fix(test): read the after-startup setting from the colon-form describe line

.claude/lint-rules/sec_unconstrained_pii_read.star

@@ -52,18 +52,29 @@ def check():
         if len(pii_attrs) == 0:
             continue
 
-        # Find roles with unconstrained READ
+        # Find roles that can read a PII attribute with no row constraint. The
+        # entity-level READ row is emitted when ANY member is readable, so it
+        # cannot answer this: a role granted `read (FullName)` has it too. The
+        # member row can. Its name is qualified for explicit member rights and
+        # bare when expanded from default rights, so match either spelling.
         unconstrained_roles = []
+        readable_pii = []
         for perm in permissions_for(e.qualified_name):
-            if perm.access_type == "READ" and perm.member_name == "" and not perm.is_constrained:
-                unconstrained_roles.append(perm.module_role_name)
+            if perm.access_type != "MEMBER_READ" or perm.is_constrained:
+                continue
+            for attr_name in pii_attrs:
+                if perm.member_name == attr_name or perm.member_name.endswith("." + attr_name):
+                    if perm.module_role_name not in unconstrained_roles:
+                        unconstrained_roles.append(perm.module_role_name)
+                    if attr_name not in readable_pii:
+                        readable_pii.append(attr_name)
 
         if len(unconstrained_roles) > 0:
             violations.append(violation(
                 message="Entity '{}' contains PII attributes ({}) and is readable without XPath row constraints by: {}".format(
                     e.qualified_name,
-                    ", ".join(pii_attrs),
-                    ", ".join(unconstrained_roles),
+                    ", ".join(readable_pii),
+                    ", ".join(sorted(unconstrained_roles)),
                 ),
                 location=location(
                     module=e.module_name,

.claude/skills/fix-issue/findings/mdl-backend.jsonl

@@ -159,7 +159,10 @@
 {"date": "2026-10-02", "area": "mdl/backend", "symptom": "Studio Pro 11.15 over --mcp: every write in a module fails 'validation failed for <doc>' with another document's error (e.g. an empty enumeration elsewhere); a nonexistent document checks 'No errors found.'", "cause": "11.15 replaced ped_check_errors' documents[] with filters{documentType,documentNamePrefix}+pagination and made all input schemas additionalProperties-permissive, so the old argument is accepted and IGNORED: the check ran project-wide. The answer became a paged listing ('Listing problems a-b (out of n). Check ID: k', then 'Name' (Type): unit headers).", "fix": "checkDocumentNow (mdl/backend/mcp/check_errors.go) sends filters when SupportsToolArg('ped_check_errors','filters'), fetches every page repeating the filters (a page without them lists the whole project), re-runs on a stale window, and keeps only problems under the exact 'Name' (Type): header (documentNamePrefix is a prefix). An unscoped listing from the fallback form is scoped the same way.", "insight": "A permissive schema turns an argument rename into a silent no-op, so 'the call succeeded' proves nothing; the live control needs a deliberately broken document AND a clean one checked in the same run (TestLive_CheckErrorsIsScoped). Gate on the newer shape's argument, never on serverInfo.version.", "file": "mdl/backend/mcp/check_errors.go", "issue": ""}
 {"date": "2026-10-02", "area": "mdl/backend", "symptom": "Studio Pro 11.15 over --mcp: DESCRIBE of an entity edited this session shows String(unlimited) for String(200) attributes; reconstructed associations have empty type/owner.", "cause": "11.15's ped_read_document omits every property equal to its schema default (StringAttributeType.length=200, Association.type=Reference/owner=Default, NoGeneralization.persistable=true, BooleanConditionOutcome.value=false); readers mapped absent to Go's zero value, and length 0 means unlimited.", "fix": "attributeTypeFromPED reads length as *int and defaults absent to 200; reconstructAssociations defaults absent type/owner to Reference/Default.", "insight": "Diff the READ output of the same element across releases, not just tool schemas: this change is in one sentence of ped_read_document's description. Any new PED reader must treat an absent property as the schema default (ped_get_schema kind:element shows '= default').", "file": "mdl/backend/mcp/read_router.go", "issue": ""}
 {"date": "2026-10-02", "area": "mdl/backend", "symptom": "create workflow \u2026 display 'X' over --mcp stores the document name as the workflow title and workflowName (Studio Pro 11.14 and 11.15).", "cause": "The context-shaped Workflows$Workflow constructor ignores the title (11.14 'caption', 11.15 'title') and workflowName it is given; 11.15 also renamed caption->title, which its permissive schema would have dropped silently anyway.", "fix": "workflowConstructorTakesContext's probe records the title key (workflowCtorTitle); workflowCreateLeafOps sets /title and /workflowName/text after the create (set ops both releases accept).", "insight": "Read back what a constructor stored instead of trusting SUCCESS: both releases accepted the key and applied nothing.", "file": "mdl/backend/mcp/workflow.go", "issue": ""}
+{"date": "2026-10-02", "area": "mdl/backend", "symptom": "alter page … set (Caption = '…') on tabPage2 fails with `widget \"tabPage2\" not found` although describe page prints `tabpage tabPage2`; a tab caption missing its default-language translation (mxbuild CE4899 after switching DefaultLanguageCode) could only be fixed by re-creating the whole page.", "cause": "findInWidgetChildren (and its twins findNearestDSInChildren and collectWidgetScopeInChildren) walked TabPages[] only to descend into each page's Widgets[], never matching the Forms$TabPage's own Name — a tab page is a named element that lives in a list that is not a widget list.", "fix": "Walk TabPages through findInWidgetArray / findNearestDSInWidgets / collectWidgetScope like any named list; INSERT INTO a tab page appends to its Widgets, and INSERT BEFORE/AFTER, REPLACE and DROP on a tab page are refused (refuseTabPageSiblingEdit) because they would write widgets into TabPages or orphan the control's DefaultPagePointer.", "insight": "Resolving a new kind of node also hands it to every structural op that trusts parentKey/parentArr: making X addressable means deciding, per op, what writing into X's parent list does.", "file": "mdl/backend/pagemutator/mutator.go", "issue": ""}
+{"date": "2026-10-02", "area": "mdl/backend", "symptom": "On a project whose default language is de_DE, alter page … set Caption on a tab page (and set Label on any Studio Pro 11 input widget) reports `Altered page` and stores nothing; set Caption on a button writes the German text over the first translation (en_US); set Title overwrites every language with the same string.", "cause": "Four text writers with four rules: setTranslatableText looked for a `Translations` key no Mendix document has, then DSet a `Text` field DSet cannot add (silent no-op on every real Texts$Text); setWidgetLabelMut read only the legacy `Label` key while 10+/11 store LabelTemplate (a Forms$ClientTemplate); setClientTemplateText wrote Items[0] whatever its language; updateTextsTextValue/updateClientTemplateText wrote all translations. A unit test built the fictional `Translations` shape and asserted nothing, so it stayed green.", "fix": "One helper, setTextsTextTranslation: update or append the Texts$Translation for model.AuthoringLanguage() (the project default DESCRIBE shows), keep other languages; setTranslatableText dispatches on $Type (Texts$Text / Forms$ClientTemplate) and refuses anything else; setWidgetLabelMut tries LabelTemplate first; execAlterPage resolves the authoring language before the first mutation.", "insight": "A text setter's test must build the shape read back from a Studio Pro-authored page (bson dump --format ndsl) and assert the stored translation per language; `err == nil` proves nothing for a setter whose miss path is DSet returning false. Verified live: de_DE switch → CE4899 on tabPage2, set Caption → de_DE added, en_US/nl_NL/ar_DZ kept, 0 errors.", "file": "mdl/backend/pagemutator/mutator.go", "issue": ""}
 {"date": "2026-10-02", "area": "mdl/backend", "symptom": "create entity over --mcp stores every attribute as String(200) on both Studio Pro 11.14 and 11.15 MCP servers; String lengths never written (also on alter entity add attribute).", "cause": "pedAttribute sent \"$Type\":\"DomainModels$Attribute\" inside the DomainModels$Entity constructor, whose attributes are PlainObject<{name,type,enumerationName}>; with $Type present PED ignores `type` and still answers SUCCESS and a clean check. Neither attribute constructor has a length property.", "fix": "buildEntityValue clears $Type on nested attributes (omitempty); applyAttributeLengths sets /entities/N/attributes/M/type/length after create and after add for every String not at the schema default 200.", "insight": "The same element has two constructor shapes depending on where it is added (nested PlainObject vs standalone constructor) \u2014 read ped_get_schema for the container, not the element. A clean ped_check_errors proves nothing about a dropped property; only a read-back of each type caught it.", "file": "mdl/backend/mcp/domainmodel.go", "issue": "ako/mxcli#923"}
 {"date": "2026-10-02", "area": "mdl/backend", "symptom": "TestLive_EntityAccessRuleReject fails on every live Studio Pro MCP server (entityIndex: not found) \u2014 its fixture module ExpenseApproval exists in no test project.", "cause": "The live test read a hand-made fixture (module/entity/role) from one developer's project via env defaults instead of building it.", "fix": "The test creates its own entity Zz_R12_AccessFixture_<stamp> in MXCLI_MCP_MODULE, grants MXCLI_MCP_ROLE (default <module>.User) once, then asserts the second grant is rejected with the rule count unchanged; skips with the role to set when the role does not exist (module roles cannot be created over MCP).", "insight": "A live test that depends on state it does not create fails as an environment problem on every other machine, so its real failures read as noise; build the fixture, and skip only on what MCP cannot author.", "file": "mdl/backend/mcp/security_test.go", "issue": "ako/mxcli#924"}
 {"area": "mdl/backend", "date": "2026-10-02", "symptom": "A view entity's OQL document that Studio Pro excluded is re-included by any CREATE OR MODIFY of the view entity that changes its query.", "cause": "encodeViewEntitySourceDocument writes Excluded=false as a constant, and WriteViewEntitySourceDocument's update path carried only the stored ExportLevel (#816), not Excluded.", "file": "`mdl/backend/modelsdk/move_view_write.go` (WriteViewEntitySourceDocument), `export_level_carry.go` (keepStoredExcluded)", "insight": "A shared create/update encoder that writes model state as a constant needs a carry on the update path for every such key, not just the one a previous bug named (#816 ExportLevel, #914 Excluded).", "refs": ["ako/mxcli#827", "ako/mxcli#914"]}
 {"area": "mdl/backend", "date": "2026-10-02", "issue": "ako/mxcli#803", "symptom": "`create association A.X from A.E to B.F on delete restrict` (TO entity in another module) stores ChildDeleteBehavior DeleteMeIfNoReferences with a null ChildErrorMessage — the shape that stops the runtime starting (CapTrackV2 §1). The same statement within one module, and ALTER on the cross-module one, were fine.", "cause": "crossAssocToGen built the delete behaviour without the restrict message; #795 added patchCrossDeleteErrorMessage only at one call site (patchCrossAssociations' new-element arm), not in the converter, so CreateCrossAssociation still wrote null.", "file": "`mdl/backend/modelsdk/association_move_write.go` (crossAssocToGen)", "fix": "Call patchCrossDeleteErrorMessage inside crossAssocToGen, as assocToGen does inline; drop the now-redundant call site.", "insight": "A property fix belongs in the converter, not at the call site that was reported — enumerate the converter's callers. Test: mdl/backend/modelsdk/issue803_cross_assoc_restrict_test.go, keep behaviour as the null control."}
+{"area": "mdl/backend", "date": "2026-10-02", "symptom": "getput: describe → exec of a combo box with `Editable: <expr>` rewrites ConditionalEditabilitySettings/Conditions[0]: 2 -> 3", "cause": "Forms$ConditionalEditabilitySettings registered Conditions as a plain mandatory list (default marker 3); Studio Pro writes [2], as for visibility", "file": "`mdl/backend/modelsdk/widget_write.go` (RegisterTypeDefaults)", "insight": "measured on both editability settings in TestApp; the ALTER path (pagemutator setWidgetConditionalSettingMut) still hand-writes [3] for both settings", "refs": ["#721"]}