feat(sync-project): --only-bin installs just the named scripts (#390)

CHANGELOG.md

@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- new(sync-project): **`bin/sync-project.sh <project> --only-bin <script.sh> [--only-bin …]` installs only the named `project-bin/` scripts into the project's `bin/` and touches nothing else; `--upgrade-bin` is now documented as what it is — a full sync that may also overwrite a modified copy.** A field run used `--upgrade-bin exec.sh --upgrade-bin _common.sh --upgrade-bin test-scratch.sh` as "install just these scripts" and got a full sync: 244 tracked files changed, one deleted, ~30 added, git hooks reinstalled. `--only-bin` decides everything before writing anything (a name outside the install manifest, NOINSTALL scripts included, a path-like or empty name, a locally modified copy without `--upgrade-bin <name>`/`--force`, or an older copy the full sync's `_common.sh` refresh hold would keep, exits 1 with the project untouched; names are never glob-expanded), backs up an overwritten copy, and prints every file it wrote. The remedy lines in `app-restart.sh`, `test-scratch.sh`, `test-stack-up.sh`, `doctor.sh` and `harvest-learnings.sh` now name `--only-bin`. Fixture `tests/wave2/test-sync-only-bin.sh` (40 checks, single- and two-tree): one `git status` change, hooks and skills untouched, while a full `--upgrade-bin` sync of the same project installs other scripts and the hooks. — field run, issue #390
 - new(bug-lookup): **`bin/bug-lookup.sh` ranks the ledger against a whole pasted error message.** One word (a CE code, a BUG id, a keyword) keeps the full-entry path unchanged; several words print the top 3 entries, each with header, score and one excerpt line, and `--full N` prints the N-th in full. Scoring is one POSIX awk pass: distinct query terms weighted by IDF, CE codes and BUG ids x3, header terms x1.5, an exact BUG id +100. A "no confident match" banner is printed below 40% term-weight coverage or for a CE code no entry mentions. `--exact` keeps the old literal phrase match for a quoted multi-word keyword. Measured on 40 labelled dev queries (the set the weights were tuned on): top-3 9% before (the literal match finds almost nothing in a pasted message) vs 94% now, top-1 89%, confident-wrong 8%. On 18 held-out queries written before the ranker ran on them: top-1 92%, top-3 100%, confident-wrong 17%. All 3 wrong answers are no-match rows without a CE code: the 40% coverage floor caught none of the 4 such rows across both sets, and coverage does not separate them from correct answers. Only the unknown-CE rule makes "no match" work today. The fixture skips, with a note, any no-match row whose CE code has since entered the ledger. About 45 ms per query vs about 950 ms (mawk; about 300 ms on BWK awk); at most 179 words printed. The banner also fires on 3 correct dev answers. Identical output under gawk, mawk and BWK awk 20121220/20180827/20231127; macOS's 20200816 build itself is not tested. All arguments are joined (`"$*"`; it read only `$1` before), so an unquoted multi-word query is ranked too. The banner exits 0 (it still lists the nearest 3); 1 is no match. The script header no longer caches the ledger's size. The routing row and CLAUDE.md mention the pasted message (+9 words on the mdl and gate stubs), and the `mxcli-bugs` row drops its stale "32k words". Fixture `tests/wave2/test-bug-lookup.sh` (floors on both sets; the PASS count depends on the awks installed; 9 checks fail on master). Field evidence: the 2026-10-15 golden-set run. — maintainer request, MendixMau
 - chore(migration skills): **duplicated migration and build-loop rules become pointers to their single source** (CLAUDE.md: "single source of the rule; every other mention defers here"). `migrate-general.md` §9 (nine OS 11 → Mendix mapping tables, about 115 lines) becomes a pointer to `source-os11.md` § Concept Mapping, after its lines not found there (the Data/Client Action implication, the sequence-from-10000 rationale, the Permission row, "Mendix does not enforce the layering", the ODC reasons) move into `source-os11.md`; its own OS 11 scope note goes with it. `migrate-general.md` §4 NPE lifecycle points at `learned-microflow-patterns.md` § NPE as Form Backing Object (the NPE-associations paragraph, found only here, stays). `migration-pipeline.md`'s restated extractor loop and validator checklist point at `extractor-quality-loop.md` § The Loop. The five "BUG-02 fixed in v0.13.0" notes in `iterative-build-loop.md`, `migrate-general.md` and `migration-pipeline.md` become `bin/bug-lookup.sh BUG-02` pointers (the struck-through handoff row in `migrate-general.md` §7 is deleted as history; the `iterative-build-loop.md` note stays because `test-bug09-13.sh` T6 keeps it on purpose); `migrate-outsystems.md` stops calling `migrate-general.md` the concept mapping. Same commit, to keep the companion PR under the 10-file cap: `iterative-build-loop.md`'s step-13 navigation and "every displayed field" bullets point at `module-review.md` § 4c, its wireframe drift-sync paragraph at `conversion-runbook.md` § 3b, and `checkpoint-cutover.md`'s What's Next at the runbook's Stage 7 row. References to the removed text are re-pointed: the audit-field standard (`migrate-outsystems.md`) and module layering (`migration-pipeline.md`) at `source-os11.md`, and `source-triage.md`'s "Phase 2's quality checklist" at `extractor-quality-loop.md` Validator Requirements; `source-os11.md`'s DAO and UI tables gain the remaining §9 details. Only always-loaded change: that `source-triage.md` line (−2 words); baseline 73,522 → 73,520. — authoring audit, maintainer request
 - fix(routing): **nine routing triggers rewritten so the words a user or agent actually types reach the row. BM25 over the 55-phrasing audit set: full trigger text 36/55 → 47/55 top-1, 46/55 → 55/55 top-3; rendered stub text (the part before the first " — ", which on-demand stub rows show) 34/55 → 42/55 top-1, 39/55 → 47/55 top-3; no phrasing ranks lower in either.** Seven phrasings missed with every audit method: "page shows 0 to 0 of 0" (empty-widget-triage), "mx check CE0066 on my access rule" (bug-lookup), "should this be a script or a skill" and "about to write a bash checker…" (skills-over-scripts), "the test wrote a row but my DB query shows nothing" (learned-local-db-confusion), "about to go live and move the old data over" (checkpoint-cutover), "half the buttons on the page do nothing" (wiring-sweep). Two CSS phrasings sat at rank 4–5 (learned-css-that-never-applied). Each trigger now front-loads the symptom words (CLAUDE.md skill-authoring rule 1), and the new words sit before the first " — ", so the stub text is a superset of the old stub text: every content word of the old stub and of the old full trigger survives, checked per row. wiring-sweep keeps "Every module before it is called done" first. module-review ("Is the module done? … once-over") and change-intake ("it also needs Y (a field, a column, a button)") were tightened from rank 2 to rank 1. Only column 3 of `bin/lib/skill-routing.tsv` changed, then re-rendered. Rows grow +6 to +15 words, and the baseline file total is unchanged (73,522). The measurement is in-sample: the rewrites were written against the same 55 phrasings. — routing retrieval audit 2026-10-15, MendixMau

bin/doctor.sh

@@ -318,7 +318,7 @@ ps_apply() {
   _psa_ex="$PROJECT_DIR/bin/exec.sh"
   if [ ! -x "$_psa_ex" ] || ! grep -q 'PATCH_MODE' "$_psa_ex" 2>/dev/null; then
     bad "property sets: not repaired — this project's bin/exec.sh has no --patch, and the repair is only run through it"
-    note "upgrade it first: bin/sync-project.sh $PROJECT_DIR --upgrade-bin exec.sh"
+    note "upgrade it first: bin/sync-project.sh $PROJECT_DIR --only-bin exec.sh --upgrade-bin exec.sh"
     return 0
   fi
   note "repairing through bin/exec.sh --patch (snapshot, fix, mxbuild gate, kept only on a verified gate)…"

bin/harvest-learnings.sh

@@ -190,8 +190,8 @@ COMMITSEOF
       STALE_N=$((STALE_N + 1))
       # <project-root>, never $PROJECT_DIR: the draft is destined for the public inbox and an
       # absolute path is a home-directory leak the pre-commit guard refuses (caught 2026-09-14).
-      printf -- '- bin/%s — STALE: identical to shipped %s (%s); fix: bin/sync-project.sh <project-root> --upgrade-bin %s\n\n' \
-        "$base" "$MATCH_SHORT" "$MATCH_DATE" "$base" >> "$TMP"
+      printf -- '- bin/%s — STALE: identical to shipped %s (%s); fix: bin/sync-project.sh <project-root> --only-bin %s --upgrade-bin %s\n\n' \
+        "$base" "$MATCH_SHORT" "$MATCH_DATE" "$base" "$base" >> "$TMP"
       continue
     fi