@dforge-core/dforge-mcp 0.2.47 → 0.2.49

package/CHANGELOG.md

@@ -4,7 +4,48 @@ All notable changes to `@dforge-core/dforge-mcp`. This project uses semver-ish
 `0.1.0-rc.N` pre-release tags; the published version is set at publish time via
 the release workflow, so committed `package.json` versions are placeholders.
 
-## Unreleased
+## 0.2.49 - 2026-11-03
+
+**Query columns (`columnType: "Q"`).** A column that gives a record a read-only list of rows — a balance register on the
+record's date, or a query written in the column and filled from the record, optionally shown as a report visualization.
+It is shown on the card and read by print forms, with the reader's rights (core #1584). `column-types.md` gains the
+section and the install refusals; `print-templates.md`, `data-views.md`, `reports.md` and `registers.md` say how it
+meets each. `dforge_entity_field_add` accepts `columnType: "Q"` (requires `params`, no `dbDatatype`). The vendored
+entity schema and `@dforge-core/metadata` (^0.0.49) carry it. The model editor cannot add one yet.
+
+**1C migration readiness and regressions.** `delta --apply` now reports per-module
+`ready` / `partial` status and exits 2 if state, totals or imported markers remain
+unsettled; retained retry markers are settled on a later run even without new rows.
+Dry runs do not certify readiness. `pnpm test:1c` covers conversion precision,
+reference/date semantics, failed settlement/retry and the per-entity reload restart
+contract using synthetic fixtures and mocked database boundaries. The loader remains
+a non-atomic migration-target reload; its restart procedure is documented.
+A new CI job (`.github/workflows/onec-tests.yml`) runs it on changes to the 1C scripts or tests. A module's retry
+markers (`df1c.unsettled`) are now cleared only for the entities it settled, not for the whole module.
+Placeholder, balance-state and yearly totals writers roll back failed transactions before
+restoring autocommit; settlement continues to the next module only after connection
+recovery, and failed recovery stops the command. Strict transaction-state tests cover
+original-error preservation, partial yearly commits, continuation and unrecoverable connections.
+Jobs authoring/schema guidance now describes `idempotencyKey` as reserved and not enforced.
+
+**Action scripts bypass entity rights.** `action-dsl.md` and `security.md` now state that `insert()` / `update()` /
+`delete()` / `query()` in an action script check neither entity rights nor column security nor the folder's row filter
+(core #1580): only `E` on the action is checked, so treat `E` as write access to everything the script touches.
+
+**`canExecute` is enforced in full on the server.** `action.execute` now computes arithmetic, `IN`, `BETWEEN`, formula
+functions, a bare boolean column, `[ref].[col]` navigation and extension columns in SQL, instead of letting them through, and
+`TODAY()` names the requester's day. A condition it cannot compute refuses the action. Install rejects `$[setting]`,
+`SUM` / `COUNT` / `AVG` and unknown function names in `canExecute`, so a module that used them stops installing: read
+settings and count children in `execute:` instead (a count belongs in a `G` column). `references/action-dsl.md`
+(`canExecute:`), `formulas.md` and `validation-checklist.md` are rewritten to match. The button still evaluates over the
+grid row, which has no extension columns and throws on `[ref].[col]`, so keep both out of a gate that must also disable the
+button. **Needs platform 1.28.12.**
+
+**Registers: `postAction` / `unpostAction`.** `references/registers.md` documents the register-binding column params that make a direct
+`data.insert` / `data.update` flipping the state flag need `E` on the post or unpost action, and the "May edit is not may
+post" pitfall: declare both and grant `E` only to the roles that may post. Each direction is checked only when its own key
+is set; actions and DSL `update()` are not re-checked. A binding with neither gets a pack / validate warning, silenced by
+`"editorMayPost": true`. **Needs a platform release after 1.28.12 (not in it).**
 
 ## 0.2.46 — 2026-10-29
 

package/dist/server.js

@@ -31243,7 +31243,7 @@ function buildZedTasks() {
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.47/node_modules/@dforge-core/metadata/dist/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.49/node_modules/@dforge-core/metadata/dist/index.js
 var AggType = {
   Sum: "sum",
   Count: "count",
@@ -31321,6 +31321,7 @@ var columnTypes = [
   { cd: "F", name: "Formula", description: "A virtual value calculated from a formula expression." },
   { cd: "G", name: "Generated", description: "A physical column auto-maintained by the database (aggregate or expression)." },
   { cd: "A", name: "Accumulation register", description: "Posts this document into a balance entity (single direction)." },
+  { cd: "Q", name: "Query rows", description: "A read-only list of rows this record reads: a register's balance as of its date, or a query filled from its columns." },
   { cd: "L", name: "Ledger register", description: "Posts document lines into movements + balances (double entry)." }
 ];
 var byCd2 = new Map(columnTypes.map((ct) => [ct.cd, ct]));
@@ -33428,7 +33429,7 @@ function checkFieldSpec(where, field) {
     );
   }
   if (typeof v.flags === "string" && v.flags.includes("M") && v.isNullable === true) {
-    const virtual = typeof v.columnType === "string" && ["R", "S", "F"].includes(v.columnType);
+    const virtual = typeof v.columnType === "string" && ["R", "S", "F", "Q"].includes(v.columnType);
     err(
       `flags '${v.flags}' includes 'M' (mandatory) while "isNullable": true \u2014 a contradiction that fails at pack time. 'M' is resolved into isNullable:false at install. Drop 'M' if the column is optional, or remove "isNullable": true if it is required.${virtual ? " (On a virtual column 'M' is inert anyway \u2014 drop it.)" : ""}`
     );
@@ -33443,7 +33444,7 @@ function checkFieldSpec(where, field) {
   const columnType = typeof v.columnType === "string" ? v.columnType : "";
   if (columnType.length > 0 && !getColumnType(columnType)) {
     err(
-      `columnType '${columnType}' is invalid. Use 'R' (reference), 'S' (set/child list), or 'F' (formula) \u2014 or omit it for a plain data column. (A/L/G exist for register columns.)`
+      `columnType '${columnType}' is invalid. Use 'R' (reference), 'S' (set/child list), 'F' (formula) or 'Q' (a list of rows the record reads) \u2014 or omit it for a plain data column. (A/L/G exist for register columns.)`
     );
   }
   if (typeof v.dbDatatype === "string" && v.dbDatatype.length > 0) {
@@ -33477,6 +33478,21 @@ function checkFieldSpec(where, field) {
       );
     }
   }
+  if (columnType === "Q") {
+    if (v.params === void 0 || typeof v.params !== "object" || v.params === null) {
+      err(
+        "query column (columnType 'Q') requires 'params': { register, asOf, dimensions? } or { entity, query, params? }. (See dforge://reference/column-types.)"
+      );
+    }
+    if (v.dbDatatype !== void 0) {
+      err("query column (columnType 'Q') must NOT set 'dbDatatype' \u2014 it owns no physical column.");
+    }
+    if (typeof v.flags === "string" && /[EM]/.test(v.flags)) {
+      warn(
+        `query column has flags '${v.flags}' \u2014 a list the record reads is never edited or required; the platform ignores them.`
+      );
+    }
+  }
   if (columnType === "G") {
     if (typeof v.formula !== "string" || v.formula.trim() === "") {
       err("generated column (columnType 'G') requires a 'formula' expression.");
@@ -34612,7 +34628,7 @@ var path10 = __toESM(require("path"));
 var fs7 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.47/node_modules/@dforge-core/metadata/dist/dsl/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.49/node_modules/@dforge-core/metadata/dist/dsl/index.js
 var PUNCT3 = ["===", "!=="];
 var PUNCT2 = [
   "==",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dforge-core/dforge-mcp",
-  "version": "0.2.47",
+  "version": "0.2.49",
   "description": "MCP server for dForge module authoring. Exposes 35 scaffold/patch/validate/pack/install tools and schema resources so AI agents (Claude Code, Cursor, Zed) can create and ship dForge modules.",
   "license": "MIT",
   "homepage": "https://github.com/iash44/dForge-core",
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@dforge-core/dforge-cli": "^0.2.37",
-    "@dforge-core/metadata": "^0.0.47",
+    "@dforge-core/metadata": "^0.0.49",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3"
   },
@@ -42,6 +42,7 @@
     "sync-schemas": "node scripts/vendor-schemas.cjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "test:1c": "python3 -m unittest discover -s test/onec -v",
     "install-skills": "node scripts/install-skills.mjs"
   }
 }

package/resources/schemas/entity.schema.json

@@ -345,11 +345,90 @@
 			},
 			"additionalProperties": false
 		},
+		"queryColumnParams": {
+			"type": "object",
+			"description": "Binding of a query column (columnType Q): a read-only list of rows for the record, with no physical column. It reads either a balance register as of the record's date (register, asOf, dimensions) or a query written in the column and filled from the record (entity, query, params). Shown on the card and read by print forms, with the reader's rights.",
+			"oneOf": [
+				{
+					"required": ["register", "asOf"],
+					"properties": {
+						"register": {
+							"type": "string",
+							"description": "A balance register of this module or of one it depends on, as 'module_cd.register_cd'. It needs a journal that stamps the date and the direction of each movement.",
+							"examples": ["wms-registry.stock"]
+						},
+						"asOf": {
+							"type": "string",
+							"description": "Date (or timestamp) column of this entity the balance is taken on. The day itself is included."
+						},
+						"viz": {
+							"type": "object",
+							"description": "How the card shows the rows: a report visualization by its type (table, a chart, pivot...) and its config as that visualization takes it. Unset: a table. A print form reads the rows as a table whatever this says.",
+							"required": ["type"],
+							"properties": {
+								"type": { "type": "string" },
+								"config": { "type": "object" }
+							},
+							"additionalProperties": false
+						},
+						"dimensions": {
+							"type": "object",
+							"description": "Register dimension → column of this entity that narrows it. A dimension left out is not narrowed, so its tuples all come back. A narrowing column that is empty on the record leaves the list empty.",
+							"additionalProperties": { "type": "string" },
+							"examples": [{ "warehouse_id": "warehouse_id" }]
+						}
+					},
+					"additionalProperties": false
+				},
+				{
+					"required": ["entity", "query"],
+					"properties": {
+						"entity": {
+							"type": "string",
+							"description": "The entity the query reads, as 'module_cd.entity_cd' (a bare code is this module's own). Of this module or of one it depends on.",
+							"examples": ["retail.goods_line"]
+						},
+						"query": {
+							"type": "object",
+							"description": "The query itself, in the shape query.run takes: columns (a plain name, or { c, agg } with agg group / sum / count / avg / min / max — grouped if any column has one), filter and sort. A filter value written '@name' is filled from the record through 'params'. An aggregate is read under its column's code. Written here and not saved elsewhere, so no edit of a shared query can change the form.",
+							"properties": {
+								"columns": { "type": "array" },
+								"filter": {},
+								"sort": { "type": "array" }
+							},
+							"additionalProperties": false
+						},
+						"viz": {
+							"type": "object",
+							"description": "How the card shows the rows: a report visualization by its type (table, a chart, pivot...) and its config as that visualization takes it. Unset: a table. A print form reads the rows as a table whatever this says.",
+							"required": ["type"],
+							"properties": {
+								"type": { "type": "string" },
+								"config": { "type": "object" }
+							},
+							"additionalProperties": false
+						},
+						"params": {
+							"type": "object",
+							"description": "Query parameter (the name after '@' in a filter value) → stored column of this entity that fills it. Every @param of the query is listed, and only those. A column that is empty on the record leaves the list empty rather than widening the query.",
+							"additionalProperties": { "type": "string" },
+							"examples": [{ "doc": "document_id" }]
+						}
+					},
+					"additionalProperties": false
+				}
+			]
+		},
 		"registryColumnParams": {
 			"type": "object",
 			"description": "params of an accumulation (A) or ledger (L) registry column. The lock lists are what BOTH generated guards freeze — the posted-document guard while the document is posted, the period guard while its period is closed — and they are required: install refuses a registry column that omits or empties them. The header's periodDateField and the state column are watched in addition, whatever the list says.",
 			"required": ["lockedFields"],
+			"if": { "required": ["editorMayPost"], "properties": { "editorMayPost": { "const": true } } },
+			"then": { "not": { "anyOf": [ { "required": ["postAction"] }, { "required": ["unpostAction"] } ] } },
 			"properties": {
+				"postAction": { "type": "string", "minLength": 1, "description": "Code of the action (available for this entity) that posts the document. A direct data.insert / data.update that turns the state flag on needs 'E' on it, as the button does, so \"may edit\" and \"may post\" stay two rights through the API too. An action's own writes are not re-checked. Pack refuses a name that no action declared for this entity carries. Unset: the transition needs only Insert/Update." },
+				"unpostAction": { "type": "string", "minLength": 1, "description": "Code of the action that unposts the document; the same gate for a direct write that turns the state flag off." },
+				"editorMayPost": { "type": "boolean", "description": "Declares that Insert/Update on the document includes posting it: no separate right to post is intended, so no postAction / unpostAction is named. Changes nothing at run time; it silences the pack warning for a column that names no posting action. Not together with postAction / unpostAction." },
 				"lockedFields": {
 					"type": "array",
 					"minItems": 1,
@@ -408,6 +487,10 @@
 				{
 					"if": { "required": ["columnType"], "properties": { "columnType": { "enum": ["A", "L"] } } },
 					"then": { "required": ["params"], "properties": { "params": { "$ref": "#/$defs/registryColumnParams" } } }
+				},
+				{
+					"if": { "required": ["columnType"], "properties": { "columnType": { "const": "Q" } } },
+					"then": { "required": ["params"], "properties": { "params": { "$ref": "#/$defs/queryColumnParams" } } }
 				}
 			],
 			"properties": {
@@ -422,8 +505,8 @@
 				},
 				"columnType": {
 					"type": "string",
-					"enum": ["D", "R", "S", "F", "A", "L", "G"],
-					"description": "Column type: D=Data (physical column), R=Reference (N:1 lookup), S=Set (1:N collection), F=Formula (virtual calculated), G=Generated/Computed (physical, auto-maintained), A=Accumulation registry, L=Ledger registry"
+					"enum": ["D", "R", "S", "F", "A", "L", "G", "Q"],
+					"description": "Column type: D=Data (physical column), R=Reference (N:1 lookup), S=Set (1:N collection), F=Formula (virtual calculated), G=Generated/Computed (physical, auto-maintained), A=Accumulation registry, L=Ledger registry, Q=Query (virtual list of rows read from a register, bound to this record)"
 				},
 				"fieldTypeCd": {
 					"type": "string",
@@ -633,6 +716,17 @@
 						"columnType": { "const": "G" },
 						"link": false
 					}
+				},
+				{
+					"title": "Query column (Q)",
+					"description": "Read-only list of rows the record reads, with no physical column (columnType 'Q'): a register's balance as of the record's date, or a query written in 'params' and filled from the record. Requires 'params'. Must NOT have 'dbDatatype', 'fieldTypeCd' or 'link'.",
+					"required": ["columnType", "params"],
+					"properties": {
+						"columnType": { "const": "Q" },
+						"dbDatatype": false,
+						"fieldTypeCd": false,
+						"link": false
+					}
 				}
 			],
 			"required": ["orderNum", "description"],

package/resources/schemas/jobs.schema.json

@@ -52,7 +52,7 @@
 					},
 					"idempotencyKey": {
 						"type": "string",
-						"description": "Template like '{job_cd}:{run.month}'. Resolved at fire time. A successful run with the same key blocks re-dispatch (Phase 3 enforcement)."
+						"description": "Reserved; not enforced yet. Stored but never read by the scheduler, so it does not block re-dispatch. Only the scheduled slot (job, scheduled_at) is deduplicated; guard business-level 'once per period' inside the action."
 					},
 					"class": {
 						"type": "string",

package/resources/schemas/print-templates.schema.json

@@ -55,6 +55,11 @@
 							"left":   { "type": "string" }
 						},
 						"additionalProperties": false
+					},
+					"culture": {
+						"type": "string",
+						"description": "The form's own culture, e.g. 'uk-UA': format_number, format_currency, format_date, _fmt and Yes/No print in it whoever prints the form. Omitted: the user's culture. An unknown culture is refused at pack and install.",
+						"examples": ["uk-UA", "de-CH"]
 					}
 				},
 				"additionalProperties": false

package/skills/dforge-1c-import/scripts/README.md

@@ -162,3 +162,30 @@ reproducible.
 This copy is kept in step with the port it was developed on (`tools/lib`, `tools/1c.py`
 there). Fixes made in a port go back to the library here. A project's own files never
 come here.
+
+### Regression checks and restart contract
+
+From the MCP repository root: `pnpm test:1c` (Python 3, standard library only).
+These tests use synthetic inputs and mocked database boundaries, never a tenant or
+source infobase. They cover conversions, COPY encoding, settlement failure/retry and
+the initial loader's committed-per-entity restart contract; they do not replace
+Parquet/DuckDB/PostgreSQL integration or real source-to-target reconciliation.
+
+`delta --apply` prints each module's `ready` or `partial` status. Exit 0 means all
+selected modules settled; exit 2 means data may have committed but settlement is
+incomplete (state/totals drift or markers not converged, including `--no-mark`
+when markers are needed). Resolve the reported problem and rerun `--apply`;
+persisted unsettled entities are checked even when the new delta has no changes.
+Dry runs report `dry_run` and do not certify readiness. Settlement write failures
+roll back the current transaction before restoring autocommit; ordinary failures
+report `partial` and allow the next module to run on a clean connection. Failure to
+rollback or restore the connection stops the command immediately. Previously
+committed entities/years remain committed; a rollback does not undo the whole import.
+Exit 0 does not replace the wider migration reconciliation.
+
+`migrate run --truncate` is a destructive reload into an isolated migration target,
+not an atomic refresh of a live application: clearing commits before loading and
+each entity commits separately. If interrupted, keep users out, repair the cause,
+rerun the same complete selection with `--truncate` from the same export, then
+reconcile again. Do not use an append rerun to recover a partially loaded target.
+For an active target, load/reconcile a separate database and switch only afterward.

package/skills/dforge-1c-import/scripts/lib/delta.py

@@ -56,6 +56,7 @@ taken for a deletion. While 1C is the system of record, nothing is entered in th
 from __future__ import print_function
 
 import argparse
+import collections
 import datetime
 import re
 import struct
@@ -65,6 +66,7 @@ import time
 import migrate
 import paths
 import store
+import transactions
 
 SCHEMA = "df1c"
 KEYS_IN_LIST = 500
@@ -515,6 +517,14 @@ def begin(cur):
 
 # --------------------------------------------------------------------------- after a module
 
+SettleResult = collections.namedtuple("SettleResult", "status notes")
+
+
+def settlement_exit_code(outcomes, apply):
+	"""Dry runs only estimate; an applied but unfinished module must block cutover."""
+	return 2 if apply and any(o.status != "ready" for o in outcomes) else 0
+
+
 def settle(pg, module, results, apply, mark_documents):
 	"""What a module needs once its rows moved: placeholders, balances, markers."""
 	import posted
@@ -526,11 +536,11 @@ def settle(pg, module, results, apply, mark_documents):
 	notes = []
 	settled = True
 	if apply and touched:
-		cur = pg.cursor()
-		cur.execute("BEGIN")
-		cur.execute("SET LOCAL session_replication_role = 'replica'")
-		filled = migrate.fill_missing(pg, schemas, verbose=False)
-		cur.execute("COMMIT")
+		with transactions.writing(pg):
+			cur = pg.cursor()
+			cur.execute("SET LOCAL session_replication_role = 'replica'")
+			filled = migrate.fill_missing(pg, schemas, verbose=False)
+			pg.commit()
 		if filled:
 			notes.append("%d placeholder(s)" % sum(f[4] for f in filled))
 
@@ -539,9 +549,8 @@ def settle(pg, module, results, apply, mark_documents):
 		if reg.journal_entity not in touched:
 			continue
 		if apply:
-			pg.autocommit = False
-			rows, written, _ = seedstate.seed(pg, reg)
-			pg.autocommit = True
+			with transactions.writing(pg):
+				rows, written, _ = seedstate.seed(pg, reg)
 			off = seedstate.drift(pg.cursor(), reg)
 			settled = settled and not off
 			notes.append("reseeded %s.%s: %d tuple(s), check %s"
@@ -587,8 +596,9 @@ def settle(pg, module, results, apply, mark_documents):
 		else:
 			notes.append("would converge markers on %d document table(s)" % len(work))
 	if apply and touched and settled:
-		pg.cursor().execute("DELETE FROM %s.unsettled WHERE module = %%s" % SCHEMA, (module,))
-	return notes
+		pg.cursor().execute("DELETE FROM %s.unsettled WHERE module = %%s AND entity = ANY(%%s)"
+		                    % SCHEMA, (module, sorted(touched)))
+	return SettleResult("dry_run" if not apply else ("ready" if settled else "partial"), notes)
 
 
 # --------------------------------------------------------------------------- command
@@ -733,6 +743,7 @@ def main():
 	print("-" * len(header))
 	totals = [0, 0, 0, 0, 0.0]
 	all_notes = []
+	outcomes = []
 	for module in modules:
 		results = []
 		for m, job in plan:
@@ -753,7 +764,20 @@ def main():
 				         res.owners if kind in ("lines", "movements") else "",
 				         res.changed, res.new, res.deleted, res.read, res.compare, res.write))
 				sys.stdout.flush()
-		for note in settle(pg, module, results, args.apply, jwt if args.apply else None):
+		try:
+			outcome = settle(pg, module, results, args.apply, jwt if args.apply else None)
+		except transactions.ConnectionRecoveryError:
+			raise  # Never continue on a connection whose cleanup failed.
+		except Exception as failure:
+			if not args.apply:
+				raise
+			transactions.recover(pg)
+			outcome = SettleResult("partial", ["settlement FAILED: %s: %s"
+			                                  % (type(failure).__name__, failure)])
+		outcomes.append(outcome)
+		all_notes.append("%s: status %s%s" % (module, outcome.status,
+		                                      "" if args.apply else " (estimate only, not a readiness verdict)"))
+		for note in outcome.notes:
 			all_notes.append("%s: %s" % (module, note))
 	print("-" * len(header))
 	print("%d entities  changed %d  new %d  deleted %d  (owners/recorders replaced %d)"
@@ -763,7 +787,11 @@ def main():
 		print("  " + note)
 	print("(rows of an entity with nothing changed and under 2s are not listed;"
 	      " lines/movements count rows replaced as new/deleted)")
-	return 0
+	code = settlement_exit_code(outcomes, args.apply)
+	if code:
+		print("delta incomplete (%s): do not cut over; resolve the notes and rerun --apply."
+		      % ", ".join(m for m, o in zip(modules, outcomes) if o.status != "ready"))
+	return code
 
 
 if __name__ == "__main__":

package/skills/dforge-1c-import/scripts/lib/totals.py

@@ -50,6 +50,7 @@ import sys
 import time
 
 import migrate
+import transactions
 
 GRANULARITIES = ("day", "month", "quarter", "year")
 
@@ -334,8 +335,7 @@ def rebuild(pg, plan):
 
 	insert = ("INSERT INTO %s (%s) VALUES (%s)"
 	          % (plan.totals, ", ".join(key + cols), ", ".join(["%s"] * (len(key) + len(cols)))))
-	pg.autocommit = False
-	try:
+	with transactions.writing(pg):
 		for year in years:
 			cur.execute("SET LOCAL session_replication_role = 'replica'")
 			cur.execute("DELETE FROM %s WHERE %s >= %%s AND %s < %%s"
@@ -344,8 +344,6 @@ def rebuild(pg, plan):
 			if by_year.get(year):
 				cur.executemany(insert, by_year[year])
 			pg.commit()
-	finally:
-		pg.autocommit = True
 	print("%-28s %7d rows written over %d year(s)   checks %.0fs, fold %.0fs, write %.0fs"
 	      % (name(plan), len(rows), len(years), scanned - started, read - scanned,
 	         time.time() - read))

package/skills/dforge-1c-import/scripts/lib/transactions.py

@@ -0,0 +1,28 @@
+"""Transaction cleanup shared by the migration settlement writers."""
+from contextlib import contextmanager
+
+
+class ConnectionRecoveryError(RuntimeError):
+	"""The connection cannot safely be reused; abort rather than try another module."""
+
+
+def recover(pg):
+	"""Rollback before changing mode: psycopg2 forbids it in an active transaction."""
+	try:
+		pg.rollback()
+		pg.autocommit = True
+	except Exception as error:
+		raise ConnectionRecoveryError("cannot restore migration connection: %s" % error) from error
+
+
+@contextmanager
+def writing(pg):
+	"""Writers commit explicitly; on any failure, rollback before restoring autocommit."""
+	pg.autocommit = False
+	try:
+		yield
+	except BaseException:
+		recover(pg)
+		raise
+	else:
+		pg.autocommit = True

package/skills/dforge-mcp-author/references/action-dsl.md

@@ -117,53 +117,54 @@ Two consequences worth designing around:
 - **`canExecute: false` is the idiom for an action only automation may fire.** The
   server refuses it through `action.execute`; triggers and scheduled jobs invoke
   the script engine directly and are unaffected.
-- **Both evaluators have gaps, and both fail open.** The server is a scalar walker
-  — comparisons between fields and literals, combined with `AND` / `OR` / `NOT`,
-  nothing else — and lets anything richer through. The client implements the full documented formula
-  function set, so ordinary functions are fine there; it throws (and its `catch`
-  **enables** the button) on **ref navigation** (`[ref].target`), on the set
-  aggregates **`SUM` / `COUNT` / `AVG`** (deliberately not formula functions —
-  counting is a Generated `G` column's job), and on **any name it does not know, a
-  typo included** — a `canExecute` is never validated against the function set at
-  install, so `TOADY()` ships and enables the button for every record.
-- **`$[setting]` references are a separate case.** They do not throw: the client's
-  resolver is stubbed to `null`, so the predicate resolves however that operator
-  treats null (an ordered comparison against null is `false`, so it tends to
-  *disable* the button), while the server has no settings resolver and fails open.
-  Keep settings out of `canExecute` and read them in `execute:` instead.
-
-| tier | construct | client | server |
-|---|---|---|---|
-| 1 | **comparisons** (`=` `!=` `<` `<=` `>` `>=`) between fields and literals, combined with `AND` / `OR` / `NOT`; a bare `true` / `false` | evaluates | **enforces** |
-| 2 | arithmetic, `IN`, `BETWEEN`, any formula function | evaluates | fail-open |
-| 3 | ref navigation, `SUM` / `COUNT` / `AVG`, any unknown function (a typo included) | **fail-open (throws)** | fail-open |
-| — | `$[setting]` references | **evaluates as null** (no throw) | fail-open |
-
-**A bare boolean column is not tier 1.** The walker evaluates conditions, not
-values — a field is only resolvable as an operand of a comparison — so
-`canExecute: [is_active]` and `canExecute: NOT [is_blocked]` fail open. Write
-`[is_active] = true` and `NOT ([is_blocked] = true)`. (`canExecute: false` is fine:
-a bare literal is a complete condition.)
-
-Mixing tier 1 and tier 2 is the normal, healthy shape: the client evaluates the
-whole thing so the button state is right, and the server short-circuits `AND` /
-`OR` so the tier-1 half is still enforced.
-
-**Tier 3 is what breaks.** The server short-circuits, the client does not — so
-`[status] = 'Pending' AND COUNT([lines]) > 0` on a non-`Pending` record still
-evaluates `COUNT` in the browser, throws, and the button is **enabled**, then the
-server refuses the call: an error where a greyed-out button was wanted. And a
-`canExecute` is not validated against the function set at install, so that spelling
-ships silently. Count with a `G` column and compare the scalar
-(`[detail_count] > 0`); denormalise instead of navigating; put anything genuinely
-unexpressible in `execute:` behind `error()`.
+- **The server evaluates the whole formula, and refuses what it cannot read.**
+  (Needs platform 1.28.12; older platforms let these through, so the gate is not enforced there.)
+  Comparisons between fields and literals (with `AND` / `OR` / `NOT`, a bare
+  `true` / `false`) are checked in-process; anything richer — arithmetic, `IN`,
+  `BETWEEN`, formula functions, a bare boolean field, `[ref].[col]`
+  navigation — is computed in SQL over the record, by the same translator as formula
+  columns (chained hops are followed up to a depth cap; a null ref gives `NULL`, which
+  counts as not true). A condition the server cannot evaluate (`$[setting]` references, set
+  aggregates `SUM` / `COUNT` / `AVG`, an unknown function name, a typo included)
+  **refuses the action** with `ACTION_EXECUTION_FAIL` ("cannot be evaluated by the
+  server") instead of allowing it. A `NULL` result counts as not true.
+  Comparisons themselves are null-safe and two-valued (see `formulas.md`), so an empty
+  field does not make `NOT ([x] = 'A')` unknown.
+- **The client has gaps of its own, and its failures enable the button.** It
+  throws (and its `catch` **enables** the button) on **ref navigation**
+  (`[ref].target`), on **`SUM` / `COUNT` / `AVG`** (deliberately not formula
+  functions — counting is a Generated `G` column's job) and on **any name it does
+  not know, a typo included** (install refuses the last two, see below).
+- **`$[setting]` references** resolve to `null` in the client (an ordered comparison
+  against null is `false`, so it tends to *disable* the button) and are refused by
+  the server and at install (platform 1.28.12 and later). Keep settings out of `canExecute` and read them in `execute:` instead.
+- **`TODAY()`** names the requester's calendar day on the server too (their time
+  zone: the request's, else the user profile's, else the workspace's, else UTC; a profile zone of
+  `UTC` counts as unset). The button is evaluated in the browser and is meant to name the same
+  day; `execute:` stays the authority.
+- **Install refuses** a `canExecute` that uses `$[setting]`, `SUM` / `COUNT` / `AVG`
+  or an unknown function name (a typo included), since the server could never run
+  the action. Read settings and count children in `execute:` instead.
+
+| construct | client | server |
+|---|---|---|
+| comparisons between fields and literals, `AND` / `OR` / `NOT`, bare `true` / `false` | evaluates | evaluates |
+| arithmetic, `IN`, `BETWEEN`, formula functions, bare boolean field | evaluates | evaluates (SQL) |
+| `[ref].[col]` navigation | **throws, button enabled** | evaluates (SQL) |
+| `SUM` / `COUNT` / `AVG`, unknown function (a typo included) | **throws, button enabled** | **refused at install**; if one is already installed, `action.execute` refuses it |
+| `$[setting]` references | evaluates as null | **refused at install**; if already installed, `action.execute` refuses it |
+
+Both evaluators agreeing is the healthy shape; the one to design around is a
+construct the client throws on, which leaves a button that is enabled and then
+refused. Count with a `G` column and compare the scalar (`[detail_count] > 0`);
+denormalise instead of navigating; put anything genuinely unexpressible in
+`execute:` behind `error()`.
 
 > Never make `canExecute` the *only* guard for something that must hold. Between
-> the fail-open rules on both sides, the enqueue-only check on background runs, and
-> the fact that the client evaluates over the grid row (which does not carry
-> extension columns) while the server evaluates over a full record load, the
-> authoritative check belongs in `execute:` — validate and `error()` before the
-> first write.
+> the enqueue-only check on background runs and the fact that the client evaluates
+> over the grid row (which does not carry extension columns) while the server
+> evaluates over a full record load, the authoritative check belongs in
+> `execute:` — validate and `error()` before the first write.
 
 ```
 canExecute:
@@ -226,6 +227,8 @@ var note = params[note]             // no quotes around param name in this DSL
 
 ### Data operations
 
+**No entity rights are checked inside a script.** `insert()`, `update()`, `delete()` and `query()` do not look at the signed-in user's `S`/`I`/`U`/`D` on the entity, nor at column security or the folder's row filter. Only `E` on the action is checked, when it is run. A user with `S` only on an entity can still change it through an action they may execute (core #1580). Treat `E` on an action as write access to everything its script touches; to keep a log free of changes, grant `E` on no action that writes to it.
+
 | Function | Returns | Description |
 |---|---|---|
 | `insert('entity', { field: value, … })` | Inserted row object | Insert a new record. Returns the full row including auto-filled columns (PK, audit, number sequences). Access returned fields with `result.field_name`. |

package/skills/dforge-mcp-author/references/column-types.md

@@ -1,6 +1,6 @@
 # Column Types Reference
 
-Every column has a `columnType` (optional for the default physical type). Seven values exist:
+Every column has a `columnType` (optional for the default physical type). Eight values exist:
 
 | `columnType` | Physical DB column? | Description |
 |---|---|---|
@@ -10,9 +10,10 @@ Every column has a `columnType` (optional for the default physical type). Seven
 | `"F"` | No | **Formula column** — virtual computed value. Evaluated by the formula engine. |
 | `"A"` | Yes | **Accumulation register column** — stores posted state for accumulation registers. Advanced (accounting modules). |
 | `"L"` | Yes | **Ledger register column** — stores posted state for double-entry bookkeeping. Advanced (accounting modules). |
+| `"Q"` | No | **Query column** — a read-only list of rows the record reads (a register's balance on its date, or a query filled from its columns). Shown on the card and read by print forms. See below. |
 | `"G"` | Yes | **Generated column** — DB-level computed value. Two strategies, auto-detected from the formula: a **trigger-based aggregate over a child set** (`SUM([lines].[amount])`), or a same-row PostgreSQL `GENERATED ALWAYS AS` (`[qty] * [price]`). This is the correct type for **roll-up totals over child rows** (see below). The aggregated child column **must be physical** (a `D` column, or a same-row `G`) — never a virtual `F`/`R`/`S` column. |
 
-**For most module development, you'll use D, R, S, and F.** Add `G` when you need a **roll-up total over a child set** (`SUM`/`COUNT`/`AVG`/`MIN`/`MAX`) — see below. Types A and L are for advanced accounting/registry modules that use the `postable`, `accumulation`, or `ledger` traits.
+**For most module development, you'll use D, R, S, and F.** Add `Q` for a list a form reads from elsewhere. Add `G` when you need a **roll-up total over a child set** (`SUM`/`COUNT`/`AVG`/`MIN`/`MAX`) — see below. Types A and L are for advanced accounting/registry modules that use the `postable`, `accumulation`, or `ledger` traits.
 
 ## Data columns (`columnType` omitted or `"D"`)
 
@@ -165,6 +166,40 @@ Do **not** include `dbDatatype` on formula columns (there's no physical storage)
 
 See `formulas.md` for syntax.
 
+## Query columns (`columnType: "Q"`)
+
+A read-only list of rows a record reads, with no physical column and no `link`: the card shows it beside the sets, and a print form loops it like a set. Declare it in the entity file; the model editor cannot add one. The binding is `params`, one of two sources:
+
+```json
+// A balance register on the record's date, narrowed by the record's own columns
+"old_stock": {
+    "columnType": "Q",
+    "description": "Balance on the document's date",
+    "params": { "register": "wms-registry.stock", "asOf": "doc_date", "dimensions": { "warehouse_id": "warehouse_id" } }
+},
+// A query written in the column, its @param filled from the record; grouped and summed if the query is
+"lines_by_product": {
+    "columnType": "Q",
+    "description": "Lines by product",
+    "params": {
+        "entity": "retail.document_line",
+        "query": {
+            "columns": [ { "c": "product_id", "agg": "group" }, { "c": "quantity", "agg": "sum" } ],
+            "filter": { "c": "document_id", "o": "eq", "v": "@doc" },
+            "sort": [ { "c": "product_id", "d": "asc" } ]
+        },
+        "params": { "doc": "document_id" }
+    }
+}
+```
+
+- `register` is a `balance` register of this module or one it depends on, with a journal that stamps date and direction. `asOf` is a date column of the record (the day itself is included). `dimensions` maps a register dimension to a record column; a dimension left out is not narrowed.
+- `entity` is `module.entity` (bare for this module's own). `query` takes `columns`, `filter` and `sort` as `query.run` does. Every `@param` of the filter is listed in `params.params`, to a stored column of the record, and only those. State a `sort` on a grouped query. An aggregate is read under its column's code.
+- Optional `params.viz` (`{ "type": "bar", "config": {} }`) shows the card's rows as a report visualization; unset, a table. A print form reads a table whatever it says.
+- Reads use the **reader's** rights: Select on the source, the folder's view and row filter. A reader who may not see it gets the column left out of the card and an empty list with a warning in a print; a PDF or subscription is refused. A record column that is empty gives an empty list, never every row. At most 1000 rows.
+- **Install refuses**: an undeclared register or entity (or one of a module this one does not depend on), a register that is not `balance` or has no dated journal, `asOf` that is not a date, a column the record or the source does not have, an unfilled or extra `@param`, keys of the other source, a `viz` without `type`, a Q column in an extension of another module's entity, a Q column listed in a data view, and a Q column as a report parameter source.
+- A Q column is no field: `data.get` skips it, DSL `select()` refuses it, and it cannot be edited. For a figure over a large table use a `G` column or a record report.
+
 ## Roll-up totals over child rows — use `G`, not `F`
 
 To total a child set on a header (line items → order total, movements → quantity on hand),
@@ -213,5 +248,6 @@ inside one aggregate must point at the **same** set column, and `COUNT(*)` is re
 - **"User picker" (points to admin.user)** → omit `columnType`, use `fieldTypeCd: "user"` (writes user ID directly, no paired FK)
 - **"Polymorphic link to any entity"** → omit `columnType`, use `fieldTypeCd: "entitylink"` (stored as JSON)
 - **"Roll-up total over child rows"** (line items → header total, movements → quantity on hand) → `"G"` with `SUM([set].[field])` (trigger-maintained, stored; see "Roll-up totals" above). Aggregate only a **physical** child column — never an `F`/`R`/`S` column. Do **not** use `"F"` for set aggregation — it silently renders empty.
+- **"List of rows this record reads"** (stock on the document's date, a document's lines by product) → `"Q"` (see "Query columns" above)
 - **"Accumulation register state"** → `"A"` (advanced accounting — requires `postable` + `accumulation` traits)
 - **"Double-entry ledger state"** → `"L"` (advanced accounting — requires `postable` + `ledger` traits)

package/skills/dforge-mcp-author/references/data-views.md

@@ -273,6 +273,8 @@ Each column is either a simple string or an object:
 ]
 ```
 
+A query column (`columnType: "Q"`) is a list the record reads, not a value: a view that lists one is refused at validate/pack. It shows on the record's card instead (column-types.md § Query columns).
+
 ## Filters
 
 Filters use dForge's canonical JSON filter format — see [filters.md](filters.md) for the full grammar. Keys are `c` (column), `o` (operator), `v` (value) for conditions, and `g` (group operator), `i` (items) for groups.

package/skills/dforge-mcp-author/references/formulas.md

@@ -11,11 +11,12 @@ Formulas are used in:
   `F` column otherwise: it must parse, call only implemented functions, and not
   aggregate over a 1:N set. See `security.md` → Column-level security.
 - **Action `canExecute:` blocks** — availability checks. Evaluated on both sides
-  and **enforced** by `action.execute`, but only over a narrow subset: comparisons
-  between fields and literals combined with `AND` / `OR` / `NOT`. Functions,
-  arithmetic, ref navigation, `$[setting]` reads and a bare boolean field all fail
-  open server-side, and some of them throw client-side. See the `canExecute:`
-  section in [action-dsl.md](action-dsl.md).
+  and **enforced** by `action.execute`: the server computes the whole formula
+  (functions, arithmetic, navigation included) and **refuses** the call when
+  it cannot read it (`$[setting]` reads, `SUM` / `COUNT` / `AVG`, unknown
+  functions). The client throws on navigation, set aggregates and unknown names,
+  which leaves the button enabled. See the `canExecute:` section in
+  [action-dsl.md](action-dsl.md).
 - **Default values** — a setting's `formula` (e.g. `"formula": "TODAY()"`) or a formula (`F`) column. Note: entity *data* columns have **no** `default`/`defaultValue` key — model a default with an `F` column or set it in action/trigger logic.
 - **Filter expressions** (partially)
 - **Validation expressions** (partially)
@@ -166,6 +167,19 @@ The whole date family evaluates identically **client-side and SQL-time** (report
     `dforge_module_validate` and `dforge_module_pack` (the CLI's static checks) catch only a
     malformed call, such as a name that is not a text literal or a dimension without its value;
     whether the register, resource and dimensions exist is known at install.
+  - The resource and dimensions must be stored columns of the register's entity. Install
+    refuses a register whose dimension or resource is a formula, reference or set column:
+    nothing is stored there to read. A register installed before that rule gives an empty
+    cell with a warning.
+  - A resource or dimension name may follow ONE reference (#1585). This is 1C's
+    `СрезПоследних(...).ФизЛицо.Наименование`. As the resource, `'person_id.name'` reads `name`
+    of what the record in effect references. As a dimension, `'employee_id.person_id', [person_id]`
+    matches the records whose employee is that person's; the newest across them wins. The column
+    followed must be the `thisKey` of a single-key reference column on the register's entity, and
+    the column named must be stored on the target's own table. The target is read with the user's
+    rights (Select, visible columns, row filter). A target the user cannot see gives an empty
+    cell, never an older record. Install refuses a path through a non-reference or to an unstored
+    column; pack refuses two hops.
   - Refused at install in a `G` column: it is computed when a row is written and would not
     follow a record added to the register later. Use an `F` column.
   - Newest record only: there is no `first` mode as `getSlice` has. Each row is one index
@@ -420,7 +434,8 @@ An `F` column is virtual: not stored, not editable. To fill a **stored, editable
 - Using JavaScript syntax like `row.field` or `this.field` — **wrong**. Only `[field]`.
 - Forgetting `baseDatatypeCd` on formula columns — **required**. Without it, filters and SQL don't work.
 - Using SQL syntax like `SELECT`, `JOIN`, `WHERE` — **wrong**. Formulas are expressions, not queries.
-- String concatenation with commas — **wrong**. Use `+` or `CONCAT()`.
+- String concatenation with commas — **wrong**. Use `+` or `CONCAT()`. `+` concatenates when either side is text: a text column or literal, a string function, an `IF` whose branch is text, `COALESCE` / `NULLIF` of text, or a `SLICE()` of a text resource. `CONCAT()` also reads a null as empty, so prefer it when a part may be missing.
+- `[x] != ''` is true when `[x]` is null: comparisons are null-safe. To test "has text", write `COALESCE([x], '') != ''`.
 
 ## Reference
 

package/skills/dforge-mcp-author/references/jobs.md

@@ -33,7 +33,7 @@ Lives in: `logic/jobs.json` at the module root. Schema: [`docs/schemas/jobs.sche
 | `timeout`        | Yes      |              | Hard timeout in seconds. Range `(0, 3600]`. **No implicit default.** `timeout > 300` requires `class: "long_running"`.               |
 | `class`          | No       | `"standard"` | `"standard"` (≤ 300 s) or `"long_running"` (≤ 3600 s). Explicit opt-in for heavy jobs.                                               |
 | `concurrency`    | No       | `1`          | Max parallel runs `[1, 5]`. `1` = single-instance.                                                                                   |
-| `idempotencyKey` | No       |              | Template like `"{job_cd}:{run.month}"`. Successful run with same key blocks re-dispatch.                                             |
+| `idempotencyKey` | No       |              | **Not enforced yet.** Accepted and stored; the Scheduler does not read it. Scheduled slots deduplicate `(job, scheduled_at)`, not business keys across slots. Guard business idempotency inside the action; manual triggers skip the slot check.                                             |
 | `timeZone`       | No       | tenant tz    | IANA name. Falls back to `auth.tenant.time_zone`.                                                                                    |
 | `params`         | No       | `{}`         | Static parameters passed to the action as `__params`. Manifest-fixed — an admin cannot change them. For tenant-configurable values use module settings, resolved from the job's folder (below).       |
 | `enabled`        | No       | `true`       | `false` fully disables — no scheduler, no manual trigger.                                                                            |

package/skills/dforge-mcp-author/references/print-templates.md

@@ -63,12 +63,15 @@ Every column on the entity is a top-level variable. Display formatting is pre-ap
 | `{{ _settings.<cd> }}`  | Folder-resolved module setting. Image/file settings come as base64 data URIs (drop into `<img src>`).   |
 | `{{ _today }}`          | Typed `DateTimeOffset` (UTC); `{{ _fmt._today }}` is the pre-formatted string                          |
 | `{{ <set_name> }}`      | Child set — array, in primary-key order. Loaded wherever the template's Liquid code names it (see below) |
+| `{{ <query_column> }}`  | Query column (`Q`) — the rows the record reads (`{% for r in old_stock %}{{ r.quantity }} {{ r._fmt.quantity }}`). Loaded only where the template's Liquid code names it, like a set; always a table here, whatever the column's `viz` says |
 | `{{ _css }}`            | The CSS string attached to the template (rarely needed in template body)                                |
 
 Inside a child-set loop, the same shape applies per row: `line._fmt.<col>`, `line._raw.<col>`, `line._color.<col>`.
 
 A loop over a document's set can read a set of the line's own entity off each line (`{% for l in lines %}{% for a in l.attributes %}`): detected by the template reading it, loaded for every line in one query under the same rights and row filter, one level deep. The editor preview does not fill it.
 
+A query column's rows are read with the **printer's** rights: without Select on its source the list prints empty and `print.render` says so in `warnings`, while `print.renderPdf`, `printPdf()` and a subscription are refused with 403 (a PDF that is archived or mailed must not silently miss data). A record with an empty date or narrowing column lists nothing, with a warning. The default form (no template) lists no query column. See column-types.md § Query columns.
+
 A printed set, nested or not, needs **Select** on its entity in the folder, as `data.get` does; one the user cannot read prints empty. `print.render` and `print.renderPdf` check Select on the printed entity.
 
 A currency column prints its glyph for the common codes (`EUR` → `€`, `USD` → `$`, `GBP` → `£`, `UAH` → `₴`, `PLN` → `zł`); other codes print as the code. `format_currency` follows the same mapping.
@@ -94,13 +97,14 @@ A value that changes over time — a price, an employee's position, an organizat
 | A value of the record or of a record it references (the organization's requisites as one block) | An `F` column on the entity: references and built-in functions |
 | A value per line (places, weight through the product's units) | An `F` column on the line entity, printed as `line.<col>` |
 | One total over a set | Over a stored line column (`D`, or a `G` on the line): a `G` column on the document (`SUM([lines].[amount])`). Over a line `F` column: a `plus` accumulator in the loop, `{% assign s = 0 %}{% for l in lines %}{% assign s = s \| plus: l.places %}{% endfor %}`, since a `G` cannot sum an `F` child (install fails with `column old.<field> does not exist`) |
-| Lines grouped by a column, totals per group (by product and series, by VAT rate, a packing list by pallet) | **Not available in the print context yet.** It prints the record and its sets as stored |
+| Lines grouped by a column, totals per group (by product and series, by VAT rate, a packing list by pallet) | A `Q` column with a grouped query on the line entity (`group` on the column, `sum` on the amounts, `@doc` filled from the record), printed as `{% for r in lines_by_product %}` (column-types.md § Query columns) |
+| A register's balance on the document's date, per product | A `Q` column with `register` / `asOf` / `dimensions`, printed as `{% for r in old_stock %}` |
 
-For the last row, do not work around it:
+For grouped rows, use a `Q` column; do not work around it:
 
 - **Not in Liquid filters.** `where`, `sum`, `group_by` and `where_exp` run in the LiquidJS preview, but Scriban (the print) fails with "The function `where` was not found". Filter and total with `{% if %}` and `plus` inside a `for`, which both engines run.
 - **Not a print table filled by an action.** It stores a copy of the document that drifts from it.
-- **Not a stored procedure.** The grouping itself is a grouped query (`references/queries.md`): `group` on the column, `sum` over a line `F` column.
+- **Not a stored procedure.** The grouping itself is a grouped query (`references/queries.md`) held in the `Q` column: `group` on the column, `sum` over the amounts.
 
 ## Custom filters
 
@@ -111,7 +115,7 @@ For the last row, do not work around it:
 | `format_date: <strftime>`                       | `{{ invoice_date | format_date: '%B %d, %Y' }}`        | `"May 22, 2026"`             |
 | `qr_code: <size?>, <ecc?>, <margin?>, <format?>`| `{{ payment_url | qr_code: 200, 'M' }}`                | `data:image/png;base64,…`    |
 
-`format_date` supports strftime: `%Y %m %d %B %b %H %M %S %I %p %A %a %e`. `%B` / `%b` / `%A` / `%a` print **English** names whatever the user's language; for a month in another language keep a small snippet that maps `%m` to the name. `format_date` returns a **string**: arithmetic on its result fails ("Operator - not supported on string"), so compute on the raw value and format last.
+`format_date` supports strftime: `%Y %y %m %d %e %B %b %A %a %H %I %M %S %p` and `%%`. A dash drops the leading zero: `%-m %-d %-H %-I %-M %-S` (`'%-H:%M'` → `9:05`). Text around the specifiers prints as written (`'%d.%m.%Y г.'`). Month and weekday names follow the form's culture (`pageSettings.culture`, else the user's). `%B` beside a day of the month is the genitive (`березня`). `format_date` returns a **string**: compute on the raw value and format last.
 
 **Time zones.** A timestamp in `_fmt` and `format_date` on an instant render in the column's `params.timeZone`, else the request's zone (before platform 2026-10-25, always UTC). A bare date or a timestamp without a zone prints as written.
 
@@ -148,7 +152,7 @@ Snippets run on Scriban (print) and LiquidJS (preview), so write them for both:
 - No `floor` on big numbers: Scriban's goes through a double and rounds them up.
 - No `modulo: 1` on a fraction without snapping the whole part with `round`. LiquidJS 10.30 leaves float noise: `0.44 | modulo: 1` is 0.43999999999999995.
 - Round a fraction half up on its decimal digits, read from the number's text (`append: ''`; the server may print a comma; a browser double under 1e-6 prints as `5e-7`), never by `times` / `plus: 0.5` / `floor`. A double's text is the shortest decimal it stands for, so this matches the server's decimals both on a tie (960.015 → 02) and just below one (1000000000.0049999 → 00). No epsilon can do both.
-- No number taken from `split` / `slice`. A digit is read as `'x0123456789' | split: ch | first | size | minus: 1`.
+- A number taken from `split` / `slice` is a string. `plus`, `minus`, `times`, `divided_by` and `modulo` take a numeric string as its number on both engines: `'5' | plus: 0` is `5`, where before platform 2026-10-30 Scriban printed `50`. A list answers `.first` / `.last` as well as `| first`.
 - Plain `{% comment %}` without trim dashes.
 
 ## Module package layout

package/skills/dforge-mcp-author/references/registers.md

@@ -188,6 +188,7 @@ A register column is a `bool` state column. `A` writes `balance`, `turnover` and
 | `lineDateField` | On a line posting, a line column dating that line's movement instead of `dateField`; an empty one falls back to `dateField`. With `periodEntity` each line's period must be open, judged by the movement's stamped date (line's or document's, after `dateTrunc`); lines skipped by `skipPostingWhenEmpty` don't count. On a `recordChangesOnly` info register, one line per key (several dates on a key are refused). A `date` or zoneless `timestamp`, in `lockedLineFields` (and `groupLinesBy` when grouped), not with `periodDimField`. |
 | `skipPostingWhenEmpty` | Dimensions whose emptiness means "this row posts nothing". The exception, see below. |
 | `lockedFields` / `lockedLineFields` | Columns frozen while posted. `["*"]` freezes the whole row. |
+| `postAction` / `unpostAction` | Params of the binding column (an `A` or `L` column), codes of this entity's actions that post and unpost the document. A direct `data.insert` / `data.update` that turns the state flag on or off needs `E` on the one for its direction, as the button does; actions and DSL `update()` are not re-checked. Each direction is gated on its own: with only one declared, the other direction needs just Insert/Update. A binding with neither gets a pack / validate warning, silenced by `"editorMayPost": true` (not allowed together with an action name). A name no action declared for the entity in `ui/actions.json` carries is refused by `module pack` / validate and by the write. **Unreleased: not in platform 1.28.12.** |
 | `movementMapping` | Journal attribute column to document or line column. |
 
 ### `map` value forms
@@ -255,6 +256,7 @@ execute:
     var price = getSlice("wms-registry.outlet_price", { warehouse_id: [warehouse_id], product_id: [product_id] }, [order_date])
 ```
 
+- A form that lists what a balance register held on the record's date (a revaluation's old stock) needs no action: a `Q` column (`register`, `asOf`, `dimensions`; column-types.md § Query columns) reads it with the reader's rights.
 - A dimension left out is summed over by `getBalance` and `getTurnover`. `getSlice` refuses an omitted dimension.
 - `getSlice` answers one dimension tuple from an action. A value per row — each line's price on its document's date, in a print form, report or view — is the formula `SLICE()` on an `F` column (formulas.md).
 - As-of reads and `getTurnover` need a journal with both stamps.
@@ -264,6 +266,10 @@ execute:
 - **Balance at a document's moment.** The platform keeps no order between movements stamped in the same second, so "the balance just before this document" is the caller's decision: read `before` the end of that second and `exclude` the document itself plus every document of that second the caller orders after it (1C's МоментВремени orders by date, then reference). `exclude` matches the postings each document wrote by its `source` stamp; postings loaded from another system carry no stamp and are kept unless the register declares `importedKeyField` (below).
 - **Reports:** a dataset with `"datasetType": "R"` reads an accounting register over an interval. It returns one row per chart account with `opening_*`, `turnover_*` and `closing_*` debit and credit for one resource. See [`reports.md`](reports.md) and [`docs/business-logic/gl-ledger-to-declared-register.md`](../../../docs/business-logic/gl-ledger-to-declared-register.md).
 
+### Showing a balance on a record: a `Q` column
+
+`getBalance` answers one tuple inside an action. To show a document its register's balance **on its own date**, as a list on the card and in print forms, declare a query column (`columnType: "Q"`, `params`: `register`, `asOf`, `dimensions`) instead of an action that computes it. Install refuses a register that is not `balance` or has no dated journal. It reads with the reader's rights and cannot read the totals cache. See column-types.md § Query columns.
+
 ## Totals cache
 
 `totals` caches the turnover inside each `day`/`month`/`quarter`/`year`, never a closing balance, so a backdated posting touches one row. Declare an `entity` whose PRIMARY KEY is exactly (dimensions, `periodField`), with `inField`/`outField` per resource (`debitField`/`creditField` and an `accountField` on accounting). Posting maintains it; install rebuilds it when its shape changes. Not available on `info`. Details: registers.md section 8.4.
@@ -286,6 +292,8 @@ For a history loaded from another system, an `accounting` register may declare `
 - **One constant for two resources.** Two resources mapped to the same constant read as two resources storing into one column and are refused.
 - **Period missing from the calendar.** With `periodEntity`, a month that has no row in the period entity counts as **closed**, and posting into it fails (`DF003: Period 1999-04 does not exist`). Seed or load the periods before the documents that post into them.
 - **A summed column that isn't a number.** A resource of a `balance`, `turnover` or `accounting` register, and a `totals` cache's columns, must be a scalar number. The editor and language server warn (`registers/column-not-numeric`, metadata 0.0.46) on `varchar`, `integer[]` and the like. An `info` register's resources are returned, not summed, and may be any type.
+- **"May edit" is not "may post".** Without `postAction` / `unpostAction` a role with Insert/Update on the document can post it through the API (`data.update` with the state flag) though it cannot run the Post action. **Unreleased: not in platform 1.28.12**, so do not declare these keys against that platform. Declare both (declaring one leaves the other direction open), and grant `E` on the actions (`"action:post_entry": "E"`) only to the roles that may post. Each name must be declared for that entity in the `ui/actions.json` of the package that owns the column; `module pack` refuses any other, including an action a bridge adds to the host's entity. `E` guards only the direct API path: an action with `E` that calls `update()` on the state flag can still post, so guard that inside its `execute:` (check the role or state and `error()`).
+- **A `Q` column over a register without a stamped journal.** The balance on a date is the state less the later movements, so the journal needs `journalDate` and `journalDirection`; install refuses the column otherwise.
 - **Missing or unlocked `dateField`.** Required once the register has `journalDate` or `period`, and it must be in `lockedFields`.
 - **Key over dimensions.** The journal, a subordinate `info` register's records and an `autoCreate` state table are written by the platform. Each needs **one** surrogate primary key of type `bigint` (`identity`/`cuid`) or `uuid`. A key over dimensions, a multi-column key, a text key and `int4` are refused.
 - **State column narrower than the journal column.** It must hold the journal's value exactly, or unposting cannot take back what posting added.

package/skills/dforge-mcp-author/references/reports.md

@@ -391,7 +391,7 @@ Each entry becomes one attachment row, and the report gains a toolbar entry on t
 | Rule | Detail |
 |---|---|
 | `entityCd` | Qualified `module.entity` for anything outside this module, and that module must be a **declared dependency**. |
-| Source columns | The entity PK, a reference (`R`) column, or a bounded scalar (number, date/datetime, bool, dropdown/radio/flags code). `text`, `json`, `file`/`image` are rejected. |
+| Source columns | The entity PK, a reference (`R`) column, or a bounded scalar (number, date/datetime, bool, dropdown/radio/flags code). `text`, `json`, `file`/`image` are rejected, and so is a set (`S`), formula (`F`) or query (`Q`) column: it holds no value of its own. |
 | Types | Source and target must be compatible; only `lookup`↔`number` and `date`↔`datetime` widen. A names-only match like `{ "customer_id": "created_date" }` is an error, not a runtime surprise. |
 | One per pair | One attachment per (entity, report). Two entries for the same entity overwrite each other. |
 | Unmapped params | Keep their normal behaviour — default value, or prompt the user. |

package/skills/dforge-mcp-author/references/security.md

@@ -81,6 +81,8 @@ Example:
 |---|---|
 | `E` | Execute (run the action/report/stored procedure, access the folder) |
 
+**`E` on an action is not limited by the user's entity rights.** The gate is on running the action, not on the statements inside it: `insert()` / `update()` / `delete()` / `query()` in its script work on an entity where the user has only `S`. Entity rights apply to the grid, the card and the API, not to action scripts (core #1580).
+
 ### Common combinations
 
 | Rights | Meaning |

package/skills/dforge-mcp-author/references/validation-checklist.md

@@ -122,14 +122,12 @@ For each action:
 - [ ] DSL file exists at `logic/actions/<script>.dsl`, where `<script>` is the bare filename in the action's `script` field (no path, no `.dsl` extension)
 - [ ] DSL file has `params:`, `canExecute:`, and `execute:` blocks
 - [ ] `canExecute:` is a valid formula expression
-- [ ] If `canExecute:` is meant to **gate** and not just grey out a button, its
-      guard is expressed in the server-enforced subset — **comparisons** between
-      fields and literals, combined with `AND` / `OR` / `NOT`. Function calls
-      (`TODAY()`, `COUNT()`, `CURRENT_USER_ID()`), arithmetic, ref navigation and
-      `$[setting]` reads are fail-open server-side and are advisory only
-- [ ] No **bare boolean field** as a whole condition — `[is_active]` and
-      `NOT [is_blocked]` are not enforced (a field is only an operand). Write
-      `[is_active] = true` / `NOT ([is_blocked] = true)`
+- [ ] `canExecute:` uses only constructs the server can evaluate — fields,
+      literals, comparisons, arithmetic, `IN`, formula functions, a bare boolean
+      field. `$[setting]` reads, `SUM` / `COUNT` / `AVG` and unknown function
+      names are **refused at install**. `[ref].[col]` works on the
+      server but the client throws and **enables** the button: denormalise it
+      into a column, and count with a `G` column
 - [ ] Anything that MUST hold is also checked in `execute:` with `error()` — a
       `canExecute` alone is never the authoritative guard
 - [ ] `execute:` uses only documented built-in functions