learn(skills): learned-file-upload-widget — File Uploader MDL shape, traps, upload instrument (field-proven on mxcli v0.24.0)

[MendixMau]

Direct lane

What changed and why (one paragraph):
New skill skills/learned-file-upload-widget.md. It covers putting a working file upload on a page with mxcli: the Mendix File Uploader 2.5.0 bound to a System.FileDocument specialisation. It gives the MDL shape (entities, grants, create/delete microflows, advanced formats) and names the upload widgets mxcli cannot author (classic FileManager, PDS uploader). It also documents two traps with their workarounds:

• a simple-mode allowedfileformat passes exec, then fails mx check with CE0463;
• an uploader page from DESCRIBE will not re-exec (exposes 2 datasources).

Finally, it defines what "the upload works" means as a six-step instrument: mx check, boot, Playwright upload as a non-admin user, OQL row check, sha256 download, and a negative format check. The skill is routed as ondemand / build/pages for the mdl and test agents.

Field evidence (a Mendix app-rebuild project, 2026-09-25, throwaway apps made with mxcli new, Mendix 11.12.2):

• Stock v0.24.0. The section-4 MDL was taken straight from the skill file and run with only a wrapper (module, role, page, menu microflow, demo user):

  • mxcli check --references: Check passed!
  • exec: every create line, no errors
  • mx check: The app contains: 0 errors.
  • boot: App is running at http://127.0.0.1:8095/
  • Playwright as a non-admin user: RESULT PASS, 2/2 files stored with HasContents true (1024 B, 244 B)
  • download: 2/2 sha256 MATCH
  • .csv rejected, CsvRows 0

• The same instrument passed on stock v0.23.0 (1/1).

• Both traps reproduce with identical messages on v0.23.0 and v0.24.0.

• The proposed fixes in the table are proven only on a local mxcli patch, with unit tests. Nothing has been filed upstream yet.

• No client data anywhere in the diff (bin/check-no-client-data.sh with the denylist: ✅ 678 tracked files)

• Size cap: 8 files, 157 lines

• Test tier reached: T0 + bin/render-routing.sh --check (in sync; baseline 78089/80000 words, unchanged, since the skill is ondemand). The skill content itself was field-run as described above.

• For a new/changed instrument: n/a (a skill, not a script)

• For a new skill: routing row added (bin/lib/skill-routing.tsv + bin/render-routing.sh)

• CHANGELOG.md line appended, crediting the source project (bin/check-pr-discipline.sh: clean)

• New bug entries: none

🤖 Generated with Claude Code