refactor(mcp): centralize domain-model dirty routing in one seam

The previous fix made ListDomainModels dirty-aware, but the routing was still
duplicated across GetDomainModel / GetDomainModelByID / ListDomainModels — each
re-implementing "session-created or dirty → reconstruct, else reader." That
duplication is exactly how ListDomainModels came to miss it.

Funnel all three through a single effectiveDomainModel(moduleID) seam that owns
the routing, so no read path can forget it. Removes the now-redundant
reconstructDomainModel wrapper (its body is inlined in the seam) and moves the
fidelity note onto reconstructDomainModelFromPED. No behavior change beyond the
already-shipped consistency; build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ako

mdl/backend/mcp/backend.go

@@ -316,76 +316,76 @@ func (b *Backend) GetModuleByName(name string) (*model.Module, error) {
 	return b.reader.GetModuleByName(name)
 }
 
+// sessionDMPrefix prefixes the synthetic domain-model ID handed out for a
+// session-created module; the suffix is the module name.
+const sessionDMPrefix = "mcp~dm~"
+
+// effectiveDomainModel is the SINGLE seam for reading a module's domain model:
+// the live view that accounts for writes made this session. Every domain-model
+// read funnels through it, so none can forget the dirty routing — the omission
+// that made ListDomainModels return stale entities and broke CREATE ASSOCIATION
+// for an existing module.
+//
+// Routing, in order:
+//   - session-created module (no on-disk domain model): reconstruct from Studio
+//     Pro with a synthetic DM ID encoding the module name (so
+//     moduleNameForDomainModel can resolve it back);
+//   - dirty existing module (written this session): reconstruct from Studio Pro;
+//   - otherwise: the on-disk reader copy (last-saved state).
+func (b *Backend) effectiveDomainModel(moduleID model.ID) (*domainmodel.DomainModel, error) {
+	for _, m := range b.sessionModules {
+		if m.ID == moduleID {
+			return b.reconstructDomainModelFromPED(m.Name, model.ID(sessionDMPrefix+m.Name), moduleID)
+		}
+	}
+	localDM, err := b.reader.GetDomainModel(moduleID)
+	if err != nil {
+		return nil, err
+	}
+	if mod, merr := b.reader.GetModule(moduleID); merr == nil && b.dirty[mod.Name] {
+		if recon, rerr := b.reconstructDomainModelFromPED(mod.Name, localDM.ID, localDM.ContainerID); rerr == nil {
+			return recon, nil // best-effort: fall back to the local copy on failure
+		}
+	}
+	return localDM, nil
+}
+
+// ListDomainModels returns every module's live domain model (dirty routing via
+// effectiveDomainModel), plus session-created modules that have no on-disk copy.
 func (b *Backend) ListDomainModels() ([]*domainmodel.DomainModel, error) {
 	local, err := b.reader.ListDomainModels()
 	if err != nil {
 		return nil, err
 	}
 	out := make([]*domainmodel.DomainModel, 0, len(local)+len(b.sessionModules))
-	// A module written this session must be reconstructed from Studio Pro's live
-	// model here too, with the SAME dirty routing GetDomainModel applies — otherwise
-	// the stale on-disk snapshot hides entities/associations created earlier in the
-	// same run. This is what made CREATE ASSOCIATION fail when its from/to entities
-	// were just created in an existing module: findEntity lists via this method, and
-	// it previously reconstructed only session-created modules, not dirty existing
-	// ones. Best-effort: keep the local copy if reconstruction fails.
 	for _, dm := range local {
-		if mod, merr := b.reader.GetModule(dm.ContainerID); merr == nil && b.dirty[mod.Name] {
-			if recon, rerr := b.reconstructDomainModel(mod.Name, dm.ContainerID); rerr == nil {
-				out = append(out, recon)
-				continue
-			}
+		eff, eerr := b.effectiveDomainModel(dm.ContainerID)
+		if eerr != nil {
+			eff = dm // best-effort: keep the on-disk copy if the live view fails
 		}
-		out = append(out, dm)
+		out = append(out, eff)
 	}
-	// Session-created modules have no on-disk domain model; reconstruct each so
-	// references into a freshly created module resolve in the same run.
 	for _, m := range b.sessionModules {
-		if dm, derr := b.reconstructDomainModelFromPED(m.Name, model.ID(sessionDMPrefix+m.Name), m.ID); derr == nil {
+		if dm, derr := b.effectiveDomainModel(m.ID); derr == nil {
 			out = append(out, dm)
 		}
 	}
 	return out, nil
 }
 
-// GetDomainModel returns a module's domain model. If the module was written
-// this session (dirty), it is reconstructed from Studio Pro's live in-memory
-// model so in-session edits are visible; otherwise it comes from the local
-// reader (last-saved state).
+// GetDomainModel returns a module's live domain model (see effectiveDomainModel).
 func (b *Backend) GetDomainModel(moduleID model.ID) (*domainmodel.DomainModel, error) {
-	// A module created over MCP this session has no on-disk domain model for the
-	// reader to read (the reader is a pre-create snapshot). Reconstruct its live
-	// entities from Studio Pro with a synthetic domain-model ID (encoding the
-	// module name, so moduleNameForDomainModel can resolve it back) — so both
-	// "create entity X.Foo" and references to X's entities (e.g. a microflow
-	// parameter or workflow context typed X.Foo) resolve within the same run.
-	for _, m := range b.sessionModules {
-		if m.ID == moduleID {
-			return b.reconstructDomainModelFromPED(m.Name, model.ID(sessionDMPrefix+m.Name), moduleID)
-		}
-	}
-	mod, err := b.reader.GetModule(moduleID)
-	if err == nil && b.dirty[mod.Name] {
-		return b.reconstructDomainModel(mod.Name, moduleID)
-	}
-	return b.reader.GetDomainModel(moduleID)
+	return b.effectiveDomainModel(moduleID)
 }
 
-// sessionDMPrefix prefixes the synthetic domain-model ID handed out for a
-// session-created module; the suffix is the module name.
-const sessionDMPrefix = "mcp~dm~"
-
 // GetDomainModelByID mirrors GetDomainModel but is keyed by the domain model's
 // own ID; it resolves the owning module and applies the same dirty routing.
 func (b *Backend) GetDomainModelByID(id model.ID) (*domainmodel.DomainModel, error) {
 	localDM, err := b.reader.GetDomainModelByID(id)
 	if err != nil {
 		return nil, err
 	}
-	if mod, err := b.reader.GetModule(localDM.ContainerID); err == nil && b.dirty[mod.Name] {
-		return b.reconstructDomainModel(mod.Name, localDM.ContainerID)
-	}
-	return localDM, nil
+	return b.effectiveDomainModel(localDM.ContainerID)
 }
 
 // ReconcileMemberAccesses is a no-op for the MCP backend. It is the executor's

mdl/backend/mcp/read_router.go

@@ -48,30 +48,17 @@ func (b *Backend) registerSynthetic(id model.ID, name string) {
 // pedIDRef matches a PED path reference like "$id(/entities/3)".
 var pedIDRef = regexp.MustCompile(`^\$id\(/entities/(\d+)\)$`)
 
-// reconstructDomainModel builds a *domainmodel.DomainModel for a dirty module
-// from Studio Pro's live in-memory model (read over MCP), assigning synthetic
-// IDs to entities and associations.
-//
-// Fidelity note: PED reads expose attribute NAMES (parsed from $QualifiedName)
-// but not their primitive types — recovering a type costs a read per attribute.
-// The reconstruction therefore uses placeholder attribute types. That is
-// sufficient for the operations the slice routes through it (ALTER attribute
-// add/drop and DROP, which key on names), but DESCRIBE of an in-session-edited
-// entity will not show precise attribute types until the project is saved.
-func (b *Backend) reconstructDomainModel(moduleName string, moduleID model.ID) (*domainmodel.DomainModel, error) {
-	// The domain-model document itself always exists on disk (nameless), so the
-	// local reader gives us its real ID/container even when entities diverged.
-	localDM, err := b.reader.GetDomainModel(moduleID)
-	if err != nil {
-		return nil, fmt.Errorf("reconstruct %s: local domain model: %w", moduleName, err)
-	}
-	return b.reconstructDomainModelFromPED(moduleName, localDM.ID, localDM.ContainerID)
-}
-
 // reconstructDomainModelFromPED reads a module's live entities/associations from
 // Studio Pro and builds a domain model with the given IDs. It is shared by the
-// dirty-saved-module path (real on-disk IDs) and the session-created-module path
-// (synthetic IDs), the latter having no on-disk domain model for the reader.
+// dirty existing-module path (real on-disk IDs) and the session-created-module
+// path (synthetic IDs), the latter having no on-disk domain model for the reader.
+//
+// Fidelity note: PED reads expose attribute NAMES (from $QualifiedName) but not
+// their primitive types — recovering a type costs a read per attribute. The
+// shallow reconstruction uses placeholder types; enrichReconstructedEntities then
+// fills in real types/documentation with one batched leaf read. This is enough
+// for the operations routed through it (name-keyed resolution, ALTER add/drop,
+// DROP); a DESCRIBE of an in-session-edited entity is faithful after enrichment.
 func (b *Backend) reconstructDomainModelFromPED(moduleName string, dmID, containerID model.ID) (*domainmodel.DomainModel, error) {
 	dm := &domainmodel.DomainModel{ContainerID: containerID}
 	dm.ID = dmID
@@ -158,7 +145,7 @@ func (b *Backend) reconstructEntities(moduleName string, dmID model.ID, raw json
 			e.Attributes = append(e.Attributes, &domainmodel.Attribute{
 				ContainerID: id,
 				Name:        lastSegment(pa.QualifiedName),
-				// Placeholder type — see fidelity note on reconstructDomainModel.
+				// Placeholder type — see fidelity note on reconstructDomainModelFromPED.
 				Type: &domainmodel.StringAttributeType{},
 			})
 		}