Sync ako/mxcli: LIST FOLDERS, OData publishing + external entities, test-runner cleanup, check-rule corrections

[ako]

Thirty-one commits from the mxcli-formula1 findings loop, grouped by theme.

Folders: read the layout back

• LIST FOLDERS [IN Module] — MOVE could place a document in a folder, but nothing could read the placement back: SHOW STRUCTURE groups by document type at every depth and never names a folder, DESCRIBE answers for one document at a time. So a move could not be confirmed, and an intended layout could not be diffed against the real one, without opening the .mpr as SQLite. Empty folders ([0]) and documents still at the module root are listed too — a listing that hid them could not round-trip against an intended layout.
• MOVE JAVA ACTION and MOVE ODATA SERVICE — neither CREATE form takes a folder clause, so MOVE is the only way those documents ever leave the module root. Both reduce to the existing reparent primitive. Watch the discriminator: MOVE FOLDER is told apart by the absence of a doctype keyword, so every keyword added to the rule must also be added to that condition.

Published OData services & external entities

• Publish Integer as Edm.Int64, not Int32 — and say when an enum is published as a string (EnumerationAsString paired with Edm.String). Found by publishing one attribute of every Mendix type in a single service and letting mxbuild adjudicate the whole table at once; that also surfaced the enum case, which was only suspected.
• Resolve constant credentials for the $metadata fetch — follow-up to the literal-credential fix. HttpUsername: '@Module.ApiUser' is a STRING_LITERAL, so the visitor's isLiteral flag said "literal" and the fifteen characters @Module.ApiUser went out as the username. A syntactic classification is not a semantic one: only the executor can say whether a quoted string names a constant. Now resolves the constant's design-time default, which is exactly what Studio Pro sends on the same fetch.
• Use the client's own credentials to fetch $metadata — previously the fetch went out unauthenticated and returned an empty client.
• Apply published-entity changes on modify — the modify branch now rebuilds EntityTypes/EntitySets and carries existing roles through.
• Honour the contract's capability annotations — Countable, NonFilterableProperties, NonSortableProperties.
• Read an attribute's OData mapping back — ODataMappedValue and ODataMappedPrimitiveCollectionValue were dropped on read.
• Stop renaming an external attribute called name — name was on the reserved list with the comment "Mendix system-managed attribute for the object name". It is not. Testing the whole list at once against mxbuild earned the seven entries that stay (id, owner, changedBy, changedDate, createdDate, type, context, all real CE7247s) and removed the one that was folklore. Two existing tests pinned the old answer and were corrected.

Microflows & pages

• Write the InheritanceSplit and its case values — previously serialised without them.
• Stop inventing an else on a type split in DESCRIBE.
• Pass a dynamic query expression through unquoted — a computed SQL string was being quoted as a literal.
• ALTER PAGE: reach widgets inside a customContent column.
• ALTER PAGE: set an action button's caption via CaptionTemplate.

Security & structure

• CREATE OR MODIFY MODULE ROLE — the idempotent form the other security statements already had.
• Don't tell a statement to move before itself.

Check rules

• Retire the false-positive MDL009; add MDL056 for (empty).
• Reject XPath association traversal from a variable (MDL055).
• Reject validation rules on non-persistent entities (MDL054).
• Advertise the three OData properties MDL-ODATA01 forgot.
• Refuse what the XPath constraints check already rejects (mxcli check doesn't flag id = <String> XPath retrieve constraints (CE0161 on real compile) — MDL048 exists in source but isn't in a release yet #833).

Test runner

• Implement @cleanup rollback — the annotation's documented default, previously parsed and ignored. The endpoint now wraps each call in startTransaction()/rollbackTransaction(), verified against Postgres with @cleanup none as the in-run control. A rollback that fails is reported per test, never silent.
• Run the app's own after-startup microflow during --local — without it, a suite depending on startup state passed under --attach and failed under --local. --skip-app-startup opts out; the run always prints which of the two it did.
• Say which after-startup microflow a local run displaces.
• Resolve a project-relative path for --list too — listing that could not find a path execution finds is a confusing split.

Theme & docs

• Add the widget-module layer, so Data Grid 2 follows the palette.
• Re-point the filter-operator popovers at the palette — four rules in _datagrid-filters.scss baked a light-mode shadow while taking their background from the palette, which is why it read as a partial fix rather than an untouched widget.
• Fix the type-split microflow examples that fail CE0090.
• Ten symptom rows appended to the fix-issue table.

Both theme fixes were verified in the compiled CSS by line number, not in the source — a rule must land after the widget module's own or the cascade eats it, and a theme-cache file older than the SCSS you just wrote is a stale compile.

Verification

Every change is covered by unit tests; grammar changes additionally went through the doctype integration gate (go test -tags integration -run TestMxCheck_DoctypeScripts) on both the modelsdk and legacy engines, which builds each script with real mxbuild. The lesson recorded from an earlier miss: for a grammar change the control sweep must run that gate, not mxcli check.