From 3e1f683a41c5c6a4158f59475728d44394908984 Mon Sep 17 00:00:00 2001
From: r <r@x>
Date: Tue, 29 Sep 2026 13:25:55 +0000
Subject: [PATCH] fix(exec.sh): delta gate keys errors on code + message +
 location, counted

The delta gate compared post-exec errors to the pre-flight baseline by
message text alone. On a real 22-error baseline, 20 errors share two
"Could not find widget" messages and every CE0117 reads "Error(s) in
expression.", so a script adding another CE0117 in a new microflow was
judged IDENTICAL and kept.

Each Error is now a short hash of errorCode, message and every location's
module / document / element, and is_subset_of is a multiset test. Names,
not GUIDs, so a CREATE OR REPLACE that leaves a pre-existing error in place
still reads as pre-existing; a rename reads as new and restores.

Field run on a scratch copy of a greenfield PoC model (Mendix 11.12.1,
22-error baseline), master vs fix, four scripts: identical verdicts on
fix-one, fix-one-add-new and replace-unchanged-plus-harmless; the
add-same-message script is KEPT on master and RESTORED on the fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
---
 CHANGELOG.md        |  1 +
 project-bin/exec.sh | 63 ++++++++++++++++++++++++++++-----------------
 2 files changed, 41 insertions(+), 23 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f65597..7359572 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ three commits past it), and a bug report can name a release instead of a sha nob
 Sections dated before 2026-09-19 predate the cycle and stay as they are.
 
 ## Unreleased
+- fix(project-bin/exec.sh): **the delta gate keys an error on code + message + location, counted, instead of the message text alone.** On a real 22-error baseline (Mendix 11.12.1), 20 errors shared two "Could not find widget" messages and CE0117 always reads "Error(s) in expression.", so a script adding another CE0117 in a new microflow, or another copy of a baseline error, was judged "identical" and kept. Now each Error is a hash of errorCode, message and every location's module / document / element, and the subset test is a multiset test. Names, not GUIDs, so a CREATE OR REPLACE that leaves a pre-existing error in place still reads as pre-existing. Field-run on a scratch copy of a greenfield PoC model — MendixMau
 - chore(inbox): **triage of `contrib/inbox/`: removed 15 promoted/obsolete files, gave the rest neutral names and scrubbed identifiers.** Gone: the ten machine-diff `*-patches.md` files from 2026-09-14, the 2026-09-27 field-project patch file, the built company-brain idea, and three already-promoted or superseded bug dumps. Kept for now: `2026-09-27-mxcli-upstream-issues.md`, because five drafts under `bug-logs/pending-github-issues/` cite it as their source. Four remaining files were renamed to `field-project-{a,b,c}` names; project and app names, home-style paths and personal names inside the 17 remaining entries were replaced with neutral labels or placeholders (technical content unchanged). — MendixMau
 - learn(learned-mdl-preflight, learned-detection-gaps, microflow-preflight, testing-shape, learned-mdl-cannot-express, learned-page-patterns, rest-integration-first-time-right, journey-proof, learned-datagrid-customcontent-binding): **the skills side of BUG-142 to BUG-154.** STOP row 12 rewritten shorter for v0.24.0 — `ContentParams` takes a bare attribute or a quoted literal only, and the `toString(Attr)` fix it taught no longer builds; row 14 notes a narrowing `grant` merges, row 23 that `diff` prints false `-`/`~` lines. Detection gaps: the ContentParams row now covers any object-bound `dynamictext` and says check passes `if … then … else`; reserved words cover entities; new CE1870 row. microflow-preflight: CONV013 false positive and doc-comment round-trip resolved from "Not verified"; error handler without `return` is the second merge-overlap shape. testing-shape: `--test-endpoint` writes into the working model until a clean stop; `run --local` starts with scheduled events off (new register row). Also: five cannot-express rows (tab badge, validate-while-typing, AppTitle, always-open nav groups, sidebar toggle / page-load / Marketplace layout) and the DG2 `emptyplaceholder` correction; control-bar attributes, nested list view `Editable` and REPLACE-not-re-run-safe in page patterns; v0.24.0 REST bullets; two OQL journey traps. Triages three inbox notes (ContentParams, REST/JSON/page field notes, scheduled events) — card-disbursement requirements-driven build
 - learn(bug-logs): **thirteen new ledger entries (BUG-142 to BUG-154) and five retests from mxcli v0.24.0 / Mendix 11.13.0.** New: `ContentParams` builds only from a bare attribute or a quoted literal, and `if … then … else` passes check and fails CE1613 (supersedes the BUG-23 fix); theme seeder and Atlas-map gaps; `create user role` omits `CheckSecurity`/`GUID`; a narrowing `grant` merges; `diff` false modifications; check/exec disagreeing on same-script documents; E007 on a last quoted enum literal; a table of check/lint misfires and check-green/mxbuild-red constructs; DG2 and filter definition gaps; `rest call … body $Var` sends the literal text; published-REST, mapping and Java action gaps; OQL `HAVING` and date aggregates; MDL surface gaps. Retests: BUG-08 (REPLACE still collides, and on reused child names), BUG-77 reproduced with its trigger isolated, BUG-92 and BUG-117 field instances, BUG-122 on a snippet list view; the layout-merge draft gains the error-handler shape. Each from a `check`/exec/mxbuild A/B or a BSON read on a scratch copy — card-disbursement requirements-driven build
diff --git a/project-bin/exec.sh b/project-bin/exec.sh
index 4f091c3..3206ae8 100755
--- a/project-bin/exec.sh
+++ b/project-bin/exec.sh
@@ -6,11 +6,10 @@
 #
 # The mxbuild gate is a DELTA gate, not an absolute "0 errors" one: a write is kept
 # when the post-exec error set is the pre-flight baseline exactly, or a strict
-# SUBSET of it (every post-exec error message already existed before this script
-# ran — nothing new, even if some were cleared). Only a set containing something
-# new triggers the snapshot restore. See "Delta gate" below.
-# Known limit: errors are compared by message text only, so a new error whose
-# message matches one already in the baseline is not seen as new.
+# SUBSET of it (every post-exec error already existed before this script ran —
+# nothing new, even if some were cleared). Only a set containing something new
+# triggers the snapshot restore. See "Delta gate" below. An error is identified by
+# code + message + where (module / document / element), counted, not deduplicated.
 #
 # Usage: ./bin/exec.sh <script.mdl>
 #        ./bin/exec.sh --patch <script> [args...]
@@ -554,20 +553,40 @@ err_codes() {
   [ -n "$PY" ] || { echo "?"; return; }
   "$PY" -c "import json;d=json.load(open('$(native_path "$1")'));print(','.join(sorted({x.get('errorCode','?') for x in d.get('problems',[]) if x.get('severity')=='Error'})))" 2>/dev/null || echo "?"
 }
+# err_set <errors.json> — one key per Error problem: a short hash of errorCode + message +
+# every location's module / document / element, sorted, duplicates KEPT, joined with "|".
+# The key used to be the message text alone. On a real 22-error model (Mendix 11.12.1),
+# 20 of the 22 shared two messages ("Could not find widget 'Markdown viewer' …" x15,
+# "… 'Events' …" x5), and mxbuild's CE0117 message is always "Error(s) in expression." —
+# so while one CE0117 or one missing widget was in the baseline, a script could add any
+# number more and the gate kept it.
+# Names, not elementId GUIDs: a CREATE OR REPLACE re-mints the GUIDs of a microflow whose
+# pre-existing error it leaves in place, and that must still read as pre-existing. A rename
+# does read as new, and restores — the safe direction. Hex tokens: no "|" or glob characters,
+# whatever the message says.
 err_set() {
   [ -n "$PY" ] || { echo ""; return; }
-  "$PY" -c "import json;d=json.load(open('$(native_path "$1")'));print('|'.join(sorted(x.get('message','') for x in d.get('problems',[]) if x.get('severity')=='Error')))" 2>/dev/null || echo ""
+  "$PY" - "$(native_path "$1")" <<'ERRSETPY' 2>/dev/null || echo ""
+import hashlib, json, sys
+d = json.load(open(sys.argv[1]))
+keys = []
+for x in d.get('problems', []):
+    if x.get('severity') != 'Error':
+        continue
+    locs = sorted('\x1e'.join(str(l.get(k) or '') for k in ('module', 'document', 'element'))
+                  for l in (x.get('locations') or []))
+    raw = '\x1f'.join([x.get('errorCode') or '', x.get('message') or ''] + locs)
+    keys.append(hashlib.sha1(raw.encode('utf-8')).hexdigest()[:16])
+print('|'.join(sorted(keys)))
+ERRSETPY
 }
 
-# is_subset_of <candidate> <superset> — both are err_set's own "|"-joined sorted
-# message strings (the SAME comparison key the identical-baseline check already
-# used; this does not introduce a new one). True (exit 0) when every message in
-# <candidate> also appears in <superset> — i.e. nothing NEW. An empty <candidate>
-# (0 post-exec errors) is trivially a subset. Bash-native, no extra Python call:
-# both strings are already in hand as plain variables by the time this runs.
-# Pure POSIX word-splitting on IFS='|', no arrays/`read -a` — bash 3.2 / Git Bash
-# safe. Messages containing a literal "|" would break the membership test the
-# same way they already break the exact-equality test above; not new exposure.
+# is_subset_of <candidate> <superset> — both are err_set's "|"-joined sorted key lists.
+# True (exit 0) when <candidate> is a sub-MULTISET of <superset>: each key in <candidate>
+# consumes one occurrence in <superset>, so a baseline holding an error once does not
+# excuse the same error twice. An empty <candidate> (0 post-exec errors) is trivially a
+# subset. Bash-native, no extra Python call. Word-splitting on IFS='|' and ${var/pat/rep},
+# no arrays or `read -a` — bash 3.2 / Git Bash safe.
 is_subset_of() {
   _cand="$1"
   [ -z "$_cand" ] && return 0
@@ -578,7 +597,7 @@ is_subset_of() {
     IFS="$_oldIFS"
     [ -z "$_e" ] && continue
     case "$_super" in
-      *"|$_e|"*) : ;;
+      *"|$_e|"*) _super="${_super/|$_e|/|}" ;;
       *) return 1 ;;
     esac
     IFS='|'
@@ -765,17 +784,15 @@ if [ -x "$MXBUILD" ] && [ -x "$JAVA_EXE" ]; then
       # A shared model means another workstream can leave it non-building; an
       # absolute "zero errors" gate would then block every good script forever.
       # Keeps the write when the POST-exec error set is the baseline exactly
-      # (nothing changed), OR a STRICT SUBSET of it (every post-exec message
-      # already existed pre-exec — no new message, even though some
-      # pre-existing ones may have been cleared). Messages only: a new error
-      # with the same text as a baseline one passes (known limit, see header).
+      # (nothing changed), OR a STRICT SUBSET of it (every post-exec error
+      # already existed pre-exec — nothing new, even though some pre-existing
+      # ones may have been cleared). An error is code + message + location,
+      # counted (see err_set), so a second copy of a baseline error is new.
       # Only a set with something NEW in it restores the snapshot.
       # Real incident: a script that took 34
       # pre-existing errors down to 1 was rolled back and logged
       # "blocked: PRE-EXISTING CE1613" because the gate could only recognise
-      # "unchanged," never "reduced." Comparison key is unchanged — err_set's
-      # per-message string (see err_set above) — subset-checked by
-      # is_subset_of, not switched to a different key.
+      # "unchanged," never "reduced."
       POST_SET=$(err_set "$ERRORS_FILE")
       DELTA_KIND=""
       if [ -n "$BASELINE_SET" ] && [ "$BASELINE_SET" = "$POST_SET" ]; then