[MendixMau]

Direct lane (changes to skills/, bug-logs/, bin/, project-bin/, project-tests/, pipelines)

What changed and why (one paragraph): Refs #670. project-bin/check-design-reaches-app.sh misread ordinary stylesheets in five ways: a one-line :root{--a:1;--b:2} read as one token with } in its value; a minified built sheet had no root block; class presence was a substring match, so .card counted as arrived when only .card-header existed; multi-line selector lists and rules inside @media were missed; var(--x, fallback) did not count as using --x. All five are fixed by one normalise_css() step (comments dropped, one selector / declaration / } per line, ; inside url(...) and strings kept) plus a whole-class matcher. Verdict names and exit codes are unchanged. It can turn a project red: a project that passed on the substring reading can now report fewer classes arrived, or 0 of N (FAIL). That is the intended correction and the changelog line says so.

Impact

Row	Answer
Process — human steps or gates added/removed; does anything new block; new stage artifacts	No step added. An existing check becomes correct: it can now FAIL (or warn with a lower count) where it passed wrongly.
Dependencies — shared files touched; order vs other open PRs; new tools/platform assumptions; new artifact reads + their producer	project-bin/check-design-reaches-app.sh, its fixture, three captured CSS fixtures, CHANGELOG.md. awk only (checked on mawk; the bracket expressions use \047, which BWK awk accepts; not run on macOS). Temp dir via ${TMPDIR:-/tmp} with an EXIT trap.
Context cost	none: no routed or always-loaded file touched.
Behaviour	n/a: scripts only.
Runtime	Measured on Linux, median of 3: 2.2 s → 6.0 s on a real project, 3.0 s → 7.2 s on the committed pair. The normaliser is about 0.3 s of that; the rest is the check now reading 29 to 38 tokens instead of 7 to 10. Time cost: per project (run after a design port, not per exec) · +4 s on a cloud Linux container · can force rework: y (a wrongly passing project now fails) · offset: maintainer OK

Field evidence — a fictional test app built with the toolkit on 2026-11-12 (Mendix 11.13, mxcli v0.28). Old → new on its real design and built sheets: design values seen 7 → 29, theme settings bound 10 → 25 of 46, classes arrived 12 → 8 of 32. Five of the classes the new check calls missing were checked by hand against the built CSS: all five are absent as classes and exist only under other names, so the old "12" was inflated. On the committed capture pair (a second fictional app): tokens arrived 9 of 10 → 32 of 38, knobs bound 10 → 31 of 46. Fixture: 70 passed, 0 failed; the same fixture against the old script fails 15 assertions, all new ones. Both layouts are exercised by the fixture.

Known limits, not fixed here: a class name with an escaped character (.sm\:hidden) and a class name appearing inside url(...) can still match falsely (the first predates this PR).

Independent review: MERGE-AFTER-FIX twice, both on the changelog line only (first misplaced inside the release-cycle paragraph, then a wrong cause given for the slowdown), fixes pushed, then MERGE, no findings at 9ed2425f. The reviewer fed a hostile stylesheet through the normaliser and found no fault. Not run on macOS or Git Bash.

• No client data anywhere in the diff (captures are from fictional test apps; reviewer checked for hosts, paths and names)
• Size cap: 1 script (+64/−12) and 1 fixture (+70), excluding captures and CHANGELOG.md
• Test tier reached: fixture on captured real input, plus a before/after run on a real project
• For a new/changed instrument: golden input captured (verbatim files and line ranges listed in the capture note), both layouts; macOS and Git Bash considered in the code, not run
• For a new skill: n/a
• CHANGELOG.md line appended in this PR, crediting the source
• New bug entries: n/a

---

Generated by Claude Code