diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff60ea83..a2191ebf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(sync-project, review-module, conformance-check): **the last eight `producer | grep -q` pipelines in these three scripts are here-strings, so pipefail cannot turn a match into a miss.** `grep -q` exits on its first match; a producer still writing then dies of SIGPIPE and, under `set -o pipefail`, the pipeline reports failure. `review-module.sh` read `SHOW MODULES` this way, and on a large app that output is over one pipe buffer, so a real module could be reported unknown. Five sites in `sync-project.sh` (one a `| head -1 | grep -q` chain), one in `review-module.sh`, two in `conformance-check.sh` (one short line each, cannot race; changed so the static check stays absolute). Same 1:1 rewrite as #328/#329. `test-pipefail-grep-q.sh` T3 now covers the three files (15 scripts); against master it lists all eight sites. Field evidence: none yet. — r-eng-backlog item 2, MendixMau
 - process(build): **Stage 5 drafts the ready set in parallel and applies serially.** The runbook dispatch row said "sequential within a module", which serialised drafting even for independent scripts; it now points to `iterative-build-loop.md` → Gate cost, the single statement of the rule. The unit is the build-plan row: every `BUILD` row whose "Depends on" rows are all applied, minus overlapping writers (two rows that replace, alter or drop+create the same document never share a ready set, and no row is drafted while it overlaps a queued unapplied one; `brd-to-build-plan.md` has Produces name every document a row writes), runs at once, its scripts in order, one `mdl-agent` per script. Applies stay one at a time through `bin/exec.sh`, and the ready set is recomputed after each. A queued draft made before a sibling apply landed is re-checked with `mxcli diff --format struct` (preflight STOP rule 23); any removal line (checked against `describe` per BUG-146) or STOP rule 21 target means re-draft, never patch, because a stale restatement of a shared document is exactly rule 21's silent seed-call loss and passes `check --references`. Report `ready set N, drafted N, applied k`; the `mdl-agent` template says a drafter never applies and never depends on an unapplied draft. Field evidence: none yet. — MendixMau
 - fix(platform-link): **CLI commits now show their changed documents in Studio Pro History.** Studio Pro's History → Model changes pane reads a `ModelChanges` array from the commit's `refs/notes/mx_metadata` note. Trap 6c's hand-written template set it to `[]`, so every mxcli/agent commit showed "Model changes 0" (field project: 270 of 270 notes empty). New `project-bin/mx-metadata-note.py` (stdlib only) computes the array from the commit's changed `.mxunit` files, in Studio Pro's entry shape: Status, UnitID, UnitType, UnitName and Module (walked up the `.mpr` Unit tree). It has `changes` / `write` / `backfill` / `sync <remote>` subcommands. `install-project-hooks.sh` now also installs post-commit and post-rewrite hooks that write the note and never block, and `--check` covers them, so `sync-project.sh` rolls them out to wired projects. Notes are published with `mx-metadata-note.py sync <remote>` after the branch push. Push config is never touched. With mxcli v0.26+ in the project root the hooks call `mxcli git note --write` instead (mendixlabs/mxcli#1337); the Python script is the fallback for older pins, and on 160 field commits both wrote the same 3,594 entries. Trap 6c rewritten. Measured against Studio Pro's own notes, 51 commits in 5 apps: 3387/3389 entries exact on all five fields. Field run on a 357-commit Mendix 11.15.0 app: 158 notes backfilled and pushed, and Studio Pro History lists the documents per revision. Review fixes: an earlier revision added `HEAD` + the notes ref to `remote.<r>.push`. It was dropped because any push refspec replaces `push.default`. A branch tracking a differently named upstream got a new same-named branch on Team Server where `simple` refuses, a missing local notes ref failed the whole push, and nobody knows whether Studio Pro's own push reads that config. The installer now only fetches the remote's notes (non-forced). It removes that exact `HEAD` + notes pair if present, and leaves and reports any other entry. `sync` handles a remote with no notes ref (it used to exit 1) and retries a rejected push once after re-merging. A note that already lists changes (Studio Pro's) is never overwritten by `write`/`backfill` without `--force`, and `sync` keeps a colleague's non-empty note over ours. The mxcli probe greps `git note --help` for `--write`. Hooks and docs call the script through `resolve_py`. Fixture `tests/wave2/test-mx-metadata-note.sh` (40 cases, over real captured template units; single- and two-tree layouts, amend, backfill and `--force`, push exit codes identical to a no-hooks clone, leftover-refspec cleanup, sync to an empty remote and its retry, notes fetch at install, a diverged notes merge; green under `init.defaultBranch` master and main). — field project (Mendix 11.15 app), MendixMau
 - learn(fixture-seeding): **explore the data structure first, choose rows by use case, scan actions for resets before any run.** Two seeding runs on public template apps: seeding raised journey passes 33 -> 58 and 20 -> 51 of the same sets (FAIL 93 -> 68, 163 -> 132; INVALID unchanged), and a "Reset all demodata" journey wiped accounts so 104 of 127 journeys reported `The username or password you entered is incorrect`, identical on empty and seeded databases. Skill gains three questions a seed must answer, a use-case checklist, a destructive-action scan, a generic traps table with symptoms, measured expectations and a denominator checklist; routing trigger now fires on seed/test/demo data and empty pages. Independent review fixes: object ids follow the Mendix bigint pattern with a business-key guard (no uuids), associations are seeded where the page's path stores them, four new traps (enum names, inheritance chain, calculated attributes, view/external entities), and the port-offset and container-label traps moved to `harness-architecture.md`. — MendixMau
diff --git a/bin/sync-project.sh b/bin/sync-project.sh
index 78c893cf..513c0810 100755
--- a/bin/sync-project.sh
+++ b/bin/sync-project.sh
@@ -98,7 +98,7 @@ AGENTS="$MXTK_AGENTS"
 is_pure_stub() {
   local f="$1"
   grep -q "STUB GENERATED" "$f" || return 1
-  sed 's/{{DOUBLE_BRACE}}//g' "$f" | grep -q '{{[A-Z_]*[^}]*}}'
+  grep -q -- '{{[A-Z_]*[^}]*}}' <<<"$(sed 's/{{DOUBLE_BRACE}}//g' "$f")"
 }
 
 DIFF_COMPLETED=0
@@ -342,7 +342,7 @@ elif [ -n "$INTAKE" ]; then
       echo "Updated: $INTAKE — appended Q9 (interview mode). Answer it this session."
     fi
     CHANGES=$((CHANGES + 1))
-  elif ! q9_section "$INTAKE" | grep -q 'Answered\|Unverified'; then
+  elif ! grep -q -- 'Answered\|Unverified' <<<"$(q9_section "$INTAKE")"; then
     # Present, but ungradeable by gate-check's Stage P check.
     Q9_TMP=$(mktemp "${TMPDIR:-/tmp}/q9sec.XXXXXX") || exit 2
     Q9_REF=$(mktemp "${TMPDIR:-/tmp}/q9ref.XXXXXX") || exit 2
@@ -358,7 +358,7 @@ elif [ -n "$INTAKE" ]; then
     # into the "edited, NOT touching it" warning below.
     q9_current_text > "$Q9_REF"
     if cmp -s "$Q9_TMP" "$Q9_REF" \
-       || sed -n '2,$p' "$Q9_TMP" | grep -v '^[[:space:]]*$' | head -1 | grep -q '^_Not yet asked\._'; then
+       || grep -q -- '^_Not yet asked\._' <<<"$(sed -n '2,$p' "$Q9_TMP" | grep -v '^[[:space:]]*$' | head -1)"; then
       echo "Note: $INTAKE Q9 is the unanswered template text — Stage P will FAIL until"
       echo "      the kickoff interview happens. That is correct; nothing to repair."
 
@@ -428,7 +428,7 @@ elif [ -n "$INTAKE" ]; then
   MISSING_N=0
   while IFS= read -r _q; do
     [ -n "$_q" ] || continue
-    if ! sed -n 's/^## [0-9][0-9]*\. //p' "$INTAKE" | grep -Fxq "$_q"; then
+    if ! grep -Fxq -- "$_q" <<<"$(sed -n 's/^## [0-9][0-9]*\. //p' "$INTAKE")"; then
       MISSING_Q="$MISSING_Q$_q
 "
       MISSING_N=$((MISSING_N + 1))
@@ -1368,7 +1368,7 @@ _ea_rewrite_item3() {   # $1=file  $2=start-prefix  $3=end-prefix  $4=replacemen
       { if (skip) { if (index($0, endp) == 1) { exit }; print; next }
         if (index($0, start) == 1) { print; skip = 1 } }
     ' "$f" | tr '\n' ' ' | tr -s ' ')"
-    printf '%s' "$_blk" | grep -qF -- "$needle" || return 1
+    grep -qF -- "$needle" <<<"$_blk" || return 1
   fi
   [ "$DRY_RUN" -eq 1 ] && return 0
   _tmp="$(mktemp "${TMPDIR:-/tmp}/eaitem3.XXXXXX")" || return 1
diff --git a/project-bin/conformance-check.sh b/project-bin/conformance-check.sh
index b76031cb..84791e0d 100755
--- a/project-bin/conformance-check.sh
+++ b/project-bin/conformance-check.sh
@@ -282,9 +282,9 @@ runnable() {
     *…*|*"..."*) return 1 ;;                       # elided placeholder, not a real command
   esac
   # Must be VERB [NOUN...] OPERAND — i.e. end in something that looks like an identifier.
-  printf '%s' "$c" | grep -Eq '^(SHOW|DESCRIBE)( +[A-Z]+)+ +[A-Za-z_][A-Za-z0-9_.]*( .*)?$' && return 0
+  grep -Eq -- '^(SHOW|DESCRIBE)( +[A-Z]+)+ +[A-Za-z_][A-Za-z0-9_.]*( .*)?$' <<<"$c" && return 0
   # SHOW <PLURAL> with no operand is legitimate (e.g. "SHOW MODULES", "SHOW PAGES").
-  printf '%s' "$c" | grep -Eq '^SHOW +[A-Z]+$' && return 0
+  grep -Eq -- '^SHOW +[A-Z]+$' <<<"$c" && return 0
   return 1
 }
 
diff --git a/project-bin/review-module.sh b/project-bin/review-module.sh
index c9923dcb..057fa288 100755
--- a/project-bin/review-module.sh
+++ b/project-bin/review-module.sh
@@ -281,7 +281,7 @@ if [ -f "$ROOT/.mxcli/catalog.db" ] && command -v sqlite3 >/dev/null 2>&1; then
 fi
 if [ "$MODULE_KNOWN" -eq 0 ]; then
   MODLIST="$(with_timeout 60 "$(find_project_mxcli 2>/dev/null || echo ./mxcli)" -p "$MPR" -c "SHOW MODULES" 2>/dev/null)"
-  printf '%s\n' "$MODLIST" | grep -qE "^\| *$MODULE +\|" && MODULE_KNOWN=1
+  grep -qE -- "^\| *$MODULE +\|" <<<"$MODLIST" && MODULE_KNOWN=1
 fi
 
 if [ "$MODULE_KNOWN" -eq 0 ]; then
diff --git a/tests/wave2/test-pipefail-grep-q.sh b/tests/wave2/test-pipefail-grep-q.sh
index 15088bcb..ff348b6d 100755
--- a/tests/wave2/test-pipefail-grep-q.sh
+++ b/tests/wave2/test-pipefail-grep-q.sh
@@ -84,7 +84,8 @@ for f in bin/lib/skill-routing.sh bin/lib/obligation-check.sh bin/lib/triage-tem
          bin/gate-check.sh bin/check-portability.sh \
          project-bin/_common.sh project-bin/check-design-portability.sh project-bin/check-page-shell.sh \
          project-bin/close-task.sh project-bin/check-sp-health.sh project-bin/app-restart.sh \
-         project-bin/test-stack-up.sh; do
+         project-bin/test-stack-up.sh \
+         bin/sync-project.sh project-bin/review-module.sh project-bin/conformance-check.sh; do
   [ -f "$TK/$f" ] || { hits="$hits
 $f: missing"; continue; }
   h="$(grep -nE '(^|[^|])\|[[:space:]]*grep[[:space:]]+(-[A-Za-z]*q|[^|]*[[:space:]]-[A-Za-z]*q)' "$TK/$f" \
@@ -92,7 +93,7 @@ $f: missing"; continue; }
   [ -n "$h" ] && hits="$hits
 $h"
 done
-if [ -z "$hits" ]; then ok "0 pipelines into grep -q across 12 scripts"
+if [ -z "$hits" ]; then ok "0 pipelines into grep -q across 15 scripts"
 else bad "pipeline into grep -q found (use a here-string: grep -q -- PAT <<<\"\$x\")" "${hits#?}"; fi
 
 echo