Refuse a bare attribute reference on every write, ALTER PAGE included

[ako]

Follow-up to #678.

Symptom

On a copy of the stock 11.13.0 project, this statement printed "Altered page":

alter page FeedbackModule.ShareFeedback_Logo {
  insert after textBox1 { image zzImg (ImageType: imageUrl, ImageUrl: '{1}', ImageUrlParams: [{1} = ImageB64]) }
}

The stored page then held DomainModels$AttributeRef { Attribute: "ImageB64" }, and mx check could not load the project:

InvalidOperationException … set the 'Attribute' property of a Attribute in a Page … ArgumentNullException

The data view's nanoflow is missing, so there is no entity to qualify ImageB64 against.

Cause

#678 added a guard against bare attribute references, but only in encodePage and encodeSnippet, the CREATE path. ALTER PAGE and ALTER SNIPPET write through the page mutator and UpdateRawUnit, which the guard never saw. The bare name comes from the template-parameter builders in mdl/backend/widgetobj/builder.go (pluggable widgets and DataGrid2 columns), which copy the name through as given.

Fix

The guard moves to the one choke point every unit write goes through: modelsdk/mpr Writer.updateUnit and insertUnit, right after the existing duplicate-$ID guard.

• It's now canon.BareAttributeRefError in modelsdk/canon/attributeref.go; the old mdl/backend/modelsdk/page_bare_attributeref.go is removed.
• This covers every write path: ALTER PAGE/SNIPPET (styling, insert/replace, column edits), widget sync, layout creation, and marketplace, theme and harvest raw writes.
• encodePage and encodeSnippet still check first, so a CREATE refusal names the page rather than a unit id.

Stored models are unaffected. Across all 374 units of the test project there are 73 AttributeRefs (71 in pages, 1 in a snippet, 1 in a page template), and none is bare. Studio Pro cannot load a bare one, so no project it saved holds one; the guard cannot block an ALTER of anything stored. The refusal names the ref's full path, so the same ALTER can drop or qualify it.

Evidence

Control. With the writer guard stubbed:

• TestUpdateUnitRefusesABareAttributeRef: "write accepted a unit holding the bare attribute reference "Name"";
• TestAlterPageSaveRefusesABareAttributeRef: "ALTER saved a page holding a bare attribute reference".

Real run (fresh copy of the project):

• The bare ALTER above is refused with "ImageB64" at …/dataView5.Widgets/zzImg.Object/…/TextTemplate/Parameters/AttributeRef. Zero .mxunit files changed (sha256 before/after).
• These still apply: the same image with a qualified parameter; set Title on Administration.Account_Edit; inserting a qualified textbox; set Class on it.
• mxcli docker check: 0 errors.

Bug-test mdl-examples/bug-tests/alter-page-bare-attributeref-refused.mdl: runs clean; its bare variant is refused.

docs-wiki/bug-patterns/unloadable-model-writes.md said an attribute reference could be "bare or Module.Entity.Attribute". That's wrong for a stored AttributeRef, so it's corrected.

Not fixed here

• check doesn't catch a bare template parameter in an ALTER, so the refusal appears at exec time.
• A textbox outside any data container turns a bare Attribute: into AttributeRef: null and reports success: the binding is silently dropped.
• insertUnit has the guard but no dedicated test.

Checklist

• Failing tests first: writer, real mutator path, unit
• Control recorded
• Real run: refusal, no bytes changed, ordinary ALTERs unaffected, mx check 0 errors
• Bug-test MDL; make check-mdl passes
• Finding appended; make check-findings passes
• make build && make test && make lint pass, each exit code checked separately

🤖 Generated with Claude Code