@@ -19,6 +19,9 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- new(doctor, init): **`bin/doctor.sh <project>` measures performance, not just presence**: a "Performance (measured)" section reads the last 20 `steps:` rows of the project's BUILD-LOG and reports the median exec time, the median gate and the slowest step against a normal machine (17-34 s per exec, gate 9-20 s), warning above 60 s per exec or 45 s gate with the lever to pull; on Windows with slow process starts it recommends (never requires) WSL2 or a dev container (Docker Engine in WSL2, Rancher Desktop, Podman Desktop). `Gate mode: check` is the default for every project, existing ones included after sync (`Gate mode: full` in PROJECT.md keeps a full build per exec). Windows field run (ExpenseTracker, Windows 11, Git Bash, 103 ms per process start): check-only execs took 90-103 s against 138-139 s with the full build (gate 60 s → 12-14 s); the 60-70 s of non-gate overhead is the next target. Reported by mkr87. — mkr87 (#584, #585)
+- new(exec): **check-only gate by default (`Gate mode: full` in PROJECT.md, or `MXTK_GATE_MODE=full`, opts out)**: each exec runs `mx check` (beside mxbuild, same version) instead of the full deploy build, converting its JSON into mxbuild's errors shape so the delta gate, rollback and report are unchanged. The full build still runs when Java/JavaScript/theme/widgets changed since the last full build, when the project has Java actions and the script drops or renames something (`drop … if exists`, the re-create idiom, does not count), on `--patch`, before any full build is recorded, and after 10 check-only passes in a row (`MXTK_CHECK_MAX`). The other full builds sit at the work's natural boundaries, as mxcli itself advises (`mx check` after every exec, mxbuild when packaging): a new pre-push hook and `module-close.sh` run `bin/verify-model.sh` when the stamp says the model was only `mx check`ed (the stamp now records `kind: check|full`; `model-stamp.sh check --full`), and `bin/verify-model.sh` closes a batch on demand. Commits stay allowed on a check stamp. Field run (purchase-requests app, Linux, Mendix 11.13.0): gate 20 s → 9-10 s; a push after check-only execs ran the full build (20 s) and re-stamped the model as full; a dropped attribute caught as 6 × CE1613 by `mx check` on the broken model. Golden input: captured `mx check -j` output in `tests/wave2/fixtures/mx-check/`. For #584/#585 (Windows, mkr87). — mkr87 (#584, #585)
+- perf(exec, doctor): **Windows exec overhead (#584/#585)**: exec.sh resolves mxbuild and the model version once per run and exports them (`MXBUILD_PATH`, `MXTK_MODEL_VERSION`) instead of re-probing per call; the build-plan page refresh runs in the background after the verdict (`MXTK_SYNC_REFRESH=1` waits); the first full build after an hour says a cold start can take 2-3 min; `MXTK_PROFILE=1` traces every command with a timestamp and prints the 15 slowest lines plus the step times; `bin/doctor.sh` measures process-start cost and above 30 ms names the antivirus exclusions to ask for (or WSL2/dev container); a missing lint baseline now says `bin/lint-gate.sh --update-baseline` instead of "lint could not run (exit 2)". Reported by mkr87. — mkr87 (#584, #585)
 - fix(page-audit, design-audit, monkey, ui-loop): **no more leaked Mendix sessions from the toolkit's own browser helpers**: all three logged in and closed the browser without the xas logout, so each run burned a seat of a trial licence's cap and later journeys failed login as "Sign in failed"; they now log out first, and `ui-loop.md` says a hand-written screenshot script must too. Field: System.Session count +1 per run on master (page-audit 0 -> 1, design-audit 1 -> 2, monkey 2 -> 3), +0 with the fix — speed experiment E2
 - fix(page-audit, design-audit): **the audits produce their own `.claude/loop/page-scope.json`**: when it is missing or older than the model they run `bin/page-scope.sh` (`scope-ensure.js`, 2 s) instead of FAULTing on 0 pages; a failed regeneration never blanks an existing file and names the failure. Field: scope deleted -> page-audit ran on 9 pages, `touch` of the .mpr -> regenerated once — speed experiment E2
 - new(look-ledger, journey-runner, module-review): **a journey run's screenshots are LOOK evidence**: `bin/look-ledger.sh shots` (run by journey-runner after every run) maps each reached step's PNG to the one page whose widgets (`DESCRIBE PAGE`) it landed on, a URL pattern breaking ties, and lists every owed page as `OPEN` (open that PNG; the Read hook then marks the page SEEN) or `UNREACHED` (short gap-fill journey, or `page-audit.js` as before) with the line `owed N = A OPEN + B UNREACHED`; a shot older than the page's last build is not evidence and nothing is claimed when unsure. Field: 8 owed pages = 5 OPEN + 3 UNREACHED from two journey runs, no separate screenshot pass; baseline words 64,004 -> 64,193 — speed experiment E2
 
@@ -439,6 +439,76 @@ case "${BASH_VERSION:-0}" in
   3.*) note "bash 3.2 (the macOS system bash). Scripts here are written for it; nothing to do." ;;
 esac
 
+# Process-start cost (#584/#585). Every toolkit script is many small process starts; exec.sh
+# alone makes hundreds. On a Windows machine whose antivirus scans each start, one start cost
+# 58-94 ms (vs ~1-3 ms on Linux/macOS), about 69 s of bookkeeping per exec before any build.
+# 20 starts of /bin/true (or `true` on PATH) measured with one clock read each side.
+_spawn_ms=""
+if command -v date >/dev/null 2>&1 && _t0=$(date +%s%N 2>/dev/null) && [ "${_t0%N}" = "$_t0" ]; then
+  _i=0; _tbin="$(command -v true 2>/dev/null)"; case "$_tbin" in /*) ;; *) _tbin=/bin/true ;; esac
+  while [ $_i -lt 20 ]; do "$_tbin"; _i=$((_i + 1)); done
+  _t1=$(date +%s%N); _spawn_ms=$(( (_t1 - _t0) / 20000000 ))
+elif [ -n "${EPOCHREALTIME:-}" ]; then
+  _t0=${EPOCHREALTIME/[.,]/}; _i=0
+  while [ $_i -lt 20 ]; do /bin/true 2>/dev/null || true; _i=$((_i + 1)); done
+  _t1=${EPOCHREALTIME/[.,]/}; _spawn_ms=$(( (_t1 - _t0) / 20000 ))
+fi
+if [ -z "$_spawn_ms" ]; then
+  note "process start cost: not measured (no sub-second clock in this shell)"
+elif [ "$_spawn_ms" -gt "${MXTK_SPAWN_WARN_MS:-30}" ]; then
+  warn "process start cost: ${_spawn_ms} ms each (fast machines: under 5 ms). Toolkit scripts start many"
+  note "processes, so each exec spends roughly a minute just starting them. Usual cause on Windows:"
+  note "antivirus scanning every start. Ask IT for Microsoft Defender exclusions (processes or folders) for:"
+  note "  this project folder, Git for Windows' usr\\bin, the JDK, and ~/.mxcli; or run the toolkit in"
+  note "  WSL2 / a dev container, where starts are cheap."
+else
+  ok "process start cost: ${_spawn_ms} ms each"
+fi
+
+# --- performance (measured, not just "is it installed") ----------------------------------------------
+# Doctor used to answer only "is it there". A machine where everything is installed can still spend
+# 64-234 s on a 1 s model write (#584/#585), and nobody saw it until a user profiled it by hand.
+# So, from the project's own docs/BUILD-LOG.md (exec.sh writes `steps: guards 0s check 1s … gate 20s
+# lint 3s score 3s` on every row): the median exec time and its slowest step over the last 20 execs,
+# against what a normal machine shows (measured 2026-10-28 on Linux: 17-34 s per exec, gate 9-20 s).
+# Thresholds: MXTK_PERF_EXEC_WARN (default 60 s per exec), MXTK_PERF_GATE_WARN (default 45 s gate).
+head_ "Performance (measured)"
+_perf_log="${PROJECT_DIR:+$PROJECT_DIR/docs/BUILD-LOG.md}"
+if [ -n "$_perf_log" ] && [ -f "$_perf_log" ] && grep -q 'steps: ' "$_perf_log" 2>/dev/null; then
+  _perf=$(grep 'steps: ' "$_perf_log" | tail -20 | awk '
+    { line=$0; sub(/.*steps: /, "", line); sub(/ *\|.*/, "", line)
+      n=split(line, w, " "); tot=0
+      for (i=1; i+1<=n; i+=2) { v=w[i+1]; sub(/s$/, "", v); if (v ~ /^[0-9]+$/) { tot+=v; st[w[i]]=st[w[i]] " " v } }
+      T[++rows]=tot }
+    function med(str,   a, k, m, i, j, t) { m=split(str, a, " "); for (i=1;i<=m;i++) for (j=i+1;j<=m;j++) if (a[j]+0<a[i]+0) { t=a[i]; a[i]=a[j]; a[j]=t }
+      return m ? a[int((m+1)/2)] : 0 }
+    END { all=""; for (i=1;i<=rows;i++) all=all " " T[i]
+      top=""; tv=-1; for (k in st) { v=med(st[k]); if (v+0>tv) { tv=v+0; top=k } }
+      printf "%d %d %s %d %d\n", rows, med(all), top, tv, med(st["gate"]) }')
+  set -- $_perf
+  _pn=${1:-0}; _pmed=${2:-0}; _ptop=${3:-?}; _ptopv=${4:-0}; _pgate=${5:-0}
+  _pmsg="last $_pn execs: median ${_pmed} s per exec (gate ${_pgate} s; slowest step: $_ptop ${_ptopv} s). Normal: 17-34 s, gate 9-20 s."
+  if [ "$_pmed" -gt "${MXTK_PERF_EXEC_WARN:-60}" ] || [ "$_pgate" -gt "${MXTK_PERF_GATE_WARN:-45}" ]; then
+    warn "slow execs — $_pmsg"
+    [ "$_pgate" -gt "${MXTK_PERF_GATE_WARN:-45}" ] && note "The gate (mxbuild) dominates: 'Gate mode: check' in PROJECT.md runs mx check per exec and the full build before push."
+    [ -n "$_spawn_ms" ] && [ "$_spawn_ms" -gt "${MXTK_SPAWN_WARN_MS:-30}" ] && note "Process starts are slow too (above): that is the machine, not the model — see the advice there."
+    note "Per-command profile of one exec: MXTK_PROFILE=1 ./bin/exec.sh <script> (prints the 15 slowest lines)."
+  else
+    ok "$_pmsg"
+  fi
+elif [ -n "$PROJECT_DIR" ]; then
+  note "no exec timings yet (docs/BUILD-LOG.md has no 'steps:' rows) — re-run doctor after a few execs"
+else
+  note "exec timings: pass a project dir (bin/doctor.sh <project>) to compare its execs with a normal machine"
+fi
+# Windows advice: the dev container / WSL2 lane is RECOMMENDED where process starts are slow, never
+# required — a machine without it keeps working, just slower.
+if [ "${PLATFORM:-}" = gitbash ] && [ -n "$_spawn_ms" ] && [ "$_spawn_ms" -gt "${MXTK_SPAWN_WARN_MS:-30}" ]; then
+  note "Recommended on this Windows machine (optional): run the toolkit in WSL2 or a dev container"
+  note "  (Docker Engine in WSL2, Rancher Desktop or Podman Desktop). Without one, the antivirus exclusions"
+  note "  above are the fix; everything keeps working either way."
+fi
+
 # --- environment lane -------------------------------------------------------------------------
 # Where this session runs decides the write modes available (CONVERSION-RUNBOOK.md → "Where you
 # run this"). It is DETECTED, never asked: the agent records the answer in PROJECT.md and moves on.
 
@@ -196,6 +196,11 @@ ${TOOLKIT_COMMIT_LINE}
 Exec approval: auto
 Permission profile: project
 Unit tests default: no
+Gate mode: check
+
+<!-- Gate mode: check (the default, also without this line) = bin/exec.sh runs \`mx check\` per
+     script and the full mxbuild before every push, at module close and when Java/theme files
+     change (mxcli's own advice). \`Gate mode: full\` = a full mxbuild on every exec. -->
 
 <!-- The bold line above is a READOUT: bin/gate-check.sh rewrites it on every full run from the
      verdicts it just produced (first stage neither PASS nor WAIVED). Do not edit it by hand.
 
@@ -482,6 +482,10 @@ print('file:'+u.pathname2url(os.path.abspath(sys.argv[1]))+'?mode=ro')" "$1" | t
 # ---------------------------------------------------------------------------
 mxtk_model_version() {
   local mpr="${1:-}" v="" py
+  # Memo: exec.sh exports MXTK_MODEL_VERSION once per run, so the many find_mxbuild calls
+  # in one exec (and the scripts it starts) do not each spawn sqlite3/python (#584: a
+  # process start costs 58-94 ms on a Defender-scanned Windows machine).
+  if [ -z "$mpr" ] && [ -n "${MXTK_MODEL_VERSION:-}" ]; then printf '%s\n' "$MXTK_MODEL_VERSION"; return 0; fi
   [ -n "$mpr" ] || mpr="$(find_mpr 2>/dev/null)" || return 1
   [ -f "$mpr" ] || return 1
   if command -v sqlite3 >/dev/null 2>&1; then
@@ -555,6 +559,9 @@ EOF_SP
 # is loud in mxtk_ensure_mxbuild (this function is always called with stderr discarded).
 find_mxbuild() {
   if [ -n "${MXBUILD_PATH:-}" ]; then echo "$MXBUILD_PATH"; return 0; fi
+  # Per-run memo exec.sh exports (#584) — its own name, so the explicit-override semantics of
+  # MXBUILD_PATH (no version match, mxtk_ensure_mxbuild's warning) never reach child scripts.
+  if [ -n "${MXTK_MXBUILD_MEMO:-}" ] && [ -x "$MXTK_MXBUILD_MEMO" ]; then echo "$MXTK_MXBUILD_MEMO"; return 0; fi
   local ver m
   if ver=$(mxtk_model_version 2>/dev/null) && m=$(mxtk_mxbuild_for_version "$ver"); then
     echo "$m"; return 0
@@ -809,6 +816,12 @@ sys.exit(0 if m and all(ok.match(x) and not re.search(r"CE[0-9]{4}", x) for x in
 mxtk_gate_mxbuild() {
   local _mpr="$1" _timeout="${2:-0}" _ef="$3" _rc=0
   MXTK_GATE_RETRY_NOTE=""; MXTK_GATE_FIRST_OUT=""; MXTK_GATE_FIRST_EXIT=""
+  # MXTK_GATE_KIND=check (set by exec.sh's gate-kind decision): `mx check` instead of a
+  # deploy build. No infra retry: mx check has no deploy stage to collide on.
+  if [ "${MXTK_GATE_KIND:-full}" = "check" ]; then
+    mxtk_mx_check_error_count "$_mpr" "$_timeout" "$_ef" >/dev/null || _rc=$?
+    return "$_rc"
+  fi
   mxtk_pause_watchers "${PROJECT_ROOT:-$(dirname "$_mpr")}"
   mxtk_mxbuild_error_count "$_mpr" "$_timeout" "$_ef" >/dev/null || _rc=$?
   case "${MXTK_MXBUILD_EXIT:-}" in
@@ -971,6 +984,99 @@ def one(e):
 print('; '.join(one(e) for e in d.get('errors',[]) or [])[:300])" 2>/dev/null || true
 }
 
+# ---------------------------------------------------------------------------
+# Check-only gate (opt-in: `Gate mode: check` in PROJECT.md; exec.sh decides per exec).
+#
+# `mx check` ships next to mxbuild and runs the same model consistency checks (CE codes) in
+# ~12 s where a deploy build takes 18-165 s, because it skips the Java compile and the deploy
+# packaging. What it cannot see is exactly that: Java compile errors, including a model change
+# that breaks a generated proxy a Java action uses. exec.sh therefore still runs the full build
+# when those can change (mxtk_gate_kind_decide in exec.sh) — this is the cheap path only.
+# WHY (#584/#585, Windows field reports): mxbuild was the largest single cost per exec there.
+#
+# mxtk_java_fp <project-root> — content fingerprint of the files only a full build compiles
+# (javasource/ javascriptsource/ theme/ userlib/ widgets/). Content, not git state: committing an
+# unchanged file must not read as a change. javasource/*/proxies/ is excluded: mxbuild regenerates
+# it from the model on every full build. exec.sh (gate kind) and verify-model.sh record it.
+mxtk_java_fp() {
+  ( cd "$1" 2>/dev/null || exit 0
+    _l="$(git ls-files -co --exclude-standard -- javasource javascriptsource theme userlib widgets 2>/dev/null \
+          | grep -v '^javasource/[^/]*/proxies/' || true)"
+    { printf '%s\n' "$_l"; [ -z "$_l" ] || printf '%s\n' "$_l" | git hash-object --stdin-paths 2>/dev/null; } \
+      | cksum | awk '{print $1}' )
+}
+
+# mxtk_find_mx — the `mx` tool beside the resolved mxbuild (same version by construction).
+mxtk_find_mx() {
+  local _mb _d _c
+  _mb="${MXBUILD_PATH:-$(find_mxbuild 2>/dev/null || true)}"
+  [ -n "$_mb" ] || return 1
+  _d="$(dirname "$_mb")"
+  for _c in "$_d/mx" "$_d/mx.exe"; do [ -x "$_c" ] && { echo "$_c"; return 0; }; done
+  return 1
+}
+
+# mxtk_mx_check_to_mxbuild <mx-check.json> <out.json> [python] — rewrite `mx check -j` output
+# into the mxbuild --write-errors shape exec.sh's err_set/err_report/err_codes read:
+#   {"errors":[...],"problems":[{"severity":"Error","errorCode","message","locations":[{module,document,element}]}]}
+# Golden input: tests/wave2/fixtures/mx-check/mx-check-11.13.0-CE1613.json (captured, mx 11.13.0).
+mxtk_mx_check_to_mxbuild() {
+  local _py="${3:-${PY:-$(resolve_py 2>/dev/null || true)}}"
+  [ -n "$_py" ] || return 1
+  "$_py" -c "import json,sys
+d=json.load(open(sys.argv[1]))
+def loc(l): return {'module':l.get('module-name',''),'document':l.get('document-name',''),'element':l.get('element-name','')}
+probs=[{'severity':'Error','errorCode':e.get('code',''),'message':e.get('message',''),
+        'locations':[loc(l) for l in e.get('locations') or []]} for e in d.get('errors') or []]
+json.dump({'errors':[],'problems':probs,'source':'mx check'},open(sys.argv[2],'w'))
+print(len(probs))" "$(native_path "$1")" "$(native_path "$2")" 2>/dev/null
+}
+
+# mxtk_mx_check_error_count <mpr> <timeout-seconds> [errors-file] — mxtk_mxbuild_error_count's
+# contract (same globals, same return codes, same printed count), backed by `mx check -j`.
+# The errors file it leaves is in mxbuild's shape (mxtk_mx_check_to_mxbuild), so every reader
+# downstream is unchanged. A run that produced no JSON is "?" with the output tail in
+# MXTK_MXBUILD_WHY — never 0.
+mxtk_mx_check_error_count() {
+  local _mpr="$1" _timeout="${2:-300}" _ef="${3:-}" _own_ef=0
+  local _mx _out _js _pid _waited=0 _exit=0 _count
+  MXTK_MXBUILD_OUT=""; MXTK_MXBUILD_EXIT=""; MXTK_MXBUILD_WHY=""
+  _mx="$(mxtk_find_mx)" || { echo "?"; return 2; }
+  if [ -z "$_ef" ]; then _ef=$(mktemp /tmp/mxcheck-errors.XXXXXX) || { echo "?"; return 2; }; _own_ef=1; fi
+  _out=$(mktemp /tmp/mxcheck-out.XXXXXX) || { echo "?"; return 2; }
+  _js=$(mktemp /tmp/mxcheck-json.XXXXXX) || { rm -f "$_out"; echo "?"; return 2; }
+  rm -f "$_js"   # mx writes the file itself; an empty pre-existing one would read as "no output"
+  "$_mx" check "$_mpr" -j "$(native_path "$_js")" > "$_out" 2>&1 < /dev/null &
+  _pid=$!
+  while kill -0 "$_pid" 2>/dev/null; do
+    if [ "$_timeout" -gt 0 ] && [ "$_waited" -ge "$_timeout" ]; then
+      kill "$_pid" 2>/dev/null; wait "$_pid" 2>/dev/null
+      MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out" "$_js"
+      MXTK_MXBUILD_EXIT=124; [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
+      echo "?"; return 3
+    fi
+    sleep 1; _waited=$((_waited + 1))
+  done
+  wait "$_pid" || _exit=$?
+  MXTK_MXBUILD_OUT=$(cat "$_out" 2>/dev/null); rm -f "$_out"
+  MXTK_MXBUILD_EXIT="$_exit"
+  if [ -s "$_js" ]; then _count=$(mxtk_mx_check_to_mxbuild "$_js" "$_ef"); fi
+  rm -f "$_js"
+  [ "$_own_ef" -eq 1 ] && rm -f "$_ef"
+  case "${_count:-}" in
+    ''|*[!0-9]*)
+      MXTK_MXBUILD_WHY="mx check wrote no readable JSON (exit $_exit): $(printf '%s' "$MXTK_MXBUILD_OUT" | tail -3 | tr '\n' ' ' | cut -c1-240)"
+      echo "?"; return 1 ;;
+  esac
+  # exit 1 with errors is the normal "model has errors" answer; any other non-zero exit
+  # with 0 errors means mx did not check the model.
+  if [ "$_count" = "0" ] && [ "$_exit" -ne 0 ]; then
+    MXTK_MXBUILD_WHY="mx check exited $_exit with no errors listed: $(printf '%s' "$MXTK_MXBUILD_OUT" | tail -3 | tr '\n' ' ' | cut -c1-240)"
+    echo "?"; return 1
+  fi
+  echo "$_count"; return 0
+}
+
 # project_name — the .mpr basename without extension, for user-facing messages.
 project_name() {
   local mpr