[saingge]

Branch fix/graph-sweep-widget-refs, one commit (cb2ab46) on origin/master 393d253. Lane 3 (direct).

What changed and why

graph-sweep's orphan caveat named only layout snippet calls. A flow used only as a pluggable widget's
datasource or action property can have no refs edge either, so a live flow reads as "strong evidence
of deadness" and the rule's own advice ("Remove if unused") would delete it. Now:

• the orphan list prints a note and the one mxcli search "<Module.Flow>" that finds the page holding a flow, with the
  caveat that it needs a REFRESH CATALOG FULL SOURCE catalog (the sweep reads a FULL one, which has no page source)
  (project-bin/graph-sweep.sh, with the comment above the query);
• the same sentence in project-tests/e2e/review-report.js (the orphan check detail) says the same;
• the QUAL004 row in skills/lint-that-actually-runs.md goes from "the catalog likely misses the
  pluggable widget's ref" to what was observed, with the upstream link
  (mendixlabs/mxcli#1513);
• the ledger entry and the pending-issue draft for that bug said "not filed"; they now point at #1513;
• test-catalog-edge-guard.sh case 1 asserts the note.

#1513 is the same defect class, but it was filed for a Data grid 2 on mxcli v0.26.0 ("not retested on
v0.27.0"). On v0.27.0 the Data grid 2 datasources in the app below did have a ref, and a Gallery's did
not in one situation. The text says so rather than saying #1513 is the Gallery case.

Impact

Row	Answer
Process	none. No step or gate added or removed; the orphan list gains a 3-line note.
Dependencies	project-bin/graph-sweep.sh, project-tests/e2e/review-report.js, skills/lint-that-actually-runs.md, bug-logs/mxcli-bugs.md, one pending-issue draft, one fixture. No shared library, no new tool, no new artifact read.
Context cost	none: lint-that-actually-runs is an on-demand row. bin/render-routing.sh --check output is identical on base 393d253 and head (Baseline: 75510 words, budget 80000).
Behaviour	NOT RUN: on-demand skill row and script output only, no baseline-routed or always-loaded text.
Runtime	n/a. The note is three echo lines.

Field evidence

A Mendix 10.24 app, mxcli v0.27.0, catalog from REFRESH CATALOG FULL, on a scratch copy (the real
project was not written):

• 5 flows used only as a Gallery's or a third-party widget's microflow datasource: each had 0 refs
  rows, show references to printed "no references found", describe page printed the datasource, and
  QUAL004 flagged each.
• Of 17 Gallery microflow datasources, 15 had a ref. All 15 Galleries have no microflow onClick. The 2
  with none have both a microflow datasource and a microflow onClick, and only the onClick flow got a ref. The
  cause is a hypothesis (one microflow ref kept per widget), not confirmed in mxcli's source.
• The two Data grid 2 microflow datasources in the app had a ref from their page.
• A third-party widget's action properties: some had no ref from the page. Not counted further.
• The printed search, run on a copy of the app with a REFRESH CATALOG FULL SOURCE catalog (mxcli v0.27.0), listed the page that holds a flow under "Source Matches" (checked for 2 flows, each one PAGE row beside its own MICROFLOW row). On a plain REFRESH CATALOG FULL catalog the same search finds nothing and mxcli prints "the source index (CATALOG.SOURCE) is not built"; that is why the note says to rebuild. An independent run by the reviewer agreed. It replaces an earlier per-page describe page loop (199 mxcli processes on this app).

Checklist

• No client data anywhere in the diff (guard plain and with LEAKGUARD_BASE=origin/master, then a read of the diff). Examples use Shop.DS_Orders.
• Size: 7 files, +28/-7 lines; no fixture or capture counted.
• Test tier: T1 (test-catalog-edge-guard.sh, which targets the changed graph-sweep.sh) + T2 (the field run above).
• Both layouts: the fixture runs the sweep on single-tree and two-tree layouts.
• Golden input: the fixture's catalogs are synthetic, as the fixture already says. The change adds output text, not a parser, so no new capture was needed; the real-catalog evidence is the field run above.
• Both platforms: the printed command is one mxcli search, run on macOS only. Not run on Git Bash.
• [n/a] New skill (no routing change).
• CHANGELOG line under ## Unreleased, credited.
• [n/a] New bug entries (an existing entry's status line was updated).

Verification

bash tests/wave2/test-catalog-edge-guard.sh project-bin/graph-sweep.sh
  ok   — [single] orphan list carries the pluggable-widget note and the source-search command
  ok   — [two] orphan list carries the pluggable-widget note and the source-search command
  PASS=24 FAIL=0

# master's graph-sweep.sh (393d253), fixture from this branch
  FAIL — [single] orphan list lacks the pluggable-widget note
  FAIL — [two] orphan list lacks the pluggable-widget note
  PASS=22 FAIL=2

bin/render-routing.sh --check   -> identical on base and head; Baseline: 75510 words (budget 80000)
bin/check-pr-discipline.sh      -> clean
bin/check-no-client-data.sh     -> no client data detected
LEAKGUARD_BASE=origin/master bin/check-no-client-data.sh -> no new capitalised words
bash -n project-bin/graph-sweep.sh; node --check project-tests/e2e/review-report.js -> ok

[MendixMau]

Thanks @saingge! Independent review: MERGE. We moved your commit unchanged, with your authorship, into #556, so CI runs without fork approval and we can handle CHANGELOG conflicts. This PR closes when #556 merges; the merge commit carries a Co-authored-by line for you.

---

Generated by Claude Code