Scripts / computed fields

  - Empty sources break the client-side evaluator. Opening an empty scripted table fails the whole load (Invalid
    decimal ''), and on a new entry the computed field shows "Computed value unavailable" until the source is filled.
    Design question: should empty be treated as "not ready — don't evaluate yet" instead of an error? And should the
    client evaluate at all, or let the server compute on save?

  - Text-column scripts are broken server-side (post_table_data.rs): the script check parse_decimal_exacts both values
    regardless of column type, so even a matching text value fails. The web UI happily lets you create a script on a
    text column. Design question: make the comparison type-aware, or forbid scripts on non-numeric columns at
    creation?

  - The "Computed values changed; review and save again" loop. When the client's computed value differs from the
    server's, save loops forever with 0 rows persisted. The permission cause is fixed, but the loop still exists
    whenever client and server disagree (rounding, currency, multi-step scripts). Design question: should the client
    just adopt the server's computed value instead of requiring a manual confirm?

  Authorization / security

  - Logout doesn't revoke the JWT. A logged-out token still works for 24 h. The client also has no logout UI at all
    (the function exists but is dead code), and there's a user_sessions table that nothing seems to use. Design
    question: server-side session revocation (deny list or the sessions table) vs. short-lived access tokens + refresh
    tokens.

  - HydrateScriptDependencies can leak cross-table values (mentioned last turn): access is checked on the requested
    table, not on the tables a script reads. A role with access to A but not B could pull B's rows through A's script.
    Design question: authorize each dependency table, or scope scripts so they can only read tables the caller can
    read?

  - Import validation errors come back as HTTP 502. User-data failures ("value is required", bad decimal) are client
    errors masquerading as server outages. Design question: map gRPC status → HTTP status (InvalidArgument/
    FailedPrecondition → 4xx, internal → 502).

  Data safety / integrity

  - Posted tables can never be deleted. "Deleting tables is not allowed after data has been posted"; journal FKs are
    NO ACTION so even raw SQL fails. A mistaken table is permanent. Design question: is that intended protection, or
    should there be an archive-then-delete flow (the "Archive first / Update anyway" guard already exists for rows)?

  - SetColumnPresentation trusts id/alias pairings. A hand-crafted POST with swapped aliases silently renames columns
    across each other — export, catalog, and validation all follow the wrong names. Design question: reject any alias
    that is currently another column's name in the same request.

  UX / correctness

  - Save errors surface inconsistently. Ctrl+S shows a full-chain dialog; Home (save_and_next_entry) only sets the
    status bar with the top context. And the save-failed dialog itself truncates long messages, cutting off the actual
    reason. Design question: always show the full chain in a wrapping dialog.

  - "Referenced data is in use" is worded as a failure. It's a guard offering Archive/Update/Cancel, but the dialog
    says the update "failed" with a FailedPrecondition code. Design question: reword as a choice, not an error.

  - Link fields display :id but accept bare ids. Typing what you see (:2) fails validation. Minor, but confusing.
  - Client caches table structure/validation and never refreshes on save — server-side changes don't reach an open
    client until the table is reopened. table_definitions has a row_revision column, so a revision check is feasible.
    Design question: refresh-on-revision-change vs. "reopen to reload".

  - Analytics leaks a DataFusion planner error on SELECT count(*) (zero-column projection). Internals in the UI; a
    special-case fix.

  - New-profile form offers USD but the server rejects it (EUR-only books). Restrict the option or support it.

  Environment / tooling

  - Your client config blocks startup: form_navigation.toml has row = "first_editable", which the current binary
    rejects. The default template in the source writes first_editable, so either the source template and the enum
    drifted, or the file came from a different build. Worth a quick look — a fresh user could hit this.