MendixMau · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/README.md b/README.md
@@ -523,6 +523,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` |
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` |
+| Splitting an existing Mendix monolith into several apps — strangler, "move module X into its own app", carving out a slice, microservices from one .mpr: cut choice on business fit AND coupling (bin/cut-score.sh), cut order by dependency direction, MPK move, every crossing edge on bin/cut-ledger.sh, OData/REST seam, and the build-green / seam-live / strangled level each slice reached | `skills/decompose-app.md` |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` |
@@ -537,6 +538,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Reviewing what the extraction actually produced — the Stage 1 surface, and the file the Stage 1 gate looks for. Renders a code-extracted and a document knowledge base alike, so a requirements-driven project gets the surface too; prints no zero that a second record does not agree with | `bin/extraction-report.sh` |
 | Assessing or planning a migration up front, before any pipeline is chosen | `skills/assess-migration.md` |
 | Running the extraction pipeline | `skills/migration-pipeline.md` |
+| Rehosting or regenerating an existing Mendix .mpr as MDL into a fresh app — "port this app to a clean Mendix 11 project", re-platform a whole app, rebuild it from its own model: Rehost vs MPK move, pipelines/mendix-mpr/rehost-extract.sh and its check/quarantine/exec/resume loop, reading the fidelity ledger, done = build-green with named hand-offs | `skills/rehost-app.md` |
 | Migrating from a stack that has no dedicated pipeline | `skills/migrate-general.md` |
 | Migrating an OutSystems app | `skills/migrate-outsystems.md` |
 | Understanding OutSystems 11 source | `skills/source-os11.md` |
@@ -635,6 +637,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 
 | Task | Skill to load |
 |---|---|
+| Mendix-to-Mendix service seam — one Mendix app's OData/REST service consumed by another Mendix app: consuming its OData as external entities, replacing a stub by an external entity, joining data that lives in the other Mendix app (mirror keyed by the consumer's key), or wiring the seam between two apps after a split; keys (PublicID AutoNumber), machine-role-only access (200/401/404), REST actions with error handlers, external-entity limits | `skills/mendix-service-seam.md` |
 | Building a REST integration (consumed or published) for the first time on a project — the checks that avoid a rebuild after the first live call | `skills/rest-integration-first-time-right.md` |
 | Adding a constant, installing a marketplace module, deploying to a new environment, or needing a Mendix PAT — where an encryption key, API credential, endpoint or access token gets its value, why a free node has only one channel, and why a token missing from the files you grepped is not missing | `skills/learned-constants-and-secrets.md` |
 

diff --git a/ROUTING.md b/ROUTING.md
@@ -53,6 +53,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` | ba | P | ondemand |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` | all | P | ondemand |
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` | ba,architect | P,0 | ondemand |
+| Splitting an existing Mendix monolith into several apps — strangler, "move module X into its own app", carving out a slice, microservices from one .mpr: cut choice on business fit AND coupling (bin/cut-score.sh), cut order by dependency direction, MPK move, every crossing edge on bin/cut-ledger.sh, OData/REST seam, and the build-green / seam-live / strangled level each slice reached | `skills/decompose-app.md` | lead,architect,mdl | 0,3,5,6 | ondemand |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` | all | - | ondemand |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` | all | 7 | ondemand |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence — a claim not in the register may not be cited | `skills/measured-claims.md` | all | - | ondemand |
@@ -74,6 +75,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Reviewing what the extraction actually produced — the Stage 1 surface, and the file the Stage 1 gate looks for. Renders a code-extracted and a document knowledge base alike, so a requirements-driven project gets the surface too; prints no zero that a second record does not agree with | `bin/extraction-report.sh` | ba | 1 | ondemand |
 | Assessing or planning a migration up front, before any pipeline is chosen | `skills/assess-migration.md` | ba | 0 | ondemand |
 | Running the extraction pipeline | `skills/migration-pipeline.md` | ba | 0,1 | ondemand |
+| Rehosting or regenerating an existing Mendix .mpr as MDL into a fresh app — "port this app to a clean Mendix 11 project", re-platform a whole app, rebuild it from its own model: Rehost vs MPK move, pipelines/mendix-mpr/rehost-extract.sh and its check/quarantine/exec/resume loop, reading the fidelity ledger, done = build-green with named hand-offs | `skills/rehost-app.md` | lead,ba,mdl | 0,1,5,6 | ondemand |
 | Migrating from a stack that has no dedicated pipeline | `skills/migrate-general.md` | ba | 0 | ondemand |
 | Migrating an OutSystems app | `skills/migrate-outsystems.md` | ba | 0 | ondemand |
 | Understanding OutSystems 11 source | `skills/source-os11.md` | ba | 0,1 | ondemand |
@@ -189,6 +191,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 
 | Always relevant for | Load this | Agent(s) | Stage(s) | Tier |
 |---|---|---|---|---|
+| Mendix-to-Mendix service seam — one Mendix app's OData/REST service consumed by another Mendix app: consuming its OData as external entities, replacing a stub by an external entity, joining data that lives in the other Mendix app (mirror keyed by the consumer's key), or wiring the seam between two apps after a split; keys (PublicID AutoNumber), machine-role-only access (200/401/404), REST actions with error handlers, external-entity limits | `skills/mendix-service-seam.md` | lead,architect,mdl | 3,5 | ondemand |
 | Building a REST integration (consumed or published) for the first time on a project — the checks that avoid a rebuild after the first live call | `skills/rest-integration-first-time-right.md` | mdl | 4,5 | ondemand |
 | Adding a constant, installing a marketplace module, deploying to a new environment, or needing a Mendix PAT — where an encryption key, API credential, endpoint or access token gets its value, why a free node has only one channel, and why a token missing from the files you grepped is not missing | `skills/learned-constants-and-secrets.md` | mdl,architect,gate | 4,5,6 | ondemand |
 

diff --git a/agents/architect-agent.md b/agents/architect-agent.md
@@ -57,6 +57,8 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `project-bin/check-prototype-links.js` | Before wireframes pass to the build loop, and with --brd before a BRD is signed off: dead #/route links, orphan screens, controls with no data-bind and no data-cut, BRD routes no screen has, screens no use case walks (design-artifacts.md Step 3c, brd-validation.md check 8) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/existing-app-change.md` | Changing an EXISTING Mendix app |
+| `skills/decompose-app.md` | Splitting an existing Mendix monolith into several apps |
+| `skills/mendix-service-seam.md` | Mendix-to-Mendix service seam |
 | `project-bin/app-facts.sh` | Collecting the facts an app dossier is written from: forces a full catalog build, module edges through the real module column, strongly connected components, describes every loop-containing microflow and parses the loop bodies; exit 2 on a stale, fast-mode or schema-incomplete catalog, never a verdict |
 | `skills/app-analysis.md` | Building or refreshing the standing dossier of an EXISTING app before changing it: inventory, module dependency shape, loop risk patterns, each section with a verdict and a fault where nothing was measured (a standing document; nothing else in the toolkit reads it yet) |
 | `skills/layering-review.md` | Checking whether an EXISTING app's module boundaries still hold: the layer map (bin/app-layer-map.sh) computes the order the modules would stack in and draws only the edges that point back up, so one tangle of N mutually reachable modules becomes a named list of edges with a weight and a ref kind; Stage 3 in existing-app-change mode, and the honest blast radius for a slice |

diff --git a/agents/ba-agent.md b/agents/ba-agent.md
@@ -74,6 +74,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/layering-review.md` | Checking whether an EXISTING app's module boundaries still hold: the layer map (bin/app-layer-map.sh) computes the order the modules would stack in and draws only the edges that point back up, so one tangle of N mutually reachable modules becomes a named list of edges with a weight and a ref kind; Stage 3 in existing-app-change mode, and the honest blast radius for a slice |
 | `skills/assess-migration.md` | Assessing or planning a migration up front, before any pipeline is chosen |
 | `skills/migration-pipeline.md` | Running the extraction pipeline |
+| `skills/rehost-app.md` | Rehosting or regenerating an existing Mendix .mpr as MDL into a fresh app |
 | `skills/migrate-general.md` | Migrating from a stack that has no dedicated pipeline |
 | `skills/migrate-outsystems.md` | Migrating an OutSystems app |
 | `skills/source-os11.md` | Understanding OutSystems 11 source |

diff --git a/agents/mdl-agent.md b/agents/mdl-agent.md
@@ -70,7 +70,10 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `project-bin/context-pack.sh` | Dispatching a build step to a helper |
 | `bug-logs/mxcli-bugs.md` | Reading a whole class of tool defects (a retest, a new mxcli release, an audit) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
+| `skills/decompose-app.md` | Splitting an existing Mendix monolith into several apps |
+| `skills/mendix-service-seam.md` | Mendix-to-Mendix service seam |
 | `skills/microflow-loop-antipatterns.md` | Reading what loop bodies do (LOOP_TQ, deferred commit, nested loop, REST in loop, transaction control per item, scheduled-event reachability) from described MDL; the catalog holds top-level activities only and cannot see inside a loop |
+| `skills/rehost-app.md` | Rehosting or regenerating an existing Mendix .mpr as MDL into a fresh app |
 | `skills/iterative-build-loop.md` | Building a module with mxcli |
 | `skills/mdl-cookbook-microflows.md` | Writing MDL microflow scripts |
 | `skills/build/mdl/oneshot-mdl-method.md` | Writing a single MDL script that takes a project from nothing to a working vertical slice |

diff --git a/bin/cut-ledger.sh b/bin/cut-ledger.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+# cut-ledger.sh: the cut ledger of one Decompose slice — one row per crossing edge, each with a
+#                resolution and its evidence, or the run fails.
+#
+# usage: bin/cut-ledger.sh (--catalog <catalog.db> | --refs <refs.tsv>) --slice <slice.txt>
+#                          --rules <rules.tsv> [--check-log <mx-check.txt>]...
+#                          [--exporter-json <export.json>]... [--extra <rows.tsv>]...
+#                          [--dump-refs <refs.tsv>] -o <ledger.tsv>
+#
+# WHAT THIS IS. The Stage 5 slice-loop instrument of process/decompose-and-rehost-plan-2026-10-12.md
+# (§3, step 2: "replace each crossing edge"). bin/cut-score.sh scores a proposed cut at module level;
+# this lists the edges of the cut you are actually executing, at document level, and refuses to
+# finish while any of them has no decision. "Done" for a slice is not "mx check is green" — a stub
+# turns an edge green and carries none of its behaviour — it is "every edge has a row that says
+# resolved, stub, handoff or retire, with the evidence".
+#
+# WHAT IT READS.
+#   --catalog   the mxcli catalog of the SOURCE app (.mxcli/catalog.db beside the .mpr, written by
+#               `mxcli -p <app>.mpr graph-report`, which project-bin/app-facts.sh runs as the
+#               mandatory Stage 0 facts step), refs table only. Or --refs: a TSV with the header
+#               SourceType SourceName TargetType TargetName RefKind (what --dump-refs writes; the
+#               committed fixture form, since a catalog is tens of MB).
+#   --slice     one name per line: a module (moves whole) or Module.Doc (a document that moves with
+#               the slice although its module stays, e.g. the Synchronization flows of one entity).
+#   --rules     tab-separated: direction (out|in|check|*), pattern (fnmatch on the far-side
+#               document, or 'OwnSide -> FarSide'), resolution, evidence. First match wins.
+#               Resolutions: resolved[:how] · stub · handoff · retire · platform. A row with no
+#               matching rule is UNRESOLVED and the run exits 1. A rule with no evidence is refused.
+#   --check-log mx check output on the slice package (the exporter's self-check, Mendix 9.24 `mx check`
+#               on the package's project.mpr). Every CE1613 name it reports that the catalog did not
+#               record becomes a `check-only` row — the catalog does not see widget actions (App
+#               events), layout placeholders, or images.
+#   --exporter-json  pipelines/mendix-mpr/export-module-mpk.py --json output: each module it counts
+#               that has no out-edge row is printed as `exporter-only` (a false positive or a
+#               catalog blind spot — read which).
+#   --extra     rows no catalog holds, verbatim (direction, kind, source_doc, target_doc, refs,
+#               resolution, evidence): second-order edges of a module brought along to satisfy an
+#               edge, app-level settings the package scrubs, Java hand-off edits.
+#
+# WHAT IT WRITES. <ledger.tsv>: edge, direction, kind, source_doc, target_doc, refs, resolution,
+# evidence. Out = the slice uses something that stays behind; in = something that stays behind uses
+# the slice (the monolith-side work of the strangler). System is auto-resolved as platform.
+#
+# WHAT IT CANNOT SEE. Whether the resolution works: that is the target's mx check and mxbuild, and
+# for a stub it never is — the evidence column says what the stub does not carry. Java and
+# JavaScript bodies naming another module, and references by string (deep links, REST paths).
+#
+# Exit: 0 every row has a resolution · 1 at least one UNRESOLVED row · 2 bad arguments
+#
+# Field run: FSM template 9.24.2 -> NativeNote slice into Mendix 11.13.0 (increment 3, 2026-10-12):
+# 199 crossing refs -> ledger in pipelines/mendix-mpr/samples/fsm-template-9.24.2/slice-nativenote/.
+#
+# portability-ok: bash 3.2, Python 3 resolved through portable.sh
+
+set -u
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+. "$HERE/lib/portable.sh"
+require_py
+
+case "${1:-}" in
+  -h|--help|"") sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//'; [ -z "${1:-}" ] && exit 2; exit 0 ;;
+esac
+
+"$PY" -I "$HERE/lib/cut-ledger.py" "$@"
+rc=$?
+[ "$rc" -gt 1 ] && exit 2
+exit "$rc"