Sync ako/mxcli: page/OData/test-runner/microflow fixes (#795, #782, #802-#804, #791, #790)

[ako]

Syncs ako/mxcli into upstream: eight commits fixing seven reported issues, all reproduced first and verified against a real project.

Closes

• ALTER SETTINGS (any command) silently corrupts every constant override in the project, and drops CustomSettings/Tracing, on write #801 — ALTER SETTINGS silently corrupts constant overrides (already upstream via Sync ako/mxcli → upstream: TimeRegistration findings #51–#56 #807)
• ALTER SETTINGS CONFIGURATION silently ignores invalid Integer-typed values while reporting success #805 — ALTER SETTINGS CONFIGURATION ignores invalid Integer values (already upstream via Sync ako/mxcli → upstream: TimeRegistration findings #51–#56 #807)
• DESCRIBE PAGE drops a datagrid's microflow DataSource — round-tripped MDL recreates the grid with no data source #795 — DESCRIBE PAGE drops a datagrid's microflow DataSource
• External Entities : allow_create_change_locally does't work #782 — External Entities: allow_create_change_locally doesn't work
• mxcli test unconditionally forces Security Level to OFF, breaking projects with custom-auth REST/OData services #802 / mxcli test cleanup crashes restoring AfterStartupMicroflow, leaving the project's security/after-startup settings permanently mutated #803 / mxcli test leaves an orphaned, empty MxTest module in the project after every run #804 — mxcli test mutates the project it tests
• roundtrip for microflow with loop can fail silently #791 — loop + split + continue produces a project Studio Pro can't open
• roundtrip for microflow with loops yields changes in positioning #790 — loop roundtrip visualization (the reproducible half)

Pages / describe (#795 + two follow-ups)

A Forms$MicroflowSource stores the microflow name in the nested Forms$MicroflowSettings; the DataGrid2 reader looked up a top-level Microflow key, got "", and returned no datasource. The describe formatter was correct all along — purely a read bug. Four readers each had their own copy of that lookup and disagreed; they now share one helper. Regression tests caught two more gaps: a Gallery using the legacy flat shape, and Forms$NanoflowSource missing entirely from the DataGrid2/Gallery switches.

A construct the codec engine cannot represent was logged and dropped while exec still printed Created page. The converter did return an error; widgetobj.ChildSerializer has no error channel (the existing TODO(shared-types)). Failures are now recorded and drained at the page/snippet write entry points, so the statement fails instead — ADR-0004's refuse-don't-drop.

A data container bound to a flow reported the flow as its context entity rather than the entity it returns. Not just cosmetic: EntityContext feeds the column and child-widget readers.

OData external entities (#782)

Two independent bugs, and the first is much bigger than the flag. entityFromGen recognised only DomainModels$OqlViewEntitySource, so any OData external entity read back with an empty Source and every remote field zeroed — describe external entity rejected it outright, and a read-modify-write rebuilt the entity without its source at all. The write path was always fine; it switches on e.Source, which the read never populated. Works under --engine legacy, whose parser handles all three flavours — a modelsdk-engine gap, and modelsdk is the default.

Separately, create or modify external entities reset CreateChangeLocally on every run. That is right for the capability flags, which the service's annotations describe, and wrong for a local modelling choice no OData contract mentions.

Test runner (#802 / #803 / #804)

Three reports, one teardown routine. The after-startup value was mis-parsed (DESCRIBE SETTINGS separates properties with commas; quotes were trimmed before punctuation), so the restore statement was unparseable, printed as a warning, and the project was left pointing at the microflow cleanup then deleted. Cleanup now returns its errors and fails the run. The generated MxTest module is dropped — but only when the run created it, since CREATE MODULE is idempotent and a pre-existing module is the user's. And the Security Level is left alone entirely: the after-startup microflow runs in an administrative context and is not subject to it, so forcing it OFF bought nothing while breaking custom-auth REST/OData services.

Microflow loops (#791, #790)

microflowObjectToGen had no case for Microflows$BreakEvent / ContinueEvent and its default returns nil, so the event was dropped while the SequenceFlow pointing at it was written — a DestinationPointer to a GUID that exists nowhere, exactly the KeyNotFoundException Studio Pro reports. Verified by dumping the microflow and checking every pointer resolves: 1 dangling before, 0 after. The same bug had already been fixed once for ErrorEvent; break and continue were missed. MDL051 — a check-time stopgap explicitly added "until the serialization is fixed" — is removed with it; note it only ever covered break, which is why the continue form reached a user as a corrupt project.

Loop boxes were sized from a measure that adds HorizontalSpacing on top of each element's full width, but that constant is a centre-to-centre pitch — over-counting a run of n activities by (n-1)*ActivityWidth. An example box goes 880 → 640 around 440px of content. Compound elements (IF/split, nested loop) keep the conservative measure: approximating their advance under-sized the box and pushed activities outside the frame, which is worse.

Already fixed, no change needed

#780 (call microflow in a loop without an error handler) is fixed on current main: ehType returns Rollback for microflows unless overridden, and the BSON is structurally identical with and without the clause, with zero dangling pointers. Worth closing with that note.

Not addressed

• roundtrip for microflow with loops yields changes in positioning #790's other half — "position annotations sometimes change" is not reproducible: explicit @position round-trips exactly and three describe/exec cycles are byte-identical. The reporter noted it was inconsistent.
• Authoring a nanoflow datasource on a pluggable widget still needs --engine legacy. modelsdk/gen/pages has no NanoflowSettings type and there is no Studio Pro sample to verify a hand-written shape against. It now fails loudly instead of silently dropping the binding.
• Range validation on settings (a port of 0 or 999999 still parses as an integer).

Testing

make build, make test, make lint and make check-mdl pass. Every fix has a regression test verified failing against the pre-fix code, plus a repro fixture under mdl-examples/bug-tests/. Symptom-table rows added for each.

Two of these issues (#801, #802) had reporters who said they had their own fixes ready — worth checking before merging so the work isn't duplicated