.sh (the statement mxcli's own cleanup runs, field-proven on v0.25.0), or Studio Pro.
• test-scratch.sh: exit 3 before copying anything.
• app-restart.sh:
  • Exit 3 before stopping anything, except when the recorded app is a live --test-endpoint run. That app holds the injection legitimately.
  • After the stop it checks again. If the stop left the injection behind, it exits 5 (new: stopped, not started).
• Bug-log entry BUG-157. The upstream issue is drafted, not posted.

Evidence / golden input. A real settings unit (4e70063d-….mxunit, the same unit id as in the issue), captured from mxcli's own test model (mendixlabs/mxcli testdata pedapp, Apache-2.0, 12ce281). It is committed as tests/wave2/fixtures/mxtest-guard/settings-unit.mxunit.

• Each case re-encodes it with a small BSON re-encoder (set-after-startup.js), rewriting every enclosing length. The fixture checks that re-encoding with the original value reproduces the capture byte for byte.
• The reader returns '' on all three real mprcontents captures and on a real v1 App.mpr.
• A capture of a real model with the injection was not possible: there is no mxcli binary or Mendix runtime in this environment.

Risks.

• A clean model sees no change.
• Exit 5 is new. No script consumes app-restart's exit codes; ui-loop.md and agent-roles.md (prose) do not mention codes.
• On a v1 .mpr, the scan reads the file until the first match. That costs seconds on a large model, and a settings blob split across SQLite overflow pages would be missed (no false refusal, just no guard).
• The helper is duplicated in both scripts to stay inside this PR's files. Moving it into _common.sh would be a later cleanup.

#304 review follow-ups

1. app-restart killed an unrelated process via a reused pid. With --cmd or MXTK_APP_START_CMD, the run --local identity check read the override string, not the process. A record left behind by a SIGKILL, plus a reused pid, meant TERM/KILL went to that process and its children. Now the pid itself must be an mxcli run: its /proc/<pid>/cmdline (else ps -o args=) must name mxcli and run, or on Windows its image name must be mxcli.exe. Otherwise it is treated as not running and never stopped.
2. test-scratch take_lock takeover race. test-scratch shares .mpr-snapshots/.exec.lock with exec.sh, so its takeover now uses exactly exec.sh's protocol from fix(exec): follow-ups from independent review of #304/#306/#290 #324 (fix/exec-followups @ 79de404, exec_lock_takeover; the bodies differ only in signature and parameter names). That means the same O_EXCL <lock>.takeover file, which counts as stale when its pid is dead or it is older than 10 s (an empty one after a minute). Under it the lock is re-read, and only the exact stale line is removed; a fresh lock is never moved aside. A wrongly moved takeover file is put back with ln. The machine-wide port lock uses the same protocol.
   • New cross-script fixture, tests/wave2/test-shared-lock-takeover.sh: 4 rounds of 5 exec.sh + 5 test-scratch contenders on one dead-holder lock. It takes exec.sh's lock block from the real exec.sh once that file carries exec_lock_takeover; until fix(exec): follow-ups from independent review of #304/#306/#290 #324 merges it uses a verbatim copy (fixtures/mxtest-guard/exec-lock-block.sh, diffed identical to 79de404, which carries the aligned -mmin +1 and own-file-only removal).

#240: lint on a copy silently drops the project rules (BUG-158)

• skills/lint-that-actually-runs.md (on demand) gets a new section, "Linting a copy of the model: copy the rules in first". It includes:
  • the field numbers (51/8 against 721/29);
  • the recipe: copy .claude/lint-rules and lint-config.yaml beside the copy;
  • a completion check: compare distinct ruleId counts before any diff.
• From reading the v0.26.0 source:
  • lint-config.yaml is read only from beside the .mpr, so even an in-repo snapshot loses it.
  • With no .git above, the rules walk continues to /.
• Bug-log entry BUG-158. The upstream issue is drafted, not posted.
• lint-gate.sh is not touched; it is owned by another PR.

Checks run

• tests/wave2/test-shared-lock-takeover.sh: PASS=6 FAIL=0, 3 of 3 runs. With master's test-scratch: two holders at once in 3 of 3 runs.
• tests/wave2/test-test-scratch.sh: PASS=38 FAIL=0. Against master's script: 10 FAIL (the takeover race replay and every mxcli v0.25.0: after-startup left as MxTest.RegisterEndpoint, which then calls itself (StackOverflowError, app won't start) #244 case).
• tests/wave2/test-app-restart.sh: PASS=59 FAIL=0. Against master's script: 10 FAIL (reused pid killed, mxcli v0.25.0: after-startup left as MxTest.RegisterEndpoint, which then calls itself (StackOverflowError, app won't start) #244 exit 3 and exit 5 cases).
• bin/check-scripts.sh: clean. bin/check-portability.sh: clean. bin/check-no-private-citations.sh: clean. LEAKGUARD_ALLOW_NO_DENYLIST=1 bin/check-no-client-data.sh: clean. bin/check-pr-discipline.sh origin/master: clean.
• bin/render-routing.sh --check reports an UNROUTED skill on both this branch and a clean origin/master worktree, naming a different file on each run. That looks environmental or pre-existing and unrelated (this PR touches no routing). No baseline words added.
• Forbidden-term grep over the added lines: zero hits.

Field-run status

Still owed. Both guards and the lint recipe are proven against captured settings units and fixtures, not on a live project with a real interrupted --test-endpoint run. The probe to run is in BUG-157: kill -TERM a run --test-endpoint, then ./bin/app-restart.sh must exit 3 or 5 with the repair. Two-tree (app/) layout: the code resolves the model dir through the existing MODEL_DIR logic, but the fixtures cover the single-tree layout only.

Refs #244 #240

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code

---

Generated by Claude Code

[MendixMau]

Landed on master as part of the integration squash #329 (commit 31e90ae), after independent review — its Review: line is in that commit message. Closing as superseded.

---

Generated by Claude Code