Fix red CI (Go 1.26.6), propose container auto-sizing for #884, regenerate LSP completions

[ako]

Three independent commits, each self-contained. The toolchain bump is the one that unblocks CI — cherry-pick cad70cc on its own if you'd rather not wait on review of the other two.

1. build: Go toolchain 1.26.5 → 1.26.6 — fixes red CI

The Vulnerability scan step (govulncheck ./...) started exiting 3 on every push. No mxcli code is at fault: all six findings are Go standard-library advisories reported as Found in: <pkg>@go1.26.5 / Fixed in: <pkg>@go1.26.6.

ID	Package
GO-2026-6218	net/url	quadratic complexity in resolvePath
GO-2026-6090	crypto/tls	unbounded post-handshake messages
GO-2026-6089	net/http	ReadHeaderTimeout on the h2c check
GO-2026-6088	encoding/xml	missing recursion depth guard
GO-2026-5972	encoding/asn1	missing recursion depth limit
GO-2026-5026	net/http	idna punycode label rejection

The timeline is the proof: cd2b01e was green at 21:43, 64935d4 red at 07:11 the next morning. go1.26.6 was published in between, and govulncheck@latest re-resolves the vulnerability database on every run — so the same code went from clean to failing with no commit responsible. Every trace lands in pre-existing code (marketplace/client.go, tunnelhub/server.go, widgets/mpk, …).

Bumps all pins together — go.mod's toolchain plus push-test, release and nightly (two jobs there). Bumping only push-test would turn CI green while release kept linking published binaries against the vulnerable standard library. Same treatment as the earlier 1.26.4 → 1.26.5 bump for GO-2026-5856.

Verified by running the scan under both toolchains rather than trusting the advisory metadata: 1.26.5 → six findings, exit 3; 1.26.6 → No vulnerabilities found, exit 0.

2. docs: proposal — derive container Size from contents (closes the last open item of mendixlabs#884)

A LoopedActivity's Size is computed from a pre-pass over the AST before its body is built, so it is a function of statement count alone. Child positions — @position included — have no effect on the box meant to contain them.

Measured on a blank 11.6.6 app, LOOP body varied and nothing else:

	Body	Child centres (X)	Loop Size
A	2 activities, default	150, 310	480;160
B	same 2, @position(1500,60) / (2000,60)	1500, 2000	480;160
C	same 2, @position(160,60) / (170,60)	160, 170	480;160
D	4 activities, default	150 … 630	800;160

Same box around contents spanning 160px, 500px and 10px; only the statement count moves it. Case B is a correctness problem, not cosmetics — both children sit entirely outside their container (interior x ∈ [0,480]), and mx check reports the same error count before and after, so validation is blind to it.

It isn't a patch because of an ordering cycle: innerStartY = loopHeight/2 and loopCenterX = loopLeftX + loopWidth/2, so children are placed relative to an origin derived from the size, while the fix needs the size derived from the children. The proposal breaks that with build-first / size-after / translate-once, keeping the translation at one choke point — the same shape as applyFlowCurves and mergePosition.

It also names the decision that must be made explicitly (@position inside a container: container-relative and translated, or authoritative and exempt — recommending the former), rejects a cheap @size escape hatch as the primary fix while noting the MDL059 coupling if it is added later, and states the risk plainly: every flow containing a loop changes geometry once, which under ADR-0008 means one round of writes users did not author.

Docs only — no behaviour change. Ships with the four-case repro at mdl-examples/bug-tests/container-autosize-884.mdl (check clean).

3. chore: regenerate LSP completions for FIRST

mendixlabs#881 added FIRST to the lexer but never refreshed the committed generated completion list, so make build left a clean checkout dirty.

Verification

• govulncheck ./... under both toolchains, as above.
• make build && make test green under 1.26.6.
• The proposal's measurements were re-run against a freshly built binary after a container rollback was found to have reverted the working tree to an older build — the numbers above are from the current branch, not the stale one.
• Mendix Studio Pro validation: not applicable — no .mpr is written by any commit here.

---

Generated by Claude Code