Sync ako/mxcli: typed retrieve constraints, security reference checks, model-level MDL-MAP04

.claude/skills/fix-issue/findings/mdl-grammar.jsonl

@@ -72,3 +72,4 @@
 {"date": "2026-10-02", "area": "mdl/grammar", "symptom": "ako/mxcli#533: `call microflow M.MF_B(P: $P)` is a parse error (`mismatched input ':' expecting '='`) while `show page M.P(P: $P)` and a page action/data source `M.F(P: $P)` parse with an MDL-DEPR007 warning \u2014 the same argument has a different set of accepted spellings per call site", "cause": "MDL-DEPR007 (`Param: e`, R4) was registered as an alias, but only showPageArg and microflowArgV3 carried the `identifierOrKeyword COLON expression` alternative; callArgument (call microflow/nanoflow/java action/javascript action/external action/web service/database query) accepted only `=`", "file": "mdl/grammar/domains/MDLMicroflow.g4 callArgument; mdl/visitor/visitor_argument_binding.go ExitCallArgument", "fix": "Add `parameterName COLON /* @alias MDL-DEPR007 */ expression` to callArgument; ExitCallArgument records MDL-DEPR007 with the ` = ` rewrite (recordColonArgument now takes any name context). Kept the registry's RemovedIn 2: under ADR-0011 an alias deprecated in the mdl 1 era warns under mdl 0 and mdl 1 and is refused only from mdl 2 \u2014 refusing it under mdl 1 would change the frozen mdl 1 for show page", "insight": "When an alias is registered, grep every rule that binds the same construct (here: every argument rule) \u2014 a registry entry names a spelling, not the rules that accept it, so the alias coverage drifts per call site", "test": "mdl/visitor/visitor_argument_binding_test.go TestArgumentBindingAliases (call * colon cases); mdl/upgrade/argument_binding_test.go TestUpgrade_ColonArgumentOnCallStatements"}
 {"date": "2026-10-02", "area": "mdl/grammar", "symptom": "ako/mxcli#533, #569: a positional data-source argument `listview lv (datasource: microflow M.DS($Value))` reports `no viable alternative at input 'datasource'` at the property keyword, plus two cascade errors \u2014 not at the argument, and naming nothing; the create-page skill (widgets.md) and `syntax page.datasource` taught the positional form", "cause": "A widget property is predicted with full-LL lookahead over the whole `datasource: \u2026` alternative, so a failure anywhere inside it is reported at the property's first token. No argument rule had a positional alternative", "file": "mdl/grammar/domains/MDLPage.g4 microflowArgV3; mdl/grammar/domains/MDLMicroflow.g4 callArgument, showPageArg; mdl/visitor/visitor_argument_binding.go refusePositionalArgument", "fix": "Each argument rule gets a last `| expression` alternative that the visitor always refuses, at the argument's own line:column, naming `Param = <expr>` and the syntax topic. Last so the ambiguity with `Param = e` (`=` is equality in an expression) resolves to the named alternative. call workflow's `(callArgumentList | VARIABLE)` reordered to `(VARIABLE | callArgumentList)` so `call workflow M.W($ctx)` keeps meaning the context variable. Docs corrected to `M.GetData(Param = $Param)`", "insight": "To move an ANTLR error to where the mistake is, accept the mistake in the grammar and refuse it in the visitor \u2014 the error-alternative pattern. A malformed named argument (`Param = )`) still reports at `datasource`: the general prediction-level case is not fixed by this", "test": "mdl/visitor/visitor_argument_binding_test.go TestPositionalArgumentIsRefusedAtTheArgument"}
 {"date": "2026-10-05", "area": "mdl/grammar", "symptom": "mendixlabs/mxcli#1288: `add $Row to $Material/MyFirstModule.SkuRowsOfMaterial;` -> `Parse error: line 9:23 mismatched input '/' expecting ';'`. The only spelling left was `change $Material (Assoc = $Row)`, which ASSIGNS the reference set: in a loop of three appends two rows were orphaned with 0 errors from check, mx check, runtime.log and a boolean-return test. Read side had the same defect: DESCRIBE of a Studio Pro Add/Remove member printed `change $Obj (Assoc = $X)`, so a describe -> exec round trip turned an append (and even a Remove) into a set assignment", "cause": "addToListStatement/removeFromListStatement only took `TO VARIABLE`, so the Change object activity's Add/Remove member types (MemberChangeTypeAdd/Remove, already in sdk/microflows and round-tripped by the codec) had no writer; formatAction ignored MemberChange.Type", "file": "mdl/grammar/domains/MDLMicroflow.g4 associationMemberTarget; mdl/visitor/visitor_microflow_actions.go; mdl/executor/cmd_microflows_builder_actions.go addAssociationMemberChange; mdl/executor/cmd_microflows_format_action.go associationMemberChangeStatement; cmd_microflows_builder_graph.go collect{List,Object}InputVariables; validate_microflow_retrieve_single.go listUseOf", "fix": "ADD expr TO $Obj/Module.Assoc and REMOVE $X FROM $Obj/Module.Assoc [commit] [refresh] -> AddToListStmt/RemoveFromListStmt with Association set -> ChangeObjectAction with one MemberChange{Type: Add|Remove}, built through addChangeObjectAction so the member resolves exactly like a CHANGE member. Refused on an attribute or a plain Reference. DESCRIBE prints a sole Add/Remove member back in that form; an Add/Remove mixed with other members gets a trailing `-- WARNING` instead of a silent `=`. The association form's $Obj is an object input, not a list input (else MDL-RETRIEVE01 and the retrieve-typing walkers misfire)", "insight": "Measured on 11.12.2 (mx check): Add on a ReferenceSet = 0 errors; Add on an attribute AND on a plain Reference = CE0033 \"The 'Type' property of this member cannot be 'Add'.\" The issue's claim that Reference was equally affected is about CHANGE set semantics, not about Add being valid there. When an AST statement gains a second meaning for an existing field (List = object variable here), grep every type-switch on the statement: the list-input walker and the single-object rule both read List as a list. And whenever a writer gains an enum value, check the describer prints it — the codec round-tripped Type all along; only formatAction dropped it, which is the silent half of this bug", "test": "mdl/visitor/visitor_add_to_association_test.go; mdl/executor/cmd_microflows_builder_add_to_association_test.go; cmd_microflows_format_action_test.go TestFormatAction_ChangeObject_AssociationAddRemove; mdl-examples/bug-tests/1288-add-remove-association-member.mdl", "refs": ["mendixlabs/mxcli#1288"], "ce": ["CE0033"]}
+{"date": "2026-10-07", "area": "mdl/grammar", "symptom": "mendixlabs/mxcli#1281: two predicates on one XPath step fail to parse. `retrieve $x from M.Location where [M.A/M.TenantUser[Status = 'Active'][AnonymizedAt = empty]/M.B = '[%CurrentUser%]']` -> `mismatched input '/' expecting ';'`; ending the path on the step -> `missing ']' at '['`. One predicate with `and` passed, and Mendix accepts the consecutive form (reporter: access rules, mx check 0 errors on 11.12.4).", "cause": "xpathStep was `xpathStepValue (LBRACKET xpathExpr RBRACKET)?` and ast.XPathStep had a single Predicate field, so every consumer (serializers, the rename rewriter, the widget/retrieve member-ref walkers) assumed one.", "file": "mdl/grammar/domains/MDLPage.g4 xpathStep; mdl/ast/ast_expression.go XPathStep.Predicates; mdl/visitor/visitor_xpath.go buildXPathStep; mdl/visitor/visitor_page_v3.go xpathPathToString; mdl/executor/cmd_microflows_helpers.go; mdl/executor/validate_microflow.go; mdl/executor/validate_widget_member_refs.go; mdl/xpathrefs/rewrite.go", "fix": "`*` on the predicate group; Predicates []Expression in source order; every consumer loops. Kept separate rather than folded into one `and`: `[reversed()]` is also a step predicate and is not a condition, and folding would rewrite the user's constraint on describe.", "insight": "The stored-constraint reader (ParseXPathConstraint) did NOT report this as a failure: ANTLR recovery consumed the stray `[b]` up to EOF, so the EOF check from #772 passed and the round trip silently returned `Entity[a]` — dropping the second predicate. A grammar-level parse error with error listeners removed can still look like a full parse; test via visitor.Build (errors surfaced) as well as the listener-free helper. The ast field rename made the compiler enumerate every consumer — cheaper than grepping for walkers. mx check control: the scaffold's own `= '[%CurrentUser%]'` against a non-User entity gave CE0161 for BOTH the two-predicate and the `and` form; only the paired run showed it was the scaffold.", "test": "mdl/visitor/visitor_xpath_test.go TestXPath_ConsecutiveStepPredicates; mdl-examples/bug-tests/1281-consecutive-xpath-step-predicates.mdl"}