[Joshua-TOF]

Closes #1843

What. A follow-up to fd51d9f (#1803). check -p and exec's pre-flight now also report:

• a quoted token on an Integer, Long or Decimal ([Cnt = '[%DayLength%]']), refused like '5';
• a date token ([%CurrentDateTime%], [%BeginOf…%], [%EndOf…%]) or a [%UserRole_…%] token on a String;
• a [%UserRole_…%] token on a DateTime;
• '[%CurrentUser%]' compared with an association whose far end is not System.User or a specialization of it.

Why. Each of these passed check -p and exec, then failed the build with CE0161 "Error(s) in XPath constraint." at "Access rule of entity …".

How. All changes are in validate_access_rule_xpath.go:

• literalTypeProblem no longer returns early for tokens other than [%CurrentUser%]. On a number it lets the existing quoted-value rule judge them; on a String or DateTime, tokenTypeProblem judges only the measured pairs.
• walkXPathLiteralComparisons is now a thin wrapper over walkXPathMemberComparisons, which also hands over qualified associations.
• currentUserAssociationProblem takes an association's ends from the script or else the project's association catalog, and walks the far end's generalization chain. That chain comes from the script's declarations, or else the project.

Left silent rather than risk a false error:

• tokens on a Boolean or enumeration, and other tokens on a String or DateTime;
• an association the entity is not the FROM end of;
• a far end the script alters, or whose chain cannot be read to the root;
• [id = '[%CurrentUser%]'].

Testing.

• validate_access_rule_xpath_test.go has 7 new refused cases and 2 new legal twins: a specialization of System.User, and an unmeasured token on a String. [Cnt = '[%DayLength%]'] moves from the legal list to the refused list, since it is measured as CE0161. All 67 subtests pass.
• go vet reports nothing; gofmt is clean.
• The -run "XPath|Grant|Retrieve|Access|Security" subset of mdl/executor fails the same 4 TestDiffLocal_* tests on main and on this branch: Windows temp-file cleanup.

Mendix 11.14.0 validation. A fresh project at security level Production, one entity and one grant per case, 49 grants:

• mx check rejected 29 with CE0161.
• main reports 21 of them; this branch reports 28.
• Neither reports any of the 20 that mx check accepted, which include '[%CurrentUser%]' on associations to System.User and to Administration.Account.
• The one not reported is [id = '[%CurrentUser%]'] on a non-user entity.

🤖 Generated with Claude Code