Sync ako/mxcli: sort over associations, page reference validation, rewrite-churn fixes (31 commits)

[ako]

Syncs ako/mxcli:main into mendixlabs/mxcli:main — 31 commits, 15 of them non-merge, since a909abc7 (docs(changelog): release v0.23.0). The fork is 0 behind.

Grouped by theme; each bullet is one fix with the measurement that settled it.

Sorting a retrieve over an association — #1152

• Resolve the hop across ancestors and modules (d614dbf). retrieve … sort by System.Language.Code asc — MDL mxcli describe had just emitted — passed check and was refused by exec with "does not belong to entity 'Administration.Account'". The hop is System.User_Language, declared on the ancestor System.User and stored in the System module; the resolver searched one domain model, matched only associations whose parent was the retrieved entity itself, and qualified with the wrong module. Now a generalization-chain walk. Control: a build that derives the hop and does not write it is mxbuild CE7247.
• Let a sort column name the association it navigates (fe5a740). Inference cannot be made correct where two associations reach one entity. Measured on 11.12.3 with Order_ShipTo/Order_BillTo (both Order → Address): a microflow sorting by the billing address came back from describe → exec sorting by the shipping one, mx check 0 errors both sides. sort by Sales.Order_BillTo/Sales.Address.City asc now says which — in a microflow retrieve and a page datasource alike. Two readers were dropping the stored hop, not one.

Pages — references that nothing resolved, properties that nothing bound

• Validate the widgets inside a placeholder block (79186ce0). A page's widgets live in two AST fields and all three validators were given only the bare body, so every reference inside placeholder X { … } — microflow, nanoflow, page, snippet, entity, image — was validated by nothing. Not an edge shape: it is what mxcli's own skills, bug-tests and DESCRIBE output write.
• Resolve the image a static or dynamic image widget names (f5961faa, SelectionHelper custom states cannot include StaticImageViewer widgets via MDL #1149). widgetRefCollector keyed the image reference on widget type, so staticimage's Image and dynamicimage's DefaultImage resolved to nothing — check --references passed and the build failed CE1613.
• Bind a pluggable widget's textTemplate to an attribute (95c1841f, Consolidate DataGrid builder paths: datagrid keyword vs pluggablewidget engine #575). A headerCaption: 'Name' rendered the literal word "Name" on every node, and the <Name>Params companion the report reached for did not exist at widget level.
• Read text templates in the generic pluggable DESCRIBE path (839e6c28, Consolidate DataGrid builder paths: datagrid keyword vs pluggablewidget engine #575). Every pluggable widget outside the list of nine went through a path reading AttributeRef and PrimitiveValue only, so TreeNode's and Timeline's text templates were absent from describe page and describe → exec dropped the caption.

Rewrites that silently dropped or churned

• Keep validation rules create or modify entity cannot spell (240c5aa6). The entity body authors Required and Unique only; RegEx and Range come from a separate statement and were listed among the fields the rewrite is authoritative about, so every rewrite deleted them. The visible symptom was churn, because the scripts that hit it re-create the rule next statement — the loss is silent.
• Reconcile a unit re-inserted under the ID of one just deleted (3ed95a43). Several create or modify handlers are delete + create under the preserved unit ID, and canon.Reconcile lives in updateUnit, so those writes never reached it. Two identical runs of one create or modify rest client differed in 143 bytes, every one an element $ID. This is CLAUDE.md's "a new write path means wiring it to canon.Reconcile" in the shape that hides — the new path is insertUnit reached by way of deleteUnit.
• Write a view entity's OQL document in place (65d79818). Changing only the OQL printed Unchanged view entity while describe entity showed the new query stored.
• Regression case and finding for re-exec identity stability (568f7be0). One idempotent script covering both instances of Re-exec is not identity-stable: nested GUIDs are re-minted, and three unit types are replaced under a new unit GUID ako/mxcli#556; the control is a binary with both fixes stashed out — 3 changed files on every re-run, mx check 0 errors each time, which is why the version-control diff was the only signal this class ever produced.

System-module metadata

• Measure the System module's String lengths (616e2d23, fix #583: parse StringAttributeType.Length across BSON numeric widths #584). meta.SystemAttrDef declared a Length and none of the 115 String attributes populated it, so every System string was built unlimited and every length comparison was made against 0. A view entity selecting u.Name from System.User could not be declared in any way that both passed check and built.
• Do not judge a pass-through length mxcli does not know (1237b5cd). MDL031 refused every declaration of a column taken from a System.* string attribute — including the one that builds — and suggested the one that does not. System.User.Name is String(100), not the 200 both the field report and the issue text assumed.

Other

• Report the members a script removes from the project — MDL087 (71851f74, CREATE OR MODIFY ENTITY drops attributes added by a later ALTER without saying so ako/mxcli#562). create or modify entity rebuilds from the statement, so an attribute a later slice added is deleted when the earlier slice is re-run alone; the loss surfaced two slices later as CE1613 on a page, naming the page and never the script. Now caught by check … --references, the one command that runs before anything is written.
• Manage workflow groups via MDL (832e9c80, feat: Manage Workflow Groups via MDL #272). alter settings workflows add|modify|remove group '…' and show workflow groups — a scripted project setup no longer has to stop and open Studio Pro to define the buckets a user task's group targeting selects from.
• Session-auth OData needs X-Csrf-Token (10d6892b). The mendix-vega-charts skill pack said the session cookie was sufficient; it is not, and Vega reads the 401 body as an empty dataset, so a chart drew axes and a full legend with zero points and no error. Measured on 11.14.0, one URL, four requests: cookie only → 401, cookie + X-Csrf-Token → 200