[kris-bom]

Closes #1652

What does it do?

check -p --references now reports CE1406 when a flow in an ordinary module does a database
retrieve of, or a create of, a Hidden entity of a Protected (add-on) module:

CE1406: retrieve $l is not allowed to use entity 'AddOn.Internal' because app modules cannot reference
hidden elements in add-on modules — AddOn is a protected module and the entity's export level is Hidden; ...

Before this change both passed check and exec, and the build failed with
Retrieve object(s) activity … is not allowed to use entity / Create object activity … is not allowed to use entity.

Root cause: since #1498 an entity is checked only in a flow's parameter and return types
(checkFlow). The flow-body check (checkFlowMembers) checked the members a create assigns and a
retrieve's XPath names, but never CreateObjectStmt.EntityType or RetrieveStmt.Source. A bare create,
or a retrieve without where, reached no check at all.

Change: checkFlowMembers calls the existing entityRef for the entity of a create and of a
database retrieve (not an association retrieve, which names an association and keeps its member check).
entityRef already folds in the level the script states, the stored level, and Hidden for an entity the
script creates, and it is silent for a Usable entity, an ordinary module and an entity it cannot find.
The add-on module itself is still skipped. Small and focused: one file of logic, about ten lines.

Files

• mdl/executor/validate_protected_module_members.go: entity check for create and database retrieve
• mdl/executor/validate_protected_module_refs_test.go: nine cases in TestValidateProtectedModuleRefs
• CHANGELOG.md: entry under Unreleased / Fixed
• .claude/skills/fix-issue/findings/mdl-executor/2026-10-25-protected-module-hidden-entity-retrieve-create-ce1406.json

Testing

New cases in TestValidateProtectedModuleRefs (MockBackend fixture with a Protected MyAddOn):
retrieve of a Hidden entity (with and without where), bare create of a Hidden entity, the same in a
nanoflow; controls that stay clean: retrieve / create of a Usable entity, a Hidden entity the script
makes usable with alter entity … set export level api, the add-on module using its own Hidden entity,
and an ordinary module's Hidden entity.

• Tests written first: with only validate_protected_module_members.go reverted, four cases fail
  (retrieve_of_hidden_entity, …_with_where, bare_create_of_hidden_entity,
  …_in_a_nanoflow); with the fix they pass.
• make build passes; make lint passes (lint-go, lint-ts, check-conformance, check-test-timeouts);
  make check-findings passes.
• make test passes. Locally on macOS the two TestSyncJavaDependencies_* tests in
  cmd/mxcli/docker hang the same way on main (their fake mx calls setsid, which macOS lacks);
  with a setsid shim on PATH that package passes too. Unrelated to this change.

The issue's script was measured with mx check on Mendix 11.12.4 (three CE1406 errors, two of them
this shape) and with check on testdata/testapp (11.14.0).

Checklist

• Issue filed first: check -p --references misses CE1406 for a database retrieve or a create of a Hidden entity of a Protected module #1652 (split from the call-result gap, check -p --references does not type a call microflow result, so a Hidden attribute of a Protected module read on it passes (CE1406) #1654, which has its own PR)
• Test written first and failed on main
• Fix proven to be the cause (revert -> tests fail -> restore -> tests pass)
• One commit, one concern
• CHANGELOG entry
• Finding recorded; make check-findings passes

🤖 Generated with Claude Code