@shundoo-ai/dsh-cosmic 1.0.21 → 1.0.22

package/skills/cosmic-build/scripts/test/test_report_query_data_source.py

@@ -196,10 +196,12 @@ class WritePayloadTest(unittest.TestCase):
                                  "data": {"formmeta": {"Items": [{"_Type_": "BillFormAp"}]}}},
         })
         with mock.patch.object(report_ops, "_api_call", call):
-            with self.assertRaises(ValueError) as raised:
+            with self.assertRaises(report_ops.ReportMutationError) as raised:
                 report_ops.set_report_query_data_source(
                     {}, "t", "kdtest_720_test_bill", data_source_number="test818")
         self.assertIn("REPORT_QUERY_DATA_SOURCE_READBACK_UNAVAILABLE", str(raised.exception))
+        self.assertTrue(raised.exception.mutation_applied)
+        self.assertEqual(sum(endpoint == "setComplexProperty" for endpoint, _payload in _calls), 1)
 
     def test_dry_run_reaches_the_platform_only_to_resolve(self) -> None:
         call, calls = _api({"queryForms": {"status": True, "errorCode": "0",

package/skills/cosmic-build/scripts/test/test_report_sdk_optimization.py

@@ -11,11 +11,10 @@ HOME = os.environ.get("COSMIC_SDK_JAVA_HOME", "")
 
 
 @pytest.mark.skipif(not CLASSPATH or not HOME, reason="target SDK and Java 8 home unavailable")
-def test_native_typed_fields_and_aggregation_use_actual_sdk(tmp_path):
+def test_aggregation_uses_actual_sdk(tmp_path):
     javac = Path(HOME) / "bin" / ("javac.exe" if os.name == "nt" else "javac")
     java = Path(HOME) / "bin" / ("java.exe" if os.name == "nt" else "java")
     subprocess.run([str(javac), "-source", "8", "-target", "8", "-cp", CLASSPATH, "-d", str(tmp_path),
-        str(ROOT / "assets/platform-report-filters/TypedReportFilterFields.java"),
         str(ROOT / "examples/java-rules/CosmicReportAggregation.java"),
         str(ROOT / "scripts/test/fixtures/ReportSdkCheck.java")], check=True, capture_output=True, text=True, timeout=60)
     result = subprocess.run([str(java), "-DclusterName=report-sdk-check", "-Dlogfactory.className=ReportSdkCheck$TestLogFactory",

package/skills/cosmic-build/scripts/test/test_test_environment.py

@@ -5,7 +5,7 @@ from pathlib import Path
 import pytest
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-from test_environment import export_test_environment
+from test_environment import export_test_environment, plugin_runtime_context
 
 
 def test_export_preserves_target_and_excludes_credentials(tmp_path):
@@ -43,3 +43,78 @@ def test_export_rejects_changed_environment_or_credential_url(tmp_path, server):
     with pytest.raises(ValueError):
         export_test_environment(tmp_path, server, ["form_a"])
     assert not (tmp_path / "_runtime" / "test-environment.json").exists()
+
+
+def test_plugin_runtime_reuses_exact_archived_list_without_discovery(tmp_path):
+    runtime = tmp_path / "_runtime"
+    runtime.mkdir()
+    (runtime / "context.json").write_text(json.dumps({"environment": {"baseUrl": "http://127.0.0.1:8080/ierp"}}))
+    url = "http://127.0.0.1:8080/ierp/?formId=bos_list&type=list&billFormId=booking&aiv=observed"
+    (tmp_path / "archive.json").write_text(json.dumps({"artifacts": [{"formNumber": "booking", "listUrl": url}]}))
+    before = (tmp_path / "archive.json").read_bytes()
+    result = plugin_runtime_context(tmp_path, "booking")
+    assert result["listUrl"] == url
+    assert result["status"] == "entry-available" and result["runtimeVerified"] is False
+    assert "previewUrl" not in result
+    assert (tmp_path / "archive.json").read_bytes() == before
+    assert "listUrl" not in plugin_runtime_context(tmp_path, "other")
+
+
+@pytest.mark.parametrize("url", [
+    "http://other.invalid/ierp/?formId=bos_list&billFormId=booking",
+    "http://127.0.0.1:8080/ierp/?formId=bos_list&billFormId=other",
+    "http://user:secret@127.0.0.1:8080/ierp/?formId=bos_list&billFormId=booking",
+    "http://127.0.0.1:8080/ierp/?formId=bos_list&billFormId=booking&token=secret",
+])
+def test_plugin_runtime_rejects_wrong_targets_and_credential_links(tmp_path, url):
+    (tmp_path / "_runtime").mkdir()
+    (tmp_path / "_runtime/context.json").write_text(json.dumps({"environment": {"baseUrl": "http://127.0.0.1:8080/ierp"}}))
+    (tmp_path / "archive.json").write_text(json.dumps({"artifacts": [{"formNumber": "booking", "listUrl": url}]}))
+    result = plugin_runtime_context(tmp_path, "booking")
+    assert "listUrl" not in result
+    assert result["discovery"]["platformOperation"] == "getPreviewUrl"
+    assert "secret" not in json.dumps(result)
+
+
+def test_plugin_runtime_does_not_use_previous_account_or_another_application(tmp_path):
+    (tmp_path / "_runtime").mkdir()
+    (tmp_path / "_runtime/context.json").write_text(json.dumps({"environment": {"baseUrl": "http://127.0.0.1:8080/ierp", "accountId": "new"}}))
+    export = {"schemaVersion": "cosmic-test-environment/v1", "baseUrl": "http://127.0.0.1:8080/ierp", "accountId": "old",
+              "application": {"appRoot": str(tmp_path)}, "forms": [{"formNumber": "booking"}]}
+    (tmp_path / "_runtime/test-environment.json").write_text(json.dumps(export))
+    assert plugin_runtime_context(tmp_path, "booking")["status"] == "target-mismatch"
+    export["accountId"] = "new"
+    export["application"]["appRoot"] = str(tmp_path / "other")
+    (tmp_path / "_runtime/test-environment.json").write_text(json.dumps(export))
+    assert plugin_runtime_context(tmp_path, "booking")["status"] == "target-mismatch"
+
+
+def test_resolve_entry_checks_active_environment_before_platform_lookup(tmp_path, monkeypatch):
+    import kd_env_loader
+    import preview_url
+    (tmp_path / "_runtime").mkdir()
+    (tmp_path / "_runtime/context.json").write_text(json.dumps({"environment": {"baseUrl": "http://127.0.0.1:8080/ierp"}}))
+    monkeypatch.setattr(kd_env_loader, "load_effective_skill_config", lambda: {"server": {"baseUrl": "http://other.invalid/ierp"}})
+    def unexpected(*args, **kwargs):
+        raise AssertionError("must not contact a different platform")
+    monkeypatch.setattr(preview_url, "get_preview_url", unexpected)
+    assert plugin_runtime_context(tmp_path, "booking", resolve_entry=True)["status"] == "target-mismatch"
+
+
+def test_resolve_entry_reuses_the_existing_platform_preview_resolver(tmp_path, monkeypatch):
+    import kd_env_loader
+    import preview_url
+    (tmp_path / "_runtime").mkdir()
+    base = "http://127.0.0.1:8080/ierp"
+    (tmp_path / "_runtime/context.json").write_text(json.dumps({"environment": {"baseUrl": base}}))
+    monkeypatch.setattr(kd_env_loader, "load_effective_skill_config", lambda: {"server": {"baseUrl": base}})
+    requests = []
+    def response(server, path, config, params):
+        requests.append((path, params))
+        url = base + "/?formId=booking" if "viewType" not in params else base + "/?formId=bos_list&type=list&billFormId=booking"
+        return {"status": True, "data": url}
+    monkeypatch.setattr(preview_url.kd_api, "get", response)
+    result = plugin_runtime_context(tmp_path, "booking", resolve_entry=True)
+    assert result["status"] == "entry-available" and "billFormId=booking" in result["listUrl"]
+    assert [params for _, params in requests] == [{"formNumber": "booking"}, {"formNumber": "booking", "viewType": "list"}]
+    assert all(path == preview_url.PREVIEW_URL_PATH for path, _ in requests)

package/skills/cosmic-build/scripts/test_environment.py

@@ -2,7 +2,7 @@
 
 import json
 from pathlib import Path
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import parse_qs, urlsplit, urlunsplit
 
 
 def environment_identity(server):
@@ -15,6 +15,72 @@ def environment_identity(server):
     }
 
 
+def plugin_runtime_context(app_root, form_number, *, resolve_entry=False):
+    """Return observed entry links for one bound form, without logging in or inventing routes."""
+    root = Path(app_root).resolve()
+    result = {"formNumber": form_number, "status": "discovery-required", "runtimeVerified": False,
+              "discovery": {"operation": "runtime-context", "resolveEntry": True, "platformOperation": "getPreviewUrl", "formNumber": form_number,
+                            "appRoot": str(root)},
+              "nextAction": "Use the saved entry for the required view; otherwise repeat runtime-context with --resolve-entry for a read-only platform lookup. Do not guess routes. Login requires user-provided identity or an existing authorized session."}
+    context = root / "_runtime" / "context.json"
+    bound = json.loads(context.read_text(encoding="utf-8-sig")) if context.is_file() else {}
+    saved = root / "_runtime" / "test-environment.json"
+    environment = json.loads(saved.read_text(encoding="utf-8-sig")) if saved.is_file() else {}
+    owner = environment.get("application", {}).get("appRoot")
+    if environment and (environment.get("schemaVersion") != "cosmic-test-environment/v1"
+                        or not owner or Path(owner).resolve() != root):
+        return {**result, "status": "target-mismatch"}
+    identity = environment_identity(environment) if environment else None
+    current = environment_identity(bound["environment"]) if bound.get("environment") else identity
+    if not current:
+        return result
+    if identity and any(identity.get(key) and identity[key] != current.get(key) for key in ("baseUrl", "accountId")):
+        return {**result, "status": "target-mismatch"}
+    result.update(current)
+    candidates = [(saved, form) for form in environment.get("forms", [])
+                  if isinstance(form, dict) and form.get("formNumber") == form_number]
+    archive = root / "archive.json"
+    if archive.is_file():
+        data = json.loads(archive.read_text(encoding="utf-8-sig"))
+        if bound.get("appCode") and data.get("appCode") and bound["appCode"] != data["appCode"]:
+            return {**result, "status": "target-mismatch"}
+        candidates += [(archive, form) for form in data.get("artifacts", [])
+                       if isinstance(form, dict) and form.get("formNumber") == form_number]
+    if resolve_entry:
+        from kd_env_loader import load_effective_skill_config
+        from preview_url import get_preview_url
+        config = load_effective_skill_config()
+        server = config.get("server", config)
+        selected = environment_identity(server)
+        if any(current.get(key) and current[key] != selected.get(key) for key in ("baseUrl", "accountId")):
+            return {**result, "status": "target-mismatch"}
+        editor = get_preview_url(server, current["baseUrl"], form_number)
+        listing = get_preview_url(server, current["baseUrl"], form_number, view_type="list", form_preview_url=editor)
+        candidates = [("platform:getPreviewUrl", {"previewUrl": editor, "listUrl": listing}), *candidates]
+    base = urlsplit(current["baseUrl"])
+    for source, form in candidates:
+        for key in ("previewUrl", "listUrl"):
+            if key in result or not isinstance(form.get(key), str):
+                continue
+            url = urlsplit(form[key])
+            query = parse_qs(url.query)
+            if (url.scheme, url.hostname, url.port) != (base.scheme, base.hostname, base.port):
+                continue
+            if url.username or url.password or url.fragment or any(
+                    re_key in name.lower() for name in query for re_key in ("token", "password", "secret", "cookie", "authorization")):
+                continue
+            if url.path.rstrip("/") != base.path.rstrip("/"):
+                continue
+            if key == "listUrl" and (query.get("formId") != ["bos_list"] or query.get("billFormId") != [form_number]):
+                continue
+            if key == "previewUrl" and query.get("formId") != [form_number]:
+                continue
+            result[key] = form[key]
+            result.setdefault("sources", {})[key] = str(source)
+    if result.get("previewUrl") or result.get("listUrl"):
+        result["status"] = "entry-available"
+    return result
+
 def export_test_environment(app_root, server, form_numbers, form_ids=None, form_links=None):
     root = Path(app_root).resolve()
     context_path = root / "_runtime" / "context.json"

package/skills/cosmic-build/skills/cosmic-coding-impl/SKILL.md

@@ -1,13 +1,24 @@
 # Cosmic Java 编码实现
 
-针对用户已绑定的表单实现或修改 Java。未提供当前 handoff 时，按
-[plugin-handoff-input.md](../../references/plugin-handoff-input.md) 准备。优先读取准备好的 `coding-start`
-文件；否则从准确 handoff 查询 `coding-start`，缺失事实
-通过准确 pointer 查询，不重复准备。
-`{ROOT_DIR}` 是根技能的技能包目录。完整字段归属和运行时集合路径以 `formGraph` /
-`relatedForms` 为准，可选 `fields` 别名不是完整字段清单。使用已准备的项目、包与源码路径，
-不搜索兄弟项目或旧插件测试来重新推导。必需元数据缺失时，通过该目标的原生读取契约补齐；
-结构不完整不能猜测。无需额外规划文档或编码 Agent。
+根据用户需求、所选应用/表单和 Java 工程实现或修改源码。前置数据由本技能独立获取，
+不要求调用方准备 handoff、建模产物、写入回执或字段映射，也不消费上游编码快照。
+`{ROOT_DIR}` 是根技能的技能包目录。
+
+在查找工程、目录、配置或源码之前，若用户在本任务中尚未指定 Java 插件源码目录，立即通过 `question`（AskUserQuestion） 询问并等待答复。复用用户已明确给出的目录或已有源码文件；不要根据工作区、appconfig、历史工程或命名约定推断用户选择。与目录无关的元数据工作可继续。
+用户选择 `src/main/java` 根或其下包目录时，将其绝对路径放入 `intent.sourceDirectory`，编码命令直接写入该目录并从路径确定模块根；修改现有文件时使用 `ownershipMode: "modify"` 和准确 `sourcePath`。所选目录不在 Java 模块内时，询问模块根，不自行搜索。
+
+写源码前，按[运行时路由](../../references/plugin-runtime-routing.md)确定业务触发类型，
+由本技能按[编码上下文输入](../../references/plugin-handoff-input.md)读取当前目标的在线元数据及目标 SDK。
+准备脚本保存的上下文只是本轮编码的本地证据，不是上游交接或元数据阶段的前置条件；
+脚本的历史文件名不改变责任归属。传入所选 appRoot、准确表单编码、业务意图和 Java 工程，
+不传建模产物，不复用之前的 handoff。直接执行返回的 `codingStartCommand`，读取一次本轮 `coding-start`，仅沿准确 pointer 补查缺失事实。
+不依赖平台元数据的已有源码修改使用文档中的 source-only 分支。
+
+涉及持久化数据时，完整字段归属和集合路径以当前 `formGraph` / `relatedForms` 为准，
+可选 `fields` 别名不是完整清单。使用解析出的工程、包与源码路径。缺失事实通过目标原生契约读取，
+不能猜测，也不搜索兄弟项目或旧测试重新推导。无需额外规划文档或编码 Agent。
+
+目标字段、必需接收者签名和业务范围明确后就写源码，不把准备扩展为设计阶段，也不为确认已知事实重复查证或浏览邻近实现。同一表单同类型需要多个独立类时，在准备前明确各自 `className`；默认名只标识一个类，不表示平台限制一个类。只有本来属于同一类的行为才合并意图。
 
 ## 使用已提供的证据
 
@@ -15,6 +26,16 @@
 契约。其中的准确签名、导入和弃用提示已经是 API 证据，不要求为满足“本轮已读”而重复打开
 页面。`coreLogic` 中的业务事件名不是 SDK 签名。
 
+只读取缺失或适用的知识。先用类型指南中本次事件和直接相关场景；未覆盖时查
+`knowledge/cosmic/platform/scenes/_index.md`，结合事件、控件和行为查找相关场景。
+类型标签用于缩小候选，不覆盖场景已验证的适用范围。读取 `codingEvidence.scenes` 中
+已选场景，按实际需要补核心 view/model 或 SDK 指南，再查准确 API 或绑定 SDK。
+对实际存在的幂等、大数据或安全风险使用已提供的 `specialized.hitModules` 和约束；
+未提供命中时，根据行为读取 `references/type-registry.json` 中 `specializedStandards`
+对应标准，不为记录命中重复准备。已有命中读取 `codingEvidence.specializedReferences`。
+用户可见文本还需阅读
+`standards.md` 的多语言章节。
+
 只读取缺失或适用的知识：
 
 - 已有证据不能确定事件位置、必需 `super` 调用或异常行为时，读所选指南的相关生命周期/场景。
@@ -53,12 +74,16 @@ modify 先完整读取现有文件，以它为起点。在已有触发方法内
 方法清单，不是要求重新声明。保留无关代码、包、类与导入。create 使用所选类型的基类及生命
 周期契约，写入返回的 `sourcePath`。
 
-写入前复用准备阶段的 `sourceGate.state="coding"`；只有缺少该状态时才执行：
+写入前仅在会话绑定一致或未绑定时，复用 `coding-start` 实读的 `sourceGate.state="coding"`；
+新子会话只为获派的类重新绑定一次，门禁标记不代表源码已编译。
+`sourceGate.requestedState` 本身不代表成功。未提供实读状态时，只读取一次门禁：
 
 ```text
-{python} "{ROOT_DIR}/scripts/plugin_source_gate.py" --project-root "{projectRoot}" --class-name "{className}" --write coding
+{python} "{ROOT_DIR}/scripts/plugin_source_gate.py" --project-root "{projectRoot}" --class-name "{className}" --read
 ```
 
+确实需要开放源码编辑时，同一命令改用 `--write coding` 并确认返回成功，不为开门禁重复准备 handoff。
+
 - 使用已验证的 `fields` / `entities` 键，以及 `fieldContracts` 中的准确访问器和值类型。
   引用字段的记录不是 ID，比较时使用其 `idAccessor` 或 `filterValue`。
   目标 8.0 SDK 的 `TimeProp` 是距午夜的整秒数，使用返回的 `getInt` 访问器，
@@ -66,6 +91,12 @@ modify 先完整读取现有文件，以它为起点。在已有触发方法内
   [CosmicTimeAdapter.java](../../../../examples/java-rules/CosmicTimeAdapter.java)
   示例演示先拒绝异常值，再转换为普通 Java 时间。
 - 准确复制基类导入和重写签名，包括大小写与参数类型。按接收者证据核对平台调用，不靠近似名称猜 API。
+  核对准确重载的方法名、参数数量/类型及各参数的业务角色。
+  `OperationServiceHelper.executeOperate` 顺序是 `(operationKey, entityNumber, ids/dataEntities, option)`；
+  前两个参数都是 `String`，编译不能发现角色颠倒。已收录重载需要 `OperateOption`，
+  不能借用 `DeleteServiceHelper` 的三参数重载。删除时传已验证的主键，先检查
+  `OperationResult.isSuccess()`，成功后才清空关联引用或保存依赖变更；失败按生命周期异常契约上抛。
+  仅方法名相同或 `compile=false` 不能证明调用合法。
 - `QFilter` 使用操作符表推荐的辅助方法，否则使用对应 `QCP` 常量，不能用字符串操作符。
   仅在所需操作符尚无证据时读取该表。
 - 实现 `coreLogic`、已提供的 `reportContract` 和 `specialized.constraints`。
@@ -85,6 +116,13 @@ modify 先完整读取现有文件，以它为起点。在已有触发方法内
   测试时检查实际生产规则，不要为了脱离平台运行而把规则复制到测试专用类。
   返回真实命令与结果，未执行时如实标记未运行。本地规则测试不能证明平台事件绑定或运行态业务覆盖。
 - 按所选生命周期处理空值、异常和 `super`。标识符用英文，注释和用户可见文本跟随回复语言。
+- 从第一版源码遵循 [DCS 部署规则](../../references/dcs-code-rules.md)：编译和运行成功仍可能被部署门禁拒绝。
+  常见违规包括静态集合字段（即使 `final`）、`ORM` / `DB`、循环内日志/保存/`updateView`、
+  无有效过滤条件的查询、使用三次却未提取常量的字段键、未使用导入和空方法。规则目录取原表全部规则
+  与新表高危/严重规则的并集，共 1582 个编号。规则指定的 `BusinessDataServiceHelper` /
+  `QueryServiceHelper` 方法即使在单层循环内也阻断；不绕过 TLS 证书/主机名验证，不使用可预测的
+  `SecureRandom` 种子，使用 `try-with-resources`。目录登记不等于完整自动检测；核实建议项，
+  全构建、TypeScript、KSC 和元数据规则交给对应引擎检查。
 
 检查修改源码中的重复签名、导入/可见性、字段访问、空值和集合边界、吞异常及已提供约束，
 在任务范围内修复。
@@ -96,9 +134,13 @@ modify 先完整读取现有文件，以它为起点。在已有触发方法内
 ## 编译并继续交付
 
 按 [compile-guide.md](../../references/compile-guide.md) 执行原生编译/归档边界。
+需要工程测试时使用准备结果的 `testCommand` 和该指南的目标测试入口；
+实际测试数量与断言失败独立于编译结果。
 该命令同时推进源码门禁，不单独写归档或标记 `source_ready`。
 实施者随后继续 [java-plugin-delivery.md](../../references/java-plugin-delivery.md) 完成注册与交付；
 达到 `source_ready` 不代表用户整体请求结束。
 
 报告原生结果中的真实源码身份、编译/归档结果、`compileSkipped` 和未验证项。
 源码及编译/归档写入保持在已验证项目和应用路径内。
+
+操作插件读取分录时，在字段准备中声明实际读取的子字段；仅声明集合不足以保证列表批量操作加载子字段。逐单将错误挂在对应的 `ExtendedDataEntity`，保留混合批量中合格单据的执行。时间值 0 是零点；先识别原始空值，再判断业务时段。

package/skills/cosmic-build/skills/cosmic-meta-api/apis/ai_meta.md

@@ -21,7 +21,7 @@
 | 查询属性 Schema | POST | `/ai-meta/property/getPropertySchema` | 查询元素可设置属性的 Schema 信息 |
 | 读取属性当前值 | POST | `/ai-meta/property/getProperties` | 读取元素属性当前值 |
 | 批量设置简单属性 | POST | `/ai-meta/property/setProperties` | 批量设置简单属性（text/checkbox/combo 等） |
-| 设置复杂属性 | POST | `/ai-meta/property/setComplexProperty` | 设置复杂属性（统一入口，28 种 complexType，由 ComplexPropertyRouter 路由） |
+| 设置复杂属性 | POST | `/ai-meta/property/setComplexProperty` | 设置复杂属性（统一入口，由 ComplexPropertyRouter 路由；支持分支取决于后端版本） |
 | 查询参数表单列表 | POST | `/ai-meta/property/listParameterForms` | 查询可选的参数表单列表 |
 | 搜索基础资料 | POST | `/ai-meta/basedata/search` | 按关键词搜索可用的基础资料 |
 | 获取基础资料实体 ID | POST | `/ai-meta/basedata/getEntityId` | 根据表单编码获取基础资料实体 ID |
@@ -836,7 +836,7 @@ Content-Type: application/json
 | `columnName` | String | 否 | DB 列名（省略则自动生成） |
 | `basedataNumber` | String | BasedataField 必填 | 基础资料编码，如 `"bd_supplier"`、`"bd_customer"` |
 
-> ⚠️ **`mustInput` 禁止放在 add `value` 中（无论 true 还是 false）。** 若需设必填，在 add 之后追加独立的 `update` op（`path:"mustInput"`,`value:true`）。
+> 已检查的 API 中，`FieldOperationHandler.applyAddField` 接受 Boolean 类型的 `value.mustInput`。初始必录直接声明并回读，不能发送字符串 `"true"`。旧部署若拒绝该参数，先独立完成并验证创建，再用带回读的 `setProperties` 写入 `MustInput`；不要追加不可靠的属性 modify 或重建字段。报表过滤还需在 `verifyQuery()` 和 `query()` 取数前校验必录，字段标志保存成功不代表查询校验已经实现。
 
 ### 响应
 
@@ -1229,7 +1229,7 @@ python cosmic_api.py setProperties --formNumber sal_order --elementKey amount --
 
 ### 8.5 设置复杂属性（统一入口）
 
-设置 `btnedit` 类型的复杂属性。通过 `complexType` 参数路由到 `ComplexPropertyRouter` 对应的处理方法，支持 28 种复杂属性类型。
+设置 `btnedit` 类型的复杂属性。通过 `complexType` 参数路由到 `ComplexPropertyRouter` 对应的处理方法，支持的分支取决于实际部署的后端版本。
 
 #### 请求
 
@@ -1296,6 +1296,19 @@ Content-Type: application/json
 | `instantSync` | 数据实时同步 | Map | `{columns:[{fieldkey:string, canUpdate:bool}]}` —— 平台存成 JSON 字符串且 columns 是对象；`action`（行事件）只读。优先用 `setInstantSync` |
 | `dropdownItems` | 下拉菜单 | List | 下拉菜单项列表 |
 
+**报表叶子列删除（不传 elementKey；需要后端补丁）：**
+
+| complexType | 说明 | data 类型 | data 结构 |
+|-------------|------|----------|----------|
+| `ReportColumns.remove` | 删除一个精确叶子列；拒绝分组列 | Map | `{fieldKey:string}` |
+
+使用已发布 `removeReportColumn` 命令，传入当前应用目录与精确报表编码。
+处理器删除列控件、关联孤立字段和对应默认排序，重排同级列后保存。
+PropertyResult 的 data 包含 fieldKey、fieldId 和 action removed；保存失败不能证明没有修改。
+旧 Router 可能在 HTTP 端点已经存在时仍返回不支持类型，并被 META_SAVE_FAIL 包装。
+CLI 返回 REPORT_COLUMN_DELETE_API_UNAVAILABLE 并停止，不隐藏、不重建、不重放；业务、
+权限、保存和瞬时错误不属于这个能力判定。
+
 #### 请求示例 1：设置权限控制（主实体级，不传 elementKey）
 
 ```json

package/skills/cosmic-build/skills/cosmic-meta-api/contracts/cli/report-write-contracts.json

@@ -10,7 +10,7 @@
   "commands": {
     "setReportColumns": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/columns",
-      "writeSemantics": "create-time only; ReportColumns replaces the column set but appends report-entity fields instead of replacing them, so a second call duplicates every field key and bricks the form. Refused with REPORT_COLUMNS_NOT_REPLACEABLE, whose message names addReportColumns for an addition and planReportRecreate for a removal or re-type, and states that adding the column in the designer is not the way around it.",
+      "writeSemantics": "create-time only; ReportColumns replaces the column set but appends report-entity fields instead of replacing them, so a second call duplicates every field key and bricks the form. Refused with REPORT_COLUMNS_NOT_REPLACEABLE, whose message names addReportColumns for an addition, removeReportColumn for a single leaf removal on a patched backend, and planReportRecreate for reorder or re-type, and states that adding the column in the designer is not the way around it.",
       "readBack": "getReportSchema.reportColumns matches the requested column tree"
     },
     "addReportColumns": {
@@ -20,17 +20,30 @@
       "response": "plannedAppendFieldKeys and preexistingFieldKeys classify the recursive request from the pre-write projection; they are planning facts, not a platform receipt.",
       "preWriteGuard": "REPORT_ENTITY_FIELDS_DUPLICATED still applies: appending cannot repair a report whose entity already carries duplicate field keys. A column-key collision is deliberately NOT refused — the platform skips it, and refusing it would break idempotence."
     },
+    "removeReportColumn": {
+      "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/columnRemoval",
+      "writeSemantics": "Delete one exact leaf (nested leaves included) through POST ai-meta/property/setComplexProperty, complexType ReportColumns.remove, data {fieldKey}. The backend removes the control, removes associated orphan entity fields while preserving fields referenced by remaining controls, renumbers siblings and removes default sorts for that fieldKey, then saves. No standalone delete endpoint, full replacement, hide or recreate fallback.",
+      "preWriteGuard": "CLI and serve require appRoot plus exact formNumber, prove owned ReportFormModel and optional formId, and require readable unique column structure. Groups and absent/ambiguous keys fail before deletion. A known presentation.currencyField / measureUnitField dependent blocks deletion with REPORT_COLUMN_IN_USE. The duplicate entity guard remains; this command is not a corrupted-entity repair.",
+      "compatibility": "Backend and client releases are independent. Explicit unsupported complex-property-type replies (including inner PropertyResult under META_SAVE_FAIL), or a missing HTTP route, return status=false with REPORT_COLUMN_DELETE_API_UNAVAILABLE and capabilityAvailable=false. Preserve the local baseline and stop; wait for the backend patch. Do not treat PARAM_INVALID, missing elements, permission denial, save rejection or transient/unknown transport errors as unavailable. No version guessing, capability cache or automatic POST replay.",
+      "readBack": "Success requires a matching fieldKey/action=removed receipt followed by independent getReportSchema: target absent, all other nodes preserved with observable properties, parent and sibling order (index may renumber); default sorts for the key removed when observable, filters/plugins preserved when observable. Missing sections are unverified, never empty-array evidence. Compact schema does not expose the field-id reference graph: entityFieldCleanup remains explicitly unverified, not a runtime claim.",
+      "authoring": "Refresh a matching current complete baseline only after read-back verifies: remove the leaf, its default sorts and reportProperties.columns entry, retaining other presentations, filters and plugins. Missing/drifted baseline or unverified write becomes incomplete. An empty column tree or empty group is not representable by the creation Artifact and also becomes incomplete; never guess requirements or rewrite historic run results.",
+      "failureSemantics": "Explicit pre-mutation input/element rejections keep the baseline. Save failures or unknown outcomes carry platformMutationPossible; a successful receipt followed by failed/mismatching read-back carries platformMutationApplied. Invalidate stale authoring in either case and re-read/reconcile before any retry. A repeated command on an already absent column is a preflight failure, not a replay or proof of the earlier write.",
+      "javaFollowUp": "Metadata deletion does not update existing Java: reconcile getColumns(), query() DataSet bindings and dependent logic against the refreshed reportContract. Do not claim compilation, registration/deployment or runtime verification from deletion alone."
+    },
     "setReportFilters": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/filters",
-      "writeSemantics": "full replacement; the supplied array is the desired complete filter state",
-      "controlTypeBoundary": "Optional source={formNumber,fieldKey} selects ReportFilters.typed. The platform resolves the native field and creates its editor type with reference/enum options; date between uses DateRangeField. getReportSchema reads actual configuration, independently compared to fresh source fieldSchemas. Source conditions requiring unresolved organization or conditional references fail before mutation. Older platforms reject the typed route; never retry through the legacy text route.",
-      "readBack": "getReportSchema.reportFilters matches the requested filter controls and panel state",
-      "preWriteGuard": "REPORT_FILTER_KEY_COLLIDES_WITH_COLUMN: a fieldPath repeating a report column or group fieldKey is refused before the platform call, because control and column would share one element key and only the designer would reject the duplicated identifier. Use a distinct key such as flt_<column> and apply it to the column inside the data-fetch plugin."
+      "writeSemantics": "full replacement; the supplied array is the desired complete filter state, editor parameters included",
+      "controlTypeBoundary": "Optional fieldType (25 editor classes) with its parameters builds the filter's native editor through the platform's typed report filter API, which ships as a platform patch. Without fieldType the platform renders a text box, or a date range for between. A platform without the patch accepts a typed request, ignores the editor part and renders that legacy control: the write succeeds and filterEditors reports the filter as degraded. A platform with an older patch refuses an editor type it does not offer before saving anything; the CLI resends that filter without its editor and reports it degraded. Never recreate a report to change an editor and never emulate one with setComplexProperty: re-apply setReportFilters once the patch is installed.",
+      "receipt": "A platform with the typed filter patch answers with data.filters[] (fieldPath, the editor class it built, fieldId, action created/updated/reused/replaced) and data.removed[]. Its absence is how an unpatched platform is recognized; no separate probe is sent.",
+      "readBack": "优先消费 getFormSchema.data.reportFilters 的结构化投影，按过滤分区保存 readBackSources，核对注册键、唯一控件、实体类型、mustInput、visibleEffective、引用目标、范围键及可读选项；名称仅取同响应中匹配 controlId/fieldId/key 的控件。unknown/null 保持未验证，坏 JSON、缺面板、孤儿/重复控件不能验收通过。旧平台保留 formLayout/schemaText fallback；多选引用只在新投影实际给出 baseEntityNumber 时验证。compareConfig 保留原来源/目标/类型，不猜比较 ID，也不证明 query 已生效。",
+      "preWriteGuard": "REPORT_FILTER_KEY_COLLIDES_WITH_COLUMN: a fieldPath repeating a report column or group fieldKey is refused before the platform call, because control and column would share one element key and only the designer would reject the duplicated identifier. Use a distinct key such as flt_<column> and apply it to the column inside the data-fetch plugin. REPORT_INPUT_INVALID for the editor rules the patch enforces: an unknown fieldType, a parameter without fieldType or on another type, a missing required parameter (basedataNumber, comboItems, itemClassTypes, typeFieldKey, asstTypeId), between on a single-value editor, a range editor without between, defaultValue on an F7 editor, mustInput together with visible:false."
     },
     "setReportSorts": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/sorts",
-      "writeSemantics": "replace report-owned default sort entries while preserving unrelated init fields",
-      "readBack": "getReportSchema.reportSorts matches the requested ordered sort list"
+      "availability": "blocked",
+      "writeSemantics": "REPORT_SORTS_API_UNSAFE: 所有入口写前阻断，包括 dry-run 和通用 ReportSorts/InitField 排序写入。旧 API 曾写入非法可见性条目；bos1030 已返回 REPORT_SORT_NOT_SUPPORTED，但仍没有已验证的原生排序通道。InitField 是默认列可见性，不是排序。",
+      "readBack": "No metadata sorting verification. InitField sort entries are invalid visibility data, never evidence that ordering works.",
+      "replacement": "Retain reportSorts in the complete Artifact. Before createPage require exactly one enabled Java reportlist plugin and leaf-column references. Compile ordered fieldKey/direction/dateIndex rules into reportContract.defaultSorts for query(); no silent dropping or unauthorized plugin substitution. Existing invalid InitField needs separate repair."
     },
     "registerReportPlugin": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/plugin",
@@ -39,10 +52,10 @@
     },
     "setReportProperties": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/reportProperties",
-      "writeSemantics": "per-key update of one host control's scalar properties, selected by --target: list -> ReportListSettings on ReportListAp, filterPanel -> ReportFilterPanel on ReportFilterAp, moreFilterPanel -> ReportMoreFilterPanel, form -> ReportFormSettings on the form root (whose element key IS the form number), tree -> ReportTree on ReportTreeAp, column -> ReportColumnProps on one EntryFieldAp or EntryFieldGroupAp named by --element. Keys absent from the map are left alone; this is not a full replacement. Only 'column' takes an --element.",
+      "writeSemantics": "per-key update of one host control's scalar properties, selected by --target: list -> ReportListSettings on ReportListAp, filterPanel -> ReportFilterPanel on ReportFilterAp, moreFilterPanel -> ReportMoreFilterPanel, form -> ReportFormSettings on the form root (whose element key IS the form number), tree -> ReportTree on the report's one ReportTreeAp, found by element type through listElements because a user adds that control in the designer under any key, column -> ReportColumnProps on one EntryFieldAp or EntryFieldGroupAp named by --element. Keys absent from the map are left alone; this is not a full replacement. 'column' needs an --element; 'tree' takes one only to pick among several ReportTreeAp controls, and refuses a key of any other type.",
       "readBack": "getProperties on the resolved host, ONE property per request, both before and after the write. Reading first is what makes the verdict honest: platform defaults are never assumed, so a value that already held is reported under indistinguishableFromCurrentValue instead of as proven. ColumnWidthStyle, MaxRowHeight, HeadHeight and ReportSumMeta resolve on no getProperties call and are reported under unverifiableRequestedProperties with a designStateExpectation the caller can settle from the platform's own export; verified is false when the write consists only of such keys.",
-      "preWriteGuard": "REPORT_PROPERTY_INPUT_INVALID for a name outside the target's allow-list, a wrong value type, a value outside a declared domain, or a key another route owns — the refusal names that route. REPORT_PROPERTY_ELEMENT_MISMATCH when the host resolves none of the requested readable properties, which is what stops a tree write against a report that has no left tree from reporting success and changing nothing. The local allow-list is not defensive duplication: the backend applies a flat map by reflection and IGNORES an unrecognised key while still answering success, so a case slip would otherwise look applied.",
-      "hazard": "ShowFilterFields is also written by setReportFilters, as a comma-joined string (observed live as \"flt_biztime,flt_supplier,flt_billstatus\"). The runtime parses that property as a JSON array, so the comma form raises KDException when a user updates the selected conditions. This command writes the JSON array form and is therefore the repair; re-apply it after any setReportFilters call until the platform's own join is fixed."
+      "preWriteGuard": "REPORT_PROPERTY_INPUT_INVALID for a name outside the target's allow-list, a wrong value type, a value outside a declared domain, or a key another route owns — the refusal names that route. REPORT_PROPERTY_ELEMENT_MISMATCH when the form has no ReportTreeAp for a tree write, or when the host resolves none of the requested readable properties, which is what stops a write against a report that lacks the host from reporting success and changing nothing. The local allow-list is not defensive duplication: the backend applies a flat map by reflection and IGNORES an unrecognised key while still answering success, so a case slip would otherwise look applied.",
+      "hazard": "ShowFilterFields is also written by setReportFilters. A platform without the typed report filter patch writes it as a comma-joined string (observed live as \"flt_biztime,flt_supplier,flt_billstatus\"); the runtime parses that property as a JSON array, so the comma form raises KDException when a user updates the selected conditions. This command writes the JSON array form and is therefore the repair; re-apply it after any setReportFilters call on such a platform, which the filter write reports as filterEditors.platformReceipt false. A patched platform writes the array itself, but resets FilterMustInput and DefaultHiddenFields from the filters' mustInput / visible, so set those after setReportFilters, not before."
     },
     "setReportRowBackColor": {
       "payloadSchemaRef": "skills/cosmic-meta-api/contracts/schema/report-write.schema.json#/$defs/rowBackColorRules",
@@ -76,21 +89,34 @@
       "identityResolution": "queryForms is a LIKE search, so only a row whose formNumber equals the requested number counts; its formId becomes dataSourceId and its formName the cached dataSourceName. The stored name is never compared on read-back: a live binding was observed still carrying an older name after a rename."
     }
   },
+  "typedFilterEditors": {
+    "note": "The skill ships with the client and the typed report filter API ships as a platform patch, so a client can be newer than the platform. Every setReportFilters result and every report run carries filterEditors (schemaVersion app-build-report-filter-editors/v1): per filter the requested editor, the legacy one, what the platform built and the status, plus typedFilterSupport for the whole write.",
+    "statuses": {
+      "typed": "the requested editor rendered",
+      "degraded": "the platform refused or ignored the editor and renders the legacy control; an unresolved boundary the reply must name, fixed by re-applying the filters after the patch is installed",
+      "unconfirmed": "no receipt and no read-back type yet",
+      "mismatch": "an editor that is neither the requested nor the legacy one; fails the write",
+      "legacy": "the filter asked for no editor type"
+    },
+    "typedFilterSupport": ["available", "partial", "unavailable", "unconfirmed", "mismatch", "notRequested"],
+    "compatibility": "A degraded filter is not a failed write: the report keeps working with the legacy control. The plugin contract names both editors for every typed filter, so query() can read either value shape and keeps working when the patch arrives and the filters are re-applied."
+  },
   "readBackSource": {
-    "canonical": "Backend exposes data.reportSchema; every readBack above is enforced exactly.",
-    "formLayout": "No data.reportSchema (verified absent on the tested deployment). getReportSchema derives columns and filters from data.formLayout and lists what that source cannot carry in unverifiableSections.",
-    "formLayout+dym": "formLayout plus the platform's own design-state export, which syncDym writes into the application. <InitField> proves reportSorts and <ReportQueryPlugin> proves reportPlugins, so those two leave unverifiableSections. The export also proves two filter properties the API projection cannot decide: <MustInput> and <Visible> on each filter control, promoted per property rather than per section because formLayout already proves the controls exist. It serializes design state and omits any property still holding its default, so for a control the export contains, a present node proves the value and an absent node proves the default; a property is promoted only when the export covers every derived filter. The export carries no plugin type/bizAppId/fpk and no <DefaultValue>: those are listed in undecidablePluginProperties / undecidableFilterProperties instead of being compared. Plugin description is in that list for a different reason, and is the one entry expected to leave it: a platform defect, fixed at the source but not yet in the measured deployment. Sending Description \"DESC_VALUE\" with DisplayName \"DISPLAY_VALUE\" read back the plugin's own full class name and no mulDescription resId, while the identical payload sent as ReportPluginExt read back \"DESC_VALUE\" with a resId. The cause is a pair of coupled ReportListAp accessors: getReportPlugin() falls back to the first Java plugin's class name and save serialisation goes through it, so the legacy <ReportPlugin> node is resurrected on every save; getReportQueryPlugin() then sees that non-empty legacy field and CLEARS the persisted plugin list to rebuild it with description=class name, so a second save could corrupt a registration that had stored correctly. Comparing description failed every run whose artifact declared one. Remove it from the list once the fixed platform is deployed. An empty section in the export never proves absence, and it never overrides a canonical projection.",
+    "canonical": "Backend exposes data.reportSchema; observable metadata sections are compared. reportSorts remains unverified: no supported native sorting contract has been confirmed, and InitField is visibility, not sorting.",
+    "formLayout": "No data.reportSchema on legacy deployments. getReportSchema derives columns and filters from data.formLayout and lists what that source cannot carry in unverifiableSections.",
+    "reportFilterProjection": "bos1030 的 data.reportFilters 独立于 data.reportSchema；只提升过滤分区，保留完整 reportFilterProjection/unknown/孤儿/重复/未管理控件诊断。正常 JSON 注册与承载面板必须可验证，其他分区不因此提升。新过滤投影不被 DYM 的默认值覆盖；比较配置只保留为 compareConfig，业务查询仍需独立验收。",
+    "formLayout+dym": "formLayout plus the platform's own design-state export, which syncDym writes into the application. <ReportQueryPlugin> proves reportPlugins, which leaves unverifiableSections. <InitField> is default column visibility; purpose=sort entries are pollution and never prove reportSorts. The export also proves two filter properties the API projection cannot decide: <MustInput> and <Visible> on each filter control, promoted per property rather than per section because formLayout already proves the controls exist. It serializes design state and omits any property still holding its default, so for a control the export contains, a present node proves the value and an absent node proves the default; a property is promoted only when the export covers every derived filter. The export carries no plugin type/bizAppId/fpk and no <DefaultValue>: those are listed in undecidablePluginProperties / undecidableFilterProperties instead of being compared. Plugin description is in that list for a different reason, and is the one entry expected to leave it: a platform defect, fixed at the source but not yet in the measured deployment. Sending Description \"DESC_VALUE\" with DisplayName \"DISPLAY_VALUE\" read back the plugin's own full class name and no mulDescription resId, while the identical payload sent as ReportPluginExt read back \"DESC_VALUE\" with a resId. The cause is a pair of coupled ReportListAp accessors: getReportPlugin() falls back to the first Java plugin's class name and save serialisation goes through it, so the legacy <ReportPlugin> node is resurrected on every save; getReportQueryPlugin() then sees that non-empty legacy field and CLEARS the persisted plugin list to rebuild it with description=class name, so a second save could corrupt a registration that had stored correctly. Comparing description failed every run whose artifact declared one. Remove it from the list once the fixed platform is deployed. An empty section in the export never proves absence, and it never overrides a canonical projection.",
     "unavailable": "Neither is present. Report verified=false; never treat an empty section array as a passing read-back."
   },
   "designStateEvidence": {
     "freshness": "A .dym on disk only proves the platform state as of the last syncDym, so it is synced after the writes and before verification. The report pipeline does this automatically — including when the only thing needing it is a filter that requested mustInput or visible — while getReportSchema does it only under --with-dym-evidence (which requires --app-root) and never trusts a file it did not just sync.",
-    "provenSections": ["reportSorts", "reportPlugins"],
+    "provenSections": ["reportPlugins"],
     "provenFilterProperties": ["mustInput", "visible"]
   },
   "rejectedInputs": {
     "note": "Rejected at input normalization so a caller never believes an unsupported property was applied.",
     "reportColumns": ["currencyField", "measureUnitField", "scale", "format", "entityId", "displayProp", "formula", "style"],
-    "reportFilters": ["enableFuzzy", "required", "basedataFilter"],
+    "reportFilters": ["enableFuzzy", "required", "basedataFilter", "source", "baseEntityId"],
     "reportPlugins": ["displayName", "generateCode", "codeSpec"],
     "queryDataSource": ["dataSourceId", "dataSourceName"],
     "artifact": ["dataSources", "reportBehavior"],
@@ -100,7 +126,7 @@
         "DataSource": "setReportQueryDataSource --dataSourceNumber (this key overwrites the deprecated string-shaped property)",
         "QueryDataSource": "setReportQueryDataSource --dataSourceNumber",
         "ReportColumns": "addReportColumns",
-        "InitField": "setReportSorts",
+        "InitField": "default column visibility, not sorting; ReportSorts is blocked. Preserve sorting requirements in reportContract.defaultSorts for Java query().",
         "ReportQueryPlugin": "registerReportPlugin",
         "ReportPluginExt": "registerReportPluginExt",
         "RowBackColor": "setReportRowBackColor",
@@ -122,25 +148,32 @@
   },
   "pluginContract": {
     "note": "Report metadata declares presentation only, so every requirement it cannot carry is compiled into {appRoot}/_runtime/<formNumber>.report-plugin-contract.json and forwarded by prepare_plugin_handoff as handoff.reportContract. A report with at least one column has a contract whenever its rows come from code: which columns query() must return, and with which Java type, is itself a requirement. A report that binds a query data source and registers no plugin gets none, because there is no query() to constrain.",
+    "pluginClasses": "The Java classes the report registers, and pluginTypes the plugin type each one's slot runs: a reportPlugins entry is reportlist (ReportListAp.ReportQueryPlugin, AbstractReportListDataPlugin), the left tree's ReportTreeAp.ReportPlugin is reporttreelist (present only after a user adds the report tree control in the designer, AbstractReportTreeDataPlugin). JS and KingScript entries are not listed: they have no Java source to deliver. render_output_cards.py refuses the cards with REPORT_PLUGIN_SOURCE_MISSING while any listed class has no archived source, naming the type to deliver it as.",
     "dataSetColumns": "The dateIndex of every declared column, case-sensitive: what query() must return. No metadata cross-check is possible.",
-    "presentationBinding": "presentation.currencyField / measureUnitField names another declared column's fieldKey — the hidden column carrying that id, normally fieldType bigint with hide true — not a loose DataSet column, because the platform builds the runtime entity from the ReportColumn list and packages rows under fieldKey. R-presentation-binding refuses a missing target and a target whose fieldKey differs from its dateIndex; with the two equal the artifact holds under either reading of the parameter, and R-presentation-binding-target warns when the target is visible or is not bigint. The contract states the relationship both ways: presentation.bindsTo names the target, and the target's dataSetColumnTypes entry lists its dependents under requiredBy.",
+    "presentationBinding": "presentation.currencyField / measureUnitField 保留币别或单位引用要求。REPORT_PRECISION_REFERENCE_UNVERIFIED 在 normalizer、CLI/serve/pipeline 和 set/add writer 写前拒绝 amount/price/qty。隐藏 bigint 的 Long、fieldKey == dateIndex 及 ReportColumnFactory 不能证明 DynamicObject 物化；R-presentation-binding-target 为 error。原始/历史契约仍用 bindsTo/requiredBy 保留依赖，不代表可写或可运行。",
+    "precisionSource": "动态绑定逐列标记 requiredRuntimeValueType=DynamicObject、runtimeVerified=false、rawIdIsReference=false、metadataWriteBlocked=true。requiredEvidence 要求持久化引用属性及旧标量迁移、格式化前批量引用物化、混合精度/分组/合计/分页/导出验收。平台能力验证后再开放 schema 和 writer；不以固定精度或删除绑定替代需求。",
     "dataSetColumnTypes": "Per column: rowAccessor (the kd.bos.algo.Row method that reads it), javaType (the value it must carry) and algoDataType (the kd.bos.algo.DataType to declare when building a DataSet by hand), all derived from the column's declared fieldType. The report sets each value into a metadata field, so a wrong type fails at set time naming the field, not the query: a date column returned as text raises 'setvalue fail, name: <column>, Unparseable date'. date and datetime both resolve to DataType.DateType because there is no DateTimeType, and decimal resolves to createBigDecimalType(precision, scale) because DataType.md documents a standalone BigDecimalType as illegal — with precision left as a placeholder, since no metadata knows it.",
-    "columnPresentation": "One ReportColumnFactory call per column whose presentation metadata cannot express, plus javaFollowUp setters. javaFollowUp carries setDateIndex whenever fieldKey and dateIndex differ: no factory signature takes dateIndex, so a rebuilt column would otherwise lose its DataSet binding and render empty. Bind these in getColumns(), recursing into ReportColumnGroup.getChildren() — a grouped column is never in the top-level list.",
-    "filterEnforcement": "Each acceptedButNotPersisted filter requirement, as something query() must enforce from ReportQueryParam.getFilter(). requirement=compare is present for every filter, because the platform renders one plain control per key whatever the comparison is, so between / in / = exist only as a requirement on query()."
+    "columnPresentation": "java 和 javaFollowUp 保留 ReportColumnFactory 的已记录签名，不是动态精度运行证据。历史/原始需求的 amount/price/qty 必须先满足 precisionSource，当前禁止写入及作为已完成实现交付。支持的呈现在 getColumns() 递归 ReportColumnGroup.getChildren() 并保留 setDateIndex。",
+    "defaultSorts": "Ordered fieldKey, direction and case-sensitive dateIndex bindings compiled from reportSorts, leaf columns only. Requires exactly one enabled Java reportlist plugin; no sorting metadata is written.",
+    "defaultSortPolicy": "query() honors validated interactive ReportQueryParam.getSortInfo() ordering first; defaults apply only when interactive ordering is absent. Apply to the final assembled DataSet after joins/unions/aggregation and before paging/export, preserving permissions. Target-SDK ordering APIs only; no unchecked SQL sort fragments. Source/compile/registration is not runtime evidence; verify default and interactive sorting separately.",
+    "filterEnforcement": "每个 compare 都保留为 query() 的显式条件要求。编辑器或 ReportFilterFieldConfig 的配置回读不证明实际业务查询已下推；mustInput 同样需要 verifyQuery/query 取数前共用校验。",
+    "filterValueContracts": "Per filter: the runtime key candidates, the value channel (getValue, or getFilterItems with the range item keys), the editor (editorFieldType) and the FilterInfo call that reads its value (valueAccessor, valueJavaType, valueEvidence measured or observeOnce). A typed filter also carries legacyEditor, the control a platform without the typed filter patch renders, and, when the run reported it, editorStatus and renderedFieldType. query() reads the editor that rendered and, unless editorStatus is typed, accepts the legacy shape too."
   },
   "acceptedButNotPersisted": {
-    "note": "Accepted because they express a real requirement, and never dropped silently: each one is compiled into the plugin contract as something query() must enforce. What the read-back says about them depends on what it can observe. mustInput and visible are decidable once the design-state export is attached, and are then compared for real. compare and defaultValue stay undecidable, so they are reported under the check's unverifiableRequestedProperties and unverifiedProperties. An undecidable property is never reported as a mismatch: 'this source cannot see it' is not evidence that the write failed, and treating it as one used to fail the whole report pipeline over a mustInput the platform had in fact stored.",
+    "note": "业务要求不静默丢弃，并保留至插件交付。按实际回读来源判定属性，不再笼统称未持久化：bos1030 投影可证明必录、有效可见性及引用/范围；旧平台使用布局及新鲜 DYM。缺失/null/unknown 属未验证，不是假阴性或默认 false。compareConfig 是配置证据，不替代业务 query；defaultValue 尚未读到。",
     "reportFilters": {
-      "mustInput": "Sent, and observed persisted as <MustInput> in the design-state export. Verified exactly once that export is attached.",
-      "visible": "Sent, and decidable from the same export. Only visible:false is a request; visible:true restates the default.",
+      "mustInput": "从结构化投影的实际实体字段 Boolean 验证；旧平台可由新鲜 DYM 补证据。未知不当 false，保存标志不等于查询必录校验。",
+      "visible": "新投影使用 visibleEffective 的实际 Boolean，不能把控件阶段字符串当 Boolean。旧平台由新鲜 DYM 验证；DefaultHiddenFields 可被后续独立写入替换。",
       "defaultValue": "Sent, with no observable evidence in either read-back source. Reported unverifiable.",
-      "compare": "Required input, mapped and sent, and observed not persisted at all: '=', 'in' and 'between' all produced the same CommonFilterColumnAp, and a between date filter did not become a CommonDateFilterColumnAp. setReportFilters says so once per write, and every filter's comparison is compiled into the plugin contract as requirement=compare, because the filter panel renders one plain control per key whatever the comparison is."
+      "compare": "必填业务比较，始终编译为 query() 条件要求。旧平台观察不到比较；新投影从 ReportFilterFieldConfig 读出 compareConfig 来源和目标，但 setReportFilters 不因此自动绑定业务查询，不将其冒充公开比较运算符。"
     }
   },
-  "failureSemantics": "A rejected report save can still have changed the form: a failed setReportFilters was observed having already replaced the filter panel. addReportColumns / setReportFilters / setReportSorts / registerReportPlugin failures say so; re-read before retrying.",
+  "metaOpsReceipt": "新 modifyMeta 回执逐项核对 formId、opsCount、opIndex、op/目标类型、target 和 path。仅 committed、无回滚、完整同请求 no_op 且 metadataChanged=false 时报告未变更成功；no_channel/rejected/未知或不完整回执拒绝全成功。submitted/applied 不替代逐项持久化回读；整体快照未变化且不是完整 no_op 时保持未确认，不盲目重试。",
+  "failureSemantics": "A rejected report save can still have changed the form: a failed setReportFilters was observed having already replaced the filter panel. addReportColumns / setReportFilters / registerReportPlugin failures say so; re-read before retrying. ReportSorts is a pre-write safety rejection with no request and no authoring-state invalidation.",
   "columnChangeRoute": {
     "add": "Adding columns to an existing report is addReportColumns. It is incremental, idempotent, and needs no recreate.",
-    "recreate": "Only a change addReportColumns cannot express needs planReportRecreate: removing a column, reordering, renaming a caption, or changing fieldType / dateIndex / width on an existing column, and repairing a report whose entity already carries duplicate field keys.",
+    "remove": "removeReportColumn deletes one exact leaf on a backend with ReportColumns.remove. If unavailable, stop and report the release boundary; a recreate or hide needs separate user authorization. Groups cannot be deleted by this route.",
+    "recreate": "Changes outside the single-leaf removal and append routes need an explicitly authorized planReportRecreate when no supported property route applies: group removal, reordering or changing fieldType / dateIndex, and repairing duplicate entity field keys.",
     "plan": "planReportRecreate --app-root <appRoot> --formNumber <exact> [--target-artifact <path>] is read-only apart from the backup it writes to {appRoot}/_runtime/<formNumber>.pre-recreate.json. It returns the current state, the column diff, every menu entry bound to the report, lostOnRecreate, and the ordered command sequence.",
     "execute": "The plan's own steps, as published commands: deleteForm (critical, two-step confirmation) then run with the intended artifact under the same formNumber, then re-point the listed menu entries. planReportRecreate performs no platform write itself.",
     "irreversible": "The recreated form gets a new formId, so menu bindings, designer-side adjustments and form-level permissions attached to the old formId do not survive."
@@ -151,7 +184,7 @@
     "repair": "A field already added this way is a report-entity field without a column. addReportColumns reuses it by fieldKey and gives it a real column, which is also what turns the stray control into the intended one. removeField is only for dropping it instead."
   },
   "rollback": {
-    "existingReport": "Only for sections the platform truly replaces. An appended column cannot be un-appended — there is no column-removal route — so treat added columns as one-way and use planReportRecreate when a column has to disappear.",
+    "existingReport": "Replaceable sections may be restored from confirmed prior state. An appended leaf can be removed with removeReportColumn only on a patched backend, with fresh target/read-back verification and explicit deletion scope. This is not an automatic rollback: old backends stop safely, groups are unsupported, and prior entity ids, dependent Java and other side effects are not recreated by re-appending.",
     "disposableReport": "delete only the exact formId returned by createPage, then prove the exact formNumber absent"
   }
 }

package/skills/cosmic-build/skills/cosmic-meta-api/contracts/cli/rule-domain.json

@@ -198,7 +198,7 @@
       "effect": "write",
       "multiMapping": "多组字段带出用 --input {mappings:[{source,target,可选 onlyEmptyTarget}],可选 conditionField/operator/value/ruleId/branch}，或 ensureRuleSet 的 args.mappings；一条 SetEqutionAction 包含全部映射。省略 branch 表示条件成立时执行；branch=false 只在条件不成立时执行；不成立时不执行服务就省略 branch。合并已有拆分规则必须传准确 ruleId。",
       "semantics": "resolve one entity, condition, source and distinct target; compile SetEqutionAction Expression/FieldName as one TakeValueId mapping pair with optional only-empty behavior, validate entity scope, deduplicate semantically and independently read back the nested mapping",
-      "arguments": ["formNumber OR form-name", "optional entity", "condition-field", "operator", "value", "source", "target", "optional only-empty-target"],
+      "arguments": ["formNumber OR form-name", "optional entity", "condition-field", "operator (empty/not-empty take no value)", "value for other operators", "source", "target", "optional only-empty-target"],
       "failClosed": [
         "source and target must be distinct fields owned by the selected entity",
         "callers never assemble TakeValueId, FieldName, RET, itemId or mountPoint",