Stage 5 FAILs while a built page has no screenshot opened since its build

[MendixMau]

Direct lane

What changed and why (one paragraph):
Two unattended builds shipped every page without anyone opening a screenshot of it. They only ran page-fidelity.js, which is a text score. This PR makes the LOOK owed and checkable:

• bin/exec.sh now records every page a script creates or alters as owed a look. It writes to .claude/loop/look/owed.tsv through the new project-bin/look-ledger.sh owe.
• A new PostToolUse(Read) hook, installed by install-claude-permissions.sh, logs each image the agent opens to seen.tsv.
• gate-check.sh <project> 5 now FAILs and names the pages still owed. A page counts as seen when a screenshot was opened after its latest build and the file name contains the page name.
• A look can also be cleared by a PROOF-OF-LOOK citation in a ui-review-*.html, which needs a real shot of at least 10KB that is newer than the build. Or it can be waived with --waive look/<Module>.

It blocks only the "Stage 5 done" claim. It never blocks the next script. With no ledger, Stage 5 stays the plain MANUAL it was. The PR also:

• makes shrink-image-read.sh leave a .src sidecar so a shrunk copy maps back to its original;
• updates skills/ui-loop.md step 2;
• promotes the 2026-09-19 inbox note on the LOOK pass and deletes it.

Supersedes the enforcement half of #189; #192 carries the Stage 4 half.

Field evidence:

• Observed: two unattended side-by-side builds of a requirements-driven PoC project, 2026-10-01/02. Both ran to page-fidelity scores and reported done with zero screenshot reads. Both agents filed the gap as a bug report themselves.
• Parser golden shapes: captured from that project's real build scripts and from this repo's .mdl files. They cover CREATE, CREATE OR REPLACE, CREATE OR MODIFY and ALTER, in either case and with quoted or bare names. Snippets and comments are skipped.
• Probe runs on a scratch project:

Case	Result
One stale page	FAIL, names it
PROOF-OF-LOOK with a 20KB fresh shot	MANUAL "3 of 3 accounted for"
Proof shot of 500B	FAIL
--waive look/<Module>	MANUAL
Rebuild two pages	FAIL, names both
No ledger	Plain MANUAL, rc=2

• Gate run time: about 2s.

• Installer probe on a legacy settings file: --check reports the missing Read hook. Install adds it and keeps a foreign PostToolUse hook. Re-run is a no-op. Uninstall removes only ours.

• No client data anywhere in the diff. The leak guard passes, and a name grep on the added lines is clean.

• Size cap: over by a little. 8 files and 373 lines excluding the promoted inbox deletion. With the deletion (−101 lines, required in the same commit) it is 9 files and 474 lines. Fixtures and CHANGELOG are excluded.

• Test tier: T0 + probe runs. bin/check-scripts.sh passes 97/97. The T1 fixtures have not run yet and are pending the maintainer's ok, which is why this is a draft:

  • tests/wave2/test-look-ledger.sh (new)
  • tests/wave2/test-install-claude-permissions.sh (extended)
  • tests/wave2/test-bug03-gates.sh

• Instrument rules:

  • golden shapes come from real scripts;
  • both layouts are covered, root and app/, from an installed bin/ copy (_common.sh honours PROJECT_ROOT);
  • GNU-then-BSD stat, bash 3.2 safe, a single awk pass;
  • the guard accepts evidence it didn't create (PROOF-OF-LOOK, waivers) and never blocks its remedy (exec.sh is never blocked).

• CHANGELOG.md line under Unreleased, credited to two field builds.

• n/a: new skill routing row, BUG-DRAFT headings.

Known gaps:

• Existing projects keep their installed exec.sh (install rule: present → keep). They write no owed rows, so their Stage 5 stays MANUAL until sync-project.sh or a reinstall refreshes it.
• Side observation, not fixed here: the look obligation reports "PASS — no module has been opened for work yet" even while pages are being built.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code