fix(check): check -p predicts exec's refusals by calling exec's decision (#906, #558, #563)

[ako]

Closes #906
Closes #558
Closes #563

Fixes mendixlabs#1210
Fixes mendixlabs#1211
Fixes mendixlabs#1212
Fixes mendixlabs#1213

What was wrong

In seven places check -p passed a statement that exec then refused part-way, with the statements before it already written. In one place both accepted a write that broke the project. Each refusal was decided inside its exec handler, and check either had no copy of that decision or had a different one.

Design: check calls exec's decision

None of the fixes restates exec's rule in check. Each prediction calls the function exec uses:

Item	Shared decision
existing demo user (#906)	added to the create registry (stmtCreateKind / setFor / stmtDropInfo), like every other "already exists"
existing jar dependency (#906)	CheckExecRefusals replays the alter module … jar dependency actions through applyJarDepAction on a copy of the stored settings, in script order. A drop followed by an add is fine. A module the script creates or drops is not predicted.
translations into the source language (#906)	translationsRefusal, extracted from execCreateTranslations. It also covers a plain create translations of a language that already has translations. Prediction stops after an alter settings language.
task queue created earlier in the script (mendixlabs#1211 = #558)	scriptContext.queues. A queue created later is now MDL-ORDER01, or, when the later statement is a create or modify, it is reported against the project.
page button → microflow created later (mendixlabs#1212)	eagerDefRefs now includes a page's or snippet's widget microflow and nanoflow refs (MDL-ORDER01), and IN QUEUE targets. A new project-tier pass, validateForwardDefRefs, walks the same index for a later create or modify, which no project-free rule can judge.
variable passed to a Microflow Java action parameter (mendixlabs#1210)	microflowParamArgRefusal, used by the flow builder (addError) and by the reference pass. The value must be a qualified name or a 'Module.Name' literal. This write left the project unloadable, so it is refused under both language versions (ADR-0011: a silent wrong write).
referenceselector (#563)	formsWidgetsWithoutWriter is used by the new MDL-WIDGET38 and by the builder's fall-through message, which no longer points at widget init. A project widget definition with that MDL name still wins in both. TestFormsWidgetsWithoutWriterAreUnbuilt parses buildWidgetV3's switch, so a keyword that gains a builder must leave the set.
XPath in RETRIEVE … WHERE (mendixlabs#1213)	MDL047 now also matches Assoc != empty (in retrieves and widget data sources). New MDL091 catches startsWith() / endsWith(); it is exec-enforced like MDL047. validateRetrieveMembers runs the widget check's unresolvableXPathSteps over the constraint as stored (retrieveXPathConstraint), with a resolver that also knows entities declared in the script. CreatedDate gets the hint to write createdDate. Implicit XPath members (id, createdDate, …) are exempt, so a valid [createdDate > …] is not reported.

New rejections, and why they are allowed under the frozen mdl 1 and under mdl 0: each one either refuses a write exec already refused (but later and part-way), or a write mxbuild rejects / that makes the project unloadable. Every XPath shape was measured on mxbuild 11.13.0 (PedApp copy) against a control:

Rejected (CE0161)	Control (clean)
startsWith(Title,'X'), endsWith(Title,'X')	starts-with(Title,'X')
[Mod.Assoc != empty] (retrieve, and list view database source)	[Mod.Assoc/Mod.Target]
[NoSuchAttr = 'x']	[Title = 'x']
[CreatedDate > …]	[createdDate > …]

Test plan

• mdl/executor/check_exec_agreement_pedapp_test.go: TestCheckExecAgree_*, one test per item on a Studio Pro-authored PedApp copy. Each test asserts that check predicts the refusal and exec (statement execution, i.e. --no-check) makes it, and pairs it with a control that both accept.
• Revert check, each fix separately: demo-user registry, jar replay, translations, sc.queues, widget refs in eagerDefRefs, Microflow-param refusal (validator + builder), MDL-WIDGET38 (validator + builder message), MDL091, MDL047 !=, validateRetrieveMembers. Each revert makes its test fail with the reported symptom. For example, the reverted referenceselector case gives exec's old "refresh … mxcli widget init" message, and the reverted Microflow-param case gives exec … got: <nil>.
• Ran the reporters' repro scripts (rehearsal 3 check-misses-* and mendixlabs A variable passed to a Microflow-typed Java action parameter passes check and exec, then the project no longer loads (StorageLoadException: not a valid MicroflowIdentifier) mendixlabs/mxcli#1210–check --references does not validate XPath in RETRIEVE … WHERE: startsWith() and a bare association "!= empty" pass, then mx check reports CE0161 mendixlabs/mxcli#1213) against PedApp copies with the built binary. Every one is now reported by check -p. The A task queue created earlier in the same script is "not found" for IN QUEUE calls — check reports it and exec refuses the whole script mendixlabs/mxcli#1211 script now checks clean and execs.
• Twice-exec rule: an mdl 1 script with create or modify task queue + in queue call, demo user, and translations ran twice on a PedApp copy. Run 2 changed no file.
• go test ./mdl/executor/ passed (364s), go test ./cmd/mxcli/ passed (skill budgets), make check-conformance passed, make lint passed, make check-findings passed.
• make test-integration-executor passed (708s, with the TestApp submodule).
• No roundtrip or parity tests were added (Round-trip CI suite reached 29m57s: create or modify now builds each declared flow #870).

🤖 Generated with Claude Code