From 32144d9ba6126553c8d10f82df02ef6bee9ef40b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 30 Oct 2026 21:38:14 +0000
Subject: [PATCH 1/2] fix(skills): correct rules that mxcli v0.25-v0.29 made
 wrong or obsolete

From the mxcli v0.29 compatibility audit (changelog-level, 2026-10-30).
- STOP 21: alter navigation/menu (v0.28) and in-loop alter microflow / replace body
  of (v0.29) exist; the describe-first rule stays.
- STOP 1b: bare Editable: <expr> since v0.25; quoted-form trap only below v0.28.
- learned-mdl-cannot-express.md: filemanager, tab Badge, app title, Visible: roles(),
  sidebartoggle are buildable from their version.
- learned-detection-gaps.md (4 rows), platform-link.md, learned-file-upload-widget.md:
  name the fixing version.
- No more auto-created <Module>.User assumption (gone since v0.27).
Nothing deleted; older-version guidance stays version-gated (nothing re-probed).
skills/generated/ re-rendered (mdl-rules.sh --check in sync).
Baseline 64193 -> 64235 words (budget 80000).
Checks: test-mdl-rules 43/0, test-mdl-scan 52/0, test-routing-tier 26/0; leak guard clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018LeNWZV2sVH62vkgfYh5u5
---
 CHANGELOG.md                         |  1 +
 skills/design-artifacts.md           |  3 ++-
 skills/generated/rules-access.md     |  4 ++--
 skills/generated/rules-any.md        |  4 ++--
 skills/generated/rules-entity.md     |  4 ++--
 skills/generated/rules-microflow.md  |  6 +++---
 skills/generated/rules-page.md       |  8 ++++----
 skills/generated/rules-workflow.md   |  6 +++---
 skills/learned-detection-gaps.md     |  8 ++++----
 skills/learned-file-upload-widget.md |  2 +-
 skills/learned-mdl-cannot-express.md | 10 +++++-----
 skills/learned-mdl-preflight.md      |  4 ++--
 skills/learned-multilingual-app.md   |  2 ++
 skills/learned-stylegallery.md       |  3 ++-
 skills/platform-link.md              |  2 +-
 15 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b057dda..ac7621a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(skills): **skill text no longer tells agents that mxcli v0.25–v0.29 cannot do things it now does**: STOP 21 said `ALTER NAVIGATION` does not exist and restatement is the only write — it now points at `alter navigation`/`alter menu` (v0.28, mendixlabs/mxcli#1522) and in-loop `alter microflow`/`replace body of` (v0.29, ako/mxcli#1693), keeping its describe-first rule; STOP 1b now writes the bare `Editable: <expr>` (v0.25) and limits the quoted-form trap to mxcli < v0.28 (#1567); `learned-mdl-cannot-express.md` marks file upload (`filemanager`, v0.27), tab `Badge:` (v0.29), app title (v0.29), role visibility `Visible: roles(…)` (v0.27) and `sidebartoggle` (v0.28) buildable from their version; four `learned-detection-gaps.md` rows (terminators, `if` without `else` in a handler, `Class` on a snippet call, property sets below 10.24.24) and `platform-link.md` now name the mxcli version that fixed them; three passages no longer assume mxcli auto-creates `<Module>.User` (gone since v0.27, #1474). Nothing deleted: old-version guidance stays, version-gated, because nothing was re-probed. Baseline 64,193 → 64,235 words. Source: mxcli v0.29 compatibility audit 2026-10-30
 - fix(doctor, sync-project, speed-setup): **doctor says when the speed fixes never reached a project**: `bin/exec.sh`, `bin/_common.sh` or `bin/lint-gate.sh` without the 2026-10-29 speed code (marker per file) gives a Machine health warning "speed fixes not active", and the Recommended fix leads with the exact `sync-project.sh --upgrade-bin ...` command (exec.sh always with its `_common.sh`; each copy backed up) before any other advice, because every other number measures the old scripts; `sync-project.sh` names the speed fixes on a hand-edited exec.sh / _common.sh that has the exit-code fix but not the speed work; `skills/speed-setup.md` has Claude show each local edit in one line and ask before replacing. Field: an English colleague's ExpenseTracker analysis after the toolkit update still showed a full mxbuild on every change (45.5 min, 57% of all exec time) with 15 drifted scripts in bin/; reproduced here with the real pre-#587 exec.sh / _common.sh / lint-gate.sh — doctor names all three, sync names exec.sh and refreshes the two unedited ones — Maurits (mauritscgvisser)
 - fix(doctor, speed-setup): **doctor no longer says "None needed" next to a verdict of "5x slower"**: when process starts are fast but one bench step is 5x+ the reference and 2 s+ slower, the Recommended fix names that step (slow git status: `git config core.untrackedCache true` / `core.fsmonitor true`, no admin rights); a project inside a OneDrive / Dropbox / Google Drive / iCloud folder gets a Machine health warning and "move the project to a local folder" as the fix; low-memory advice now offers "restart the computer" before `--cleanup`; the bench's git step runs one untimed warm-up so a stale index after a copy or clone no longer reads as slow (field, ab-581/gk: 18.3 s cold, 31 ms warm); `skills/speed-setup.md` tells Claude never to say deno, mxbuild or helper process to a user. Field run: ab-581/gk on Linux, bench 14.7 s vs 10.9 s, "None needed" correctly; a project under a OneDrive path, move advice shown — Maurits (mauritscgvisser)
 - fix(gate-check, gate-cache): **the closeout verdict cache also keys on file CONTENT, so an overwrite that keeps an old mtime (`cp -p`, `rsync -t`, `tar x`, `unzip`, `touch -d`) can no longer replay a stale verdict**: a signed triage.md copied over a FAIL one still printed the cached Stage 0 FAIL (PR #589 review); the cache now stores one `find | sort | xargs cksum | cksum` signature of the project files (skipping .git, node_modules, .mxtk, mprcontents, deployment, *.mpr, files over 1 MB) and any difference, or a signature that cannot be computed, re-evaluates; new `tests/wave2/test-gate-cache.sh` (hit, edit/delete/waiver miss, cp -p miss, TTL 0, 'not evaluated' line); `MXTK_GATE_CACHE_TRACE=1` prints `gate-cache: hit|miss` on --closeout. Field run: ab-581/base copy (197 MB, 633 hashed files) - signature 28 ms, cache hit 1464 -> 1498 ms vs 2567-2786 ms full evaluation - PR #589 reviewer, OlafFede (#583) — OlafFede (#583)
diff --git a/skills/design-artifacts.md b/skills/design-artifacts.md
index d795e43f..112bc819 100644
--- a/skills/design-artifacts.md
+++ b/skills/design-artifacts.md
@@ -416,7 +416,8 @@ The gate is all four, and 3 and 4 are the ones projects skip:
 2. the gallery module builds with 0 CE errors;
 3. the gallery home page is **in a navigation profile and granted to a role a demo user actually
    holds** — check with `SHOW MODULE ROLES IN <GalleryModule>`, because a security script that was
-   drafted and never executed leaves every grant on the auto-created `.User` role, and then the
+   drafted and never executed leaves every grant on the auto-created `.User` role (mxcli < v0.27) or,
+   on v0.27+, on no role at all (mendixlabs/mxcli#1474), and then the
    first attempt to screenshot the gallery silently measures whatever the demo user lands on
    instead;
 4. **someone opened it and wrote down what they saw.**
diff --git a/skills/generated/rules-access.md b/skills/generated/rules-access.md
index a617fbbb..72bc4f34 100644
--- a/skills/generated/rules-access.md
+++ b/skills/generated/rules-access.md
@@ -46,7 +46,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 |---|---|---|---|---|
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | The old, wider rights survive the narrowing `grant`. | access |
 | 16 🔎 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[Decision_Partner = '[%CurrentUser/PLM.Account_Partner%]']`. **Fix (confirmed working):** `[PLM.Decision_Partner/PLM.Partner/Administration.Account_Partner = '[%CurrentUser%]']` — walk Partner→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Invalid Mendix XPath, not an mxcli bug: `CE0161` every time. The fixed form is mxcli-safe — no GUI fallback. | access |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
@@ -271,7 +271,7 @@ Every row was found in the field: **a green result only certifies what its rung
 | A non-idempotent statement anywhere in a script — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, `CREATE MICROFLOW` on a name that exists | rungs 1–4 **on the re-run**, because the model is still valid | reading the model back and counting against the plan (`DESCRIBE MICROFLOW`, `SHOW MICROFLOWS`), or a from-empty replay | the failing statement **stops the run** (v0.27+ rolls every edit back; older versions skip everything below it), while the mxbuild gate reports 0 errors on a model that is merely missing work. Found when a microflow quietly lost a call it had had an hour earlier. Use `create or modify` everywhere; see `skills/learned-mdl-preflight.md` STOP row 22 | same |
 | A data widget on a page some role can open without read access to the widget's entity — even in a section that role never sees (BUG-94: no role-scoped visibility) | rungs 1–3, **and a bare `mx check` on a scratch copy** (cause of the difference not isolated) | exec.sh's mxbuild gate: CE2729 per widget attribute | Give that role read under an XPath no row satisfies (`[Assoc = empty and Assoc != empty]`), or move the widget to a page only the reading roles open. A clean scratch probe is not a pass for pages with security-scoped widgets — gate on the real exec | card-disbursement requirements-driven build, 2026-09-26 |
 | `[%CurrentUser%]` in a retrieve inside a microflow a REST, scheduled or system-context path can reach | rungs 1–5, lint, and every UI journey | rung 6 **on the system-session path only**: *"token cannot be used in a system session"*, the operation answers 500 | Look the account up by login name — `learned-microflow-patterns.md` → `[%CurrentUser%]` | card-disbursement requirements-driven build, 2026-09-27 |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
 ## Operating rules that fall out of this table
diff --git a/skills/generated/rules-any.md b/skills/generated/rules-any.md
index e7c11eca..9924721f 100644
--- a/skills/generated/rules-any.md
+++ b/skills/generated/rules-any.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
@@ -113,7 +113,7 @@ Every row was found in the field: **a green result only certifies what its rung
 | Construct that looks fine | Green through | First oracle that catches it | Rule / fix | Ref |
 |---|---|---|---|---|
 | A non-idempotent statement anywhere in a script — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, `CREATE MICROFLOW` on a name that exists | rungs 1–4 **on the re-run**, because the model is still valid | reading the model back and counting against the plan (`DESCRIBE MICROFLOW`, `SHOW MICROFLOWS`), or a from-empty replay | the failing statement **stops the run** (v0.27+ rolls every edit back; older versions skip everything below it), while the mxbuild gate reports 0 errors on a model that is merely missing work. Found when a microflow quietly lost a call it had had an hour earlier. Use `create or modify` everywhere; see `skills/learned-mdl-preflight.md` STOP row 22 | same |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
 ## Operating rules that fall out of this table
diff --git a/skills/generated/rules-entity.md b/skills/generated/rules-entity.md
index 34766d11..9e5772d3 100644
--- a/skills/generated/rules-entity.md
+++ b/skills/generated/rules-entity.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
@@ -261,7 +261,7 @@ Every row was found in the field: **a green result only certifies what its rung
 | `AutoCreatedDate` / `AutoOwner` attributes a page must show | rungs 1-3 (v0.26.0): `check` accepts, notes MDL022 | They become system members `createdDate` / `owner`; a lab run could not bind them in a widget. `date` as a type is refused (MDL-DEPR160: `DateTime` with `not localized`) | For a **bindable** audit field use a plain `DateTime` or `String` attribute a microflow sets | lab run, 2026-10-15 |
 | A data widget on a page some role can open without read access to the widget's entity — even in a section that role never sees (BUG-94: no role-scoped visibility) | rungs 1–3, **and a bare `mx check` on a scratch copy** (cause of the difference not isolated) | exec.sh's mxbuild gate: CE2729 per widget attribute | Give that role read under an XPath no row satisfies (`[Assoc = empty and Assoc != empty]`), or move the widget to a page only the reading roles open. A clean scratch probe is not a pass for pages with security-scoped widgets — gate on the real exec | card-disbursement requirements-driven build, 2026-09-26 |
 | `get workflows for $X` on an entity no workflow uses as its context yet | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE1870 | Stub the helper and write its body in the same step as the workflow | BUG-149 |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
 ## Operating rules that fall out of this table
diff --git a/skills/generated/rules-microflow.md b/skills/generated/rules-microflow.md
index 6ca7f984..d31b4dec 100644
--- a/skills/generated/rules-microflow.md
+++ b/skills/generated/rules-microflow.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. | microflow |
@@ -716,13 +716,13 @@ Every row was found in the field: **a green result only certifies what its rung
 | `CREATE Entity (...) COMMIT;` with the result **discarded** (no `$Var =`) | rungs 1–3 | native `mx check`: `CE6005 "The 'Entity' property is required."` | Always assign every CREATE's result, even to a variable nothing reads: `$Row = CREATE ...` | exam-prep app project, 2026-08-25; found by bisection of a seeding script |
 | A **workflow branch point** in a `create workflow` script: a `DECISION`, or a call-microflow task with Boolean or enumeration outcomes (both go through the same outcome writer) | rungs 1–4, lint, **and rung 6 within one deploy**: every journey that starts and finishes an instance passes | rung 6 **across a restart or redeploy**. An instance left paused after the decision comes back `Incompatible` (*"A selected outcome has been replaced in the already executed path"*), even when the restart changes nothing in the model | mxcli writes condition outcomes with no `PersistentId`, so the runtime gives them a new identity on every load. There is no MDL fix. Once per workflow, probe it: start an instance, let it stop at the first task after a decision, restart the app, read the instance's state. Until upstream fixes it, the app's workflow admin page must list and handle `Incompatible` instances. Note what the ladder cannot express here: the defect is not in any one deploy, it is *between* two | BUG-141 |
 | `create import mapping` array-to-child binding | rungs 1–4; `DESCRIBE IMPORT MAPPING` looks correct | live retrieve after a real `import from mapping`: child list empty | Unverified-until-proven-live; severity not yet classified — read BUG-99's hold before blaming mxcli | BUG-99 |
-| An `if` with no `else` inside an `on error { }` handler body | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE0079 / CE0773 — the `if`'s false flow is not configured | Keep handler bodies straight-line calls; move the branching into a sub-microflow the handler calls | card-disbursement requirements-driven build, 2026-09-26 |
+| An `if` with no `else` inside an `on error { }` handler body — **mxcli < v0.29** (fixed by ako/mxcli#1455) | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE0079 / CE0773 — the `if`'s false flow is not configured | Keep handler bodies straight-line calls; move the branching into a sub-microflow the handler calls | card-disbursement requirements-driven build, 2026-09-26 |
 | An entity, attribute or Java action parameter named with a Mendix-reserved word — `Case` failed as both an entity and a Java action parameter; `Context` as an attribute | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE7247 | Qualify the name (`CustomerCase`, `ApprovalContext`). The reserved list is Mendix's, not MDL's, so quoting does not help — mxcli's bundled `check-syntax` skill lists what it knows (`syntax domain-model keywords` lists MDL's keywords, not these) | lab run, 2026-09-26; BUG-149 |
 | `[%CurrentUser%]` in a retrieve inside a microflow a REST, scheduled or system-context path can reach | rungs 1–5, lint, and every UI journey | rung 6 **on the system-session path only**: *"token cannot be used in a system session"*, the operation answers 500 | Look the account up by login name — `learned-microflow-patterns.md` → `[%CurrentUser%]` | card-disbursement requirements-driven build, 2026-09-27 |
 | `get workflows for $X` on an entity no workflow uses as its context yet | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE1870 | Stub the helper and write its body in the same step as the workflow | BUG-149 |
 | A `commit` (or `create … commit`) **inside a loop** — and every other shape defect `mxcli lint` has a rule for (CONV011, empty container MPR006, empty nanoflow MPR002) | rungs 1–4 **including exec.sh's mxbuild gate**, and `mxcli check` (whose MDL001/MDL067 hints are not lint, however the script header labels them) | `mxcli lint` — but only if something *runs* it | On a 2026-09-24 field project the gate-agent, where lint was an optional step, had been spawned 0 times against 21 `exec.sh` runs and 234 raw `mxcli exec` runs; `lint-gate.sh` had run twice, by hand, to seed a baseline. A migration flow shipped three commits-in-a-loop under "✅ applied · mxbuild clean". Fix: `exec.sh` runs `lint-gate.sh` after every clean mxbuild and writes the lint verdict into the BUILD-LOG row (`LINT ROSE` exits 4, write kept, `SKIP_LINT=<reason>` recorded). **An instrument that lives only in an agent definition is a suggestion; count its BUILD-LOG rows before claiming coverage** | a marketplace guest-group migration, 2026-09-24 |
 | `Title = null` (or any `= null`) as an **XPath retrieve constraint** | rungs 1–3 — `check --references` clean, exec succeeds, and mxcli's **own OQL engine evaluates the query** and returns rows, so even a read-back looks right | native `mx check` / mxbuild: CE0161 | XPath has no `= null`; write `not(Title)` / `Title != ''` for the empty test. Note what makes this one expensive: mxcli's query engine is more permissive than the model loader, so "I ran the query and it worked" is **not** evidence the constraint is legal | field build (Maurits Visser), 2026-09 |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 | An object created in a page-triggered microflow and saved only via `commitInSeparateDatabaseTransaction` | every model-side gate, forward-only journeys, admin test users | a journey with a browser-Back step and a 5xx check, run as the least-privileged role | After Back the runtime checks Create on the request's uncommitted copy: `Attempt to illegally add an object to the state` (HTTP 560), and every server-backed widget on the page fails. `rollback $X refresh` before the flow ends; see `learned-microflow-patterns.md` | #565 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
diff --git a/skills/generated/rules-page.md b/skills/generated/rules-page.md
index d7f329f3..d7b66ae6 100644
--- a/skills/generated/rules-page.md
+++ b/skills/generated/rules-page.md
@@ -45,10 +45,10 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 1 🔎 | Use `visible:` or `editable:` **conditional expressions** on containers **inside a `datagrid customContent` column** | **STOP → Studio Pro by hand** | mxcli writes blank `AttributeIdentifier` → `StorageLoadException` on SP open; mxbuild passes clean (BUG-18). Safe CLI alternative: `dynamictext (Attribute: "State")` renders enum caption natively. Do NOT use `ContentParams: [{1} = toString("State")]` inside customContent — resolves as attribute path → CE1613. Per-value colours: set them in Studio Pro. | page |
-| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write it as an expression, `Editable: [<expr>]` — never the quoted string `Editable: '<expr>'`.** (`Visible: [<expr>]` and `ALTER PAGE … SET Visible/Editable = [<expr>]` work.) | The quoted form is dropped with no message, so the field is silently always editable; `check` and `exec` are both silent. Read the page back with `describe page`. | page |
+| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated, MDL-DEPR081).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
 | 4 | Bind a widget to the `AutoChangedBy` system attribute | **STOP → omit it, or bind `AutoChangedDate` instead** | `check` passes, then `mx check` CE1613 (`changedBy` no longer exists); lint does not flag it. | page |
 | 12 🔎 | Put anything but a bare attribute or a quoted literal in a `dynamictext`'s `ContentParams` — `toString(Attr)`, `$currentObject/Attr`, `if … then … else`, any function | **Bind a bare attribute (`{1} = Attr`) or a quoted literal, nothing else.** A computed label becomes data: a stored or derived String attribute, bound bare. Tone variants go in `DynamicClasses`, which takes a real expression (and there *needs* the prefix: `'if $currentObject/State = Enum.Value then ...'`). | An expression is stored as an attribute path → CE1613 at mxbuild; `if … then … else` passes `check` and `exec` (BUG-142). | page |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | CE6083 at the gate. `Class: 'form-vertical'` then built clean but changed nothing on screen where the theme's dataview rules decide the layout — the look caught it, no gate could. | page |
@@ -566,8 +566,8 @@ Every row was found in the field: **a green result only certifies what its rung
 | A page layout migrated with `ALTER PAGES … WHERE LAYOUT = X`, in a project whose page scripts **hardcode** `Layout:` inside `create or replace page` | rungs 1–6 — every rung, including live runtime: the app loads, every page renders, every journey passes. There is no error anywhere | a screenshot **of the nav shell** on every page, or `grep -l 'Layout: <old>' mdlsource/` after the migration | `create or replace page` rewrites the page **wholesale**, layout included — so re-running any older page script silently reverts that page to the old shell, and the app ships **two navigation shells at once**. Found when 4 of 7 screens had no navigation at all, just a bare hamburger, after a UI fix loop re-ran five page scripts. A layout migration is not done until the `Layout:` literal is fixed **in the source scripts**; the `ALTER` is a one-shot, the scripts are the repeat offender | field build (Maurits Visser), 2026-09 |
 | A pluggable **combo box filter with `lazyLoading: true`** whose options data source also sets the **preset value** | rungs 1–4, lint, and every scripted check — the model is valid and the list *is* filtered | rung 6, by eye, **before touching the filter**: the list is already narrowed by the preset while the filter looks empty (no value, no clear button) until its menu is first opened | Lazy loading defers the options source, so the preset it sets is not rendered until first open. Turn lazy loading off for short lists (≤10 options). Before the build, check every pluggable property that changes *when* data loads (lazy loading, load-on-open), on any widget that should show a value on page load | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
 | A widget **inserted into an existing container** whose theme pins `height` on **positional row classes** (`widget-row-N` and kin) | rungs 1–4, lint, and every scripted check — the MDL insert is correct and the widget renders | rung 6, by eye: the next row overlaps the inserted widget and covers part of it (here the filter's clear button) | The theme sized rows by position, not content, so a taller row 1 runs under row 2. Before an insert into an existing container, grep the theme SCSS for fixed `height` on that container's row/position classes; if found, add a `:has(<new widget>)` rule adjusting both rows | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
-| A **`Class` (or `Style`) on a `SNIPPETCALL`** — `alter page … set (Class: 'x') on <snippetcall>` | rungs 1–4, lint, **and DESCRIBE**, which shows the class on the call | rung 6, a DOM probe: `document.querySelector('.x')` is null on every page that carries it | A snippet call renders **no element of its own**; the snippet's widgets are inlined into the parent, so the class has nothing to sit on. Put the class on the container around the call, or on the snippet's own top-level container. Found when a stepper marker on 6 snippet calls changed nothing on screen with every gate green | field run, mxcli v0.26.0, 2026-10-14, [#336](https://github.com/MendixMau/mxcli-project-toolkit/issues/336) |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| A **`Class` (or `Style`) on a `SNIPPETCALL`** — `alter page … set (Class: 'x') on <snippetcall>` | rungs 1–4, lint, **and DESCRIBE** on mxcli < v0.28; since v0.28 `check` warns (mendixlabs/mxcli#1511) | rung 6, a DOM probe: `document.querySelector('.x')` is null on every page that carries it | A snippet call renders **no element of its own**; the snippet's widgets are inlined into the parent, so the class has nothing to sit on. Put the class on the container around the call, or on the snippet's own top-level container. Found when a stepper marker on 6 snippet calls changed nothing on screen with every gate green | field run, mxcli v0.26.0, 2026-10-14, [#336](https://github.com/MendixMau/mxcli-project-toolkit/issues/336) |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 | An object created in a page-triggered microflow and saved only via `commitInSeparateDatabaseTransaction` | every model-side gate, forward-only journeys, admin test users | a journey with a browser-Back step and a 5xx check, run as the least-privileged role | After Back the runtime checks Create on the request's uncommitted copy: `Attempt to illegally add an object to the state` (HTTP 560), and every server-backed widget on the page fails. `rollback $X refresh` before the flow ends; see `learned-microflow-patterns.md` | #565 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
diff --git a/skills/generated/rules-workflow.md b/skills/generated/rules-workflow.md
index ab13f6a6..a7239094 100644
--- a/skills/generated/rules-workflow.md
+++ b/skills/generated/rules-workflow.md
@@ -45,7 +45,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | Callee created in the same script: `check --references` skips the call, `exec` auto-fills the `WITH` mapping, `mx check` CE0117. | workflow |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
@@ -114,10 +114,10 @@ Every row was found in the field: **a green result only certifies what its rung
 | Construct that looks fine | Green through | First oracle that catches it | Rule / fix | Ref |
 |---|---|---|---|---|
 | A non-idempotent statement anywhere in a script — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, `CREATE MICROFLOW` on a name that exists | rungs 1–4 **on the re-run**, because the model is still valid | reading the model back and counting against the plan (`DESCRIBE MICROFLOW`, `SHOW MICROFLOWS`), or a from-empty replay | the failing statement **stops the run** (v0.27+ rolls every edit back; older versions skip everything below it), while the mxbuild gate reports 0 errors on a model that is merely missing work. Found when a microflow quietly lost a call it had had an hour earlier. Use `create or modify` everywhere; see `skills/learned-mdl-preflight.md` STOP row 22 | same |
-| A **`PARALLEL SPLIT` path with no terminator node** — i.e. every scripted split, since MDL cannot write one | rungs 1–4, and in **both directions**: `check`, `exec`, `DESCRIBE WORKFLOW`, `mxbuild` and native `mx check` report identically on the broken and the repaired model | a **live run**: count the tasks the engine opens at the split. Consecutive *End of parallel split path* rows with no task between them | `bin/wf-add-path-terminators.py <unit> --apply` after the script, and after every later script that rewrites the workflow; verify by running it, never by building it | BUG-121, `learned-workflow-patterns.md` §23 |
+| A **`PARALLEL SPLIT` path with no terminator node** — every split written by mxcli **< v0.22**; v0.22+ writes the marker itself, and v0.29+ leaves it out below Mendix 10.21, where the type does not exist (ako/mxcli#1163) | rungs 1–4, and in **both directions**: `check`, `exec`, `DESCRIBE WORKFLOW`, `mxbuild` and native `mx check` report identically on the broken and the repaired model | a **live run**: count the tasks the engine opens at the split. Consecutive *End of parallel split path* rows with no task between them | `bin/wf-add-path-terminators.py <unit> --apply` after the script, and after every later script that rewrites the workflow; verify by running it, never by building it | BUG-121, `learned-workflow-patterns.md` §23 |
 | A **workflow branch point** in a `create workflow` script: a `DECISION`, or a call-microflow task with Boolean or enumeration outcomes (both go through the same outcome writer) | rungs 1–4, lint, **and rung 6 within one deploy**: every journey that starts and finishes an instance passes | rung 6 **across a restart or redeploy**. An instance left paused after the decision comes back `Incompatible` (*"A selected outcome has been replaced in the already executed path"*), even when the restart changes nothing in the model | mxcli writes condition outcomes with no `PersistentId`, so the runtime gives them a new identity on every load. There is no MDL fix. Once per workflow, probe it: start an instance, let it stop at the first task after a decision, restart the app, read the instance's state. Until upstream fixes it, the app's workflow admin page must list and handle `Incompatible` instances. Note what the ladder cannot express here: the defect is not in any one deploy, it is *between* two | BUG-141 |
 | `get workflows for $X` on an entity no workflow uses as its context yet | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE1870 | Stub the helper and write its body in the same step as the workflow | BUG-149 |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
 ## Operating rules that fall out of this table
diff --git a/skills/learned-detection-gaps.md b/skills/learned-detection-gaps.md
index d0cdd90b..9d0be3db 100644
--- a/skills/learned-detection-gaps.md
+++ b/skills/learned-detection-gaps.md
@@ -37,12 +37,12 @@ Every row was found in the field: **a green result only certifies what its rung
 | `elseif` in a page/widget expression (DynamicClasses, Visible, …) | rungs 1–3 | native `mx check`: CE0117 | Nested `else if` — the native page-expression parser has no `elseif` token (microflows compile it away; page expressions pass through). Already a preflight bullet: `learned-mdl-preflight.md` | a product-provisioning PoC project, 2026-08-13 |
 | **Quoted** association-path / attribute bindings: `attribute: "Assoc/Attr"`, quoted names in `attributes: [...]`, `$Obj/"Attr"` | rungs 1–3 (`DESCRIBE` round-trips the corrupted binding as if fine) | native `mx check`: CE1613 / CE0117 naming the literal quoted string | Association paths and member accesses go **unquoted** — the one place an "always quote identifiers" convention must break. `resolveAssociationAttributePath` doesn't strip quotes before splitting on `/` | a martial-arts-academy PoC project 2026-08-14 + independently a product-provisioning PoC (BUG-75 family) |
 | `calculated by` on an attribute | rungs 1–4 **and** BSON looks like a normal attribute unless decoded | live retrieve: value always empty; `SHOW CALLERS` of the microflow: none | Don't use it this mxcli version: stored attribute + explicit compute-change-commit. Verify with a live retrieve (`mxcli oql --direct`, `learned-db-assertions.md` — `mx.data.get` is disabled in the React client) before anything depends on it | BUG-98 |
-| A **`PARALLEL SPLIT` path with no terminator node** — i.e. every scripted split, since MDL cannot write one | rungs 1–4, and in **both directions**: `check`, `exec`, `DESCRIBE WORKFLOW`, `mxbuild` and native `mx check` report identically on the broken and the repaired model | a **live run**: count the tasks the engine opens at the split. Consecutive *End of parallel split path* rows with no task between them | `bin/wf-add-path-terminators.py <unit> --apply` after the script, and after every later script that rewrites the workflow; verify by running it, never by building it | BUG-121, `learned-workflow-patterns.md` §23 |
+| A **`PARALLEL SPLIT` path with no terminator node** — every split written by mxcli **< v0.22**; v0.22+ writes the marker itself, and v0.29+ leaves it out below Mendix 10.21, where the type does not exist (ako/mxcli#1163) | rungs 1–4, and in **both directions**: `check`, `exec`, `DESCRIBE WORKFLOW`, `mxbuild` and native `mx check` report identically on the broken and the repaired model | a **live run**: count the tasks the engine opens at the split. Consecutive *End of parallel split path* rows with no task between them | `bin/wf-add-path-terminators.py <unit> --apply` after the script, and after every later script that rewrites the workflow; verify by running it, never by building it | BUG-121, `learned-workflow-patterns.md` §23 |
 | A **workflow branch point** in a `create workflow` script: a `DECISION`, or a call-microflow task with Boolean or enumeration outcomes (both go through the same outcome writer) | rungs 1–4, lint, **and rung 6 within one deploy**: every journey that starts and finishes an instance passes | rung 6 **across a restart or redeploy**. An instance left paused after the decision comes back `Incompatible` (*"A selected outcome has been replaced in the already executed path"*), even when the restart changes nothing in the model | mxcli writes condition outcomes with no `PersistentId`, so the runtime gives them a new identity on every load. There is no MDL fix. Once per workflow, probe it: start an instance, let it stop at the first task after a decision, restart the app, read the instance's state. Until upstream fixes it, the app's workflow admin page must list and handle `Incompatible` instances. Note what the ladder cannot express here: the defect is not in any one deploy, it is *between* two | BUG-141 |
 | `create import mapping` array-to-child binding | rungs 1–4; `DESCRIBE IMPORT MAPPING` looks correct | live retrieve after a real `import from mapping`: child list empty | Unverified-until-proven-live; severity not yet classified — read BUG-99's hold before blaming mxcli | BUG-99 |
 | Cross-module `ALTER PAGE ... INSERT` of a DG2 column | rungs 1–3 (`DESCRIBE` *omits* the malformed column) | rung 5: Studio Pro loader `InvalidCastException`; `mx check` also crashes | Forbidden construct; recovery is `create or replace page` | BUG-96 |
 | `ALTER PAGE ... REPLACE` of an existing DG2 column with a new `Attribute:` (same module). The `SET (Attribute: …)` form is refused by `check` | rungs 1–2: `check --references` prints "Check passed!", exec applies it | rung 4: mxbuild, "An attribute is required when 'Show' is set to 'Attribute'" plus its sorting variant | Any change to a DG2 column is a whole-page `create or modify page` re-emit (`learned-dg2-patterns.md` rule 1) | BUG-DRAFT-dg2-replace-column-attribute-passes-check; an Ollama connector app, 2026-10-14 |
-| An `if` with no `else` inside an `on error { }` handler body | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE0079 / CE0773 — the `if`'s false flow is not configured | Keep handler bodies straight-line calls; move the branching into a sub-microflow the handler calls | card-disbursement requirements-driven build, 2026-09-26 |
+| An `if` with no `else` inside an `on error { }` handler body — **mxcli < v0.29** (fixed by ako/mxcli#1455) | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE0079 / CE0773 — the `if`'s false flow is not configured | Keep handler bodies straight-line calls; move the branching into a sub-microflow the handler calls | card-disbursement requirements-driven build, 2026-09-26 |
 | An entity, attribute or Java action parameter named with a Mendix-reserved word — `Case` failed as both an entity and a Java action parameter; `Context` as an attribute | rungs 1–3 (mxcli v0.24.0) | mxbuild: CE7247 | Qualify the name (`CustomerCase`, `ApprovalContext`). The reserved list is Mendix's, not MDL's, so quoting does not help — mxcli's bundled `check-syntax` skill lists what it knows (`syntax domain-model keywords` lists MDL's keywords, not these) | lab run, 2026-09-26; BUG-149 |
 | An **enumeration value** named `New` (a brief often says "New") | rungs 1-3 (v0.26.0) | mxbuild: CE7247 (reserved words cover enumeration values too) | Name it `Queued` and keep `New` as its caption | lab run, 2026-10-15 |
 | `AutoCreatedDate` / `AutoOwner` attributes a page must show | rungs 1-3 (v0.26.0): `check` accepts, notes MDL022 | They become system members `createdDate` / `owner`; a lab run could not bind them in a widget. `date` as a type is refused (MDL-DEPR160: `DateTime` with `not localized`) | For a **bindable** audit field use a plain `DateTime` or `String` attribute a microflow sets | lab run, 2026-10-15 |
@@ -55,8 +55,8 @@ Every row was found in the field: **a green result only certifies what its rung
 | A page layout migrated with `ALTER PAGES … WHERE LAYOUT = X`, in a project whose page scripts **hardcode** `Layout:` inside `create or replace page` | rungs 1–6 — every rung, including live runtime: the app loads, every page renders, every journey passes. There is no error anywhere | a screenshot **of the nav shell** on every page, or `grep -l 'Layout: <old>' mdlsource/` after the migration | `create or replace page` rewrites the page **wholesale**, layout included — so re-running any older page script silently reverts that page to the old shell, and the app ships **two navigation shells at once**. Found when 4 of 7 screens had no navigation at all, just a bare hamburger, after a UI fix loop re-ran five page scripts. A layout migration is not done until the `Layout:` literal is fixed **in the source scripts**; the `ALTER` is a one-shot, the scripts are the repeat offender | field build (Maurits Visser), 2026-09 |
 | A pluggable **combo box filter with `lazyLoading: true`** whose options data source also sets the **preset value** | rungs 1–4, lint, and every scripted check — the model is valid and the list *is* filtered | rung 6, by eye, **before touching the filter**: the list is already narrowed by the preset while the filter looks empty (no value, no clear button) until its menu is first opened | Lazy loading defers the options source, so the preset it sets is not rendered until first open. Turn lazy loading off for short lists (≤10 options). Before the build, check every pluggable property that changes *when* data loads (lazy loading, load-on-open), on any widget that should show a value on page load | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
 | A widget **inserted into an existing container** whose theme pins `height` on **positional row classes** (`widget-row-N` and kin) | rungs 1–4, lint, and every scripted check — the MDL insert is correct and the widget renders | rung 6, by eye: the next row overlaps the inserted widget and covers part of it (here the filter's clear button) | The theme sized rows by position, not content, so a taller row 1 runs under row 2. Before an insert into an existing container, grep the theme SCSS for fixed `height` on that container's row/position classes; if found, add a `:has(<new widget>)` rule adjusting both rows | field run (jopterhorst), 2026-10, [#299](https://github.com/MendixMau/mxcli-project-toolkit/issues/299) |
-| A **`Class` (or `Style`) on a `SNIPPETCALL`** — `alter page … set (Class: 'x') on <snippetcall>` | rungs 1–4, lint, **and DESCRIBE**, which shows the class on the call | rung 6, a DOM probe: `document.querySelector('.x')` is null on every page that carries it | A snippet call renders **no element of its own**; the snippet's widgets are inlined into the parent, so the class has nothing to sit on. Put the class on the container around the call, or on the snippet's own top-level container. Found when a stepper marker on 6 snippet calls changed nothing on screen with every gate green | field run, mxcli v0.26.0, 2026-10-14, [#336](https://github.com/MendixMau/mxcli-project-toolkit/issues/336) |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| A **`Class` (or `Style`) on a `SNIPPETCALL`** — `alter page … set (Class: 'x') on <snippetcall>` | rungs 1–4, lint, **and DESCRIBE** on mxcli < v0.28; since v0.28 `check` warns (mendixlabs/mxcli#1511) | rung 6, a DOM probe: `document.querySelector('.x')` is null on every page that carries it | A snippet call renders **no element of its own**; the snippet's widgets are inlined into the parent, so the class has nothing to sit on. Put the class on the container around the call, or on the snippet's own top-level container. Found when a stepper marker on 6 snippet calls changed nothing on screen with every gate green | field run, mxcli v0.26.0, 2026-10-14, [#336](https://github.com/MendixMau/mxcli-project-toolkit/issues/336) |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 | An object created in a page-triggered microflow and saved only via `commitInSeparateDatabaseTransaction` | every model-side gate, forward-only journeys, admin test users | a journey with a browser-Back step and a 5xx check, run as the least-privileged role | After Back the runtime checks Create on the request's uncommitted copy: `Attempt to illegally add an object to the state` (HTTP 560), and every server-backed widget on the page fails. `rollback $X refresh` before the flow ends; see `learned-microflow-patterns.md` | #565 |
 
 ## Operating rules that fall out of this table
diff --git a/skills/learned-file-upload-widget.md b/skills/learned-file-upload-widget.md
index 0a872008..67aa454d 100644
--- a/skills/learned-file-upload-widget.md
+++ b/skills/learned-file-upload-widget.md
@@ -26,7 +26,7 @@ v0.24.0.
 | Widget | mxcli can author it? | Use it? |
 |---|---|---|
 | **Mendix File Uploader 2.5.0** (`com.mendix.widget.web.fileuploader.FileUploader`, keyword `fileuploader`) | Yes, on stock v0.23 and v0.24, with the rules below | **Yes.** Proven end to end |
-| Classic `Forms$FileManager` (Studio Pro "File manager") | No. No keyword. A `.def.json` gives a false-green `mxcli check`, then exec fails with `template not found: filemanager` | No, until mxcli gets a native `filemanager` (upstream #151) |
+| Classic `Forms$FileManager` (Studio Pro "File manager") | **v0.27+: yes, native `filemanager` keyword** (mendixlabs/mxcli#151), inside a data view on a `System.FileDocument` specialization. Below v0.27: no keyword; a `.def.json` gives a false-green `mxcli check`, then exec fails with `template not found: filemanager` | Not yet proven end to end by the toolkit — retest before relying on it |
 | `mendix.PDSFileUploader` | Writes, but stock mxcli gives CE0463 (action variables not written). It also posts to a REST endpoint, not to a FileDocument | Only with a REST backend and a patched mxcli |
 
 ## 2. What the File Uploader needs (it is not a FileManager)
diff --git a/skills/learned-mdl-cannot-express.md b/skills/learned-mdl-cannot-express.md
index 507965a8..05b09185 100644
--- a/skills/learned-mdl-cannot-express.md
+++ b/skills/learned-mdl-cannot-express.md
@@ -19,18 +19,18 @@ would have taken four minutes to find at Stage 3, when the design was still chea
 
 | The design says | MDL offers | Status |
 |---|---|---|
-| A **file upload** control | nothing. `mxcli syntax page.widgets` prints the complete keyword set and there is no `filemanager`/`fileuploader`/`imageuploader` in it — `filemanager fm (…)` is a parse error, not an unknown property | ⛔ **not buildable** |
+| A **file upload** control | **mxcli v0.27+:** `filemanager fileManager1 (Label: 'File', Type: Upload, MaxFileSize: 10, AllowedExtensions: '.xlsx', ShowFileInBrowser: false)` inside a data view on a `System.FileDocument` specialization (mendixlabs/mxcli#151). Below v0.27: nothing — `filemanager` is a parse error | ✅ **buildable on v0.27+**; below it ⛔ not buildable (the pluggable `fileuploader` in `learned-file-upload-widget.md` works on older versions) |
 | A **pluggable widget with a list-valued property** (an HTML element's `attributes`, a chart's `series`, a datagrid's `columns` written by hand) | nothing. On v0.20.0 a pluggable widget takes **scalar properties in parens and no body at all**: `pluggablewidget '<id>' <name> ( tagName: 'div' )` parses, and *every* body form is rejected with `mismatched input '<keyword>' expecting '}'` — the object-list keywords (`attribute`, `event`) and the child-slot keywords (`tagcontentcontainer`) alike | ⛔ **not buildable** |
 | A page-level **boolean a button toggles** (a collapsible section, a show/hide) | page `variables:` exist and can be READ by `visible:`, but nothing in MDL writes one — that needs a nanoflow | ⛔ **not buildable** |
 | A **language picker** a non-admin user can use (the Marketplace LanguageSelector) | no grant route found on one project for `System.User_Language`: `grant read (User_Language) on entity Administration.Account …` passes `check` and `exec` refuses it (`has no member(s) User_Language`, v0.25.0); Studio Pro does not offer the member either, so the widget errors on pick | ⚠️ **workaround**: a microflow sets `$currentUser`'s language + a nanoflow reloads — `learned-multilingual-app.md` §4 |
 | A **gallery empty-placeholder** | no `emptyState`/`emptyplaceholder` block on `gallery`. On v0.24.0 the Data grid 2 `emptyplaceholder` slot fails mxbuild with CE0463 too, because the bundled definition fixes `showEmptyPlaceholder` to `none` (BUG-150) | ⚠️ **workaround**: a one-attribute non-persistent entity the page switches on |
 | An **aggregate over an association** inside a gallery/listview template | client expressions have no `count()`; XPath does, but a template expression is not XPath | ⚠️ **workaround**: denormalise, with ONE writer that recomputes rather than increments |
-| A **count badge on a tab** ("Documents 3") | nothing on v0.24.0: a tab page is written with Caption and Widgets only, `Badge:` is refused by `check`, and `update widgets` reaches only pluggable property bags. `Forms$TabPage.Badge` exists in the metamodel | ⛔ **not buildable** — say the count in the pane's lead line |
+| A **count badge on a tab** ("Documents 3") | **mxcli v0.29+:** a tab page's `Badge:` (ako/mxcli#1653). Below v0.29: nothing — `Badge:` is refused by `check` | ✅ **buildable on v0.29+**; below it ⛔ not buildable — say the count in the pane's lead line |
 | A text box that **validates while typing** | nothing: v0.24.0 hard-codes `SubmitBehaviour` to on-leave (`widget_write.go`), so a field error clears only on blur | ⛔ **not buildable** — make the error line take the hint's height so the form does not reflow |
-| The **browser tab title** (`<AppTitle> - <page title>`) | nothing: the client takes AppTitle from the navigation profile, and `create navigation` has no title clause (`describe navigation` does not print it). A theme `index.html` `<title>` changes only the pre-boot title | ⚠️ **workaround**: set AppTitle in Studio Pro, or bridge `document.title` from a script in `theme/web/index.html` |
+| The **browser tab title** (`<AppTitle> - <page title>`) | **mxcli v0.29+:** `create or modify navigation` takes `app title '<text>'` and `app icon <Module.Collection.Image>`, and `describe navigation` prints both (ako/mxcli#1756, mendixlabs/mxcli#1664). Below v0.29: no title clause | ✅ **buildable on v0.29+**; below it ⚠️ **workaround**: set AppTitle in Studio Pro, or bridge `document.title` from a script in `theme/web/index.html` |
 | **Always-open menu groups** in a sidebar navigation tree | nothing: `create navigation` has no expanded/collapsed flag, and Mendix renders groups collapsed | ⚠️ **workaround**: CSS only — `li.mx-navigationtree-has-items > ul { display: flex }`, parent anchor restyled as the group heading (it keeps `aria-expanded="false"`) |
-| A **sidebar toggle button**, a **page-load nanoflow**, or a button added to a **Marketplace module's layout** | nothing: no `SidebarToggleButton`, no nanoflow data source or on-load event, and `alter layout` refuses a Marketplace layout (so an app copy of `Atlas_Default` loses its toggle) | ⚠️ **workaround**: an own layout (move pages with `alter pages … where layout =`), an action button calling a JS action that toggles a class on `<html>`, and a pre-boot script in `theme/web/index.html` for on-load work |
-| A widget **visible to one role and not another** | nothing: `visible:` takes an expression, and there is no module-role clause on any widget | ⚠️ **workaround** for an action button only — see "One role sees the button" below; it has three traps |
+| A **sidebar toggle button**, a **page-load nanoflow**, or a button added to a **Marketplace module's layout** | the toggle, **mxcli v0.28+:** `sidebartoggle sidebarToggle3 (Tooltip: 'Toggle Menu', ButtonStyle: Primary)` (mendixlabs/mxcli#1220). Otherwise nothing: on older mxcli no `SidebarToggleButton`, no nanoflow data source or on-load event, and `alter layout` refuses a Marketplace layout (so an app copy of `Atlas_Default` loses its toggle) | ⚠️ **workaround**: an own layout (move pages with `alter pages … where layout =`), an action button calling a JS action that toggles a class on `<html>`, and a pre-boot script in `theme/web/index.html` for on-load work |
+| A widget **visible to one role and not another** | **mxcli v0.27+:** `Visible: roles (Mod.A, …)`, combinable with an expression, on widgets, tab pages and navigation list items (mendixlabs/mxcli#1460). Below v0.27: no module-role clause on any widget | ✅ **buildable on v0.27+** (the three traps below still apply to testing it); below it ⚠️ **workaround** for an action button only — see "One role sees the button" below |
 | A **pluggable widget you want to configure** | only its scalar properties, and **case-sensitively** — `ItemSelectionMode` fails where `itemSelectionMode` works, even though the rest of MDL is case-insensitive | ⚠️ works, read the widget's own doc |
 
 ## The probe — four minutes, at Stage 3
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index 86c17c30..bdf23cce 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -31,13 +31,13 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 1 🔎 | Use `visible:` or `editable:` **conditional expressions** on containers **inside a `datagrid customContent` column** | **STOP → Studio Pro by hand** | mxcli writes blank `AttributeIdentifier` → `StorageLoadException` on SP open; mxbuild passes clean (BUG-18). Safe CLI alternative: `dynamictext (Attribute: "State")` renders enum caption natively. Do NOT use `ContentParams: [{1} = toString("State")]` inside customContent — resolves as attribute path → CE1613. Per-value colours: set them in Studio Pro. | page |
-| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write it as an expression, `Editable: [<expr>]` — never the quoted string `Editable: '<expr>'`.** (`Visible: [<expr>]` and `ALTER PAGE … SET Visible/Editable = [<expr>]` work.) | The quoted form is dropped with no message, so the field is silently always editable; `check` and `exec` are both silent. Read the page back with `describe page`. | page |
+| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated, MDL-DEPR081).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
 | 4 | Bind a widget to the `AutoChangedBy` system attribute | **STOP → omit it, or bind `AutoChangedDate` instead** | `check` passes, then `mx check` CE1613 (`changedBy` no longer exists); lint does not flag it. | page |
 | 12 🔎 | Put anything but a bare attribute or a quoted literal in a `dynamictext`'s `ContentParams` — `toString(Attr)`, `$currentObject/Attr`, `if … then … else`, any function | **Bind a bare attribute (`{1} = Attr`) or a quoted literal, nothing else.** A computed label becomes data: a stored or derived String attribute, bound bare. Tone variants go in `DynamicClasses`, which takes a real expression (and there *needs* the prefix: `'if $currentObject/State = Enum.Value then ...'`). | An expression is stored as an attribute path → CE1613 at mxbuild; `if … then … else` passes `check` and `exec` (BUG-142). | page |
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | The old, wider rights survive the narrowing `grant`. | access |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | Callee created in the same script: `check --references` skips the call, `exec` auto-fills the `WITH` mapping, `mx check` CE0117. | workflow |
 | 16 🔎 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[Decision_Partner = '[%CurrentUser/PLM.Account_Partner%]']`. **Fix (confirmed working):** `[PLM.Decision_Partner/PLM.Partner/Administration.Account_Partner = '[%CurrentUser%]']` — walk Partner→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Invalid Mendix XPath, not an mxcli bug: `CE0161` every time. The fixed form is mxcli-safe — no GUI fallback. | access |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | CE6083 at the gate. `Class: 'form-vertical'` then built clean but changed nothing on screen where the theme's dataview rules decide the layout — the look caught it, no gate could. | page |
diff --git a/skills/learned-multilingual-app.md b/skills/learned-multilingual-app.md
index 0618d4c1..23ceb524 100644
--- a/skills/learned-multilingual-app.md
+++ b/skills/learned-multilingual-app.md
@@ -140,6 +140,8 @@ begin
   call javascript action NanoflowCommons.Reload();
 end;
 
+-- mxcli v0.27+ no longer creates MyModule.User for you (mendixlabs/mxcli#1474)
+create or modify module role MyModule.User;
 grant execute on microflow MyModule.SUB_SetLanguage to MyModule.User;
 grant execute on nanoflow MyModule.ACT_LanguageES to MyModule.User;
 ```
diff --git a/skills/learned-stylegallery.md b/skills/learned-stylegallery.md
index fe671d77..b76b81a8 100644
--- a/skills/learned-stylegallery.md
+++ b/skills/learned-stylegallery.md
@@ -385,7 +385,8 @@ rendered gallery home page** (via `module-review.md`'s LOOK stage) and confirm:
 gallery build ends with (a) a navigation entry in a profile, (b) a role grant, and (c) the skill
 stating **which demo user can see it**. A gallery with no menu entry and no URL is unreachable in
 the running app, and unreachable is indistinguishable from absent to everyone downstream. Check the
-grant landed on a real role, not the auto-created `.User`:
+grant landed on a real role a demo user holds. mxcli < v0.27 auto-created `<Module>.User`; v0.27+ creates
+no role at all (mendixlabs/mxcli#1474), so an ungranted document is reachable by nobody:
 
 ```
 SHOW MODULE ROLES IN <GalleryModule>
diff --git a/skills/platform-link.md b/skills/platform-link.md
index fa9aad0a..41e5bc48 100644
--- a/skills/platform-link.md
+++ b/skills/platform-link.md
@@ -504,7 +504,7 @@ same properties"* — once Studio Pro has saved such a document, and the Version
 fails. Field case: 78 changed units written with v0.24 on a production app, with no gate able to
 see them. mxcli v0.26.0 completes the set on every unit it writes, but only on units it rewrites,
 so a project upgraded mid-flight still carries the old ones until the repair runs. **Not on
-Mendix 10.24 below 10.24.24, through mxcli v0.27.0:** its property table starts at 10.24.24, so on
+Mendix 10.24 below 10.24.24, through mxcli v0.28.0:** (v0.29.0 measured the table from 10.24.0, ako/mxcli#1505, and lists `MIXED` names, exiting 1.) its property table starts at 10.24.24, so on
 10.24.18 a unit it writes can still lack keys, and `fix property-sets --dry-run` (hence
 `doctor --property-sets`) calls every unit complete (mendixlabs/mxcli#1595). There, the proof is
 Mendix's own `mx diff <base>.mpr <mine>.mpr out.json` against the base branch: exit 0 is clean.

From fdac2358243625f6994afe598d830d7924b57b8e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 07:39:45 +0000
Subject: [PATCH 2/2] Address #601 review: STOP-1 scan covers the bare form;
 version-gate old spellings

- mdl-scan STOP-1 matched only `Visible:/Editable: [`; the preflight now
  recommends the bare v0.25+ form, so a conditional inside a datagrid
  customContent column (BUG-18) would pass the scan. The regex also
  matches a bare expression ($, comparison, not(), roles()) and leaves
  a static true/false alone. New case in test-mdl-scan.sh.
- STOP 1b: below v0.25 write `[<expr>]`.
- STOP 21: `alter microflow` exists since v0.25 (loop bodies and
  `replace body of` since v0.29); keep the pre-v0.28 parse-error
  signature for `alter navigation`.
- skills/generated re-rendered (mdl-rules.sh --render).

test-mdl-scan 53/0, test-mdl-rules 43/0, test-routing-tier 26/0,
mdl-rules --check in sync. Baseline 64,235 -> 64,252 words.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018LeNWZV2sVH62vkgfYh5u5
---
 CHANGELOG.md                        |  2 +-
 bin/lib/mdl-scan-rules.tsv          |  2 +-
 skills/generated/rules-access.md    |  2 +-
 skills/generated/rules-any.md       |  2 +-
 skills/generated/rules-entity.md    |  2 +-
 skills/generated/rules-microflow.md |  2 +-
 skills/generated/rules-page.md      |  4 ++--
 skills/generated/rules-workflow.md  |  2 +-
 skills/learned-mdl-preflight.md     |  4 ++--
 tests/wave2/test-mdl-scan.sh        | 11 +++++++++++
 10 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac7621a0..ec79227d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
-- fix(skills): **skill text no longer tells agents that mxcli v0.25–v0.29 cannot do things it now does**: STOP 21 said `ALTER NAVIGATION` does not exist and restatement is the only write — it now points at `alter navigation`/`alter menu` (v0.28, mendixlabs/mxcli#1522) and in-loop `alter microflow`/`replace body of` (v0.29, ako/mxcli#1693), keeping its describe-first rule; STOP 1b now writes the bare `Editable: <expr>` (v0.25) and limits the quoted-form trap to mxcli < v0.28 (#1567); `learned-mdl-cannot-express.md` marks file upload (`filemanager`, v0.27), tab `Badge:` (v0.29), app title (v0.29), role visibility `Visible: roles(…)` (v0.27) and `sidebartoggle` (v0.28) buildable from their version; four `learned-detection-gaps.md` rows (terminators, `if` without `else` in a handler, `Class` on a snippet call, property sets below 10.24.24) and `platform-link.md` now name the mxcli version that fixed them; three passages no longer assume mxcli auto-creates `<Module>.User` (gone since v0.27, #1474). Nothing deleted: old-version guidance stays, version-gated, because nothing was re-probed. Baseline 64,193 → 64,235 words. Source: mxcli v0.29 compatibility audit 2026-10-30
+- fix(skills): **skill text no longer tells agents that mxcli v0.25–v0.29 cannot do things it now does**: STOP 21 said `ALTER NAVIGATION` does not exist and restatement is the only write — it now points at `alter navigation`/`alter menu` (v0.28, mendixlabs/mxcli#1522) and in-loop `alter microflow`/`replace body of` (v0.29, ako/mxcli#1693), keeping its describe-first rule; STOP 1b now writes the bare `Editable: <expr>` (v0.25) and limits the quoted-form trap to mxcli < v0.28 (#1567); `learned-mdl-cannot-express.md` marks file upload (`filemanager`, v0.27), tab `Badge:` (v0.29), app title (v0.29), role visibility `Visible: roles(…)` (v0.27) and `sidebartoggle` (v0.28) buildable from their version; four `learned-detection-gaps.md` rows (terminators, `if` without `else` in a handler, `Class` on a snippet call, property sets below 10.24.24) and `platform-link.md` now name the mxcli version that fixed them; three passages no longer assume mxcli auto-creates `<Module>.User` (gone since v0.27, #1474). `mdl-scan` STOP-1 now also catches the bare `Visible:/Editable: <expr>` form inside a customContent column (it matched only `[`), since STOP 1b now recommends that form. Nothing deleted: old-version guidance stays, version-gated, because nothing was re-probed. Baseline 64,193 → 64,252 words. Source: mxcli v0.29 compatibility audit 2026-10-30
 - fix(doctor, sync-project, speed-setup): **doctor says when the speed fixes never reached a project**: `bin/exec.sh`, `bin/_common.sh` or `bin/lint-gate.sh` without the 2026-10-29 speed code (marker per file) gives a Machine health warning "speed fixes not active", and the Recommended fix leads with the exact `sync-project.sh --upgrade-bin ...` command (exec.sh always with its `_common.sh`; each copy backed up) before any other advice, because every other number measures the old scripts; `sync-project.sh` names the speed fixes on a hand-edited exec.sh / _common.sh that has the exit-code fix but not the speed work; `skills/speed-setup.md` has Claude show each local edit in one line and ask before replacing. Field: an English colleague's ExpenseTracker analysis after the toolkit update still showed a full mxbuild on every change (45.5 min, 57% of all exec time) with 15 drifted scripts in bin/; reproduced here with the real pre-#587 exec.sh / _common.sh / lint-gate.sh — doctor names all three, sync names exec.sh and refreshes the two unedited ones — Maurits (mauritscgvisser)
 - fix(doctor, speed-setup): **doctor no longer says "None needed" next to a verdict of "5x slower"**: when process starts are fast but one bench step is 5x+ the reference and 2 s+ slower, the Recommended fix names that step (slow git status: `git config core.untrackedCache true` / `core.fsmonitor true`, no admin rights); a project inside a OneDrive / Dropbox / Google Drive / iCloud folder gets a Machine health warning and "move the project to a local folder" as the fix; low-memory advice now offers "restart the computer" before `--cleanup`; the bench's git step runs one untimed warm-up so a stale index after a copy or clone no longer reads as slow (field, ab-581/gk: 18.3 s cold, 31 ms warm); `skills/speed-setup.md` tells Claude never to say deno, mxbuild or helper process to a user. Field run: ab-581/gk on Linux, bench 14.7 s vs 10.9 s, "None needed" correctly; a project under a OneDrive path, move advice shown — Maurits (mauritscgvisser)
 - fix(gate-check, gate-cache): **the closeout verdict cache also keys on file CONTENT, so an overwrite that keeps an old mtime (`cp -p`, `rsync -t`, `tar x`, `unzip`, `touch -d`) can no longer replay a stale verdict**: a signed triage.md copied over a FAIL one still printed the cached Stage 0 FAIL (PR #589 review); the cache now stores one `find | sort | xargs cksum | cksum` signature of the project files (skipping .git, node_modules, .mxtk, mprcontents, deployment, *.mpr, files over 1 MB) and any difference, or a signature that cannot be computed, re-evaluates; new `tests/wave2/test-gate-cache.sh` (hit, edit/delete/waiver miss, cp -p miss, TTL 0, 'not evaluated' line); `MXTK_GATE_CACHE_TRACE=1` prints `gate-cache: hit|miss` on --closeout. Field run: ab-581/base copy (197 MB, 633 hashed files) - signature 28 ms, cache hit 1464 -> 1498 ms vs 2567-2786 ms full evaluation - PR #589 reviewer, OlafFede (#583) — OlafFede (#583)
diff --git a/bin/lib/mdl-scan-rules.tsv b/bin/lib/mdl-scan-rules.tsv
index 88cefa0f..f1326296 100644
--- a/bin/lib/mdl-scan-rules.tsv
+++ b/bin/lib/mdl-scan-rules.tsv
@@ -18,7 +18,7 @@
 #   evidence the bug-log entry holding the captured failure; its fixture is
 #            tests/wave2/fixtures/mdl-scan/<id>.{bad,good}.mdl (`-- evidence:` lines)
 # A rule with no captured failure in bug-logs/ does not get a row (issue #349).
-STOP-1	customcontent	warn	(visible|editable)[[:space:]]*:[[:space:]]*\[	conditional Visible/Editable inside a datagrid customContent column (StorageLoadException on Studio Pro open)	set it in Studio Pro by hand, or bind dynamictext (Attribute: "State")	BUG-18
+STOP-1	customcontent	warn	(visible|editable)[[:space:]]*:[[:space:]]*(\[|[^,)]*(\$|=|<|>|not[[:space:]]*\(|roles[[:space:]]*\())	conditional Visible/Editable inside a datagrid customContent column (StorageLoadException on Studio Pro open)	set it in Studio Pro by hand, or bind dynamictext (Attribute: "State")	BUG-18
 STOP-12	contentparams	warn	-	ContentParams value is an expression; it is stored as an attribute path (CE1613 at mxbuild)	bind a bare attribute ({1} = Attr) or a quoted literal; make a computed label a String attribute	BUG-142
 STOP-16	line	warn	\[%currentuser/	path inside the [%CurrentUser%] token in an XPath constraint (CE0161)	keep the token bare and walk the whole path on the left: [Mod.A_B/Mod.B/Mod.B_Account = '[%CurrentUser%]']	bug-logs/mxcli-bugs.md "Any GRANT/REVOKE exec in a module fails once ANY entity there has an Account_Supplier-style cross-module XPath"
 STOP-26	line	warn	attribute[[:space:]]*:[[:space:]]*"[^"]*/[^"]*"	quoted association path in Attribute: is stored as one attribute named "Assoc/Attr" (CE1613)	write the path unquoted: Attribute: Assoc_A_B/Name	BUG-DRAFT-dg2-association-path-bindings
diff --git a/skills/generated/rules-access.md b/skills/generated/rules-access.md
index 72bc4f34..6687fe1b 100644
--- a/skills/generated/rules-access.md
+++ b/skills/generated/rules-access.md
@@ -46,7 +46,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 |---|---|---|---|---|
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | The old, wider rights survive the narrowing `grant`. | access |
 | 16 🔎 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[Decision_Partner = '[%CurrentUser/PLM.Account_Partner%]']`. **Fix (confirmed working):** `[PLM.Decision_Partner/PLM.Partner/Administration.Account_Partner = '[%CurrentUser%]']` — walk Partner→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Invalid Mendix XPath, not an mxcli bug: `CE0161` every time. The fixed form is mxcli-safe — no GUI fallback. | access |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
diff --git a/skills/generated/rules-any.md b/skills/generated/rules-any.md
index 9924721f..fee0b231 100644
--- a/skills/generated/rules-any.md
+++ b/skills/generated/rules-any.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
diff --git a/skills/generated/rules-entity.md b/skills/generated/rules-entity.md
index 9e5772d3..3f27008a 100644
--- a/skills/generated/rules-entity.md
+++ b/skills/generated/rules-entity.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
diff --git a/skills/generated/rules-microflow.md b/skills/generated/rules-microflow.md
index d31b4dec..94437b62 100644
--- a/skills/generated/rules-microflow.md
+++ b/skills/generated/rules-microflow.md
@@ -44,7 +44,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 25 | Write a microflow with any loop, >20 planned activities, or a list built from a list | **STOP → run `microflow-preflight.md` and post its checklist first.** | Lint runs only after exec and counts only top-level activities (a loop body is invisible to CONV009/QUAL003); CONV011 commit-in-loop and MPR008 overlap findings came back on field builds after the write, not before. | microflow |
diff --git a/skills/generated/rules-page.md b/skills/generated/rules-page.md
index d7b66ae6..13f44e98 100644
--- a/skills/generated/rules-page.md
+++ b/skills/generated/rules-page.md
@@ -45,10 +45,10 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 1 🔎 | Use `visible:` or `editable:` **conditional expressions** on containers **inside a `datagrid customContent` column** | **STOP → Studio Pro by hand** | mxcli writes blank `AttributeIdentifier` → `StorageLoadException` on SP open; mxbuild passes clean (BUG-18). Safe CLI alternative: `dynamictext (Attribute: "State")` renders enum caption natively. Do NOT use `ContentParams: [{1} = toString("State")]` inside customContent — resolves as attribute path → CE1613. Per-value colours: set them in Studio Pro. | page |
-| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated, MDL-DEPR081).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
+| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated there, MDL-DEPR081; below v0.25 write `[<expr>]`).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
 | 4 | Bind a widget to the `AutoChangedBy` system attribute | **STOP → omit it, or bind `AutoChangedDate` instead** | `check` passes, then `mx check` CE1613 (`changedBy` no longer exists); lint does not flag it. | page |
 | 12 🔎 | Put anything but a bare attribute or a quoted literal in a `dynamictext`'s `ContentParams` — `toString(Attr)`, `$currentObject/Attr`, `if … then … else`, any function | **Bind a bare attribute (`{1} = Attr`) or a quoted literal, nothing else.** A computed label becomes data: a stored or derived String attribute, bound bare. Tone variants go in `DynamicClasses`, which takes a real expression (and there *needs* the prefix: `'if $currentObject/State = Enum.Value then ...'`). | An expression is stored as an attribute path → CE1613 at mxbuild; `if … then … else` passes `check` and `exec` (BUG-142). | page |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | CE6083 at the gate. `Class: 'form-vertical'` then built clean but changed nothing on screen where the theme's dataview rules decide the layout — the look caught it, no gate could. | page |
diff --git a/skills/generated/rules-workflow.md b/skills/generated/rules-workflow.md
index a7239094..8dacae61 100644
--- a/skills/generated/rules-workflow.md
+++ b/skills/generated/rules-workflow.md
@@ -45,7 +45,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | Callee created in the same script: `check --references` skips the call, `exec` auto-fills the `WITH` mapping, `mx check` CE0117. | workflow |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
diff --git a/skills/learned-mdl-preflight.md b/skills/learned-mdl-preflight.md
index bdf23cce..ce0709b4 100644
--- a/skills/learned-mdl-preflight.md
+++ b/skills/learned-mdl-preflight.md
@@ -31,13 +31,13 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 | # | If your script will… | Then… | Fails as | Kind |
 |---|---|---|---|---|
 | 1 🔎 | Use `visible:` or `editable:` **conditional expressions** on containers **inside a `datagrid customContent` column** | **STOP → Studio Pro by hand** | mxcli writes blank `AttributeIdentifier` → `StorageLoadException` on SP open; mxbuild passes clean (BUG-18). Safe CLI alternative: `dynamictext (Attribute: "State")` renders enum caption natively. Do NOT use `ContentParams: [{1} = toString("State")]` inside customContent — resolves as attribute path → CE1613. Per-value colours: set them in Studio Pro. | page |
-| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated, MDL-DEPR081).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
+| 1b | Put `Editable:` on an input widget in `CREATE PAGE` | **Write a bare expression: `Editable: $currentObject/Status != 'Closed'` (v0.25+; `[<expr>]` is deprecated there, MDL-DEPR081; below v0.25 write `[<expr>]`).** Below v0.28 never the quoted string `Editable: '<expr>'`. | Below v0.28 the quoted form is dropped with no message, so the field is silently always editable (fixed in v0.28, mendixlabs/mxcli#1567). Read the page back with `describe page`. | page |
 | 4 | Bind a widget to the `AutoChangedBy` system attribute | **STOP → omit it, or bind `AutoChangedDate` instead** | `check` passes, then `mx check` CE1613 (`changedBy` no longer exists); lint does not flag it. | page |
 | 12 🔎 | Put anything but a bare attribute or a quoted literal in a `dynamictext`'s `ContentParams` — `toString(Attr)`, `$currentObject/Attr`, `if … then … else`, any function | **Bind a bare attribute (`{1} = Attr`) or a quoted literal, nothing else.** A computed label becomes data: a stored or derived String attribute, bound bare. Tone variants go in `DynamicClasses`, which takes a real expression (and there *needs* the prefix: `'if $currentObject/State = Enum.Value then ...'`). | An expression is stored as an attribute path → CE1613 at mxbuild; `if … then … else` passes `check` and `exec` (BUG-142). | page |
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | The old, wider rights survive the narrowing `grant`. | access |
 | 18 | Write **any workflow MDL** — `CREATE`/`ALTER WORKFLOW`, a `CALL MICROFLOW` step, a `JUMP TO`, user-task outcomes | **STOP → read [[learned-workflow-patterns]] first, then script. Create every callee microflow in an EARLIER script than the workflow that calls it.** Read the BRD lifecycle + wireframe before writing a single outcome. | Callee created in the same script: `check --references` skips the call, `exec` auto-fills the `WITH` mapping, `mx check` CE0117. | workflow |
 | 16 🔎 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[Decision_Partner = '[%CurrentUser/PLM.Account_Partner%]']`. **Fix (confirmed working):** `[PLM.Decision_Partner/PLM.Partner/Administration.Account_Partner = '[%CurrentUser%]']` — walk Partner→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Invalid Mendix XPath, not an mxcli bug: `CE0161` every time. The fixed form is mxcli-safe — no GUI fallback. | access |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522), and `alter microflow` inside loop bodies or `replace body of` (v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 24 | Put a `DesignProperties: [...]` entry on a widget (Form orientation, Label width, Spacing, …) in an app scaffolded by `mxcli new` (any `--theme`) | **STOP → grep the theme first: `grep -l '<property name>' themesource/*/web/design-properties.json`. If it is not there, use the Atlas class instead (`Class: 'form-vertical'`, `spacing-outer-bottom-large`).** `mxcli new`'s theme layer ships a `design-properties.json` that does not carry Atlas's FormBase entries, so mxbuild rejects the property with CE6083 "not supported by your theme". v0.24.0: `check` only warns (MDL-WIDGET11), `exec` writes, `mx check` fails; lint does not flag it. `design-spacing.md` says design properties and classes write the identical model; that holds only when the theme declares the property. | CE6083 at the gate. `Class: 'form-vertical'` then built clean but changed nothing on screen where the theme's dataview rules decide the layout — the look caught it, no gate could. | page |
diff --git a/tests/wave2/test-mdl-scan.sh b/tests/wave2/test-mdl-scan.sh
index d9d4c9dc..2f61c9c6 100755
--- a/tests/wave2/test-mdl-scan.sh
+++ b/tests/wave2/test-mdl-scan.sh
@@ -157,6 +157,17 @@ column colB (ShowContentAs: customContent, Caption: 'B') {
 EOF
 rc=$(scan "$WORK/l8.mdl"); [ "$rc" = 0 ] && ok "customcontent rules ignore text inside string literals" || bad "string literal matched STOP-1: $(cat "$WORK/out")"
 
+cat > "$WORK/l9.mdl" <<'EOF'
+column colB (ShowContentAs: customContent, Caption: 'B') {
+  container c (Visible: $currentObject/State = Module.ENUM_State.Open) {
+    dynamictext t (Content: 'Open')
+  }
+  container d (Visible: true, Editable: false)
+}
+EOF
+rc=$(scan "$WORK/l9.mdl"); [ "$(grep -c 'STOP-1 ' "$WORK/out")" = 1 ] \
+  && ok "STOP-1 also fires on the bare v0.25+ form (Visible: <expr>), not on a static true/false" || bad "bare-form STOP-1: exit $rc $(cat "$WORK/out")"
+
 echo "== U: usage"
 [ "$(scan)" = 2 ] && ok "no script: exit 2" || bad "no script did not exit 2"
 [ "$(scan "$WORK/nope.mdl")" = 2 ] && ok "unreadable script: exit 2" || bad "missing script did not exit 2"