fixup: walk EnumSplitStmt cases in reference validation; pin BSON keys

Address review on PR #475.

**B2 (real bug, fixed)** — `flowRefCollector.collectFromStatements`
had `case *ast.EnumSplitStmt:` with an empty body immediately followed
by `case *ast.InheritanceSplitStmt:` whose body walked `s.Cases` and
`s.ElseBody`. Go type switches do not fall through, so the
EnumSplitStmt case was a silent no-op: any microflow / page / java
action / entity reference inside an enum-split case body or its else
body escaped reference validation. Give EnumSplitStmt its own complete
walk identical to the InheritanceSplitStmt one.

Tests: `TestValidateMicroflowReferences_DescendsIntoEnumSplitCases` and
`…IntoEnumSplitElse` pin that a missing microflow inside either branch
is reported, so this regression cannot return.

**B1 (review premise wrong, BSON keys pinned by tests)** — review
asserted Studio Pro stores `CastAction` output under
`OutputVariableName` and `InheritanceCase` entity reference under
`Entity`. A BSON dump of the Control Centre app (Mendix 9.24)
contradicts both:

  Microflows$CastAction:
    VariableName = Account
    ErrorHandlingType = Rollback
  Microflows$InheritanceCase:
    Value = Administration.Account

The writer is correct as-is (`VariableName` for CastAction, `Value` for
InheritanceCase). Rather than change correct code, pin the BSON shape
with regression tests that fail loudly if anyone "fixes" the writer
based on a faulty premise:

  - TestSerializeCastAction_UsesVariableNameFieldKey
  - TestBuildSequenceFlowCase_InheritanceCase_UsesValueFieldKey

The parser already falls back to the alternative keys for forward
compatibility (introduced in PR #365), so projects produced by future
Mendix versions that ever switched naming would still parse cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hjothamendix

mdl/executor/validate.go

@@ -598,6 +598,10 @@ func (c *flowRefCollector) collectFromStatements(stmts []ast.MicroflowStatement)
 			c.collectFromStatements(s.ThenBody)
 			c.collectFromStatements(s.ElseBody)
 		case *ast.EnumSplitStmt:
+			for _, cse := range s.Cases {
+				c.collectFromStatements(cse.Body)
+			}
+			c.collectFromStatements(s.ElseBody)
 		case *ast.InheritanceSplitStmt:
 			for _, cse := range s.Cases {
 				c.collectFromStatements(cse.Body)

mdl/executor/validate_microflow_split_collect_test.go

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// flowRefCollector.collectFromStatements must descend into EnumSplitStmt
+// case bodies and the else body. A regression in PR #475's first revision
+// left the EnumSplitStmt branch with an empty case body in a Go type
+// switch, so the loop walking case bodies was silently stolen by the
+// next case (InheritanceSplitStmt). The result was that microflow calls
+// inside any `case ... when ... then ...` branch escaped reference
+// validation.
+func TestValidateMicroflowReferences_DescendsIntoEnumSplitCases(t *testing.T) {
+	moduleID := model.ID("module-1")
+	backend := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListModulesFunc: func() ([]*model.Module, error) {
+			return []*model.Module{{
+				BaseElement: model.BaseElement{ID: moduleID},
+				Name:        "SyntheticAudit",
+			}}, nil
+		},
+		ListMicroflowsFunc: func() ([]*microflows.Microflow, error) {
+			return nil, nil
+		},
+	}
+	ctx, _ := newMockCtx(t, withBackend(backend))
+
+	stmt := &ast.CreateMicroflowStmt{
+		Name: ast.QualifiedName{Module: "SyntheticAudit", Name: "RouteByStatus"},
+		Body: []ast.MicroflowStatement{
+			&ast.EnumSplitStmt{
+				Variable: "Status",
+				Cases: []ast.EnumSplitCase{
+					{
+						Values: []string{"Open"},
+						Body: []ast.MicroflowStatement{
+							&ast.CallMicroflowStmt{
+								MicroflowName: ast.QualifiedName{Module: "SyntheticAudit", Name: "MissingHandler"},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	err := validate(ctx, stmt)
+	if err == nil {
+		t.Fatal("expected reference error for microflow inside enum split case body")
+	}
+	if !strings.Contains(err.Error(), "microflow not found: SyntheticAudit.MissingHandler") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+// And the else body of an EnumSplitStmt must also be walked.
+func TestValidateMicroflowReferences_DescendsIntoEnumSplitElse(t *testing.T) {
+	moduleID := model.ID("module-1")
+	backend := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListModulesFunc: func() ([]*model.Module, error) {
+			return []*model.Module{{
+				BaseElement: model.BaseElement{ID: moduleID},
+				Name:        "SyntheticAudit",
+			}}, nil
+		},
+		ListMicroflowsFunc: func() ([]*microflows.Microflow, error) {
+			return nil, nil
+		},
+	}
+	ctx, _ := newMockCtx(t, withBackend(backend))
+
+	stmt := &ast.CreateMicroflowStmt{
+		Name: ast.QualifiedName{Module: "SyntheticAudit", Name: "RouteByStatus"},
+		Body: []ast.MicroflowStatement{
+			&ast.EnumSplitStmt{
+				Variable: "Status",
+				ElseBody: []ast.MicroflowStatement{
+					&ast.CallMicroflowStmt{
+						MicroflowName: ast.QualifiedName{Module: "SyntheticAudit", Name: "MissingFallback"},
+					},
+				},
+			},
+		},
+	}
+
+	err := validate(ctx, stmt)
+	if err == nil {
+		t.Fatal("expected reference error for microflow inside enum split else body")
+	}
+	if !strings.Contains(err.Error(), "microflow not found: SyntheticAudit.MissingFallback") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}

sdk/mpr/inheritance_roundtrip_test.go

@@ -63,3 +63,45 @@ func TestCastAction_RoundtripVariableName(t *testing.T) {
 		t.Fatalf("OutputVariable = %q, want SpecificInput", parsed.OutputVariable)
 	}
 }
+
+// TestSerializeCastAction_UsesVariableNameFieldKey pins the BSON field key
+// Studio Pro emits for Microflows$CastAction. Empirical evidence (BSON
+// dump of the Control Centre app on Mendix 9.24): Studio Pro stores the
+// output variable under "VariableName", not "OutputVariableName". The
+// parser still falls back to "VariableName" if "OutputVariableName" is
+// absent (set in PR #365 to handle real Studio Pro data); the writer
+// must keep emitting "VariableName" so projects we produce open cleanly
+// in Studio Pro.
+func TestSerializeCastAction_UsesVariableNameFieldKey(t *testing.T) {
+	action := &microflows.CastAction{
+		BaseElement:    model.BaseElement{ID: "cast-1"},
+		OutputVariable: "SpecificInput",
+	}
+	doc := serializeMicroflowAction(action)
+	if got := bsonGetKey(doc, "VariableName"); got != "SpecificInput" {
+		t.Fatalf("VariableName = %v, want SpecificInput", got)
+	}
+	if got := bsonGetKey(doc, "OutputVariableName"); got != nil {
+		t.Fatalf("OutputVariableName = %v, want absent (Studio Pro uses VariableName)", got)
+	}
+}
+
+// TestBuildSequenceFlowCase_InheritanceCase_UsesValueFieldKey pins the
+// BSON field key for Microflows$InheritanceCase. Empirical evidence
+// (BSON dump of the Control Centre app, Mendix 9.24): the entity
+// reference is stored under "Value" as a qualified-name string
+// (e.g. "Administration.Account"), not "Entity". The parser already
+// falls back to "Entity" for forward compatibility, but the writer must
+// emit "Value" so output matches Studio Pro's authored shape.
+func TestBuildSequenceFlowCase_InheritanceCase_UsesValueFieldKey(t *testing.T) {
+	doc := buildSequenceFlowCase(&microflows.InheritanceCase{
+		BaseElement:         model.BaseElement{ID: "case-1"},
+		EntityQualifiedName: "Sample.SpecializedInput",
+	})
+	if got := bsonGetKey(doc, "Value"); got != "Sample.SpecializedInput" {
+		t.Fatalf("Value = %v, want Sample.SpecializedInput", got)
+	}
+	if got := bsonGetKey(doc, "Entity"); got != nil {
+		t.Fatalf("Entity = %v, want absent (Studio Pro uses Value)", got)
+	}
+}