UPDATE SECURITY aborts on the virtual System domain model ("load domain model 00000000-...-000000000002: file not found")

[Chendodelangen]

UPDATE SECURITY aborts on the virtual System domain model ("load domain model 00000000-...-000000000002: file not found")

• mxcli version: v0.19.0 (2026-08-21T13:13:26Z)
• Mendix version: 11.12.2 (MPR v2, mprcontents layout)
• Severity: Medium — the statement exists and reconciles the app modules, but always ends in an error because it insists on loading the System module's domain-model unit, which is platform-virtual and has no .mxunit on disk. Scoping (UPDATE SECURITY <Module>; parses) does not avoid the System step.
• Tracker searches: "UPDATE SECURITY", "reconcile System", "entity access out of date", "CE0066" → Security reconciliation (UPDATE SECURITY / CREATE ASSOCIATION) strips inherited members from access rules of specialized entities; damage masked by CE0066 and unrepairable via GRANT #758 (closed) covers the reconciliation member-stripping; Add mxcli check --full: semantic validation equivalent to mx check (CE0111/CE0109/CE0053/CE0066) #623/Add ALTER PROJECT SECURITY ADMIN PASSWORD (resolve CE0129 from MDL) #624/Author entity access rules (GRANT) over MCP/PED via domain-model path-ops; security role/user docs are sealed #704 are adjacent enhancements; nothing covers this failure.

Steps to reproduce

On any MPR v2 project whose mprcontents/ does not contain
00/00/00000000-0000-0000-0000-000000000002.mxunit (standard for our 11.12.2
projects — the System domain model is not materialized on disk):

UPDATE SECURITY;

Expected

Reconciliation of the modules that exist on disk; the platform-owned System
module skipped or resolved from wherever describe/exec resolve System members
(GRANTs referencing System.owner work fine).

Actual

Every on-disk module reconciles ("Reconciled N access rule(s) in module ..."),
then:

Error: failed to reconcile security for module System: load domain model
00000000-0000-0000-0000-000000000002: open ...\mprcontents\00\00\00000000-0000-0000-0000-000000000002.mxunit:
Het systeem kan het opgegeven pad niet vinden.

The statement exits non-zero even though the useful work succeeded, so any
script treating exec failure as fatal rolls back a working step. Same behaviour
for the module-scoped form (UPDATE SECURITY NCRManagement;): the System step
still runs and still fails.

Workaround

mxcli exec --continue-on-error and accept the trailing error; verify with
mx check that the app-module CE0066s are gone.

• Diagnostic bundle: available, mxcli-diag-20260827-184627.tar.gz