fix(skills): correct rules that mxcli v0.25–v0.29 made wrong or obsolete

CHANGELOG.md

@@ -19,6 +19,7 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- fix(skills): **skill text no longer tells agents that mxcli v0.25–v0.29 cannot do things it now does**: STOP 21 said `ALTER NAVIGATION` does not exist and restatement is the only write — it now points at `alter navigation`/`alter menu` (v0.28, mendixlabs/mxcli#1522) and in-loop `alter microflow`/`replace body of` (v0.29, ako/mxcli#1693), keeping its describe-first rule; STOP 1b now writes the bare `Editable: <expr>` (v0.25) and limits the quoted-form trap to mxcli < v0.28 (#1567); `learned-mdl-cannot-express.md` marks file upload (`filemanager`, v0.27), tab `Badge:` (v0.29), app title (v0.29), role visibility `Visible: roles(…)` (v0.27) and `sidebartoggle` (v0.28) buildable from their version; four `learned-detection-gaps.md` rows (terminators, `if` without `else` in a handler, `Class` on a snippet call, property sets below 10.24.24) and `platform-link.md` now name the mxcli version that fixed them; three passages no longer assume mxcli auto-creates `<Module>.User` (gone since v0.27, #1474). `mdl-scan` STOP-1 now also catches the bare `Visible:/Editable: <expr>` form inside a customContent column (it matched only `[`), since STOP 1b now recommends that form. Nothing deleted: old-version guidance stays, version-gated, because nothing was re-probed. Baseline 64,193 → 64,252 words. Source: mxcli v0.29 compatibility audit 2026-10-30
 - fix(wire-company-brain): **re-wiring a company brain works on macOS, and a rewrite that fails no longer reports "Updated"**: the block was handed to awk as `-v blk=…`, which BSD awk (macOS) refuses when the value holds a newline, so every re-run (a moved brain, a changed block) left the files untouched while printing `Updated: … rewritten in place`; the block now goes through the environment (`ENVIRON["BLK"]`), and a failed rewrite or append prints `FAILED: …`, leaves the file alone and is not counted. Pinned by `tests/wave2/test-company-brain.sh` T2c (a stub awk with BSD's `-v` rule; 4 of its 5 checks fail on 2ba8158) — reported in #598 from a field-run project, macOS 26 / BSD awk 20200816
 - fix(doctor, sync-project, speed-setup): **doctor says when the speed fixes never reached a project**: `bin/exec.sh`, `bin/_common.sh` or `bin/lint-gate.sh` without the 2026-10-29 speed code (marker per file) gives a Machine health warning "speed fixes not active", and the Recommended fix leads with the exact `sync-project.sh --upgrade-bin ...` command (exec.sh always with its `_common.sh`; each copy backed up) before any other advice, because every other number measures the old scripts; `sync-project.sh` names the speed fixes on a hand-edited exec.sh / _common.sh that has the exit-code fix but not the speed work; `skills/speed-setup.md` has Claude show each local edit in one line and ask before replacing. Field: an English colleague's ExpenseTracker analysis after the toolkit update still showed a full mxbuild on every change (45.5 min, 57% of all exec time) with 15 drifted scripts in bin/; reproduced here with the real pre-#587 exec.sh / _common.sh / lint-gate.sh — doctor names all three, sync names exec.sh and refreshes the two unedited ones — Maurits (mauritscgvisser)
 - fix(doctor, speed-setup): **doctor no longer says "None needed" next to a verdict of "5x slower"**: when process starts are fast but one bench step is 5x+ the reference and 2 s+ slower, the Recommended fix names that step (slow git status: `git config core.untrackedCache true` / `core.fsmonitor true`, no admin rights); a project inside a OneDrive / Dropbox / Google Drive / iCloud folder gets a Machine health warning and "move the project to a local folder" as the fix; low-memory advice now offers "restart the computer" before `--cleanup`; the bench's git step runs one untimed warm-up so a stale index after a copy or clone no longer reads as slow (field, ab-581/gk: 18.3 s cold, 31 ms warm); `skills/speed-setup.md` tells Claude never to say deno, mxbuild or helper process to a user. Field run: ab-581/gk on Linux, bench 14.7 s vs 10.9 s, "None needed" correctly; a project under a OneDrive path, move advice shown — Maurits (mauritscgvisser)

bin/lib/mdl-scan-rules.tsv

@@ -18,7 +18,7 @@
 #   evidence the bug-log entry holding the captured failure; its fixture is
 #            tests/wave2/fixtures/mdl-scan/<id>.{bad,good}.mdl (`-- evidence:` lines)
 # A rule with no captured failure in bug-logs/ does not get a row (issue #349).
-STOP-1	customcontent	warn	(visible|editable)[[:space:]]*:[[:space:]]*\[	conditional Visible/Editable inside a datagrid customContent column (StorageLoadException on Studio Pro open)	set it in Studio Pro by hand, or bind dynamictext (Attribute: "State")	BUG-18
+STOP-1	customcontent	warn	(visible|editable)[[:space:]]*:[[:space:]]*(\[|[^,)]*(\$|=|<|>|not[[:space:]]*\(|roles[[:space:]]*\())	conditional Visible/Editable inside a datagrid customContent column (StorageLoadException on Studio Pro open)	set it in Studio Pro by hand, or bind dynamictext (Attribute: "State")	BUG-18
 STOP-12	contentparams	warn	-	ContentParams value is an expression; it is stored as an attribute path (CE1613 at mxbuild)	bind a bare attribute ({1} = Attr) or a quoted literal; make a computed label a String attribute	BUG-142
 STOP-16	line	warn	\[%currentuser/	path inside the [%CurrentUser%] token in an XPath constraint (CE0161)	keep the token bare and walk the whole path on the left: [Mod.A_B/Mod.B/Mod.B_Account = '[%CurrentUser%]']	bug-logs/mxcli-bugs.md "Any GRANT/REVOKE exec in a module fails once ANY entity there has an Account_Supplier-style cross-module XPath"
 STOP-26	line	warn	attribute[[:space:]]*:[[:space:]]*"[^"]*/[^"]*"	quoted association path in Attribute: is stored as one attribute named "Assoc/Attr" (CE1613)	write the path unquoted: Attribute: Assoc_A_B/Name	BUG-DRAFT-dg2-association-path-bindings

skills/design-artifacts.md

@@ -416,7 +416,8 @@ The gate is all four, and 3 and 4 are the ones projects skip:
 2. the gallery module builds with 0 CE errors;
 3. the gallery home page is **in a navigation profile and granted to a role a demo user actually
    holds** — check with `SHOW MODULE ROLES IN <GalleryModule>`, because a security script that was
-   drafted and never executed leaves every grant on the auto-created `.User` role, and then the
+   drafted and never executed leaves every grant on the auto-created `.User` role (mxcli < v0.27) or,
+   on v0.27+, on no role at all (mendixlabs/mxcli#1474), and then the
    first attempt to screenshot the gallery silently measures whatever the demo user lands on
    instead;
 4. **someone opened it and wrote down what they saw.**

skills/generated/rules-access.md

@@ -46,7 +46,7 @@ Each row keeps one failure clause; the full root cause is in `process/baseline-i
 |---|---|---|---|---|
 | 14 | Narrow an existing entity grant (fewer attributes or rights than the rule already has) | **`revoke` first, then `grant` the narrower set.** A lone narrowing `grant` merges into the existing rule instead of replacing it (BUG-145). | The old, wider rights survive the narrowing `grant`. | access |
 | 16 🔎 | Write an access-rule XPath constraint with a **path expression inside the `[%CurrentUser/...%]` substitution token** — `[Assoc = '[%CurrentUser/Module.OtherAssoc%]']`, especially crossing module boundaries | **Never put a path inside the CurrentUser substitution. Keep it bare (`'[%CurrentUser%]'`) and do the ENTIRE multi-hop/cross-module traversal on the left-hand side instead**, qualifying the entity name at every module crossing (same rule as the "cross-module association expression paths" MDL gotcha, extended here to access-rule XPath constraints, not just microflow expressions). Was: `[Decision_Partner = '[%CurrentUser/PLM.Account_Partner%]']`. **Fix (confirmed working):** `[PLM.Decision_Partner/PLM.Partner/Administration.Account_Partner = '[%CurrentUser%]']` — walk Partner→Account fully on the left, compare directly to the (already-an-Account) CurrentUser token. | Invalid Mendix XPath, not an mxcli bug: `CE0161` every time. The fixed form is mxcli-safe — no GUI fallback. | access |
-| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** mxcli has no `ALTER MICROFLOW` for an existing body, and `ALTER NAVIGATION` **does not exist at all** (the parser rejects it: `no viable alternative at input 'alternavigation'`). Whole-document restatement is therefore the only write mxcli offers, which makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
+| 21 | `DROP` + `CREATE`, `create or modify` or `create or replace` any document **another script also edits** — an aggregator microflow, an after-startup chain, a navigation profile | **STOP → `describe` the live document first, diff your restatement against that dump, and name in the script header which call sites you preserved. A new owner adds `-- supersedes: <script>`; drafting ahead of unrun scripts, `bin/describe-baseline.sh stamp <script>` after the DESCRIBE (exec.sh only warns).** Prefer an in-place edit where your mxcli has one: `alter navigation` / `alter menu` (v0.28+, mendixlabs/mxcli#1522; below it a parse error, `no viable alternative at input 'alternavigation'`), and `alter microflow` (v0.25+; inside loop bodies and `replace body of` v0.29+, ako/mxcli#1693). Whole-document restatement makes losing a sibling script's edit the *default* outcome, not an unlikely one. | A sibling script's call silently vanished; `mx check` 0 errors, lint's orphan rule exempts `ACT_` (2026-08-26). | any |
 | 22 | Write a script containing ANY non-idempotent statement — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, bare `CREATE MICROFLOW`/`CREATE PAGE` on a name that may already exist | **STOP → use the `create or modify` form for every statement, and give every document exactly ONE owning script.** From mxcli v0.27 any write failure **rolls back the whole run**, so one non-idempotent statement, even last, fails every re-run. The property to hold is that `mdlsource/` replays cleanly against an EMPTY app; that is one command and it is the only thing that proves it. | v0.27+: nothing written; older: earlier statements stay written. `mx check` 0 errors — the exit code is the only signal: never ignore it. | any |
 | 23 | Name any document or entity that **might already exist** — `create or modify` on an entity, or any `create or replace` on a page, layout or microflow | **STOP → run `mxcli diff -p <app>.mpr <script>.mdl --format struct` FIRST.** It is read-only, it takes a second, and it prints exactly what the script would add and what it would REMOVE. (`exec` itself only warns — v0.24.0: `create or modify entity Mod.Order drops 6 existing member(s)` — and then writes.) Read the `-` lines before you exec, every time. Rules 21 and 22 tell you to write `create or modify` and to give each document one owner; this is the check that the name you chose is actually free. | `create or modify` on an entity **replaces** its attribute set; `mx check` stays clean. `diff` also prints false `- Attribute` lines (BUG-146): check each against `DESCRIBE ENTITY`. | any |
 | 1c 2 3 5 6 6b 7 8 9 10 11 13 15 17 27 | *(retired 2026-09-30 — numbers kept for `STOP #n` citations; why each went: `process/baseline-incident-history.md` § PF1)* | | | |
@@ -271,7 +271,7 @@ Every row was found in the field: **a green result only certifies what its rung
 | A non-idempotent statement anywhere in a script — `alter entity … add attribute`, bare `CREATE ASSOCIATION`, `CREATE MICROFLOW` on a name that exists | rungs 1–4 **on the re-run**, because the model is still valid | reading the model back and counting against the plan (`DESCRIBE MICROFLOW`, `SHOW MICROFLOWS`), or a from-empty replay | the failing statement **stops the run** (v0.27+ rolls every edit back; older versions skip everything below it), while the mxbuild gate reports 0 errors on a model that is merely missing work. Found when a microflow quietly lost a call it had had an hour earlier. Use `create or modify` everywhere; see `skills/learned-mdl-preflight.md` STOP row 22 | same |
 | A data widget on a page some role can open without read access to the widget's entity — even in a section that role never sees (BUG-94: no role-scoped visibility) | rungs 1–3, **and a bare `mx check` on a scratch copy** (cause of the difference not isolated) | exec.sh's mxbuild gate: CE2729 per widget attribute | Give that role read under an XPath no row satisfies (`[Assoc = empty and Assoc != empty]`), or move the widget to a page only the reading roles open. A clean scratch probe is not a pass for pages with security-scoped widgets — gate on the real exec | card-disbursement requirements-driven build, 2026-09-26 |
 | `[%CurrentUser%]` in a retrieve inside a microflow a REST, scheduled or system-context path can reach | rungs 1–5, lint, and every UI journey | rung 6 **on the system-session path only**: *"token cannot be used in a system session"*, the operation answers 500 | Look the account up by login name — `learned-microflow-patterns.md` → `[%CurrentUser%]` | card-disbursement requirements-driven build, 2026-09-27 |
-| Units **mxcli < v0.26** wrote, and any mxcli's on **Mendix below 10.24.24** | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 "clean" proves nothing; `mx diff` exit 0 does | #295, mxcli#1595 |
+| Units **mxcli < v0.26** wrote, and those mxcli **< v0.29** wrote on **Mendix below 10.24.24** (v0.29 fixed the table from 10.24.0, ako/mxcli#1505, mendixlabs/mxcli#1595) | rungs 1–6 | Studio Pro merge/diff: *"… do not have the same properties"* | after mxcli upgrades, before merging: `bin/doctor.sh --property-sets <project>`; `platform-link.md`. Below 10.24.24 on mxcli < v0.29 "clean" proves nothing; `mx diff` exit 0 does. v0.29's `fix property-sets` also lists `MIXED` names and exits 1 | #295, mxcli#1595 |
 
 > Source: `skills/learned-detection-gaps.md` § Operating rules that fall out of this table
 ## Operating rules that fall out of this table