fix(flows): six silent wrong writes in flows — written correctly or refused (#591 #698 #991 #992 #870 #175)

[ako]

Six flow statements that passed check and exec but wrote something wrong. Each one is now written correctly, or refused at both check and exec. Every one was reproduced first on an ako/TestApp copy (Mendix 11.14.0).

Fixes mendixlabs#591
Fixes mendixlabs#698
Fixes mendixlabs#991
Fixes mendixlabs#992
Fixes mendixlabs#870
Fixes mendixlabs#175

What changed

Issue	Symptom (reproduced)	Fix
#591	create list / add / remove / count / head / filter / sort in a nanoflow: CE6035 per activity. call nanoflow … on error continue: CE6035. check passed all of it.	The list actions and cast now carry the flow type's default: Abort in a nanoflow, Rollback in a microflow. This matches what Studio Pro stores (130 nanoflow actions in TestApp are all Abort). The writer emits the value and the reader reads it back. In a nanoflow, create, commit, call nanoflow and call microflow accept only on error without rollback, measured per cell. Every other clause is refused there. ValidateNanoflow now reports the nanoflow rules that previously only exec's build enforced (MDL091), plus the annotation rules.
#698	Over --mcp, the call action's error handling was dropped.	The mapper writes errorHandlingType. A custom handler, or an error-handler flow, is refused: PED's SequenceFlow has no error-handler property (checked with ped_get_schema).
mendixlabs#991	@anchor / @curve inside on error … begin … end error did nothing. describe printed no @position (or other layout) inside the handler.	Handler edges now apply the anchors, and the handler's curves are applied. The handler describer uses emitObjectAnnotations. The error edge's entry side is compared against the top side when deciding whether it is the default.
mendixlabs#992	@anchor(true: (to: top)) was parsed as to ÷ top, so no anchor was set. @curve(true: …) was dropped silently on nanoflows.	The grammar tries annotationParenValue before annotationValue. An @anchor parameter mxcli cannot use is refused (MDL092). Nanoflows now run MDL059/060.
#870	lock workflow all → CE1825. describe showed Studio Pro's lock (PauseAllWorkflows plus a selection, in WorkflowCommons) as lock workflow all;.	lock workflow $Def|Mod.Wf [pause all] and unlock … [unpause all] (Studio Pro's "Pause / Unpause instances"). The writer always writes the named selection. A bare all is refused (MDL-WF17).
#175	call workflow … on error continue → CE6035.	Added to MDL076. MDL076 is now enforced by exec. StatementErrorHandling falls back to reflection, so statements missing from the hand-kept list (call workflow, REST) are seen.

Design choices

• ADR-0011. Every new refusal is a form that mx check rejects (CE6035 / CE1825), or an annotation that was silently dropped. That makes them silent wrong writes, so they are refused under both mdl 0 and mdl 1. pause all / unpause all and lock workflow Mod.Wf are additions: before this PR they were parse errors (and describe emitted the qualified form, which did not parse).
• Handler annotations follow the main-path semantics. to: is the incoming edge, so on the first handler statement it is the error edge. from: and @curve apply to the outgoing edge. On the last statement that is the rejoin edge, which takes only from:.
• Per-case @curve stays unsupported. It is now refused on nanoflows too, matching microflows.
• Old wrong values are not rewritten. Nanoflows that an earlier mxcli wrote with Rollback on list activities stay as they are until the flow is rebuilt.

Test plan (what I ran)

• Unit tests, written to fail first: go test ./mdl/executor/ ./mdl/visitor/ ./mdl/backend/... ./mdl/exprcheck/... ./cmd/mxcli/... ./mdl/linter/..., all green.
• Revert checks: I reverted each fix and confirmed its test fails with the reported symptom:
  • Writer Rollback literal → read back Rollback.
  • Builder ehType → "".
  • ValidateNanoflow additions → no MDL091/060.
  • Grammar alternative order → TrueBranchAnchor not set.
  • Lock describe → lock workflow all;.
  • MDL-WF17 → check and exec accept it.
  • Lock writer → selection lost.
  • fix(lint): stop CONV010 and QUAL004 reporting correct code as violations #175, fix(catalog): mark java action type-parameter types unambiguously #698, Canvas annotations inside ON ERROR { } are accepted and silently ignored, and describe emits none of them — the error branch's layout is unwritable and lost on round-trip mendixlabs/mxcli#991 build/describe: these tests failed before their implementation.
• make test-integration-roundtrip passes. make test-integration-parity and make test-integration-executor each had tests that asserted the now-refused CE6035 forms (commit … on error rollback in a nanoflow, commit … on error continue, call microflow … on error continue in a nanoflow). I moved those to measured-buildable forms and re-ran them green.
• make check-conformance, make lint, make check-findings, make build: all pass.
• mx check (11.14.0, TestApp copy).
  • The original repro script: before the fix, 6 errors (CE1825 ×2, CE6035 ×4). With the fix, check refuses every bad form.
  • The corrected script (mdl 1): it builds with 0 errors. It covers nanoflow list ops and a handler with @anchor/@curve. It stores error-edge sides (2,3), handler edge (1,3) with curves 0;30/0;-30, rejoin (0,2) with curves 0;-30/-30;0, and the true edge (1,0). It also covers lock … pause all with a name selection.
• Twice-exec. Running the create or modify script a second time reported "7 documents already in sync". describe → exec of the result reported unchanged.
• Studio Pro content. I ran describe → exec on all 11 Studio Pro nanoflows plus WorkflowCommons.ACT_WorkflowDefinition_Lock and …_Unlock: "16 documents already in sync". Before this PR, the lock flows described as lock workflow all;.
• Not exercised live: an MCP write with errorHandlingType. It follows the ped_get_schema declaration, and the notify mapping already uses it.

🤖 Generated with Claude Code