[MendixMau]

Fixes #672, fixes #673.

Time cost (#687): removes 2+ false FAULTs per module verify/review (review's conformance + coverage rungs on a single-BRD or flat ledger; the coverage engine "not found" when only the Toolkit root row wires the toolkit). No new steps.

Direct lane

What changed and why: Four scripts each had their own copy of the coverage-ledger lookup, and the copies drifted. review-module.sh knew 2 of the 4 sanctioned forms and verify-module.sh knew 3. So a valid architecture/coverage-ledger.md (single-BRD) or architecture/modules/<M>-coverage-ledger.md (flat) FAULTed review's conformance and coverage rungs, while conformance-check/coverage-preflight run on their own measured it (#673). This PR adds mxtk_resolve_ledger <root> <module> in project-bin/_common.sh. It checks, in this order: the per-BRD <M>/coverage-ledger/ directory (only counts if it holds at least one *.md), <M>/coverage-ledger.md, the flat <M>-coverage-ledger.md, then architecture/coverage-ledger.md. All four scripts now use it. Each script still handles its own explicit overrides (LEDGER_FILE, positional), and their behaviour is unchanged. The helper's header cites the "duplicated discovery logic drifts" lesson (bin/lib/discover-brds.sh, CLAUDE.md "generic first").

For #672, find_toolkit_root (the existing _common.sh helper that reads the Toolkit root row of CLAUDE.local.md) is now also tried in four places: coverage-preflight.sh find_engine, the COVERAGE_CHECK lookup in verify-module.sh, and _tool() in both verify-module.sh and review-module.sh. An installed project with MXTK_ROOT unset now finds coverage-check.sh.

Row	Answer
Process	none: no gates or steps added or removed
Dependencies	project-bin/_common.sh gains one function. Projects get it through sync-project.sh, together with the four callers. Expected overlap with parked #651: it also touches verify-module.sh's coverage rung, resolve_ledger_hint and tests/wave2/test-verify-ledger-hint.sh. The hunks here are kept minimal there: resolve_ledger_hint's body, one extra candidate in the COVERAGE_CHECK loop, and a helper-load line in the fixture's hint(). Whichever PR lands second needs a small rebase.
Context cost	none: no routed or always-loaded file touched
Behaviour	n/a: scripts only
Runtime	n/a (one extra sed of CLAUDE.local.md per _tool call)

Regression risk: some modules used to get FAULT here. They are now measured, so real UNCLAIMED/PHANTOM/conformance findings can show up where a FAULT row used to be. Lookup order is unchanged for conformance-check and coverage-preflight; the existing fixtures confirm this. In review-module, multi-ledger mode now triggers on the resolved per-BRD directory (it still reads the index file beside it for BRD names), not on any coverage-ledger/ directory found next to the canonical path. In verify-module, the ledger hint (which is only used when coverage-preflight is absent) now also finds the flat form.

Field evidence: both issues were reproduced from the field run that filed them (toolkit 97c1139c, installed layout, only the Toolkit root row, MXTK_ROOT unset gives FAULT). The new fixture reproduces both against origin/master.

Fixtures (only those whose subject is a changed file):

• new tests/wave2/test-ledger-resolver.sh project-bin/_common.sh: 20/20 here, 0 pass on origin/master (12 FAIL). Runs on both layouts, single-tree and two-tree (.mpr under app/). Covers the helper order, review-module on the single-BRD and flat forms, verify's hint on the flat form, an installed coverage-preflight wired only by the Toolkit root row, and _tool via find_toolkit_root.

• test-verify-ledger-hint 4/4, test-review-conformance-per-brd 6/6, test-coverage-preflight-ledger-dir 13/13, test-coverage-phantom-scope 2/2, test-conformance-per-brd-ledger 20/20, test-conformance-absent-marker 24/24, test-conformance-baseline-scope 9/9, test-common-root-multiapp ok, test-common-windows ok, test-verify-stack-blocked 6/6, test-mxbuild-version-match 18/18, test-find-java-version ok.

• test-verify-module-446 15/16. The one failure (V3: playwright rows=1) is identical on origin/master, so it is pre-existing and not caused by this PR.

• check-scripts clean, check-portability clean, leak guard clean (LEAKGUARD_ALLOW_NO_DENYLIST=1 LEAKGUARD_BASE=origin/master), check-pr-discipline clean. No full suites were run.

• No client data anywhere in the diff

• Size cap: 5 scripts + 2 fixtures + CHANGELOG

• Test tier: fixture-level (T1), both layouts. Git Bash is unverified: the changes are plain POSIX-ish bash plus ls globbing, already used in these files.

• Golden input: n/a, because no tool output is parsed (file layout only). Both layouts are covered.

• CHANGELOG.md line, credited "— field run (coverage-preflight cannot find coverage-check.sh when the toolkit root comes from the Toolkit root row #672, review-module.sh: the single-BRD ledger (architecture/coverage-ledger.md) is not found, so conformance and coverage rungs FAULT while the dedicated checks pass #673)"

Review: pending independent review

---

Generated by Claude Code