Complete name-first 1C adapter saved-state support

docs/runbooks/adapter-1c-mcp.md

@@ -126,7 +126,10 @@ REST and MCP selector-chain smoke tests. The selector-chain smoke also checks,
 when a routine name is available from module metadata, that
 `metadata.resolve_overrides` returns `write_plan_evidence.next_resolution` for
 `metadata.saved_state.modules.search` with the same `base_id` and routine query,
-then follows that resolver. If a saved-state stream exposes `write_plan_target`,
+plus a public object `ref`/`kind`/`name` and semantic
+`layer=base_saved_state|extension_saved_state`; public follow-ups never require
+`ConfigSave`, `ConfigCASSave`, or `owner_guid`. The smoke then follows that
+resolver. If a saved-state stream exposes `write_plan_target`,
 the smoke composes it with `write_plan_evidence.target` and checks the resulting
 read-only `metadata.write.plan`; when the test base has no saved-state stream,
 that last composition step records `skipped_no_saved_state_target`.
@@ -506,6 +509,23 @@ roles/users can read or write this metadata object". Do not depend on
 `metadata.objects.list kind=Role`: some live bases do not expose roles as regular
 metadata objects through that route.
 
+For BSP data-access keys, keep the metadata object and concrete data record
+separate:
+
+```json
+{
+  "base_id": "upo_test",
+  "kind": "object",
+  "object_ref": "Справочники.Номенклатура",
+  "record_ref": "00112233445566778899AABBCCDDEEFF"
+}
+```
+
+Here `kind=object` is the `access_keys_query` area, not the metadata kind.
+`object_ref` is resolved to the internal BSP SQL number and `record_ref` to the
+record id. The same public pair works with `access_object_keys_resolve` and
+`access_object_explain`; do not invent `object_sql_number` in MCP code.
+
 For BSP role-right checks, `action=write` means add or modify rights. Read-only
 roles must not be returned for `write`; query `action=read` separately when you
 need visibility roles. Returned permissions keep `source_fields` from
@@ -634,6 +654,26 @@ Agent rules:
   `metadata.form.command_button.write` for the complete form command + visible
   button + handler workflow. `code.write` remains a compatibility shortcut for
   simple module edits.
+- For a metadata object's standard `synonym` or `comment`, call generic
+  `onec_request` with `method=metadata.object.property.write`, a public
+  `ref`/`kind` + `name`, and `allow_saved_state_write=true`. Prefer
+  `execution_mode=plan` first. The adapter resolves GUIDs and serialized paths;
+  MCP callers must not pass SQL tables or file names. Object rename and adding
+  a new synonym locale are intentionally unsupported.
+- For an existing requisite, tabular section, dimension, or resource, add a
+  public `member_ref` such as
+  `Catalog.Номенклатура.Attribute.Артикул`. When only
+  `member_kind` + `member_name` is used and several identities match, preserve
+  the adapter's `ambiguous` result and retry with the full member path.
+- To add a requisite, call `metadata.object.member.add` through `onec_request`
+  with a full `template_member_ref` from the same object and the new public
+  name/synonym. Never invent a GUID, Config table, collection path, or type
+  descriptor in MCP code; the new requisite inherits type/settings from the
+  named template.
+- The same method adds a tabular-section column when
+  `template_member_ref` contains the full
+  `...TabularSection.<name>.Attribute.<column>` path. Keep the complete path so
+  duplicate checks and generated identity remain scoped to that table part.
 - For unresolved module owners, inspect `diagnostics.owner_resolution` and
   `counts.owner_scan_limit_hit`; narrow by `kind`/`name`/`guid` or increase
   `owner_scan_limit` before falling back to broader searches.