@stalfh233/omc-cli 0.0.0-stage → 0.4.10

package/dist/lanes/runtime-data.js

@@ -0,0 +1,1054 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import { FilterDslError, injectPropertyTypes, toQueryCondition } from "../data-list-filter.js";
+import { ENDPOINTS } from "../endpoints.js";
+import { capabilityArg, environmentArg } from "../args.js";
+import { governedRead } from "../read.js";
+import { ToolInputError, ToolRefusalError } from "../tool-types.js";
+import { writeTool } from "../write.js";
+import { defineTool } from "../tool-types.js";
+import { wireCall, wireRows, WireError } from "../wire.js";
+import { CHILD_TABLE_PROPERTY_TYPE, runtimeWriteWithAppMapping } from "../runtime-support.js";
+import { getReplayToken, searchWorkItems, wireString } from "../workflow-support.js";
+import { ENGINE_OWNED_KEYS, RUNTIME_DATA_LANE_CONTRACT, RUNTIME_DATA_WIRE, runtimeFormDataArg, } from "./runtime-data-contract.js";
+const RUNTIME_LANE = RUNTIME_DATA_LANE_CONTRACT.lane;
+const RUNTIME_TOOLS = RUNTIME_DATA_LANE_CONTRACT.tools;
+/**
+ * Resolve a model's single published workflow code, or null when the model has
+ * no workflow. A workflow-backed data submit must START the workflow
+ * (runtime/form/submit formType=1 + workflowCode), not merely save a sheet row
+ * (formType=2): only the former creates the workflow instance and runs node
+ * routing / approval. Detection via workflow/isworkflow (WorkflowTemplateController
+ * :1338), code via workflow/getWorkflow (returns the published template).
+ */
+async function resolvePublishedWorkflowCode(session, schemaCode) {
+    const isWorkflow = (await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode } })).data === true;
+    if (!isWorkflow)
+        return null;
+    const template = (await wireCall(session, { path: ENDPOINTS.workflowGetBySchema, query: { schemaCode } })).data;
+    const code = template && typeof template.workflowCode === "string" && template.workflowCode.length > 0 ? template.workflowCode : null;
+    return code;
+}
+function extractBizObjectPage(value) {
+    const root = value && typeof value === "object" ? value : {};
+    const candidate = root.bizObjectPage && typeof root.bizObjectPage === "object" ? root.bizObjectPage : root;
+    const content = Array.isArray(candidate.content) ? candidate.content.filter((row) => !!row && typeof row === "object") : [];
+    return {
+        total: typeof candidate.totalElements === "number" ? candidate.totalElements : 0,
+        totalPages: typeof candidate.totalPages === "number" ? candidate.totalPages : 0,
+        page: typeof candidate.page === "number" ? candidate.page : undefined,
+        size: typeof candidate.size === "number" ? candidate.size : undefined,
+        content,
+    };
+}
+/**
+ * Resolve the active form's sheetCode. Priority order: explicit caller arg
+ * (verbatim) > default-form sheetCode from bizsheet/get > schemaCode
+ * fallback. Returns the chosen sheetCode plus a provenance tag so callers
+ * can report which tier won.
+ */
+async function resolveFormSheetCode(session, args) {
+    const explicit = typeof args.sheetCode === "string" && args.sheetCode.trim() ? args.sheetCode.trim() : "";
+    if (explicit)
+        return { sheetCode: explicit, resolvedFrom: "explicit" };
+    try {
+        const result = await wireCall(session, {
+            path: ENDPOINTS.sheetGet,
+            query: { schemaCode: args.schemaCode, sheetCode: args.schemaCode },
+        });
+        const data = result.data;
+        const candidate = data?.code ?? data?.sheetCode;
+        if (typeof candidate === "string" && candidate) {
+            return { sheetCode: candidate, resolvedFrom: "default-form" };
+        }
+    }
+    catch {
+        // fall through to schemaCode fallback
+    }
+    return { sheetCode: args.schemaCode, resolvedFrom: "fallback" };
+}
+/**
+ * Read the record status from a form/load payload. The live face nests it as
+ * `bizObject.data.sequenceStatus`; the flat fake form carries it top-level.
+ */
+/**
+ * Read the workflow instance id from a form/load payload. The live face may
+ * carry it top-level, under `bizObject`, or under `bizObject.data` — the submit
+ * RESPONSE often omits it entirely (bench53: start/approval submits answered
+ * workflowInstanceId:null even though the instance existed), so the loaded row
+ * is the fallback the next-todo lookup depends on.
+ */
+function extractWorkflowInstanceId(readback) {
+    if (!readback)
+        return null;
+    const candidates = [
+        readback.workflowInstanceId,
+        readback.bizObject?.workflowInstanceId,
+        readback.bizObject?.data?.workflowInstanceId,
+    ];
+    for (const candidate of candidates)
+        if (typeof candidate === "string" && candidate.length > 0)
+            return candidate;
+    return null;
+}
+function extractSequenceStatus(readback) {
+    if (!readback)
+        return null;
+    if (typeof readback.sequenceStatus === "string")
+        return readback.sequenceStatus;
+    const nested = readback.bizObject;
+    if (nested && typeof nested.sequenceStatus === "string")
+        return nested.sequenceStatus;
+    const nestedData = nested?.data;
+    if (nestedData && typeof nestedData.sequenceStatus === "string")
+        return nestedData.sequenceStatus;
+    return null;
+}
+/**
+ * Engine-owned record keys that must never be echoed back in a submit
+ * payload: persisting the loaded `sequenceStatus` pins the row to its
+ * pre-submit status (live evidence ticket 17 — the portal client only
+ * submits form fields, never the status column). The key list is the
+ * contract constant the fake's merge also consumes (ticket 20).
+ */
+function stripEngineOwnedKeys(data) {
+    const stripped = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (ENGINE_OWNED_KEYS.includes(key))
+            continue;
+        stripped[key] = value;
+    }
+    return stripped;
+}
+/**
+ * Normalize a form/load payload to the flat record contract the tool surface
+ * promises: business fields plus `id`/`sequenceStatus`. The live face returns
+ * a FormLoadVO nesting them under `bizObject.data`; the flat fake form
+ * carries them top-level. A null payload stays null (absence).
+ */
+function normalizeLoadedRecord(payload) {
+    if (!payload)
+        return null;
+    const bizObject = payload.bizObject;
+    if (!bizObject || typeof bizObject !== "object")
+        return payload;
+    const record = bizObject;
+    const fields = record.data && typeof record.data === "object"
+        ? { ...record.data }
+        : {};
+    if (typeof record.id === "string")
+        fields.id = record.id;
+    if (typeof record.sequenceStatus === "string")
+        fields.sequenceStatus = record.sequenceStatus;
+    return fields;
+}
+/**
+ * Engine/system record keys that dominate a raw form/load payload but carry no
+ * business meaning for the caller: the `owner`/`creater`/`modifier` staff blobs
+ * and the owning-department objects. Each is a ~30-key object full of nulls
+ * (live 2026-09-25: a 23-key record was ~3 KB, of which these were ~2.5 KB).
+ * They stay reachable via `full:true` (raw record) and in the spilled artifact.
+ */
+const RUNTIME_ENGINE_RECORD_KEYS = new Set([
+    "owner", "creater", "modifier", "createdDeptId", "ownerDeptId", "ownerDeptQueryCode",
+    "createdBy", "modifiedBy",
+]);
+/**
+ * Default-compact a runtime record: drop only KNOWN engine noise — `*_` keys are
+ * flow-engine internals (`activityName_`, `participants_`, …) and the staff/dept
+ * blobs above. Every business value is kept verbatim, INCLUDING null/empty (a
+ * null business field is a real, readable state; dropping it would make it
+ * indistinguishable from an absent field). `full:true` returns the untouched
+ * record.
+ *
+ * Round 13: the filter now recurses. A child-table field comes back as an array
+ * of row objects, and each row carries its own owner/creater/dept blobs and
+ * `*_` internals — the first version only stripped the top level, so a record
+ * with a child table still shipped the noise one level down. The keys are
+ * platform-reserved (`SYSTEM_FIELD_CODES` / engine internals), so a business
+ * field cannot collide with them and recursion cannot eat authored data.
+ */
+function compactRuntimeValue(value) {
+    if (Array.isArray(value))
+        return value.map(compactRuntimeValue);
+    if (value !== null && typeof value === "object")
+        return compactRuntimeRecord(value);
+    return value;
+}
+function compactRuntimeRecord(record) {
+    const compact = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (key.endsWith("_"))
+            continue;
+        if (RUNTIME_ENGINE_RECORD_KEYS.has(key))
+            continue;
+        compact[key] = compactRuntimeValue(value);
+    }
+    return compact;
+}
+/**
+ * Round 3 (issue §D5): the write readback inlined the whole `authoritative`
+ * record (owner/creater objects included), ~4 KB a row. Default is now the
+ * compact projection (business fields + identity); `summary:true` keeps
+ * identity/status keys, `fields:[...]` keeps exactly the named keys, and
+ * `full:true` returns the untouched record.
+ */
+function projectReadbackRecord(record, args) {
+    if (record === null || typeof record !== "object" || Array.isArray(record))
+        return record;
+    const source = record;
+    if (Array.isArray(args.fields) && args.fields.length > 0) {
+        const projected = {};
+        for (const field of args.fields)
+            if (field in source)
+                projected[field] = source[field];
+        return projected;
+    }
+    if (args.summary === true) {
+        const projected = {};
+        for (const key of ["id", "bizObjectId", "schemaCode", "name", "sequenceStatus"])
+            if (key in source)
+                projected[key] = source[key];
+        return projected;
+    }
+    if (args.full === true)
+        return record;
+    return compactRuntimeRecord(source);
+}
+/** Shared optional schema fields for the write readback projection. */
+export const readbackProjectionArgs = {
+    summary: z.boolean().optional().describe("只回身份/状态字段，裁剪 readback.authoritative（默认关闭，读回为业务字段+身份的精简记录）"),
+    fields: z.array(z.string().min(1)).optional().describe("只保留 readback.authoritative 中列出的字段（比 summary 更精确）"),
+    full: z.boolean().optional().describe("返回未裁剪的原始记录（含 owner/creater 等系统字段与 *_ 引擎内部字段；默认已裁剪）"),
+};
+/**
+ * Authoritative existence probe for an existing business object. The platform
+ * form/load face returns either a null payload or a business error
+ * (304001 业务对象不存在) when the object is absent; both are absence, not a
+ * read failure. `data.update` uses this to refuse an absent target instead of
+ * letting runtime/form/save silently insert (BizObjectFacadeImpl falls back to
+ * createBizObject when the id is not found).
+ */
+async function loadExistingBizObject(session, schemaCode, sheetCode, objectId) {
+    try {
+        const result = await wireCall(session, {
+            path: ENDPOINTS.runtimeFormLoad,
+            query: { schemaCode, sheetCode, objectId },
+        });
+        const value = result.data;
+        if (value == null || value === false)
+            return null;
+        return typeof value === "object" ? value : {};
+    }
+    catch (error) {
+        if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.absenceErrcode)
+            return null;
+        throw error;
+    }
+}
+/**
+ * Portal-required fields the published form declares (`control.options.required`
+ * or `requiredFormula`). The portal enforces these client-side; the REST
+ * runtime/form/submit path does NOT, so a submit with a required field missing
+ * returns ok/PROCESSING anyway (dogfood R3: `amount:null` still advanced the
+ * workflow). Read the PUBLISHED form controls and cross-check the submitted
+ * formData, then report the discrepancy instead of letting the caller believe a
+ * portal-invalid submit succeeded.
+ */
+async function portalRequiredViolations(session, schemaCode, sheetCode, formData) {
+    const sheet = ((await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode, sheetCode } })).data ?? {});
+    const face = typeof sheet.publishedAttributesJson === "string" ? sheet.publishedAttributesJson : typeof sheet.draftAttributesJson === "string" ? sheet.draftAttributesJson : undefined;
+    if (!face)
+        return { requiredFields: [], missingRequired: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(face);
+    }
+    catch {
+        return { requiredFields: [], missingRequired: [] };
+    }
+    const requiredFields = Object.entries(parsed)
+        .filter(([, control]) => control?.options?.required === true || typeof control?.options?.requiredFormula === "string")
+        .map(([code]) => code);
+    const missingRequired = requiredFields.filter((code) => {
+        const value = formData[code];
+        return value === null || value === undefined || (typeof value === "string" && value.trim() === "");
+    });
+    return { requiredFields, missingRequired };
+}
+/**
+ * The platform dispatches each CHILD_TABLE(8) row on the form-save path by its
+ * `rowStatus` (BizObjectUpdateModel.convertBizObjectOpItem): "Added" → insert,
+ * "Modified" → update, "Deleted" → delete, and **any other/missing value →
+ * immutable (silently ignored)**. The portal client stamps it (the compiled
+ * admin bundle sets `rowStatus:"Modified"` on edited rows and `"Added"` on new
+ * ones); a hand-built payload that omits it loses every child edit while the
+ * write still answers errcode 0 (live 2026-10-08: data.update of a child row
+ * without rowStatus left process_name/plan fields unchanged). Stamp the obvious
+ * intent so OMC never reports a successful child write that did not land: a row
+ * carrying its own `id` is "Modified", an id-less row is "Added"; an explicit
+ * rowStatus is preserved verbatim.
+ */
+async function stampChildRowStatuses(session, schemaCode, formData) {
+    const childCodes = new Set();
+    try {
+        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+        for (const row of rows) {
+            if (Number(row.propertyType ?? row.type) === CHILD_TABLE_PROPERTY_TYPE)
+                childCodes.add(String(row.code ?? row.propertyCode ?? ""));
+        }
+    }
+    catch {
+        return formData;
+    }
+    if (childCodes.size === 0)
+        return formData;
+    let changed = false;
+    const next = { ...formData };
+    for (const code of childCodes) {
+        const value = formData[code];
+        if (!Array.isArray(value))
+            continue;
+        next[code] = value.map((entry) => {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                return entry;
+            const row = entry;
+            if (typeof row.rowStatus === "string" && row.rowStatus.trim())
+                return row;
+            changed = true;
+            const hasId = typeof row.id === "string" && row.id.trim().length > 0;
+            return { ...row, rowStatus: hasId ? "Modified" : "Added" };
+        });
+    }
+    return changed ? next : formData;
+}
+/** Runtime business-object data keyed by field code. */
+export function registerRuntimeDataLane(tools) {
+    tools.push(defineTool({
+        name: "data.list",
+        layer: "low",
+        kind: "read",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.list"].scope,
+        description: RUNTIME_TOOLS["data.list"].description,
+        inputSchema: {
+            environment: environmentArg,
+            schemaCode: z.string().min(1),
+            queryCode: z.string().min(1).optional().describe("query view code; defaults to schemaCode (the default list view)"),
+            // `filter` may be a SINGLE clause object `{op,field,value}` or an ARRAY
+            // of clauses (a natural mistake that the old schema rejected with a bare
+            // `Expected object, received array`). An array is the caller's AND-list,
+            // so accept it and treat it as `filters` rather than costing a retry
+            // (dogfood R1 round17).
+            filter: z.union([z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).optional().describe('one clause { op, field, value? } (or an array of clauses = AND); op is one of eq, neq, gt, lt, gte, lte, like, notlike, in, notin, between, notbetween, isnull, isnotnull'),
+            filters: z.array(z.record(z.string(), z.unknown())).optional().describe("clauses combined with AND; a malformed clause is refused with blocker invalid-filter-DSL"),
+            filterGroup: z.record(z.string(), z.unknown()).optional().describe('nested group { op:"and"|"or", clauses:[clause|group] }'),
+            rawCondition: z.unknown().optional(),
+            displayFields: z.array(z.string().min(1)).optional(),
+            columns: z.array(z.string().min(1)).optional(),
+            orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional(),
+            mobile: z.boolean().optional(),
+            showTotal: z.boolean().default(true),
+            page: z.number().int().min(0).default(0),
+            size: z.number().int().min(1).max(200).default(10),
+            full: z.boolean().optional().describe("内联完整列表结果；默认大结果只返回计数与 detailFile"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => {
+            let condition;
+            let fromDsl = false;
+            try {
+                // An array `filter` is the caller's AND-list; fold it into `filters`.
+                const asFilters = args.filters ?? (Array.isArray(args.filter) ? args.filter : undefined);
+                const asFilter = Array.isArray(args.filter) ? undefined : args.filter;
+                condition = toQueryCondition({
+                    rawCondition: args.rawCondition,
+                    ...(asFilter !== undefined ? { filter: asFilter } : {}),
+                    ...(asFilters !== undefined ? { filters: asFilters } : {}),
+                    ...(args.filterGroup !== undefined ? { filterGroup: args.filterGroup } : {}),
+                });
+                fromDsl = condition !== undefined && args.rawCondition === undefined;
+            }
+            catch (error) {
+                if (error instanceof FilterDslError)
+                    return {
+                        status: "refused",
+                        blocker: "invalid-filter-DSL",
+                        reason: error.code,
+                        message: `${error.message}；filter 的最小合法形状：{"filter":{"op":"eq","field":"<字段code>","value":"<值>"}}（op 取 eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull）；多条件用 filters:[clause,…]（AND）或 filterGroup:{op:"and"|"or",clauses:[…]}。可运行示例：describe data.list --example list-filter-equality`,
+                        minimalValidFilter: { filter: { op: "eq", field: "<fieldCode>", value: "<value>" } },
+                        acceptedOps: ["eq", "neq", "gt", "lt", "gte", "lte", "like", "notlike", "in", "notin", "between", "notbetween", "isnull", "isnotnull"],
+                    };
+                throw error;
+            }
+            return governedRead(ctx, self, args, async (session) => {
+                // Published field metadata is the sole source for filter propertyType
+                // injection AND for the projectionHint below. Fetch at most once per
+                // call: the DSL path needs it up front; the hint path asks only after
+                // an explicit projection came back all-null, so a normal read that
+                // yields values performs zero metadata requests.
+                let publishedTypes = null;
+                const publishedTypeByCode = async () => {
+                    if (publishedTypes)
+                        return publishedTypes;
+                    const meta = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } })).data);
+                    publishedTypes = new Map(meta.map((row) => [String(row.code ?? row.propertyCode), Number(row.propertyType ?? row.type)]));
+                    return publishedTypes;
+                };
+                if (fromDsl) {
+                    const typeByCode = await publishedTypeByCode();
+                    const injected = injectPropertyTypes(condition, (code) => {
+                        const type = typeByCode.get(code);
+                        return Number.isInteger(type) ? type : undefined;
+                    });
+                    if (!injected.ok)
+                        return {
+                            status: "refused",
+                            blocker: "unknown-filter-field",
+                            missing: injected.missing,
+                            message: `filter fields not found in published field metadata: ${injected.missing.join(", ")}; the runtime query requires each leaf's propertyType from field metadata (no guessing); system/foreign fields may use rawCondition`,
+                        };
+                    condition = injected.condition;
+                }
+                const requestedFields = args.displayFields ?? args.columns;
+                const fields = requestedFields && requestedFields.length > 0 ? requestedFields : undefined;
+                const body = {
+                    schemaCode: args.schemaCode,
+                    queryCode: args.queryCode ?? args.schemaCode,
+                    filters: [],
+                    mobile: args.mobile === true,
+                    page: args.page ?? 0,
+                    size: args.size ?? 10,
+                    queryVersion: 1,
+                    showTotal: args.showTotal !== false,
+                    ...(condition !== undefined ? { queryCondition: condition } : {}),
+                };
+                // An empty model answers with a business error (301005) on this face;
+                // that is "no data yet", not a query failure.
+                let result;
+                try {
+                    result = await wireCall(session, { path: ENDPOINTS.runtimeQueryList, method: "POST", body });
+                }
+                catch (error) {
+                    if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.emptyModelErrcode) {
+                        return { schemaCode: args.schemaCode, total: 0, totalPages: 0, page: args.page ?? 0, size: args.size ?? 10, items: [] };
+                    }
+                    throw error;
+                }
+                const page = extractBizObjectPage(result.data);
+                const items = page.content.map((row) => {
+                    const rawData = row.data && typeof row.data === "object" ? row.data : {};
+                    // Round 10: default-compact each row with the SAME known-noise filter
+                    // data.load uses (`*_` flow internals + owner/creater/dept blobs), so a
+                    // list read no longer ships engine fields the caller then filters out.
+                    // Explicit `fields` still projects exactly what was asked, and
+                    // `full:true` keeps the untouched row.
+                    const data = args.full === true ? rawData : compactRuntimeRecord(rawData);
+                    const selected = fields ?? Object.keys(data).filter((field) => !["id", "bizObjectId", "schemaCode", "sequenceStatus", "createdTime", "updatedTime", "creator", "updater"].includes(field));
+                    return { id: row.bizObjectId ?? row.id ?? data.id, fields: Object.fromEntries(selected.map((field) => [field, data[field] ?? null])) };
+                });
+                const readback = {
+                    schemaCode: args.schemaCode,
+                    ...(args.queryCode !== undefined ? { queryCode: args.queryCode } : {}),
+                    total: args.showTotal === false ? null : page.total,
+                    totalPages: page.totalPages,
+                    page: page.page ?? args.page ?? 0,
+                    size: page.size ?? args.size ?? 20,
+                    items,
+                };
+                // A model's unconfigured default list view projects business columns as
+                // null even though the stored values exist (ticket 07). Only when the
+                // caller explicitly projected columns, EVERY returned row yielded null
+                // for EVERY selected column, and the published metadata confirms those
+                // are real model fields, surface the recovery hint. `items` is never
+                // reshaped — the hint is a sibling readback field.
+                if (fields &&
+                    fields.length > 0 &&
+                    items.length > 0 &&
+                    items.every((item) => fields.every((field) => item.fields[field] === null))) {
+                    const typeByCode = await publishedTypeByCode();
+                    if (fields.every((field) => typeByCode.has(field)))
+                        readback.projectionHint = RUNTIME_DATA_WIRE.projectionHint;
+                }
+                return readback;
+            }, { full: args.full === true, target: `data.list:${JSON.stringify({ schemaCode: args.schemaCode, queryCode: args.queryCode ?? args.schemaCode, filter: args.filter, filters: args.filters, filterGroup: args.filterGroup, rawCondition: args.rawCondition, displayFields: args.displayFields, columns: args.columns, page: args.page ?? 0, size: args.size ?? 10 })}` });
+        },
+    }));
+    tools.push(defineTool({
+        name: "data.load",
+        layer: "low",
+        kind: "read",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.load"].scope,
+        description: RUNTIME_TOOLS["data.load"].description,
+        inputSchema: {
+            environment: environmentArg,
+            schemaCode: z.string(),
+            bizObjectId: z.string({ required_error: "bizObjectId 必填（业务对象 id；参数名是 bizObjectId，不是 id。从 data.submit 读回的 objectId/sequenceNo 或 data.list 的 row.bizObjectId 取）" }),
+            full: z.boolean().optional().describe("返回未裁剪的完整业务对象（含 owner/creater 等系统字段；默认返回业务字段+身份的精简记录）"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => {
+            const includeSchema = !ctx.schemaCache.has(args.schemaCode);
+            return governedRead(ctx, self, args, async (session) => {
+                let result;
+                try {
+                    result = await wireCall(session, {
+                        path: ENDPOINTS.runtimeFormLoad,
+                        query: { schemaCode: args.schemaCode, sheetCode: args.schemaCode, objectId: args.bizObjectId },
+                    });
+                }
+                catch (error) {
+                    // An absent (e.g. deleted) object answers the business error 304001
+                    // 业务对象不存在. That is AUTHORITATIVE ABSENCE, not a governance
+                    // refusal — surfacing it as policy-refused misleads a cleanup check
+                    // (bench18 verified a delete by data.load and got policy-refused).
+                    if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.absenceErrcode)
+                        return { schemaCode: args.schemaCode, bizObjectId: args.bizObjectId, exists: false, data: null, note: "业务对象不存在（304001 = 缺席信号，非失败）" };
+                    throw error;
+                }
+                // Flat record contract: live FormLoadVO business fields normalize
+                // out of `bizObject.data` (ticket 17).
+                const normalized = normalizeLoadedRecord(result.data && typeof result.data === "object" ? result.data : null);
+                let data = normalized ?? result.data;
+                if (data && typeof data === "object" && !Array.isArray(data)) {
+                    if (!includeSchema)
+                        delete data.bizSchema;
+                    if (args.full !== true)
+                        data = compactRuntimeRecord(data);
+                }
+                if (includeSchema)
+                    ctx.schemaCache.add(args.schemaCode);
+                return { schemaCode: args.schemaCode, bizObjectId: args.bizObjectId, exists: data != null, ...(includeSchema ? {} : { schemaCached: true }), data };
+            }, { full: args.full === true, target: `data.load:${args.schemaCode}:${args.bizObjectId}` });
+        },
+    }));
+    writeTool(tools, "data.save", RUNTIME_LANE, RUNTIME_TOOLS["data.save"].scope, RUNTIME_TOOLS["data.save"].description, {
+        schemaCode: z.string().min(1),
+        sheetCode: z.string().optional(),
+        formData: runtimeFormDataArg,
+        workflowCode: z.string().optional().describe("portal draft-save shape: create the row AND a DRAFT workflow instance + start workItem (finishStart=FALSE); submit later via data.submit with the returned workItemId. formData must NOT carry an id — in-place workflow start has no REST surface in 8.6.26"),
+        ...readbackProjectionArgs,
+    }, async (session, args) => {
+        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
+            // Portal draft-save shape. The row id travels in data.id (the portal
+            // form SDK receives a pre-generated id from form/load and echoes it);
+            // BizObjectModel.getId() reads data["id"], so a client-chosen id is
+            // echoed back as FormSaveVO.objectId. An id that already exists in
+            // the store would hit the create-path INSERT duplicate (40000), so an
+            // existing id is refused up front.
+            const suppliedId = typeof formData.id === "string" ? formData.id.trim() : "";
+            if (suppliedId) {
+                const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, suppliedId);
+                if (existing) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "save-workflow-draft-with-id-unsupported",
+                        schemaCode: args.schemaCode,
+                        bizObjectId: suppliedId,
+                        workflowCode: args.workflowCode,
+                        message: "workflow draft-save always INSERTs in 8.6.26 (no REST in-place start for an existing row); use a fresh id or no id, or submit an existing workflow draft via data.submit with its workItemId",
+                    });
+                }
+            }
+            const objectId = suppliedId || randomUUID().replaceAll("-", "");
+            // isStartWf branch runs verifyReplay; the instance is DRAFT only when
+            // data carries sequenceStatus DRAFT (an empty default builds PROCESSING).
+            const replayToken = await getReplayToken(session);
+            const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
+                path: ENDPOINTS.runtimeFormSave,
+                method: "POST",
+                body: {
+                    workflowCode: args.workflowCode,
+                    ...(replayToken ? { replayToken } : {}),
+                    bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
+                },
+            }), formData);
+            const vo = (performed.data ?? {});
+            const returnedId = typeof vo.objectId === "string" && vo.objectId ? vo.objectId : typeof vo.bizObjectId === "string" && vo.bizObjectId ? vo.bizObjectId : objectId;
+            const workflowInstanceId = typeof vo.workflowInstanceId === "string" ? vo.workflowInstanceId : null;
+            // saveWorkflow resolves the start workItem via getWorkItem INSIDE the
+            // still-uncommitted request transaction (autoCommit:false), so the live
+            // FormSaveVO usually omits workItem. The committed row is visible to a
+            // follow-up search_workitems read; resolve the pending start todo by
+            // exact instanceId (the server filter is a NOT-equal exclusion).
+            let workItem = vo.workItem;
+            let workItemId = workItem && typeof workItem.id === "string" ? workItem.id : null;
+            let workItemSource = workItemId ? "form-save" : null;
+            if (!workItemId && workflowInstanceId) {
+                // search_workitems via the shared workflow seam (ticket 21): exact
+                // instanceId match is client-side (the server filter is a NOT-equal
+                // exclusion); the seam's default size 200 is the unified scan width.
+                const found = await searchWorkItems(session, {
+                    workflowCode: args.workflowCode,
+                    instanceId: workflowInstanceId,
+                });
+                const matchId = found.items.length > 0 ? wireString(found.items[0].id) : null;
+                if (matchId) {
+                    workItemId = matchId;
+                    workItemSource = "workitem-search";
+                }
+            }
+            let readbackData = null;
+            let sequenceStatus = null;
+            readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: returnedId } })).data;
+            sequenceStatus = extractSequenceStatus((readbackData ?? {}));
+            return {
+                performed: { errcode: performed.errcode, bizObjectId: returnedId, workflowInstanceId, workItemId, workItemSource, sheetCode, resolvedFrom, formType: "save-draft-workflow" },
+                readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
+            };
+        }
+        const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
+            path: ENDPOINTS.runtimeFormSave,
+            method: "POST",
+            body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
+        }), formData);
+        const bizObjectId = performed.data?.bizObjectId ?? performed.data?.objectId ?? performed.data;
+        let readbackData = null;
+        if (typeof bizObjectId === "string" && bizObjectId) {
+            readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } })).data;
+        }
+        return {
+            performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom },
+            readback: {
+                authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args),
+                // Ticket 111: a plain save lands as sequenceStatus DRAFT, and DRAFT
+                // rows SKIP the Create/Update rule dispatch entirely
+                // (DomainServiceImpl.java:240-248 buckets drafts before the rule
+                // branch) — business rules only run once data.submit advances the
+                // row. Saying so on every plain-save readback prevents the
+                // "rule didn't fire" misdiagnosis.
+                draftRuleHint: "草稿态（DRAFT）保存不触发业务规则——DRAFT 行跳过 Create/Update 分发（DomainServiceImpl.java:240-248）；data.submit 提交（DRAFT→COMPLETED）后才触发 Create 规则",
+            },
+        };
+    });
+    writeTool(tools, "data.update", RUNTIME_LANE, RUNTIME_TOOLS["data.update"].scope, RUNTIME_TOOLS["data.update"].description, {
+        schemaCode: z.string().min(1),
+        sheetCode: z.string().optional(),
+        bizObjectId: z.string().min(1).describe("id of the EXISTING record to edit; the tool refuses when it is absent (never silently inserts)"),
+        formData: runtimeFormDataArg.describe("fields to change, keyed by field code; the platform merges them onto the stored record, so omitted fields keep their value (patch semantics)"),
+        ...readbackProjectionArgs,
+    }, async (session, args) => {
+        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+        const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, args.bizObjectId);
+        if (!existing) {
+            // The platform's save-with-id path silently inserts when the id is
+            // unknown (BizObjectFacadeImpl.createBizObject). Refuse instead of
+            // turning an edit into an accidental create.
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "update-target-absent",
+                errcode: RUNTIME_DATA_WIRE.absenceErrcode,
+                schemaCode: args.schemaCode,
+                bizObjectId: args.bizObjectId,
+                sheetCode,
+                message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
+            });
+        }
+        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const performed = await wireCall(session, {
+            path: ENDPOINTS.runtimeFormSave,
+            method: "POST",
+            // Live-proven shape: BizObjectModel.getId() reads data["id"], so the
+            // target id MUST travel inside `data`; a top-level bizObject.id is
+            // ignored and the platform silently creates a new row.
+            body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: args.bizObjectId } } },
+        });
+        const performedData = (performed.data ?? {});
+        const returnedId = typeof performedData.objectId === "string" ? performedData.objectId : typeof performedData.bizObjectId === "string" ? performedData.bizObjectId : args.bizObjectId;
+        const readbackData = await loadExistingBizObject(session, args.schemaCode, sheetCode, returnedId);
+        const sequenceStatus = extractSequenceStatus(readbackData);
+        return {
+            performed: { errcode: performed.errcode, bizObjectId: returnedId, sheetCode, resolvedFrom },
+            // Flat record contract (ticket 17): live FormLoadVO normalizes to the
+            // fake's flat field shape so `authoritative.<fieldCode>` reads work on
+            // both faces.
+            readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord(readbackData), args), sequenceStatus },
+        };
+    });
+    /**
+     * Round 16b (dogfood R1-R3): `data.delete`'s `absent:true` only proves THAT id is
+     * gone, not that the model is clean — a submit can leave a separate draft row
+     * behind. After a delete, read the model's residue so "cleaned up" is a
+     * model-level fact (`total:0`). Best-effort: a query failure never fails the
+     * delete, but it IS surfaced as `modelResidueError`.
+     */
+    async function modelResidue(session, schemaCode, sheetCode) {
+        try {
+            const result = await wireCall(session, {
+                path: ENDPOINTS.runtimeQueryList,
+                method: "POST",
+                body: { schemaCode, queryCode: schemaCode, filters: [], mobile: false, page: 0, size: 1, queryVersion: 1, showTotal: true },
+            });
+            const page = extractBizObjectPage(result.data);
+            return { modelResidue: { total: page.total, clean: page.total === 0, sheetCode } };
+        }
+        catch (error) {
+            if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.emptyModelErrcode)
+                return { modelResidue: { total: 0, clean: true, sheetCode } };
+            return { modelResidue: { total: null, clean: null, sheetCode, modelResidueError: error instanceof Error ? error.message : String(error) } };
+        }
+    }
+    writeTool(tools, "data.delete", RUNTIME_LANE, RUNTIME_TOOLS["data.delete"].scope, RUNTIME_TOOLS["data.delete"].description, { schemaCode: z.string().min(1), sheetCode: z.string().optional(), bizObjectId: z.string().min(1).optional(), bizObjectIds: z.array(z.string().min(1)).optional().describe("批量删除多个业务对象 id（等价于逐个 data.delete，但只花一次往返；返回 deleted 列表）") }, async (session, args) => {
+        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+        const ids = args.bizObjectIds && args.bizObjectIds.length > 0 ? args.bizObjectIds : args.bizObjectId ? [args.bizObjectId] : [];
+        if (ids.length === 0)
+            throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "data.delete", message: "需要 bizObjectId（单个）或 bizObjectIds（数组，批量）" });
+        const deleteOne = async (bizObjectId) => {
+            // Delete is destructive: probe the authoritative object first so an
+            // absent id is an idempotent no-op, never a blind runtime delete.
+            const before = await loadExistingBizObject(session, args.schemaCode, sheetCode, bizObjectId);
+            if (!before)
+                return { bizObjectId, skipped: "already-absent", absent: true };
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.runtimeFormDelete,
+                method: "POST",
+                query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId },
+            });
+            // The absence readback: a missing object surfaces either as an empty
+            // payload or as a business error (304001 业务对象不存在) from form/load.
+            // Both are authoritative absence, not a delete failure.
+            let absent = false;
+            try {
+                const readback = await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } });
+                const value = readback.data;
+                absent = value == null || value === false;
+            }
+            catch (error) {
+                if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.absenceErrcode)
+                    absent = true;
+                else
+                    throw error;
+            }
+            return { bizObjectId, errcode: performed.errcode, absent };
+        };
+        if (ids.length === 1) {
+            const one = await deleteOne(ids[0]);
+            if (one.skipped === "already-absent")
+                return { performed: { skipped: "already-absent", sheetCode, resolvedFrom }, readback: { absent: true, recoveryHint: "id 不存在（already-absent≠删除成功）：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏，shell 空值兜底出来的 id 同样删不掉任何东西。若 modelResidue.total>0，用 items[].id 重删。", ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+            return { performed: { errcode: one.errcode, sheetCode, resolvedFrom }, readback: { absent: one.absent, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+        }
+        const deleted = [];
+        for (const id of ids)
+            deleted.push(await deleteOne(id));
+        // `deleted`/`count` ride `readback` — the write envelope surfaces only
+        // performed/readback inline (extra top-level keys are artifact-only).
+        return { performed: { sheetCode, resolvedFrom }, readback: { absent: true, count: deleted.length, deleted, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+    });
+    writeTool(tools, "data.submit", RUNTIME_LANE, RUNTIME_TOOLS["data.submit"].scope, RUNTIME_TOOLS["data.submit"].description, {
+        schemaCode: z.string().min(1),
+        sheetCode: z.string().optional(),
+        formData: runtimeFormDataArg,
+        workflowCode: z.string().optional(),
+        workflowInstanceId: z.string().optional(),
+        workItemId: z.string().optional(),
+        bizObjectId: z.string().optional().describe("existing record id; REQUIRED for workItem approval submits (formType=1 + workItemId) — the submit's bizObject must reference the in-flight record or the engine NPEs (DataChangeHandlerImpl.changeBizObject)"),
+        agree: z.boolean().optional(),
+        approval: z.record(z.string(), z.unknown()).optional(),
+        runMode: z.string().optional(),
+        isSimulative: z.boolean().optional(),
+        ...readbackProjectionArgs,
+    }, async (session, args) => {
+        const hasWorkItem = typeof args.workItemId === "string" && args.workItemId.trim().length > 0;
+        const hasInstance = typeof args.workflowInstanceId === "string" && args.workflowInstanceId.trim().length > 0;
+        const targetObjectId = typeof args.bizObjectId === "string" && args.bizObjectId.trim() ? args.bizObjectId.trim() : null;
+        if ((hasWorkItem || hasInstance) && !targetObjectId) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-biz-object-id-required",
+                schemaCode: args.schemaCode,
+                workItemId: args.workItemId,
+                workflowInstanceId: args.workflowInstanceId,
+                message: "workItemId or workflowInstanceId submit requires bizObjectId; refusing before runtime/form/submit",
+            });
+        }
+        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        // Portal required-field semantics: the REST submit does NOT enforce them,
+        // so a missing required value must be REPORTED, not silently accepted as a
+        // portal-valid submit (dogfood R3). Best-effort read; a failure never
+        // blocks the submit.
+        const validation = await portalRequiredViolations(session, args.schemaCode, sheetCode, args.formData).catch(() => ({ requiredFields: [], missingRequired: [] }));
+        // Directive: a workflow-backed model's submit must START the workflow, not
+        // merely save a sheet row. When the caller names no workflow params, detect
+        // the model's workflow and start it (formType=1 + workflowCode); a model
+        // with no workflow stays a direct sheet submit (formType=2 -> COMPLETED).
+        let explicitWorkflowCode = typeof args.workflowCode === "string" && args.workflowCode.trim().length > 0 ? args.workflowCode.trim() : "";
+        let autoStarted = false;
+        if (!explicitWorkflowCode && !hasWorkItem && !hasInstance) {
+            const resolved = await resolvePublishedWorkflowCode(session, args.schemaCode);
+            if (resolved) {
+                explicitWorkflowCode = resolved;
+                autoStarted = true;
+            }
+        }
+        const hasWorkflowCode = explicitWorkflowCode.length > 0;
+        const hasWorkflow = hasWorkflowCode || hasWorkItem || hasInstance;
+        const formType = hasWorkflow ? "1" : "2";
+        const payload = {
+            formType,
+            bizObject: {
+                schemaCode: args.schemaCode,
+                sheetCode,
+                data: args.formData,
+            },
+            agree: args.agree !== false,
+        };
+        let draftObjectId = null;
+        if (targetObjectId && hasWorkflowCode && !hasWorkItem && !hasInstance) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-existing-workflow-unsupported",
+                schemaCode: args.schemaCode,
+                bizObjectId: targetObjectId,
+                workflowCode: explicitWorkflowCode,
+                message: "8.6.26 has no REST in-place workflow start for an existing no-instance row (submitWorkflowByWorkflowCode -> createAndGetBizObject INSERTs -> 40000 duplicate primary key; the load+update starter is facade-only). Supported shape: create workflow drafts via data.save with workflowCode (returns same-id row + DRAFT instance + start workItemId), then data.submit with that workItemId + workflowInstanceId + bizObjectId",
+            });
+        }
+        let preSubmitExisting = null;
+        if (targetObjectId) {
+            const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, targetObjectId);
+            preSubmitExisting = existing;
+            if (!existing) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-target-absent",
+                    errcode: RUNTIME_DATA_WIRE.absenceErrcode,
+                    schemaCode: args.schemaCode,
+                    bizObjectId: targetObjectId,
+                    sheetCode,
+                    message: "no live business object with this id; refusing to submit (the platform would otherwise create a new row)",
+                });
+            }
+            // Direct-submit chain (ticket 18): form/submit persists bizObject.data
+            // itself — formType=2 submitBizSheet -> saveBizObject (sets COMPLETED,
+            // merges via updateBizObject.mergeObject); formType=1 workItem ->
+            // SubmitDataChangeHandlerImpl.updateBizObject — so the historical
+            // pre-submit form/save + form/load round-trip is redundant wire. The
+            // submit bizObject is synthesized from the authoritative pre-check
+            // load overlaid with the caller's formData.
+            const flat = normalizeLoadedRecord(existing) ?? {};
+            payload.bizObject = {
+                id: targetObjectId,
+                schemaCode: args.schemaCode,
+                sheetCode,
+                ownerId: typeof flat.ownerId === "string" ? flat.ownerId : undefined,
+                // Engine-owned keys must never be echoed back: the loaded row's
+                // `sequenceStatus: DRAFT` would be persisted verbatim and pin the
+                // row to DRAFT across submits (the portal client never resubmits
+                // the status column; live TID 10e6bc65 evidence, ticket 17).
+                data: stripEngineOwnedKeys({ ...flat, ...formData }),
+            };
+            if (formType === "2")
+                payload.actionCode = "submit";
+            draftObjectId = targetObjectId;
+        }
+        else if (formType === "2") {
+            const saved = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.submit 运行时提交稳定失败（50000）", () => wireCall(session, {
+                path: ENDPOINTS.runtimeFormSave,
+                method: "POST",
+                body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
+            }));
+            const savedData = (saved.data ?? {});
+            draftObjectId = typeof savedData.bizObjectId === "string" ? savedData.bizObjectId : typeof savedData.objectId === "string" ? savedData.objectId : null;
+            if (!draftObjectId)
+                throw new WireError("business", "submit chain: draft save returned no bizObjectId", 304001);
+            // No post-save form/load (ticket 18): the submit persists
+            // bizObject.data itself and updateBizObject merges patch-style onto
+            // the stored row, and initSubmitBizObject.setOwner re-reads the
+            // stored row's owner server-side — so formData + the saved id is the
+            // complete submit payload.
+            payload.bizObject = {
+                id: draftObjectId,
+                schemaCode: args.schemaCode,
+                sheetCode,
+                data: stripEngineOwnedKeys(formData),
+            };
+            payload.actionCode = "submit";
+        }
+        let replayToken;
+        if (hasWorkflowCode && !hasWorkItem && !hasInstance) {
+            // Starting a workflow (formType=1 + workflowCode, no workItem) requires
+            // a replayToken pre-registered in Redis via GET /runtime/form/getReplayToken
+            // (AbstractFormRuntimeController.verifyReplay -> SYS_REPLAY_ERROR 100005).
+            replayToken = await getReplayToken(session);
+        }
+        if (hasWorkflowCode)
+            payload.workflowCode = explicitWorkflowCode;
+        if (replayToken)
+            payload.replayToken = replayToken;
+        if (typeof args.workflowInstanceId === "string")
+            payload.workflowInstanceId = args.workflowInstanceId;
+        if (typeof args.workItemId === "string")
+            payload.workItemId = args.workItemId;
+        if (args.approval && typeof args.approval === "object")
+            payload.approval = args.approval;
+        if (typeof args.runMode === "string")
+            payload.runMode = args.runMode;
+        if (typeof args.isSimulative === "boolean")
+            payload.isSimulative = args.isSimulative;
+        const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.submit 运行时提交稳定失败（50000）", () => wireCall(session, {
+            path: ENDPOINTS.runtimeFormSubmit,
+            method: "POST",
+            body: payload,
+        }));
+        const performedData = (performed.data ?? {});
+        let readback = { formType };
+        if (formType === "2") {
+            const objectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
+            if (!objectId) {
+                // Source contract: submitBizSheet ALWAYS returns objectId.
+                // Absence is a transport / protocol deviation — never paper over
+                // it with a fabricated sequenceStatus:COMPLETED.
+                return {
+                    performed: { errcode: performed.errcode, sheetCode, resolvedFrom, formType, draftObjectId },
+                    readback: { formType, sequenceStatus: null, missingObjectId: true },
+                };
+            }
+            if (targetObjectId && objectId !== targetObjectId) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-target-id-changed",
+                    expectedBizObjectId: targetObjectId,
+                    actualBizObjectId: objectId,
+                    message: "runtime/form/submit returned a different object id; refusing to accept a new row",
+                });
+            }
+            const load = await wireCall(session, {
+                path: ENDPOINTS.runtimeFormLoad,
+                query: { schemaCode: args.schemaCode, sheetCode, objectId },
+            });
+            const loaded = (load.data ?? {});
+            const record = normalizeLoadedRecord(loaded) ?? {};
+            const sequenceStatus = extractSequenceStatus(record);
+            readback = {
+                ...readback,
+                objectId,
+                schemaCode: typeof performedData.schemaCode === "string" ? performedData.schemaCode : args.schemaCode,
+                formCode: typeof performedData.formCode === "string" ? performedData.formCode : sheetCode,
+                sequenceStatus,
+                ...(sequenceStatus === null ? { missingSequenceStatus: true } : {}),
+                submittedData: projectReadbackRecord(record, args),
+            };
+        }
+        else {
+            const returnedObjectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
+            if (targetObjectId && returnedObjectId !== targetObjectId) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-target-id-changed",
+                    expectedBizObjectId: targetObjectId,
+                    actualBizObjectId: returnedObjectId,
+                    message: "runtime/form/submit returned a different object id; refusing to accept a new row",
+                });
+            }
+            const workflowInstanceId = typeof performedData.workflowInstanceId === "string" ? performedData.workflowInstanceId : null;
+            const objectId = returnedObjectId ?? targetObjectId;
+            // Workflow engine status writes can lag the submit response
+            // (autoCommit): an immediate authoritative form/load may still show
+            // the pre-submit status. Poll briefly when a workflow submit reads
+            // back unchanged — a genuinely unchanged mid-flow status costs one
+            // short bounded wait, a lagged boundary transition resolves.
+            const preSubmitStatus = preSubmitExisting ? extractSequenceStatus(preSubmitExisting) : null;
+            let loaded = objectId ? await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId) : null;
+            let sequenceStatus = extractSequenceStatus(loaded);
+            for (let attempt = 0; objectId && sequenceStatus !== null && sequenceStatus === preSubmitStatus && attempt < 3; attempt += 1) {
+                await new Promise((resolve) => setTimeout(resolve, 400));
+                loaded = await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId);
+                sequenceStatus = extractSequenceStatus(loaded);
+            }
+            const loadedRecord = normalizeLoadedRecord(loaded);
+            // The platform's submit response often omits workflowInstanceId (the fake
+            // start path returns only {result, objectId}); the authoritative loaded
+            // row carries it. Prefer the response, then the row.
+            const effectiveInstanceId = workflowInstanceId ?? extractWorkflowInstanceId(loaded) ?? (loadedRecord && typeof loadedRecord.workflowInstanceId === "string" && loadedRecord.workflowInstanceId ? loadedRecord.workflowInstanceId : null);
+            readback = {
+                ...readback,
+                workflowInstanceId: effectiveInstanceId,
+                objectId,
+                workItemId: typeof performedData.workItemId === "string" ? performedData.workItemId : null,
+                sequenceStatus,
+                submittedData: projectReadbackRecord(loadedRecord, args),
+            };
+            // Multi-level approval: after a submit advances the flow, the caller
+            // almost always needs the NEXT pending todo — bench52/53 paid an extra
+            // `workitem.list` wire call at every approval level because the submit
+            // response carried only the object id. Attach the pending work items for
+            // this instance while the flow is still in flight (best-effort: a lookup
+            // failure must never fail the submit).
+            if (hasWorkflow && effectiveInstanceId && sequenceStatus !== "COMPLETED") {
+                try {
+                    const pending = await searchWorkItems(session, { instanceId: effectiveInstanceId });
+                    const nextWorkItems = pending.items.slice(0, 5).map((item) => ({
+                        workItemId: wireString(item.id),
+                        activityCode: wireString(item.activityCode),
+                        activityName: wireString(item.activityName),
+                        state: wireString(item.state),
+                    }));
+                    if (nextWorkItems.length > 0) {
+                        readback.nextWorkItems = nextWorkItems;
+                        // The submit RESPONSE's own workItemId is null (it names the item
+                        // just completed, not the next one). Expose the fully-formed args
+                        // for the NEXT approval so a multi-level flow advances without an
+                        // extra workitem.list round or guessing which id to use.
+                        readback.nextSubmit = {
+                            schemaCode: args.schemaCode,
+                            workItemId: nextWorkItems[0].workItemId,
+                            workflowInstanceId: effectiveInstanceId,
+                            bizObjectId: objectId,
+                            note: "下一级审批：用这些字段调 data.submit（同意传 agree:true / formData 回填）。",
+                        };
+                    }
+                }
+                catch {
+                    // best-effort
+                }
+            }
+        }
+        return {
+            performed: {
+                errcode: performed.errcode,
+                sheetCode,
+                resolvedFrom,
+                formType,
+                ...(draftObjectId ? { draftObjectId } : {}),
+                // The workflow was auto-detected and started (formType=1) rather than
+                // saved as a bare sheet row — surfaced so the caller knows the row is
+                // now a PROCESSING workflow instance, not an orphan sheet record.
+                ...(autoStarted ? { autoStartedWorkflow: explicitWorkflowCode } : {}),
+            },
+            readback: {
+                ...readback,
+                // Portal-required semantics are NOT enforced by the REST submit path;
+                // say exactly what the tool checked so `ok` is never mistaken for
+                // "the portal would have accepted this" (dogfood R3). This is a
+                // SEPARATE concern from server-side business rules (which DO run on
+                // submit) — name that so `portalRulesExecuted:false` is not misread as
+                // "no rule ran" (dogfood R2).
+                portalRulesExecuted: false,
+                portalRulesNote: "portalRulesExecuted 只指门户客户端的必填/控件校验未在 REST 提交时执行；服务端业务规则（含流程 end 规则）照常运行。",
+                requiredFields: validation.requiredFields,
+                missingRequired: validation.missingRequired,
+                ...(validation.missingRequired.length > 0
+                    ? {
+                        portalValidationWarning: `已提交但**未执行门户必填校验**：${validation.missingRequired.join("、")} 在发布表单里是必填，本次 formData 为空/缺省。REST runtime/form/submit 不跑门户客户端校验；如需真正阻断，请在提交前自行校验，或在服务端规则里加必填约束。`,
+                    }
+                    : {}),
+                // Round 16b (dogfood R1-R3): a submit can leave BOTH a draft row and a
+                // committed row, and deleting only the committed id leaves the draft
+                // behind (data.list still counts it). Name both ids so cleanup does not
+                // silently miss one. Round 17 (dogfood R2): when there is only ONE row
+                // (a workflow submit advances the same row), say so explicitly — the
+                // absence of a hint was itself read as an evidence gap.
+                ...(typeof readback.objectId === "string"
+                    ? draftObjectId && readback.objectId !== draftObjectId
+                        ? { cleanupHint: `本次提交产生 draft(${draftObjectId}) 与 committed(${String(readback.objectId)}) 两条记录；验收后两条都要 data.delete，直到 data.list total=0。` }
+                        : { cleanupHint: `本次提交只有一条记录（${String(readback.objectId)}）；验收后 data.delete 该 id，直到 data.list total=0。` }
+                    : {}),
+            },
+        };
+    });
+}
+//# sourceMappingURL=runtime-data.js.map