feat(messagedefs): authorable message definition collections

[ako]

Closes #272. Implements PROPOSAL_authorable_message_definitions.md (#371, #375).

A mapping binds to one of four schema sources, and MDL could create one. Message
definitions are 74 of the 327 mappings in the demo corpus (22.6%) and were
the only other one a script could bring into existence — an XML schema holds an
imported .xsd and a web service holds a WSDL, but a message definition holds
nothing external: it is a selection over the domain model.

create message definition collection Sales.MD_Order
  folder 'Messages'
(
  definition OrderMessage for Sales.Order as 'Orders' (
    OrderId,
    TotalAmount as 'Total',
    Sales.OrderLine_Order/Sales.OrderLine as 'Lines' ( Sku, Quantity ),
    Sales.Order_Customer/Sales.Customer ( FirstName, Address example 'Kerstraat 5' )
  )
);

create import mapping Sales.IMM_Order
  with message definition Sales.MD_Order.OrderMessage
{ create Sales.Order { OrderId = OrderId } };

Plus DROP, DESCRIBE (re-executable), SHOW — there was no listing at all —
and targeted ALTER for both definitions and members.

The evidence this is right

describe → exec against ako/TestApp's hand-authored collection reproduces
Studio Pro's document exactly. The executor prints Unchanged, meaning
canon.Reconcile found the rebuilt content semantically equal and elided the
write. mxbuild 11.13/11.14: 0 errors, including mappings in both directions
bound to an authored definition.

One hand-authored document beat a 4,686-element census

The proposal was measured over 36 marketplace-module collections. Round-tripping
one hand-authored document (thank you) found five things that census had not:

1. Path is a chain of ORIGINAL names, not exposed ones, and an
   association contributes two segments — Order|OrderLine_Order|OrderLine|Amount.
   Confirmed afterwards at 4,707/4,707 once we knew to look.
2. Typed-array marker is 2, where the codec defaults to 3.
3. Every element serializes Children even when empty — the bare [2],
   same MandatoryLists rule as a rule document's Flows.
4. PrimitiveType is mapped, not passed through: Long → Integer,
   AutoNumber → Integer, Enumeration → String. A pass-through gets 279
   corpus elements wrong; TestApp caught it on a Long.
5. Example is author-set — empty in 4,686/4,686 of the corpus, set in
   TestApp. Hardcoding it empty would silently drop the one that exists, so
   example '...' is now syntax.

The round-trip test is what finds these, and the baseline matters: compare
against the stored bytes, not a re-encoding of the decoded original — a
lazily-decoded element that was never marked dirty encodes as an empty document,
so that baseline passes by comparing nothing to nothing.

The derivation most likely to be got wrong

MaxOccurs on an association follows the direction of traversal, not the
association's type — all 927 resolvable associations in the corpus are
Reference, yet 526 store 1 and 401 store -1:

holder is	cardinality	count
the association's FROM entity (following the FK)	1	496
its TO entity (the reverse)	-1	401

An association connecting the two entities in neither direction is
refused, not defaulted — a wrong cardinality exposes a list as a single
object and builds cleanly, so there is no downstream check to catch it.

TestApp carries the natural control: Mappings.Order_Customer appears in both
its definitions with a different MaxOccurs each time. Pinned as
TestFixtureCarriesTheDirectionControl.

Two proposal decisions corrected by measurement

• Inherited attributes are IN, not refused: 398 of 3,697 exposed attributes
  (10.8%). The stored Attribute names the DECLARING entity, which
  DeclaringMemberRef already resolves for mappings.
• Example is IN — see above.

Not guessed

Studio Pro pluralises a repeating element's exposed name. mxcli defaults to
the entity's own name and lets as 'Orders' say otherwise — reproducing English
inflection needs -y → -ies and an already-plural detector, and a name the
author writes beats one a heuristic guesses. Same conclusion as array-item
naming in #272's first half.

A bug the example caught

After a CREATE that resolves a folder, the cached hierarchy predates that
folder, so a later create or modify did not find the collection and wrote a
duplicate (CE0122). I checked whether it was pre-existing: JSON structures
do not hit it, but only because their create path happens to call
applyDocumentFolder first. The create branch now invalidates explicitly.

Scope

Import and export mappings, and nothing else — confirmed three ways:
generated/metamodel (11.6 snapshot) declares messageDefinition on exactly
those two types; modelsdk/gen (newer) declares the ref only in
importmappings/exportmappings/mappings, with businessevents and kafka
declaring none; and across the corpus + TestApp, of 24 collections the only
documents naming one are 8 import and 8 export mappings.

Authoring is modelsdk-only, as rules, menus and layouts are; legacy refuses with
the established message. Reading works on both engines.

Verification

• Round trip against the real document, with controls: reverting the path rule
  reports 14 diffs, reverting the marker reports 1.
• 6 executor tests with controls: reverting the direction gives
  MaxOccurs = 1, want -1; reverting the type map gives Long, want Integer.
• 9 visitor tests, 2 codec round-trip tests.
• mdl-examples/doctype-tests/40-message-definition-examples.mdl runs clean and
  builds at 0 errors.

Full suite, go vet, gofmt, make check-mdl (463 PASS) and
make check-skill-mdl are green.

Reviewer notes

• Two new lexer tokens. MEMBER (only MEMBERS existed) and EXAMPLE.
  ANTLR prefers the longest match so members still lexes as MEMBERS, and
  both are added to identifierOrKeyword so attributes called Member or
  Example still parse. COLLECTION already accepted singular and plural.
• TestNewRegistry_HandlerCountSnapshot and
  TestEveryShowAlternativeProducesAStatement both caught missing wiring during
  this work — they are doing their job. The equivalent guard does not exist for
  CREATE/ALTER/DROP; worth adding separately, since it will likely flag
  pre-existing gaps that should not ride along here.
• The merge of main needed a hand-resolved findings/mdl-executor.jsonl:
  merge=union resurrected a record main had deleted. Second time
  (see fix(mappings): refuse to rewrite a SOAP-sourced mapping instead of dropping it #369); the merge commit explains it.

🤖 Generated with Claude Code