Fix eight defects from the rest/ledger/sudoku/ChipCoV6 test-project findings

[ako]

Eight independent fixes from the 2026-10-09 FINDINGS.md rounds of the test projects (ako/mxcli-ledger, ako/mxcli-sudoku, ako/ChipCoV6). One commit each, each with a failing-first test, a revert proof, and a new finding record; most also checked end to end on a copy of the reporting project.

1. fix(pages): layout-grid row/column appearance lost on describe → exec (ledger #167) — data loss

A describe → exec round trip dropped every design property, class and style on layout-grid rows and columns, and reset row/column alignment. On ledger MyFirstModule.Home_Web: Forms$DesignPropertyValue 46 → 33 ('Flex container' ×7, 'Column gap' ×3, 'Cards style' ×3 — real values, not None as the finding thought), and VerticalAlignment: Center ×6 → None. check, exec and mx check were all green.

Cause: no layer carried it — parseLayoutGridRows read only columns/weights/widgets, the v3 builder ignored row/column properties (validator classed them slotDropped), and the writer hardcoded an empty appearance and alignment None.
Fix: sdk/pages rows/columns gain Class, Style, DynamicClasses, DesignProperties and alignment; describe prints them only when set (a plain grid still describes as row {); the builder types design properties against the theme's LayoutGridRow/LayoutGridColumn groups; both writers (modelsdk, mcp) write them, defaults unchanged.
End to end: 46 entries kept, alignment kept, second exec reports Unchanged page. Not run: docker check (no mxbuild in this container).

A follow-up commit strikes two TestApp snippets (WorkflowCommons.Snip_UserTask_NameColumnWithIcon, Snip_WorkflowJumpToDetails) from the round-trip knownFailures: this fix repaired them (they still fail at its parent commit), and the ratchet requires the allowlist to shrink.

2. fix(check): no MDL-WIDGET07 for an explicit pluggable widget id without a project (ledger #165)

Without -p, a pluggablewidget '<id>' has no definition and fell through to the built-in widgets' allow-list, so every property was reported "silently dropped on write" (58 false hits on the ledger's Vega chart). Now skipped for explicit-id widgets, as MDL-WIDGET25 already does; with a project an unknown id is still MDL-WIDGET25. Control: a built-in container with a bogus key still warns. Ledger, no project: 58 → 0.

3. fix(navigation): report Unchanged when a navigation rewrite was elided (ChipCoV6)

create or modify navigation printed "updated" on every run though the write was elided (unit files byte-identical). Now reported through ctx.reportWrite like security/settings (#890); the kept-menu-actions note prints only when written. ChipCoV6 re-run: 22 → 23 documents in sync, no navigation line.

4. fix(security): echo the rule a GRANT wrote, not a shared one (ChipCoV6)

The Result: line picked the first rule naming any granted role; the backend upserts by the exact role set + XPath. GRANT now selects by that key (REVOKE keeps the overlap match). ChipCoV6: Result: read * → Result: read (Country), write (Country), matching show access.

5. fix(deprecation): MDL-DEPR081 names the $currentObject form it means (sudoku #63)

The warning said to write Visible: <expression> — "same meaning" — but inside the brackets a bare attribute is rooted in $currentObject, so dropping the brackets alone rebinds it. fmt --upgrade was already right. The entry's Canonical now names the binding; it is the text shown by the warning, the mdl-2 refusal, the LSP, fmt notes, help and the generated migration table (regenerated).

6. fix(visitor): hint the if exists order, and no false missing-; after recovery (ledger #166)

drop microflow M.F if exists; gave only extraneous input 'if', plus — under mdl 1; — a second error claiming a missing ;, because recovery truncated the statement. The parse error now names the order (drop microflow if exists M.F;), and the mdl-1 terminator check stands down on a line that already has a syntax error. Control: a genuinely missing ; on a clean line is still refused.

7. fix(visitor): hint the quoted last segment for a hyphenated icon name (ChipCoV6)

Icon: Atlas_Core.Atlas.add-circle (error pointing at a dot) and Icon: 'Atlas_Core.Atlas.add-circle' (stray string) now carry a hint naming Atlas_Core.Atlas."add-circle", for menu items and widget icons. The grammar is unchanged — an icon stays a qualified name. Control: the quoted segment parses; unrelated errors on an icon line get no hint.

8. fix(lint): MPR007 flags a user role that cannot open its home page (ChipCoV6)

A user role whose module roles have no access to its effective home page (role-based entry, else the profile default; page or microflow) built to 10× CE2729 in docker check, with nothing from lint or check --references. MPR007 now reports it per profile and user role, naming the page and the fix (grant view, or a role-based home page). Skipped under security level Off; a page with no allowed roles at all stays CE0557's report. End to end on ChipCoV6: an added TmpUser (mxbuild: 10× CE2729) is flagged; the unmodified project and the ledger report no new MPR007.

Validation

make build, make test, make lint-go and make check-findings pass; TestTestAppRoundTrip passes locally with the struck allowlist.

🤖 Generated with Claude Code

https://claude.ai/code/session_012PkPkaYM12u8yqMKNmzBgT