Feature request: UPDATE SECURITY --repair — drop unresolvable member accesses, so a broken rule never needs Studio Pro

[Chendodelangen]

Feature request: UPDATE SECURITY --repair — drop unresolvable member accesses, so a broken rule never needs Studio Pro

• mxcli version: v0.19.0 (2026-08-21T13:13:26Z)
• Mendix version: 11.12.2
• Type: enhancement
• Related: GRANT on a System.Image specialization writes a member access for the non-existent System.Thumbnail_Image (CE1613) #972 (GRANT injects the dead System.Thumbnail_Image), UPDATE SECURITY aborts on the virtual System domain model ("load domain model 00000000-...-000000000002: file not found") #981 (UPDATE SECURITY aborts on the virtual System module), Security reconciliation (UPDATE SECURITY / CREATE ASSOCIATION) strips inherited members from access rules of specialized entities; damage masked by CE0066 and unrepairable via GRANT #758 (closed; reconciliation member handling), Add mxcli check --full: semantic validation equivalent to mx check (CE0111/CE0109/CE0053/CE0066) #623 (check --full)
• Tracker searches: "repair access rule", "strip member access", "unresolvable member", "security repair" — the bugs above exist, a repair capability does not.

The gap, measured end to end (27 Aug 2026, unattended build round)

An agent-driven round hit this exact wall:

1. GRANT ... ON <System.Image specialization> injects a member access for
   System.Thumbnail_Image, which does not exist on Mendix 11 (GRANT on a System.Image specialization writes a member access for the non-existent System.Thumbnail_Image (CE1613) #972). mxcli
   check/exec/describe all stay silent; mx check reports CE1613.
2. UPDATE SECURITY; reconciles every on-disk module (fixes the CE0066/CE2729
   class), but leaves the unresolvable member access untouched — verified three
   times, on constrained and unconstrained rules alike.
3. mx.exe has no security verb, and the Studio Pro MCP toolset has neither a
   reconcile tool nor a save, so nothing scriptable can finish the job.
4. The only remover is Studio Pro's interactive "Update security" click — and
   even that strips the dead member only from rules WITHOUT an XPath
   constraint; a constrained rule keeps its CE1613 across reconciles.

Net effect: one dead member reference makes an otherwise fully scripted,
headless pipeline dependent on a human click, and the workaround costs a
security constraint (we had to drop the XPath from a write rule so the click
would clean it).

Ask

UPDATE SECURITY --repair (or make it the default): while reconciling, DROP
any member access whose attribute or association no longer resolves, and log
one line per dropped member (rule <entity>/<roles>: dropped unresolvable member System.Thumbnail_Image). Combined with skipping the virtual System
module (#981), GRANT + UPDATE SECURITY becomes self-sufficient: whatever a
writer bug injects, the next reconcile heals, headlessly.

Acceptance sketch

• A rule carrying a dead member + UPDATE SECURITY --repair → member gone,
  remaining members untouched, mx check clean, exit code 0.
• Works identically for rules with and without XPath constraints.
• Without --repair (if not default): current behaviour, but WARN per
  unresolvable member instead of silence.