@dforge-core/dforge-mcp 0.2.47 → 0.2.48

package/CHANGELOG.md

@@ -6,6 +6,40 @@ the release workflow, so committed `package.json` versions are placeholders.
 
 ## Unreleased
 
+**1C migration readiness and regressions.** `delta --apply` now reports per-module
+`ready` / `partial` status and exits 2 if state, totals or imported markers remain
+unsettled; retained retry markers are settled on a later run even without new rows.
+Dry runs do not certify readiness. `pnpm test:1c` covers conversion precision,
+reference/date semantics, failed settlement/retry and the per-entity reload restart
+contract using synthetic fixtures and mocked database boundaries. The loader remains
+a non-atomic migration-target reload; its restart procedure is documented.
+A new CI job (`.github/workflows/onec-tests.yml`) runs it on changes to the 1C scripts or tests. A module's retry
+markers (`df1c.unsettled`) are now cleared only for the entities it settled, not for the whole module.
+Placeholder, balance-state and yearly totals writers roll back failed transactions before
+restoring autocommit; settlement continues to the next module only after connection
+recovery, and failed recovery stops the command. Strict transaction-state tests cover
+original-error preservation, partial yearly commits, continuation and unrecoverable connections.
+Jobs authoring/schema guidance now describes `idempotencyKey` as reserved and not enforced.
+
+**Action scripts bypass entity rights.** `action-dsl.md` and `security.md` now state that `insert()` / `update()` /
+`delete()` / `query()` in an action script check neither entity rights nor column security nor the folder's row filter
+(core #1580): only `E` on the action is checked, so treat `E` as write access to everything the script touches.
+
+**`canExecute` is enforced in full on the server.** `action.execute` now computes arithmetic, `IN`, `BETWEEN`, formula
+functions, a bare boolean column, `[ref].[col]` navigation and extension columns in SQL, instead of letting them through, and
+`TODAY()` names the requester's day. A condition it cannot compute refuses the action. Install rejects `$[setting]`,
+`SUM` / `COUNT` / `AVG` and unknown function names in `canExecute`, so a module that used them stops installing: read
+settings and count children in `execute:` instead (a count belongs in a `G` column). `references/action-dsl.md`
+(`canExecute:`), `formulas.md` and `validation-checklist.md` are rewritten to match. The button still evaluates over the
+grid row, which has no extension columns and throws on `[ref].[col]`, so keep both out of a gate that must also disable the
+button. **Needs platform 1.28.12.**
+
+**Registers: `postAction` / `unpostAction`.** `references/registers.md` documents the register-binding column params that make a direct
+`data.insert` / `data.update` flipping the state flag need `E` on the post or unpost action, and the "May edit is not may
+post" pitfall: declare both and grant `E` only to the roles that may post. Each direction is checked only when its own key
+is set; actions and DSL `update()` are not re-checked. A binding with neither gets a pack / validate warning, silenced by
+`"editorMayPost": true`. **Needs a platform release after 1.28.12 (not in it).**
+
 ## 0.2.46 — 2026-10-29
 
 Requires `@dforge-core/dforge-cli` 0.2.37 and `@dforge-core/metadata` 0.0.47; the vendored `dforge://schema/data-views` now accepts the grouping keys.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dforge-core/dforge-mcp",
-  "version": "0.2.47",
+  "version": "0.2.48",
   "description": "MCP server for dForge module authoring. Exposes 35 scaffold/patch/validate/pack/install tools and schema resources so AI agents (Claude Code, Cursor, Zed) can create and ship dForge modules.",
   "license": "MIT",
   "homepage": "https://github.com/iash44/dForge-core",
@@ -42,6 +42,7 @@
     "sync-schemas": "node scripts/vendor-schemas.cjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "test:1c": "python3 -m unittest discover -s test/onec -v",
     "install-skills": "node scripts/install-skills.mjs"
   }
 }

package/skills/dforge-1c-import/scripts/README.md

@@ -162,3 +162,30 @@ reproducible.
 This copy is kept in step with the port it was developed on (`tools/lib`, `tools/1c.py`
 there). Fixes made in a port go back to the library here. A project's own files never
 come here.
+
+### Regression checks and restart contract
+
+From the MCP repository root: `pnpm test:1c` (Python 3, standard library only).
+These tests use synthetic inputs and mocked database boundaries, never a tenant or
+source infobase. They cover conversions, COPY encoding, settlement failure/retry and
+the initial loader's committed-per-entity restart contract; they do not replace
+Parquet/DuckDB/PostgreSQL integration or real source-to-target reconciliation.
+
+`delta --apply` prints each module's `ready` or `partial` status. Exit 0 means all
+selected modules settled; exit 2 means data may have committed but settlement is
+incomplete (state/totals drift or markers not converged, including `--no-mark`
+when markers are needed). Resolve the reported problem and rerun `--apply`;
+persisted unsettled entities are checked even when the new delta has no changes.
+Dry runs report `dry_run` and do not certify readiness. Settlement write failures
+roll back the current transaction before restoring autocommit; ordinary failures
+report `partial` and allow the next module to run on a clean connection. Failure to
+rollback or restore the connection stops the command immediately. Previously
+committed entities/years remain committed; a rollback does not undo the whole import.
+Exit 0 does not replace the wider migration reconciliation.
+
+`migrate run --truncate` is a destructive reload into an isolated migration target,
+not an atomic refresh of a live application: clearing commits before loading and
+each entity commits separately. If interrupted, keep users out, repair the cause,
+rerun the same complete selection with `--truncate` from the same export, then
+reconcile again. Do not use an append rerun to recover a partially loaded target.
+For an active target, load/reconcile a separate database and switch only afterward.

package/skills/dforge-1c-import/scripts/lib/delta.py

@@ -56,6 +56,7 @@ taken for a deletion. While 1C is the system of record, nothing is entered in th
 from __future__ import print_function
 
 import argparse
+import collections
 import datetime
 import re
 import struct
@@ -65,6 +66,7 @@ import time
 import migrate
 import paths
 import store
+import transactions
 
 SCHEMA = "df1c"
 KEYS_IN_LIST = 500
@@ -515,6 +517,14 @@ def begin(cur):
 
 # --------------------------------------------------------------------------- after a module
 
+SettleResult = collections.namedtuple("SettleResult", "status notes")
+
+
+def settlement_exit_code(outcomes, apply):
+	"""Dry runs only estimate; an applied but unfinished module must block cutover."""
+	return 2 if apply and any(o.status != "ready" for o in outcomes) else 0
+
+
 def settle(pg, module, results, apply, mark_documents):
 	"""What a module needs once its rows moved: placeholders, balances, markers."""
 	import posted
@@ -526,11 +536,11 @@ def settle(pg, module, results, apply, mark_documents):
 	notes = []
 	settled = True
 	if apply and touched:
-		cur = pg.cursor()
-		cur.execute("BEGIN")
-		cur.execute("SET LOCAL session_replication_role = 'replica'")
-		filled = migrate.fill_missing(pg, schemas, verbose=False)
-		cur.execute("COMMIT")
+		with transactions.writing(pg):
+			cur = pg.cursor()
+			cur.execute("SET LOCAL session_replication_role = 'replica'")
+			filled = migrate.fill_missing(pg, schemas, verbose=False)
+			pg.commit()
 		if filled:
 			notes.append("%d placeholder(s)" % sum(f[4] for f in filled))
 
@@ -539,9 +549,8 @@ def settle(pg, module, results, apply, mark_documents):
 		if reg.journal_entity not in touched:
 			continue
 		if apply:
-			pg.autocommit = False
-			rows, written, _ = seedstate.seed(pg, reg)
-			pg.autocommit = True
+			with transactions.writing(pg):
+				rows, written, _ = seedstate.seed(pg, reg)
 			off = seedstate.drift(pg.cursor(), reg)
 			settled = settled and not off
 			notes.append("reseeded %s.%s: %d tuple(s), check %s"
@@ -587,8 +596,9 @@ def settle(pg, module, results, apply, mark_documents):
 		else:
 			notes.append("would converge markers on %d document table(s)" % len(work))
 	if apply and touched and settled:
-		pg.cursor().execute("DELETE FROM %s.unsettled WHERE module = %%s" % SCHEMA, (module,))
-	return notes
+		pg.cursor().execute("DELETE FROM %s.unsettled WHERE module = %%s AND entity = ANY(%%s)"
+		                    % SCHEMA, (module, sorted(touched)))
+	return SettleResult("dry_run" if not apply else ("ready" if settled else "partial"), notes)
 
 
 # --------------------------------------------------------------------------- command
@@ -733,6 +743,7 @@ def main():
 	print("-" * len(header))
 	totals = [0, 0, 0, 0, 0.0]
 	all_notes = []
+	outcomes = []
 	for module in modules:
 		results = []
 		for m, job in plan:
@@ -753,7 +764,20 @@ def main():
 				         res.owners if kind in ("lines", "movements") else "",
 				         res.changed, res.new, res.deleted, res.read, res.compare, res.write))
 				sys.stdout.flush()
-		for note in settle(pg, module, results, args.apply, jwt if args.apply else None):
+		try:
+			outcome = settle(pg, module, results, args.apply, jwt if args.apply else None)
+		except transactions.ConnectionRecoveryError:
+			raise  # Never continue on a connection whose cleanup failed.
+		except Exception as failure:
+			if not args.apply:
+				raise
+			transactions.recover(pg)
+			outcome = SettleResult("partial", ["settlement FAILED: %s: %s"
+			                                  % (type(failure).__name__, failure)])
+		outcomes.append(outcome)
+		all_notes.append("%s: status %s%s" % (module, outcome.status,
+		                                      "" if args.apply else " (estimate only, not a readiness verdict)"))
+		for note in outcome.notes:
 			all_notes.append("%s: %s" % (module, note))
 	print("-" * len(header))
 	print("%d entities  changed %d  new %d  deleted %d  (owners/recorders replaced %d)"
@@ -763,7 +787,11 @@ def main():
 		print("  " + note)
 	print("(rows of an entity with nothing changed and under 2s are not listed;"
 	      " lines/movements count rows replaced as new/deleted)")
-	return 0
+	code = settlement_exit_code(outcomes, args.apply)
+	if code:
+		print("delta incomplete (%s): do not cut over; resolve the notes and rerun --apply."
+		      % ", ".join(m for m, o in zip(modules, outcomes) if o.status != "ready"))
+	return code
 
 
 if __name__ == "__main__":

package/skills/dforge-1c-import/scripts/lib/totals.py

@@ -50,6 +50,7 @@ import sys
 import time
 
 import migrate
+import transactions
 
 GRANULARITIES = ("day", "month", "quarter", "year")
 
@@ -334,8 +335,7 @@ def rebuild(pg, plan):
 
 	insert = ("INSERT INTO %s (%s) VALUES (%s)"
 	          % (plan.totals, ", ".join(key + cols), ", ".join(["%s"] * (len(key) + len(cols)))))
-	pg.autocommit = False
-	try:
+	with transactions.writing(pg):
 		for year in years:
 			cur.execute("SET LOCAL session_replication_role = 'replica'")
 			cur.execute("DELETE FROM %s WHERE %s >= %%s AND %s < %%s"
@@ -344,8 +344,6 @@ def rebuild(pg, plan):
 			if by_year.get(year):
 				cur.executemany(insert, by_year[year])
 			pg.commit()
-	finally:
-		pg.autocommit = True
 	print("%-28s %7d rows written over %d year(s)   checks %.0fs, fold %.0fs, write %.0fs"
 	      % (name(plan), len(rows), len(years), scanned - started, read - scanned,
 	         time.time() - read))

package/skills/dforge-1c-import/scripts/lib/transactions.py

@@ -0,0 +1,28 @@
+"""Transaction cleanup shared by the migration settlement writers."""
+from contextlib import contextmanager
+
+
+class ConnectionRecoveryError(RuntimeError):
+	"""The connection cannot safely be reused; abort rather than try another module."""
+
+
+def recover(pg):
+	"""Rollback before changing mode: psycopg2 forbids it in an active transaction."""
+	try:
+		pg.rollback()
+		pg.autocommit = True
+	except Exception as error:
+		raise ConnectionRecoveryError("cannot restore migration connection: %s" % error) from error
+
+
+@contextmanager
+def writing(pg):
+	"""Writers commit explicitly; on any failure, rollback before restoring autocommit."""
+	pg.autocommit = False
+	try:
+		yield
+	except BaseException:
+		recover(pg)
+		raise
+	else:
+		pg.autocommit = True

package/skills/dforge-mcp-author/references/action-dsl.md

@@ -117,53 +117,54 @@ Two consequences worth designing around:
 - **`canExecute: false` is the idiom for an action only automation may fire.** The
   server refuses it through `action.execute`; triggers and scheduled jobs invoke
   the script engine directly and are unaffected.
-- **Both evaluators have gaps, and both fail open.** The server is a scalar walker
-  — comparisons between fields and literals, combined with `AND` / `OR` / `NOT`,
-  nothing else — and lets anything richer through. The client implements the full documented formula
-  function set, so ordinary functions are fine there; it throws (and its `catch`
-  **enables** the button) on **ref navigation** (`[ref].target`), on the set
-  aggregates **`SUM` / `COUNT` / `AVG`** (deliberately not formula functions —
-  counting is a Generated `G` column's job), and on **any name it does not know, a
-  typo included** — a `canExecute` is never validated against the function set at
-  install, so `TOADY()` ships and enables the button for every record.
-- **`$[setting]` references are a separate case.** They do not throw: the client's
-  resolver is stubbed to `null`, so the predicate resolves however that operator
-  treats null (an ordered comparison against null is `false`, so it tends to
-  *disable* the button), while the server has no settings resolver and fails open.
-  Keep settings out of `canExecute` and read them in `execute:` instead.
-
-| tier | construct | client | server |
-|---|---|---|---|
-| 1 | **comparisons** (`=` `!=` `<` `<=` `>` `>=`) between fields and literals, combined with `AND` / `OR` / `NOT`; a bare `true` / `false` | evaluates | **enforces** |
-| 2 | arithmetic, `IN`, `BETWEEN`, any formula function | evaluates | fail-open |
-| 3 | ref navigation, `SUM` / `COUNT` / `AVG`, any unknown function (a typo included) | **fail-open (throws)** | fail-open |
-| — | `$[setting]` references | **evaluates as null** (no throw) | fail-open |
-
-**A bare boolean column is not tier 1.** The walker evaluates conditions, not
-values — a field is only resolvable as an operand of a comparison — so
-`canExecute: [is_active]` and `canExecute: NOT [is_blocked]` fail open. Write
-`[is_active] = true` and `NOT ([is_blocked] = true)`. (`canExecute: false` is fine:
-a bare literal is a complete condition.)
-
-Mixing tier 1 and tier 2 is the normal, healthy shape: the client evaluates the
-whole thing so the button state is right, and the server short-circuits `AND` /
-`OR` so the tier-1 half is still enforced.
-
-**Tier 3 is what breaks.** The server short-circuits, the client does not — so
-`[status] = 'Pending' AND COUNT([lines]) > 0` on a non-`Pending` record still
-evaluates `COUNT` in the browser, throws, and the button is **enabled**, then the
-server refuses the call: an error where a greyed-out button was wanted. And a
-`canExecute` is not validated against the function set at install, so that spelling
-ships silently. Count with a `G` column and compare the scalar
-(`[detail_count] > 0`); denormalise instead of navigating; put anything genuinely
-unexpressible in `execute:` behind `error()`.
+- **The server evaluates the whole formula, and refuses what it cannot read.**
+  (Needs platform 1.28.12; older platforms let these through, so the gate is not enforced there.)
+  Comparisons between fields and literals (with `AND` / `OR` / `NOT`, a bare
+  `true` / `false`) are checked in-process; anything richer — arithmetic, `IN`,
+  `BETWEEN`, formula functions, a bare boolean field, `[ref].[col]`
+  navigation — is computed in SQL over the record, by the same translator as formula
+  columns (chained hops are followed up to a depth cap; a null ref gives `NULL`, which
+  counts as not true). A condition the server cannot evaluate (`$[setting]` references, set
+  aggregates `SUM` / `COUNT` / `AVG`, an unknown function name, a typo included)
+  **refuses the action** with `ACTION_EXECUTION_FAIL` ("cannot be evaluated by the
+  server") instead of allowing it. A `NULL` result counts as not true.
+  Comparisons themselves are null-safe and two-valued (see `formulas.md`), so an empty
+  field does not make `NOT ([x] = 'A')` unknown.
+- **The client has gaps of its own, and its failures enable the button.** It
+  throws (and its `catch` **enables** the button) on **ref navigation**
+  (`[ref].target`), on **`SUM` / `COUNT` / `AVG`** (deliberately not formula
+  functions — counting is a Generated `G` column's job) and on **any name it does
+  not know, a typo included** (install refuses the last two, see below).
+- **`$[setting]` references** resolve to `null` in the client (an ordered comparison
+  against null is `false`, so it tends to *disable* the button) and are refused by
+  the server and at install (platform 1.28.12 and later). Keep settings out of `canExecute` and read them in `execute:` instead.
+- **`TODAY()`** names the requester's calendar day on the server too (their time
+  zone: the request's, else the user profile's, else the workspace's, else UTC; a profile zone of
+  `UTC` counts as unset). The button is evaluated in the browser and is meant to name the same
+  day; `execute:` stays the authority.
+- **Install refuses** a `canExecute` that uses `$[setting]`, `SUM` / `COUNT` / `AVG`
+  or an unknown function name (a typo included), since the server could never run
+  the action. Read settings and count children in `execute:` instead.
+
+| construct | client | server |
+|---|---|---|
+| comparisons between fields and literals, `AND` / `OR` / `NOT`, bare `true` / `false` | evaluates | evaluates |
+| arithmetic, `IN`, `BETWEEN`, formula functions, bare boolean field | evaluates | evaluates (SQL) |
+| `[ref].[col]` navigation | **throws, button enabled** | evaluates (SQL) |
+| `SUM` / `COUNT` / `AVG`, unknown function (a typo included) | **throws, button enabled** | **refused at install**; if one is already installed, `action.execute` refuses it |
+| `$[setting]` references | evaluates as null | **refused at install**; if already installed, `action.execute` refuses it |
+
+Both evaluators agreeing is the healthy shape; the one to design around is a
+construct the client throws on, which leaves a button that is enabled and then
+refused. Count with a `G` column and compare the scalar (`[detail_count] > 0`);
+denormalise instead of navigating; put anything genuinely unexpressible in
+`execute:` behind `error()`.
 
 > Never make `canExecute` the *only* guard for something that must hold. Between
-> the fail-open rules on both sides, the enqueue-only check on background runs, and
-> the fact that the client evaluates over the grid row (which does not carry
-> extension columns) while the server evaluates over a full record load, the
-> authoritative check belongs in `execute:` — validate and `error()` before the
-> first write.
+> the enqueue-only check on background runs and the fact that the client evaluates
+> over the grid row (which does not carry extension columns) while the server
+> evaluates over a full record load, the authoritative check belongs in
+> `execute:` — validate and `error()` before the first write.
 
 ```
 canExecute:
@@ -226,6 +227,8 @@ var note = params[note]             // no quotes around param name in this DSL
 
 ### Data operations
 
+**No entity rights are checked inside a script.** `insert()`, `update()`, `delete()` and `query()` do not look at the signed-in user's `S`/`I`/`U`/`D` on the entity, nor at column security or the folder's row filter. Only `E` on the action is checked, when it is run. A user with `S` only on an entity can still change it through an action they may execute (core #1580). Treat `E` on an action as write access to everything its script touches; to keep a log free of changes, grant `E` on no action that writes to it.
+
 | Function | Returns | Description |
 |---|---|---|
 | `insert('entity', { field: value, … })` | Inserted row object | Insert a new record. Returns the full row including auto-filled columns (PK, audit, number sequences). Access returned fields with `result.field_name`. |

package/skills/dforge-mcp-author/references/formulas.md

@@ -11,11 +11,12 @@ Formulas are used in:
   `F` column otherwise: it must parse, call only implemented functions, and not
   aggregate over a 1:N set. See `security.md` → Column-level security.
 - **Action `canExecute:` blocks** — availability checks. Evaluated on both sides
-  and **enforced** by `action.execute`, but only over a narrow subset: comparisons
-  between fields and literals combined with `AND` / `OR` / `NOT`. Functions,
-  arithmetic, ref navigation, `$[setting]` reads and a bare boolean field all fail
-  open server-side, and some of them throw client-side. See the `canExecute:`
-  section in [action-dsl.md](action-dsl.md).
+  and **enforced** by `action.execute`: the server computes the whole formula
+  (functions, arithmetic, navigation included) and **refuses** the call when
+  it cannot read it (`$[setting]` reads, `SUM` / `COUNT` / `AVG`, unknown
+  functions). The client throws on navigation, set aggregates and unknown names,
+  which leaves the button enabled. See the `canExecute:` section in
+  [action-dsl.md](action-dsl.md).
 - **Default values** — a setting's `formula` (e.g. `"formula": "TODAY()"`) or a formula (`F`) column. Note: entity *data* columns have **no** `default`/`defaultValue` key — model a default with an `F` column or set it in action/trigger logic.
 - **Filter expressions** (partially)
 - **Validation expressions** (partially)

package/skills/dforge-mcp-author/references/jobs.md

@@ -33,7 +33,7 @@ Lives in: `logic/jobs.json` at the module root. Schema: [`docs/schemas/jobs.sche
 | `timeout`        | Yes      |              | Hard timeout in seconds. Range `(0, 3600]`. **No implicit default.** `timeout > 300` requires `class: "long_running"`.               |
 | `class`          | No       | `"standard"` | `"standard"` (≤ 300 s) or `"long_running"` (≤ 3600 s). Explicit opt-in for heavy jobs.                                               |
 | `concurrency`    | No       | `1`          | Max parallel runs `[1, 5]`. `1` = single-instance.                                                                                   |
-| `idempotencyKey` | No       |              | Template like `"{job_cd}:{run.month}"`. Successful run with same key blocks re-dispatch.                                             |
+| `idempotencyKey` | No       |              | **Not enforced yet.** Accepted and stored; the Scheduler does not read it. Scheduled slots deduplicate `(job, scheduled_at)`, not business keys across slots. Guard business idempotency inside the action; manual triggers skip the slot check.                                             |
 | `timeZone`       | No       | tenant tz    | IANA name. Falls back to `auth.tenant.time_zone`.                                                                                    |
 | `params`         | No       | `{}`         | Static parameters passed to the action as `__params`. Manifest-fixed — an admin cannot change them. For tenant-configurable values use module settings, resolved from the job's folder (below).       |
 | `enabled`        | No       | `true`       | `false` fully disables — no scheduler, no manual trigger.                                                                            |

package/skills/dforge-mcp-author/references/registers.md

@@ -188,6 +188,7 @@ A register column is a `bool` state column. `A` writes `balance`, `turnover` and
 | `lineDateField` | On a line posting, a line column dating that line's movement instead of `dateField`; an empty one falls back to `dateField`. With `periodEntity` each line's period must be open, judged by the movement's stamped date (line's or document's, after `dateTrunc`); lines skipped by `skipPostingWhenEmpty` don't count. On a `recordChangesOnly` info register, one line per key (several dates on a key are refused). A `date` or zoneless `timestamp`, in `lockedLineFields` (and `groupLinesBy` when grouped), not with `periodDimField`. |
 | `skipPostingWhenEmpty` | Dimensions whose emptiness means "this row posts nothing". The exception, see below. |
 | `lockedFields` / `lockedLineFields` | Columns frozen while posted. `["*"]` freezes the whole row. |
+| `postAction` / `unpostAction` | Params of the binding column (an `A` or `L` column), codes of this entity's actions that post and unpost the document. A direct `data.insert` / `data.update` that turns the state flag on or off needs `E` on the one for its direction, as the button does; actions and DSL `update()` are not re-checked. Each direction is gated on its own: with only one declared, the other direction needs just Insert/Update. A binding with neither gets a pack / validate warning, silenced by `"editorMayPost": true` (not allowed together with an action name). A name no action declared for the entity in `ui/actions.json` carries is refused by `module pack` / validate and by the write. **Unreleased: not in platform 1.28.12.** |
 | `movementMapping` | Journal attribute column to document or line column. |
 
 ### `map` value forms
@@ -286,6 +287,7 @@ For a history loaded from another system, an `accounting` register may declare `
 - **One constant for two resources.** Two resources mapped to the same constant read as two resources storing into one column and are refused.
 - **Period missing from the calendar.** With `periodEntity`, a month that has no row in the period entity counts as **closed**, and posting into it fails (`DF003: Period 1999-04 does not exist`). Seed or load the periods before the documents that post into them.
 - **A summed column that isn't a number.** A resource of a `balance`, `turnover` or `accounting` register, and a `totals` cache's columns, must be a scalar number. The editor and language server warn (`registers/column-not-numeric`, metadata 0.0.46) on `varchar`, `integer[]` and the like. An `info` register's resources are returned, not summed, and may be any type.
+- **"May edit" is not "may post".** Without `postAction` / `unpostAction` a role with Insert/Update on the document can post it through the API (`data.update` with the state flag) though it cannot run the Post action. **Unreleased: not in platform 1.28.12**, so do not declare these keys against that platform. Declare both (declaring one leaves the other direction open), and grant `E` on the actions (`"action:post_entry": "E"`) only to the roles that may post. Each name must be declared for that entity in the `ui/actions.json` of the package that owns the column; `module pack` refuses any other, including an action a bridge adds to the host's entity. `E` guards only the direct API path: an action with `E` that calls `update()` on the state flag can still post, so guard that inside its `execute:` (check the role or state and `error()`).
 - **Missing or unlocked `dateField`.** Required once the register has `journalDate` or `period`, and it must be in `lockedFields`.
 - **Key over dimensions.** The journal, a subordinate `info` register's records and an `autoCreate` state table are written by the platform. Each needs **one** surrogate primary key of type `bigint` (`identity`/`cuid`) or `uuid`. A key over dimensions, a multi-column key, a text key and `int4` are refused.
 - **State column narrower than the journal column.** It must hold the journal's value exactly, or unposting cannot take back what posting added.

package/skills/dforge-mcp-author/references/security.md

@@ -81,6 +81,8 @@ Example:
 |---|---|
 | `E` | Execute (run the action/report/stored procedure, access the folder) |
 
+**`E` on an action is not limited by the user's entity rights.** The gate is on running the action, not on the statements inside it: `insert()` / `update()` / `delete()` / `query()` in its script work on an entity where the user has only `S`. Entity rights apply to the grid, the card and the API, not to action scripts (core #1580).
+
 ### Common combinations
 
 | Rights | Meaning |

package/skills/dforge-mcp-author/references/validation-checklist.md

@@ -122,14 +122,12 @@ For each action:
 - [ ] DSL file exists at `logic/actions/<script>.dsl`, where `<script>` is the bare filename in the action's `script` field (no path, no `.dsl` extension)
 - [ ] DSL file has `params:`, `canExecute:`, and `execute:` blocks
 - [ ] `canExecute:` is a valid formula expression
-- [ ] If `canExecute:` is meant to **gate** and not just grey out a button, its
-      guard is expressed in the server-enforced subset — **comparisons** between
-      fields and literals, combined with `AND` / `OR` / `NOT`. Function calls
-      (`TODAY()`, `COUNT()`, `CURRENT_USER_ID()`), arithmetic, ref navigation and
-      `$[setting]` reads are fail-open server-side and are advisory only
-- [ ] No **bare boolean field** as a whole condition — `[is_active]` and
-      `NOT [is_blocked]` are not enforced (a field is only an operand). Write
-      `[is_active] = true` / `NOT ([is_blocked] = true)`
+- [ ] `canExecute:` uses only constructs the server can evaluate — fields,
+      literals, comparisons, arithmetic, `IN`, formula functions, a bare boolean
+      field. `$[setting]` reads, `SUM` / `COUNT` / `AVG` and unknown function
+      names are **refused at install**. `[ref].[col]` works on the
+      server but the client throws and **enables** the button: denormalise it
+      into a column, and count with a `G` column
 - [ ] Anything that MUST hold is also checked in `execute:` with `error()` — a
       `canExecute` alone is never the authoritative guard
 - [ ] `execute:` uses only documented built-in functions