[kris-bom]

Closes #1654

What does it do?

check -p --references now knows which entity the output variable of call microflow holds, so a
member read on a call result is checked like one on a parameter:

$Request = call microflow AddOn.Request_GetFirst();   -- Usable, returns the Usable AddOn.Request
declare $Secret String = $Request/Secret;             -- Secret is a Hidden attribute

now gives CE1406: declare $Secret is not allowed to use attribute 'AddOn.Request.Secret' …. Before this
change it passed check and exec, and mxbuild refused it with CE1406. The same gap left
change $r (NoSuchAttribute = …) on a call result without its CE1613 report.

Root cause: walkTypedFlow (mdl/executor/validate_member_refs.go), the one variable-typing walk
the --references member checks share, typed parameters, create, retrieve and loop iterators, but
not the output of call microflow. A member path on an untyped variable resolves no entity, so every
check on it stayed silent.

Change: walkTypedFlow types a call's output from the stored callee's return type (ObjectType or
ListType, which carry the entity's qualified name); a list return also types a loop over it. A callee
the same script creates or rewrites is left untyped: its stored return type may be the one the script
replaces, and a stale type would turn a valid member into a false refusal. Both callers pass that set
(scriptContext.microflows for the member check, the resolver's scriptFlows for the Protected-module
check). New helper storedMicroflowReturnEntity. Small and focused: one walk and its two callers.

Files

• mdl/executor/validate_member_refs.go: call output typing in walkTypedFlow, storedMicroflowReturnEntity
• mdl/executor/validate_protected_module_members.go: passes the script's flows to the walk
• mdl/executor/validate_member_refs_test.go: TestValidateMemberReferences_TypesACallMicroflowResult
• mdl/executor/validate_protected_module_refs_test.go: a Usable API_GetPub in the fixture, three cases
• CHANGELOG.md: entry under Unreleased / Fixed
• .claude/skills/fix-issue/findings/mdl-executor/2026-10-25-call-microflow-output-untyped-member-checks-silent.json

Testing

• TestValidateMemberReferences_TypesACallMicroflowResult: a change with an unknown attribute on an
  object call result and on the iterator over a list call result is reported; a real attribute is not;
  a callee the script rewrites stays untyped (no report).
• TestValidateProtectedModuleRefs: a Hidden attribute on a call result in a return and in a
  declare is CE1406; a Usable attribute on it is clean.
• Tests written first: with only the two non-test files reverted, all four reporting checks fail
  (got []); with the fix they pass.
• make build, make test and make lint (lint-go, lint-ts, check-conformance,
  check-test-timeouts) pass; make check-findings passes. (On macOS, cmd/mxcli/docker's
  TestSyncJavaDependencies_* need a setsid on PATH, on main as here; unrelated.)

The issue's script was measured with mx check on Mendix 11.12.4 (CE1406 on the declare) and with
check on testdata/testapp (11.14.0).

Checklist

• Issue filed first: check -p --references does not type a call microflow result, so a Hidden attribute of a Protected module read on it passes (CE1406) #1654 (split from check -p --references misses CE1406 for a database retrieve or a create of a Hidden entity of a Protected module #1652, which has its own PR)
• Test written first and failed on main
• Fix proven to be the cause (revert -> tests fail -> restore -> tests pass)
• One commit, one concern
• CHANGELOG entry
• Finding recorded; make check-findings passes

🤖 Generated with Claude Code