docs(wiki): digest the cmd/mxcli findings into five bug-pattern pages

[ako]

Stacked on #356 (shared seed table and SYNC_LOG.md) — retarget to main once that merges.

87 of the 95 cmd/mxcli findings (92%) now belong to a named class. This is the tooling surface rather than the model, and the classes look nothing like the executor's.

page	findings	thesis
test-runner-cannot-fail	14	mxcli test reporting PASS for what did not hold, run, or get evaluated
local-loop-silence	16	the thing that breaks is not the thing that reports
styling-compiles-to-nothing	11	nothing validates CSS
package-operations-damage	11	handing the project to tools mxcli does not control, and being told it went fine
cli-contract-defects	14	the class with no Mendix document in it

The one that deserves its own paragraph

A test runner that cannot fail is worse than no test runner, because a real suite gets written against it and believed. @expect 1 = 2 passed. @verify — the annotation covering the harder half of Mendix testing, where a microflow's only observable effect is rows written — was parsed and read by nothing but --list. --require-assertions exited 0 on a suite where nothing asserted. A test with both @throws and @expect reported two assertions and made one.

Every other class in this wiki costs a debugging session. This one spends confidence that was never earned.

The mechanism is silent absence, not silent breakage: an annotation parsed into a struct field that no consumer reads. grep -n '\.Verify' over the package was the whole diagnosis, and the parse succeeding is what made it invisible — --list printed the annotation back, so the feature looked wired. Amplified by two result-assembly paths (after-startup runner and HTTP endpoint), which is [[duplicate-resolver-drift]] landing where its consequence is a false pass.

The remedies that held are structural: fail closed (an annotation that claims to assert and cannot be honoured is an error, and the test does not run), one constructor and one pre-run verdict function, each pinned by a test asserting it is the only call site.

Cross-area link

styling-compiles-to-nothing and rewrite-drops-unauthored-state turn out to be the same guard in two materials — the theme writer fences a digest-marked region in files the project owns and refuses a block a human edited, which is ADR-0005's guard-don't-drop applied to files instead of BSON. Its failure mode is the mirror image: a project that has silently taken ownership of a file, reported as skipped forever after.

Contract

Per maintain-wiki.md: title / category / last-synced / sources on every page, a Do not duplicate guardrail, concept-first prose. Every sources: path and every [[wiki-link]] verified before committing. Seed table extended by five rows; five rows appended to SYNC_LOG.md.

Where the digest stands

area	findings	covered
mdl/executor	248	83%
cmd/mxcli	95	92%
mdl/backend	83	—
mdl/grammar	53	—
mdl/visitor	28	—

🤖 Generated with Claude Code