Fix three upstream check/exec gaps (#831, #832, #833) + two corruptions found while verifying

[ako]

Fixes upstream issues #831, #832 and #833. Verifying them against real mxbuild turned up three further defects, each committed separately.

Every claim below was checked against a real build — mxbuild 11.6.6 throughout, and 10.24.24.119349 + 11.13.0 where a version question arose. No rule was added on reasoning alone.

The three issues

mendixlabs#832 — validation rules on non-persistent entities (MDL054, new)

create non-persistent entity X ( Name: String(100) not null error '…' ) passed check and exec; only a real build caught it with CE0070 "Validations rules are not allowed on entity 'X', because it is not persistable." not null and unique are validation rules — Studio Pro models "required" and "uniqueness" as rules on the entity, not column constraints.

The construct matrix came from mxbuild, not the issue text: bare not null produces CE0070 too. The report only showed the message form, and treating the message as the trigger would have left half the bug in place.

Scoped to CREATE, where the persistence kind is known. ALTER … ADD ATTRIBUTE doesn't carry it — the same limitation MDL020 has, stated in the rule comment rather than papered over.

mendixlabs#831 — XPath traversal from a variable (MDL055, new)

where [Name = $RefProduct/Mod.Product_Category/Name] passed both, then failed CE0161. The boundary is narrower than it looks:

Form	Verdict
$Var/Attr	valid
$Var/Mod.Assoc	valid — one hop
$Var/Mod.Assoc/Attr	CE0161

The obvious rule — flag a qualified segment after a variable — would reject the middle form, which builds clean. The rule keys on hop count instead. Both rewrites the error message recommends were built and confirmed at 0 errors before the text claimed they work.

mendixlabs#833 — exec didn't enforce what check rejects

Not really about MDL048. There are two validators: the exec path ran ValidateMicroflowBody, while the MDL0xx rule set lives in ValidateMicroflow, wired only into cmd_check.go and the LSP. All 17 error-severity rules were check-only, so a script that skipped check wrote microflows the build rejects. Same shape as mendixlabs#836.

Enforced via an explicit allowlist of rules verified against mxbuild (MDL047/048/055). Blanket promotion was implemented first and reverted — see below.

Three defects found while verifying

MDL009 was a false positive. It errored on when Open, Pending then, claiming Mendix requires one value per branch. A multi-value branch covering every value plus (empty) builds at 0 errors, and our own write-microflows skill documents that form — so check was rejecting valid MDL. This is why mendixlabs#833 promotes an allowlist rather than the whole set: blanket promotion would have made exec refuse valid MDL. Retired and replaced with MDL056, which checks what actually fails — the missing (empty) branch (CE0079). That half is universal (it holds even on a not null attribute), so it needs no enum lookup. Full value coverage is deliberately left out: it needs the enum's member list, and guessing would trade one false positive for another.

MDL008 (no else on an enum split) is correct and stays — mxbuild gives CE0079 per uncovered value and CE0773. That MDL008 and MDL009 are indistinguishable by inspection is precisely why the allowlist requires a build.

split type produced an unloadable project. mxcli check ✓, exec ✓, then mxbuild died before validating anything: KeyNotFoundException … at StreamingBsonUnitReader.ResolvePostponedProperties. Reproduced on 11.6.6 and 11.13.0. Two gaps, both the mendixlabs#791 shape: microflowObjectToGen had no InheritanceSplit case (the split was dropped while three flows kept pointing at its $ID), and caseValueToGen had no InheritanceCase case (every branch degraded to a bare NoCase). Diagnosed with the recipe already in the symptom table — dump, collect every $ID, check each *Pointer resolves: 27 objects / 3 dangling → 28 / 0.

Field list taken from the generated type, not the legacy serializer: legacy writes ErrorHandlingType on the split, but initInheritanceSplit has no such property.

Type-split docs taught a shape that fails the build. The skill paired case Spec with else and said else handles unmatched objects. It doesn't — else is accepted (it serializes as NoCase) but doesn't satisfy coverage, so the base entity needs its own case or the build fails CE0090. Two shipped examples had the same defect and did not build; 475's header even claimed "mx check reports 0 errors". Both build clean now on 11.6.6 and 11.13.0.

475's added base case is deliberately a terminating branch: the scenario it pins is "exactly one non-split branch continues", and a falling-through body would make two branches continue and silently retire the regression.

Also fixed

A validation error that named its own subject got the hint "X is defined later in this script — move its create statement before this one" — advice impossible to follow, since the statement it points at is the one that failed. annotateForwardRef took an ast.Statement it deliberately ignored; it now uses it.

Verification

• Full go test ./... green; make check-mdl and scripts/check-skill-mdl.sh (189 blocks) both pass.
• Every new error-severity rule was swept against all of mdl-examples/ for false positives — zero.
• Each new rule has a .fail.mdl negative test (must fail check, enforced by make check-mdl) paired with an -ok.mdl pinning the other edge, and each -ok.mdl was built with mxbuild at 0 errors.
• TestValidateMicroflowRules_UnverifiedRulesNotPromoted fails if the exec allowlist is widened without a build check.

Notes for review

• exec now refuses three constructs it previously wrote. Intended — they all fail the build — but it is a behaviour change for scripts that never ran check.
• count(…) / empty(…) in widget conditionals: unrelated to this PR's rules, but worth knowing they are not client-expression functions and surface as CE0117.
• CI gap this exposes: make check-mdl only runs check, never a build, which is how three pieces of reference material shipped a shape that fails mxbuild. A build-backed example check would close it — flagged rather than changed here.
• One cosmetic artifact left alone: describe emits an empty else block on a type split that was never authored. It re-parses and builds clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_013uQvFDd5R4eNqqita59jM8

---

Generated by Claude Code