@stalfh233/omc-cli 0.4.53 → 0.4.54

package/dist/approval-flow.js

@@ -19,6 +19,7 @@
 import { runToolCall } from "./call.js";
 import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
+import { argvValue } from "./args.js";
 /** 解析步骤 DSL 为 {name, participant}（导出供测试）。 */
 export function parseStep(raw) {
     const match = /^(.+?)@(role|user):([A-Za-z0-9_.:-]+)$/.exec(raw.trim());
@@ -55,15 +56,15 @@ export function composeApprovalTemplate(options) {
 }
 export async function cmdApprovalFlow(args) {
     const request = requestId();
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     const multi = (name) => {
         const values = [];
+        const prefix = `${name}=`;
         for (let i = 0; i < args.length; i++) {
             if (args[i] === name && args[i + 1] !== undefined)
                 values.push(args[i + 1]);
+            else if (args[i] !== undefined && args[i].startsWith(prefix))
+                values.push(args[i].slice(prefix.length));
         }
         return values;
     };

package/dist/args.js

@@ -22,4 +22,18 @@ export const confirmProductionArg = z
  * review (omc-config-draft-review).
  */
 export const WRITE_PROTOCOL = "写入由环境 writable 决定（只读环境拒写）；生产环境的写必须带 confirmProduction:true（高危确认，记入审计）；写前仍走对话层草稿确认（omc-config-draft-review）。";
+/**
+ * CLI argv flag reader. Accepts BOTH `--name value` and `--name=value` — a
+ * sandbox probe (r4, 2026-10-17) passed `--steps='审批@role:x'` and the
+ * separate-token-only parser answered "至少一个 --steps 审批步骤", pushing the
+ * agent to bypass the composer and hand-build the workflow.
+ */
+export function argvValue(args, name) {
+    const prefix = `${name}=`;
+    const inline = args.find((token) => token.startsWith(prefix));
+    if (inline !== undefined)
+        return inline.slice(prefix.length);
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
 //# sourceMappingURL=args.js.map

package/dist/cli-output.js

@@ -26,9 +26,22 @@ export function configureOutput(argv) {
  * are consumed once here instead of being declared on every subcommand.
  */
 export function stripOutputFlags(argv) {
+    // Normalize `--flag=value` into two tokens BEFORE commander parses: the
+    // dispatcher's variadic options (`--steps`, `--when`, `--then`) drop the
+    // equals form (a real sandbox call `--steps=x` answered "至少一个 --steps
+    // 审批步骤"), and every other subcommand gets the same courtesy for free.
+    const normalized = [];
+    for (const token of argv) {
+        if (token.startsWith("--") && token.includes("=")) {
+            const at = token.indexOf("=");
+            normalized.push(token.slice(0, at), token.slice(at + 1));
+        }
+        else
+            normalized.push(token);
+    }
     const out = [];
-    for (let index = 0; index < argv.length; index += 1) {
-        const token = argv[index];
+    for (let index = 0; index < normalized.length; index += 1) {
+        const token = normalized[index];
         if (token === "--quiet" || token === "--verbose")
             continue;
         if (token === "--out") {

package/dist/cli.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 // T04：SQLite 警告过滤器必须保持第一个 import（先于任何拉起 omc-core/node:sqlite 的模块）。
 import "./sqlite-warning-filter.js";
+import { argvValue } from "./args.js";
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { stdin, argv } from "node:process";
 import { createRequire } from "node:module";
-import { Command, CommanderError } from "commander";
+import { Command, CommanderError, Option } from "commander";
 import { ConfigStore, defaultPaths, removedProfileKeys } from "./config-store.js";
 import { loadCoverageManifest, versionFamilyNotice } from "./coverage.js";
 import { redactText } from "./redact.js";
@@ -64,10 +65,7 @@ async function askSecret(question) {
     });
 }
 async function cmdSetup(store, args) {
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     if (args.includes("--list")) {
         for (const { name, profile } of store.listEnvironments())
             console.error(`${name}${profile.isDefault ? "（默认）" : ""} [${profile.production ? "生产环境" : "测试环境"}，${environmentWritable(profile) ? "允许写入" : "只读"}${profile.production ? "（生产写需逐笔 confirmProduction）" : ""}${removedProfileKeys(profile).length > 0 ? `，⚠ 含已移除键：${removedProfileKeys(profile).join("、")}` : ""}] -> ${profile.baseUrl} 应用=${profile.applicationCode}${profile.engineCode ? ` 租户=${profile.engineCode}` : ""}`);
@@ -233,8 +231,7 @@ function doctorAnchor() {
     ].join("\n");
 }
 function flag0(args, name) {
-    const index = args.indexOf(name);
-    return index >= 0 ? args[index + 1] : undefined;
+    return argvValue(args, name);
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function cmdCall(store, args) {
@@ -255,10 +252,7 @@ async function cmdCall(store, args) {
         writeEnvelope(envelope(status, boundResult(result, maxOutputBytes), request, classified.error));
         return exitCode;
     };
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     const positional = args.filter((token, index) => !token.startsWith("--") && (index === 0 || !args[index - 1]?.startsWith("--env") && !args[index - 1]?.startsWith("--environment") && !args[index - 1]?.startsWith("--args")));
     const toolName = positional[0];
     if (!toolName || toolName === "help" || args.includes("--help")) {
@@ -950,11 +944,15 @@ async function main() {
         const rest = ["compute", ...(options.schema ? ["--schema", options.schema] : []), ...(options.schemaCode ? ["--schema-code", options.schemaCode] : []), ...(options.target ? ["--target", options.target] : []), ...(options.property ? ["--property", options.property] : []), ...(options.formula !== undefined ? ["--formula", options.formula] : []), ...(options.name ? ["--name", options.name] : []), ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.apply ? ["--apply"] : [])];
         commandExitCode = await cmdCompute(rest);
     });
-    command.command("rule-when").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--on <trigger>").option("--when <condition>", undefined, { variadic: true }).option("--then <action>", undefined, { variadic: true }).option("--name <name>").option("--env <environment>").option("--environment <environment>").option("--apply").addHelpText("after", "\n条件-动作规则拼装器：--when 条件（可多个 AND）→ --then set:字段=值/引用/公式。编译为设计器验证形状（预置触发+UPDATE filter/赋值）。默认 dry-run，--apply 保存并发布；前台生效按输出清单人工验证。\n").action(async (options) => {
+    // Commander 14 needs a real variadic Option; the old `{variadic:true}` cast
+    // landed in the argParser slot and silently dropped every --steps value
+    // (live 2026-10-18: `--steps "审批@role:x"` answered "至少一个 --steps").
+    const collectValues = (value, previous = []) => [...previous, value];
+    command.command("rule-when").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--on <trigger>").addOption(new Option("--when <condition>", "条件，可重复").argParser(collectValues).default([])).addOption(new Option("--then <action>", "动作，可重复").argParser(collectValues).default([])).option("--name <name>").option("--env <environment>").option("--environment <environment>").option("--apply").addHelpText("after", "\n条件-动作规则拼装器：--when 条件（可多个 AND）→ --then set:字段=值/引用/公式。编译为设计器验证形状（预置触发+UPDATE filter/赋值）。默认 dry-run，--apply 保存并发布；前台生效按输出清单人工验证。\n").action(async (options) => {
         const rest = ["rule-when", ...(options.schema ? ["--schema", options.schema] : []), ...(options.schemaCode ? ["--schema-code", options.schemaCode] : []), ...(options.on ? ["--on", options.on] : []), ...(Array.isArray(options.when) ? options.when.flatMap((w) => ["--when", w]) : []), ...(Array.isArray(options.then) ? options.then.flatMap((a) => ["--then", a]) : []), ...(options.name ? ["--name", options.name] : []), ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.apply ? ["--apply"] : [])];
         commandExitCode = await cmdRuleWhen(rest);
     });
-    command.command("approval-flow").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--steps <step>", undefined, { variadic: true }).option("--env <environment>").option("--environment <environment>").option("--apply").option("--no-originator-node").option("--no-reject-to-start").addHelpText("after", "\n审批流拼装器：--steps 名称@role:<角色code>（多级给多个）。编译为验证模板（START→填写→审批链→END，审批节点字段只读），--apply 建流+权限+发布。\n").action(async (options) => {
+    command.command("approval-flow").option("--schema <schemaCode>").option("--schema-code <schemaCode>").addOption(new Option("--steps <step>", "审批步骤，可重复").argParser(collectValues).default([])).option("--env <environment>").option("--environment <environment>").option("--apply").option("--no-originator-node").option("--no-reject-to-start").addHelpText("after", "\n审批流拼装器：--steps 名称@role:<角色code>（多级给多个）。编译为验证模板（START→填写→审批链→END，审批节点字段只读），--apply 建流+权限+发布。\n").action(async (options) => {
         const rest = ["approval-flow", ...(options.schema ? ["--schema", options.schema] : []), ...(options.schemaCode ? ["--schema-code", options.schemaCode] : []), ...(Array.isArray(options.steps) ? options.steps.flatMap((s) => ["--steps", s]) : []), ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.apply ? ["--apply"] : []), ...(options.originatorNode === false ? ["--no-originator-node"] : []), ...(options.rejectToStart === false ? ["--no-reject-to-start"] : [])];
         commandExitCode = await cmdApprovalFlow(rest);
     });

package/dist/code-rules.js

@@ -33,6 +33,17 @@ export const RESERVED_CODES = new Set([
     "ownerDeptQueryCode",
     "version",
 ].map((code) => code.toLowerCase()));
+/**
+ * SQL 关键字（MySQL 未加引号时的保留字）。平台在 wire 才拒绝（10033
+ * 编码[order]为SQL关键字），这里前置到与 code 格式同层，省一轮建了再改。
+ */
+export const SQL_KEYWORD_CODES = new Set([
+    "order", "group", "key", "index", "desc", "asc", "select", "from", "where", "join",
+    "union", "all", "and", "or", "not", "null", "true", "false", "case", "when", "then",
+    "else", "end", "default", "primary", "foreign", "references", "constraint", "create",
+    "drop", "alter", "insert", "delete", "update", "into", "values", "table", "column",
+    "check", "distinct", "having", "limit", "offset", "by", "left", "right", "inner", "outer",
+]);
 /** Infer the style a code is written in (underscores → snake, else camel). */
 export function inferCodeStyle(code) {
     if (code.includes("_"))
@@ -60,6 +71,12 @@ export function validateBusinessCode(rawCode, options) {
     }
     if (RESERVED_CODES.has(code.toLowerCase()))
         violations.push({ code, classification: "code_reserved", message: `code "${code}" 是平台系统/保留字段编码，业务模型与字段不得使用（会与平台自身列冲突）` });
+    if (SQL_KEYWORD_CODES.has(code.toLowerCase()))
+        violations.push({
+            code,
+            classification: "code_reserved",
+            message: `code "${code}" 是 SQL 关键字（平台会在落库时报 10033 编码[${code}]为SQL关键字）；改成语义后缀，如 ${code}Ref / ${code}No`,
+        });
     return violations;
 }
 /** Convenience for the dry-lint call sites: true when validateBusinessCode has no violations. */

package/dist/compute.js

@@ -16,6 +16,7 @@
 import { runToolCall } from "./call.js";
 import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
+import { argvValue } from "./args.js";
 /** 编译 formula → editorText：每个 {token} 引用包成 <field-mark>裸token</field-mark>。 */
 export function compileEditorText(formula, editorMark) {
     return formula.replace(/\{([^{}]+)\}/g, (_match, token) => `<${editorMark}>${token.trim()}</${editorMark}>`);
@@ -40,10 +41,7 @@ export function composeComputeArgs(options) {
 }
 export async function cmdCompute(args) {
     const request = requestId();
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     const schema = flag("--schema") ?? flag("--schema-code");
     const target = flag("--target") ?? flag("--property");
     const formula = flag("--formula");

package/dist/form-default.js

@@ -16,6 +16,7 @@
 import { runToolCall } from "./call.js";
 import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
+import { argvValue } from "./args.js";
 /** 从 form.get 结果提取控件数组（draft 优先，published 兜底）。 */
 function toControlList(value) {
     if (Array.isArray(value))
@@ -36,10 +37,7 @@ function extractControls(formGet) {
 }
 export async function cmdFormDefault(args) {
     const request = requestId();
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     const schema = flag("--schema") ?? flag("--schema-code");
     const field = flag("--field");
     const value = flag("--default");

package/dist/lanes/app.js

@@ -131,6 +131,10 @@ export function registerAppLane(tools) {
                 portalHidden,
                 ...(warning ? { warning } : {}),
                 publishBoundary: { inScope: false, nextAction: "publish-in-designer", reason: "app publish is outside the CLI configuration boundary" },
+                manualActions: [
+                    { action: "publish-in-designer", detail: "在设计器发布应用，否则门户不可见" },
+                    { action: "portal-visibility-check", detail: "发布后核对应用位于具名分组并在门户可见" },
+                ],
                 recovery: [{ code: "publish-in-designer", action: "在设计器发布应用并核对其位于具名分组；再做门户可见性验证" }],
                 note: "应用发布属边界外：建成后需人工在设计器发布并核对该分组，否则门户不可见",
             },

package/dist/lanes/b2-registration-contract.js

@@ -117,7 +117,7 @@ export const B2_LANE_CONTRACT = Object.freeze({
         }),
         "service.register": Object.freeze({
             scope: B2_SCOPE,
-            description: "注册业务集成服务（`/bizservice/service/create`，body `{code,name,adapterCode,description,configJson?}`；adapterCode 空 → 500005）+ 可选方法（`/bizservice/method/create`，可带 `configJson`/`inputParametersJson`/`outputParametersJson`），并回读。serviceConfig 明文序列化（RESTFUL/INTERNAL/SOAP 需 auth+commonlist.url；DATA_SQL/DATA_TABLE 需 commonlist.databaseConnectionPoolCode；SAP 需 commonlist.sapConnectionPoolCode；KAFKA 需 commonlist.kafkaConnectionPoolCode），methodConfig 由工具 AES-128-ECB+Base64 加密（SOAP 方法由 WSDL 动态发现，无固定方法 configJson）。参数面结构化序列化；RESTFUL 每参数需 configJson.position，URL_VARIABLE 拒绝；required 三态透传。设计器同款必填：name（≤50）、adapterCode、serviceCategoryId；除 SOAP 动态方法外，各原生适配器带 methodName 时必带 methodConfig；INTERNAL 方法创建走二开扩展包导入，不在本写面；仅名字/参数面的注册壳不可绑定。",
+            description: "**URL 前缀 × 鉴权（混用即 401）**：方法 url `/openapi/...` → `/api/openapi/...` 单层 + `xclient`（OAuth2 Client Credentials）；`/api/...` → `/api/api/...` 双层 + 用户 token（client_id=api）。排障先 `service.list`→`service.get` 找同 adapter 的既有成功服务照抄形状；禁止用 `/externalLink/...` 等免鉴权前缀承载二开接口。注册业务集成服务（`/bizservice/service/create`，body `{code,name,adapterCode,description,configJson?}`；adapterCode 空 → 500005）+ 可选方法（`/bizservice/method/create`，可带 `configJson`/`inputParametersJson`/`outputParametersJson`），并回读。serviceConfig 明文序列化（RESTFUL/INTERNAL/SOAP 需 auth+commonlist.url；DATA_SQL/DATA_TABLE 需 commonlist.databaseConnectionPoolCode；SAP 需 commonlist.sapConnectionPoolCode；KAFKA 需 commonlist.kafkaConnectionPoolCode），methodConfig 由工具 AES-128-ECB+Base64 加密（SOAP 方法由 WSDL 动态发现，无固定方法 configJson）。参数面结构化序列化；RESTFUL 每参数需 configJson.position，URL_VARIABLE 拒绝；required 三态透传。设计器同款必填：name（≤50）、adapterCode、serviceCategoryId；除 SOAP 动态方法外，各原生适配器带 methodName 时必带 methodConfig；INTERNAL 方法创建走二开扩展包导入，不在本写面；仅名字/参数面的注册壳不可绑定。",
         }),
         "service.update": Object.freeze({
             scope: "update readback",
@@ -133,7 +133,7 @@ export const B2_LANE_CONTRACT = Object.freeze({
         }),
         "method.create": Object.freeze({
             scope: "method create readback",
-            description: "在**已存在的业务服务**下新增方法（`/bizservice/method/create`）：新写一个扩展接口通常不是新建服务，而是往已有服务里加方法。服务不存在 → refused（新增服务用 `service.register`）；方法已存在 → refused（改用 `method.update`）。configJson 由工具 AES 加密，参数面结构化序列化并回读。",
+            description: "在**已存在的业务服务**下新增方法（`/bizservice/method/create`）：新写一个扩展接口通常不是新建服务，而是往已有服务里加方法。服务不存在 → refused（新增服务用 `service.register`）；方法已存在 → refused（改用 `method.update`）。configJson 由工具 AES 加密，参数面结构化序列化并回读。**RESTFUL 参数面**：入参与出参的每个参数都要 `configJson.position`，合法值只有 `QUERY_PARAMS | URL_VARIABLE | REQUEST_HEADER | REQUEST_BODY | PATH_PARAMS`（`REQUEST_PARAM` 不存在；`URL_VARIABLE` 运行时 501007 被拒）。平台注入的常量头（如 X-LowCode-Corpid）标 `required:false`，否则 method.test 会按缺参 fail-closed。写入用枚举名，读回是整数索引（0 QUERY_PARAMS / 1 URL_VARIABLE / 2 REQUEST_HEADER / 3 REQUEST_BODY / 4 PATH_PARAMS）。",
         }),
         "method.delete": Object.freeze({
             scope: "method delete readback",

package/dist/lanes/businessrule.js

@@ -93,7 +93,7 @@ export function registerBusinessRuleLane(tools) {
                     enabled: row.enabled,
                     status: row.status,
                     ...(row.ruleVersion !== undefined ? { ruleVersion: row.ruleVersion } : {}),
-                    ...(row.defaultRule !== undefined ? { defaultRule: row.defaultRule } : {}),
+                    ...(row.defaultRule !== undefined ? { defaultRule: row.defaultRule, preset: row.defaultRule === true } : {}),
                     // ticket-80's update-mode readback teaches following the same-code
                     // latestPublished row — keep the flag on the default face (5 B).
                     ...(row.latestPublished !== undefined ? { latestPublished: row.latestPublished } : {}),

package/dist/lanes/model-contract.js

@@ -8,7 +8,7 @@ import { LANES } from "./lane-ids.js";
 export const MODEL_WIRE = Object.freeze({
     createBody: "bizmodels/create carries appCode, parentId (folder), modelType, bizSchemaCode, icon, name_i18n, pcAble/mobileAble, options{statisticEnabled:false}",
     readback: "exits_bizschema readback via apppackage/trees (type==='BizModel' && code===schemaCode)",
-    folderResolution: "explicit folderId > first non-BizModel tree node (auto-default-folder); none found → 302001",
+    folderResolution: "explicit folderId（树行 id 或目录 code，经 applicationTree 归一为树行 id；未命中 → model-create-folder-unresolved）> first non-BizModel tree node (auto-default-folder)；none found → 302001。注意 apppackage/list 的目录键是 code、trees 的键是 id，跨读面传值必须归一",
     deleteBody: "apppackage/physically_delete body [{id,code,type:'BizModel'}] where id MUST be the app-tree node id (AppFunction id)",
     deleteIdNamespace: "physically_delete resolves each row id as an AppFunction id (removeBizModel → getAppFunction(id), AppIntegrationFacadeImpl) and answers 601003 业务模型不存在 for a biz-model record id; the two id spaces are NOT interchangeable. model.delete/deleteMany resolve the node across applications (default app first, then applicationList per-app trees) and refuse fail-closed with model-application-unresolved when the record exists but no tree node does — never guessing a record id",
     deleteTolerance: "already-absent short-circuits; the authoritative record face polls to verified absence; the tree node is eventually consistent and reported as treeNodePending",
@@ -108,7 +108,7 @@ export const MODEL_LANE_CONTRACT = Object.freeze({
         }),
         "model.create": Object.freeze({
             scope: MODEL_SCOPE,
-            description: "Create a design-time model (bizmodels/create) with exits_bizschema readback. folderId optional (auto-resolved from the app tree). applicationCode optional — defaults to the configured app, else the tenant's first application.",
+            description: "Create a design-time model (bizmodels/create) with exits_bizschema readback. folderId optional — accepts BOTH the tree row id and the folder code and is normalized to the row id (apppackage/list exposes codes; trees expose ids); an unresolved folder is refused with candidates. applicationCode optional — defaults to the configured app, else the tenant's first application. A tree-miss does not prove absence: the record face is checked too (model-create-duplicate-orphan). readback.present=false downgrades deliveryState to WRITE_UNVERIFIED.",
         }),
         "model.delete": Object.freeze({
             scope: MODEL_SCOPE,

package/dist/lanes/model.js

@@ -301,6 +301,8 @@ export function registerModelLane(tools) {
                     form,
                     listview,
                     rules,
+                    rulesPreset: rules.filter((rule) => rule.defaultRule === true).map((rule) => rule.code),
+                    rulesCustom: rules.filter((rule) => rule.defaultRule !== true).map((rule) => rule.code),
                     datarules,
                     workflow,
                     hint: "model.inspect 聚合设计时六面（fields/form/listview/rules/datarules/workflow，摘要）。modelPresent 是存在性判据（field 面 300004=false）；字段 options 细节用 field.list --code；规则图用 rule.get schemaCode+ruleCode；运行数据用 data.list（不在此面）。",
@@ -345,10 +347,56 @@ export function registerModelLane(tools) {
                 message: `模型 ${args.code} 已存在于应用 ${existing.applicationCode} 的应用树中；create 拒绝重复 POST，不能把既有模型证明为本次创建结果`,
             });
         }
+        // A tree-miss does NOT prove absence: an orphan mount (row exists in
+        // h_biz_schema but its h_app_function.parentId is invalid) is invisible to
+        // the tree scan but real on the record face. Refuse instead of creating a
+        // second row and leaving the first orphaned (live 2026-10-17).
+        try {
+            // bizmodels/get_all is keyed by the query, so a non-null object IS the
+            // model (an absent one answers a business errcode — wireCall throws and
+            // we fall through to create).
+            const record = (await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode: args.code } })).data;
+            if (record !== null && typeof record === "object") {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-create-duplicate-orphan",
+                    schemaCode: args.code,
+                    applicationCode: args.applicationCode ?? null,
+                    message: `模型 ${args.code} 在册（bizmodels/get_all 可读）但不在应用树中——疑似挂载孤儿（h_app_function.parentId 无效）。请修 parentId 为目录行 id，不要 create；否则会再建一条孤儿`,
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof ToolRefusalError)
+                throw error;
+            // A record-face read failure must not be read as absence; let create
+            // proceed and rely on the platform's unique key.
+        }
+        // Cross-face key trap (live 2026-10-17, AI-Platform 1.1.7): apppackage/list
+        // projects a Folder node's h_app_function.CODE, while apppackage/trees rows
+        // carry the function ID. Passing the former straight through as
+        // bizmodels/create.parentId writes an orphan row that the tree assembler
+        // drops — the model reads fine on schema faces but vanishes from the menu,
+        // model.list(tree) and duplicate checks. Resolve BOTH keys and always send
+        // the tree row id.
+        const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
         let folderId = args.folderId;
         let resolvedFrom = args.folderId ? "explicit" : undefined;
-        if (!folderId) {
-            const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+        if (folderId) {
+            const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string" && (String(row.id) === folderId || String(row.code ?? "") === folderId));
+            if (!folder) {
+                const candidates = tree.filter((row) => row.type !== "BizModel" && typeof row.id === "string").map((row) => `${String(row.id)}|${String(row.code ?? "")}|${String(row.name ?? "")}`);
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-create-folder-unresolved",
+                    message: `folderId ${folderId} 未命中应用 ${applicationCode} 树中任何目录（id/code 双口径）——不要把 apppackage/list 的目录 code 当 id 传；候选（id|code|name）：${candidates.join("；") || "（无目录）"}`,
+                    applicationCode,
+                });
+            }
+            resolvedFrom = String(folder.id) === folderId ? "explicit" : "explicit-code-resolved";
+            folderId = String(folder.id);
+        }
+        else {
             const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
             if (!folder)
                 throw new WireError("business", "no folder found for model creation", 302001);

package/dist/lanes/report.js

@@ -339,6 +339,18 @@ export function registerReportLane(tools) {
         const infos = args.dataSourceInfos.map((info) => ({ dataSourceId: info.dataSourceId, useType: info.useType ?? 1 }));
         const linked = (await biCall(session, { path: ENDPOINTS.biDatasourceModelLink, body: { dataSourceInfos: infos }, query: { lang: "cn" }, auth }));
         const models = Array.isArray(linked) ? linked : [];
+        // Live 2026-10-18: the platform answers success but links NOTHING when the
+        // model has not synced into BI yet (cloudpivot_report.i_datasource /
+        // i_modelschema empty). DELIVERED with linkedCount:0 is a false success —
+        // refuse it with the prerequisite instead (designer must open the report
+        // once to trigger the sync).
+        if (infos.length > 0 && models.length === 0)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "report-datasource-link-not-synced",
+                message: "平台返回成功但未绑定任何数据集（linkedCount:0）：模型尚未同步进 BI。先在设计器打开一次报表/触发同步，再重试；不要以 DELIVERED 判定成功。",
+                dataSourceIds: infos.map((info) => info.dataSourceId),
+            });
         return {
             performed: { errcode: 0, linked: infos.map((info) => info.dataSourceId) },
             readback: { linkedCount: models.length, models: models.map((model) => ({ dataSourceId: model.dataSourceId, displayName: model.displayName, tableName: model.schema?.tableName })) },

package/dist/lanes/runtime-data.js

@@ -503,6 +503,11 @@ export function registerRuntimeDataLane(tools) {
                     schemaCode: args.schemaCode,
                     ...(args.queryCode !== undefined ? { queryCode: args.queryCode } : {}),
                     total: args.showTotal === false ? null : page.total,
+                    // This branch is the non-`all` read: the platform's default filter
+                    // hides DRAFTs and the total excludes them too — say so explicitly
+                    // (live 2026-10-18: total:0 was read as "no residue" while 9 drafts
+                    // existed).
+                    filter: { excludedDraft: true, hint: "默认不含 DRAFT（total 亦仅计非草稿）；核对/清理残留请加 all:true" },
                     totalPages: page.totalPages,
                     page: page.page ?? args.page ?? 0,
                     size: page.size ?? args.size ?? 20,

package/dist/lanes/workflow-contract.js

@@ -120,7 +120,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "workflow.update": Object.freeze({
             scope: WORKFLOW_SCOPE,
-            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；改名才产生新码——平台不能原地改名），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。用 `npm run test:live-permission`（非管理员参与者）验收，管理员会被后端强制 `e:true` 掩盖。",
+            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；**改名=同 code 原地生效**——工具把新名写入 `name_i18n`（zh/zh_TW/en），activityName 平台侧保持首建值，读回以 `renamedInPlace.displayName` 为准；只有**类型变更**才铸新码并弃旧码），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。用 `npm run test:live-permission`（非管理员参与者）验收，管理员会被后端强制 `e:true` 掩盖。",
         }),
         "workflow.publish": Object.freeze({
             scope: WORKFLOW_SCOPE,

package/dist/lanes/workflow.js

@@ -751,11 +751,14 @@ function activityCodeOf(record) {
  * type END) — reproduced on bench12/13/15, where the second approval node
  * showed as "结束". Only a FRESH code receives the caller's name/type.
  *
- * Reconcile the caller list against the draft: keep a code when the caller
- * re-sends the same type + name (idempotent re-update), otherwise mint a
- * collision-free code so the change actually lands. Returns the rewritten
- * activities plus the original→final code map for route remapping.
- */
+  * Reconcile the caller list against the draft: keep a code when the caller
+  * re-sends the same type + name (idempotent re-update). A NAME change is an
+  * IN-PLACE rename — the new name rides `name_i18n` (zh/zh_TW/en) on the same
+  * code (live 2026-10-17: that is exactly what the designer's rename posts;
+  * activityName stays the first-created value server-side). Only a TYPE
+  * change still mints a collision-free fresh code. Returns the rewritten
+  * activities plus the original→final code map for route remapping.
+  */
 function reconcileCallerActivityCodes(callerActivities, draftActivities) {
     const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
     const used = new Set(draftActivities.map((activity) => String(activity.activityCode ?? "")));
@@ -766,6 +769,7 @@ function reconcileCallerActivityCodes(callerActivities, draftActivities) {
         const name = activityNameOf(record);
         const draft = draftByCode.get(original);
         let code = original;
+        let renameInPlace = false;
         if (draft !== undefined) {
             const draftType = String(draft.activityType ?? "").trim().toUpperCase() === "APPROVAL" ? "PARTICIPANT" : String(draft.activityType ?? "").trim().toUpperCase();
             const draftName = activityNameOf(draft);
@@ -776,17 +780,31 @@ function reconcileCallerActivityCodes(callerActivities, draftActivities) {
             // Activity3_2_2). An omitted type is "keep the stored one", not "changed
             // to empty".
             const callerHasType = record.activityType !== undefined || record.type !== undefined;
-            const changed = (callerHasType && draftType !== type) || (name !== undefined && draftName !== undefined && name !== draftName);
-            if (changed) {
+            const typeChanged = callerHasType && draftType !== type;
+            const nameChanged = name !== undefined && draftName !== undefined && name !== draftName;
+            // Live 2026-10-17 (designer capture + raw replay, 8.6.26): a NAME change
+            // DOES land in place — the writable carrier is `name_i18n` (locale map;
+            // the designer's own rename posts exactly that and activityName stays
+            // the first-created value). Only a TYPE change still needs a fresh code
+            // (activityType is pinned for existing codes).
+            if (typeChanged) {
                 let suffix = 2;
                 while (used.has(`${original}_${suffix}`))
                     suffix += 1;
                 code = `${original}_${suffix}`;
             }
+            else if (nameChanged) {
+                renameInPlace = true;
+            }
         }
         used.add(code);
         codeMap.set(original, code);
-        return { ...record, activityCode: code, ...(name !== undefined ? { activityName: name, i18nMessage: name } : {}) };
+        return {
+            ...record,
+            activityCode: code,
+            ...(name !== undefined ? { activityName: name, i18nMessage: name } : {}),
+            ...(renameInPlace ? { name_i18n: { zh: name, zh_TW: name, en: name } } : {}),
+        };
     });
     return { activities, codeMap };
 }
@@ -968,10 +986,12 @@ async function backfillDesignerDefaults(session, schemaCode, body, callerTemplat
     }
 }
 /**
- * Rename pairs surfaced in the readback (live r51 2026-10-14): a rename mints
- * `<original>_<n>` and DROPS the original code — re-sending the OLD code then
- * reads as a brand-new node and APPENDS it, silently growing the flow. The
- * readback names the pairs so the caller switches to the new code.
+ * Rename pairs surfaced in the readback: a TYPE change (the only remaining
+ * mint trigger) mints `<original>_<n>` and DROPS the original code —
+ * re-sending the OLD code then reads as a brand-new node and APPENDS it,
+ * silently growing the flow. The readback names the pairs so the caller
+ * switches to the new code. (A pure NAME rename no longer mints — it rides
+ * name_i18n in place; see inPlaceRenames.)
  */
 function renamedActivityPairs(template, data) {
     const callerCodes = new Set((callerActivities(template) ?? []).map((row) => activityCodeOf(row)).filter((code) => code !== ""));
@@ -984,6 +1004,30 @@ function renamedActivityPairs(template, data) {
     }
     return pairs;
 }
+/**
+ * In-place renames in a readback: rows whose name_i18n (the rename carrier)
+ * diverges from the first-created activityName. Display name =
+ * name_i18n.zh ?? name_i18n.en ?? activityName.
+ */
+function inPlaceRenames(data) {
+    // The platform's draft face carries activities as an INDEX-KEYED OBJECT (the
+    // compact projection already handles both shapes); accept either.
+    const raw = data.activities;
+    const rows = Array.isArray(raw)
+        ? raw
+        : raw && typeof raw === "object"
+            ? Object.values(raw)
+            : [];
+    const out = [];
+    for (const row of rows) {
+        const i18n = row.name_i18n;
+        const zh = i18n && typeof i18n === "object" ? String(i18n.zh ?? i18n.en ?? "") : "";
+        const base = String(row.activityName ?? "");
+        if (zh !== "" && zh !== base)
+            out.push({ activityCode: String(row.activityCode ?? ""), activityName: base, displayName: zh });
+    }
+    return out;
+}
 /**
  * Live 2026-10-14: a workflow node's propertyPermissions ACCEPTS
  * `required:true` on a CHILD_TABLE (子表) property at the wire level, but the
@@ -1039,10 +1083,13 @@ function mergeCallerDelta(template, draft) {
             ...(raw.participant !== undefined ? { participant: normalizeParticipantForWire(raw.participant) } : {}),
         };
     });
-    // Live 2026-09-23: the platform cannot rename an existing activityCode — the
-    // stored name/type win (same constraint the replace path reconciles). A
-    // caller that re-sends the readback with a changed name/type must get a FRESH
-    // code, and the old node must be DROPPED so it is a rename, not a duplicate.
+    // Live 2026-10-17 (designer traffic capture + raw replay on 8.6.26): for an
+    // EXISTING activityCode the platform pins activityName/i18nMessage/
+    // activityType at their first-created values — but `name_i18n` (locale map)
+    // is writable and IS the rename carrier (the designer's rename posts exactly
+    // that under the same code). reconcileCallerActivityCodes keeps the code for
+    // a name change and stamps name_i18n; only a type change still mints a fresh
+    // code and DROPS the old node (a retype, not a rename).
     const { activities: reconciledCaller, codeMap } = reconcileCallerActivityCodes(caller, draftActivities);
     const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
     const originalOf = new Map();
@@ -1356,7 +1403,7 @@ export function workflowCompactProjection(result) {
         index: Number(index),
         code: activity.activityCode ?? null,
         type: activity.activityType ?? null,
-        name: activity.activityName ?? activity.i18nMessage ?? null,
+        name: effectiveActivityName(activity),
         ...(activity.participant !== undefined ? { participant: activity.participant } : {}),
         // Round 16 (bench65 feedback): a participant node's field permissions were
         // only visible in the 30–45 KB full body, so acceptance (and any "did my
@@ -1393,7 +1440,7 @@ export function workflowCompactProjection(result) {
             edges,
             ruleBindings,
             ruleBindingCount: ruleBindings.reduce((sum, binding) => sum + binding.ruleCodes.length, 0),
-            ...(originate ? { originateActivity: { code: originate.activityCode ?? null, type: originate.activityType ?? null, name: originate.activityName ?? originate.i18nMessage ?? null, participant: originate.participant ?? null } } : {}),
+            ...(originate ? { originateActivity: { code: originate.activityCode ?? null, type: originate.activityType ?? null, name: effectiveActivityName(originate), participant: originate.participant ?? null } } : {}),
         },
         // Editing needs only `activities` (array or index object) + `routes`: the tool
         // merges onto the stored draft, connects added nodes through to END, fills
@@ -1402,6 +1449,21 @@ export function workflowCompactProjection(result) {
         summaryHint: "改流程只需把要改/新增的 activities（数组）+ routes 传给 workflow.update：缺 START/END 的部分模板会自动按增量 merge 到草稿（草稿为基，自动补 sheetCode/连线/坐标），无需读回整模板或 --full 正文；字段权限也只需在对应 PARTICIPANT 上给 propertyPermissions:[{propertyCode,...}]，工具按 propertyCode 合并、未列的字段权限保留。只有要整图替换时才给全 START..END 的完整模板；要看通知等完整节点正文才用 detailArtifactId 或 --full",
     };
 }
+/**
+ * A node's DISPLAY name: `name_i18n` (the rename carrier — the designer's
+ * rename writes the locale map and activityName keeps its first-created value,
+ * live 2026-10-17) wins over the first-created activityName/i18nMessage.
+ */
+function effectiveActivityName(activity) {
+    const i18n = activity.name_i18n;
+    if (i18n && typeof i18n === "object") {
+        const map = i18n;
+        const localized = map.zh ?? map.zh_TW ?? map.en;
+        if (localized !== undefined && String(localized) !== "")
+            return String(localized);
+    }
+    return (activity.activityName ?? activity.i18nMessage ?? null);
+}
 /**
  * A workflow event handler (start/cancel/activate/end) binds a business rule by
  * CODE. The platform's designer rule picker only offers CUSTOM rules — the
@@ -1651,7 +1713,18 @@ export function registerWorkflowLane(tools) {
         validateWorkflowRender(data, "workflow.update readback");
         const participantWarnings = participantReferenceWarnings(data);
         const renamedActivities = renamedActivityPairs(template, data);
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : 0, templateType: data.templateType ?? null, ...(participantWarnings.length ? { participantWarnings } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "改名会铸新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        const renamedInPlace = inPlaceRenames(data);
+        // 改名验收的权威读数：每个节点的当前显示名（platform may keep
+        // activityName or sync it; effectiveActivityName resolves both shapes).
+        const rawActivityRows = Array.isArray(data.activities)
+            ? data.activities
+            : data.activities && typeof data.activities === "object"
+                ? Object.values(data.activities)
+                : [];
+        const activityNames = Object.fromEntries(rawActivityRows
+            .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
+            .filter(([code]) => code !== ""));
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, ...(participantWarnings.length ? { participantWarnings } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
     }, (args) => {
         // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
         // governed pipeline — including the rollback before-capture read.

package/dist/rule-when.js

@@ -21,6 +21,7 @@
 import { runToolCall } from "./call.js";
 import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
+import { argvValue } from "./args.js";
 const WHEN_OPS = { "=": "EQ", "==": "EQ", "!=": "NEQ", ">": "GT", "<": "LT", ">=": "GTEQ", "<=": "LTEQ", "~=": "CT", "!~": "NCT" };
 /** 编译 --when/--then DSL 为设计器验证形状的规则图（导出供测试断言）。 */
 export function composeRuleWhenGraph(options) {
@@ -93,15 +94,15 @@ export function composeRuleWhenArgs(options) {
 }
 export async function cmdRuleWhen(args) {
     const request = requestId();
-    const flag = (name) => {
-        const index = args.indexOf(name);
-        return index >= 0 ? args[index + 1] : undefined;
-    };
+    const flag = (name) => argvValue(args, name);
     const multi = (name) => {
         const values = [];
+        const prefix = `${name}=`;
         for (let i = 0; i < args.length; i++) {
             if (args[i] === name && args[i + 1] !== undefined)
                 values.push(args[i + 1]);
+            else if (args[i] !== undefined && args[i].startsWith(prefix))
+                values.push(args[i].slice(prefix.length));
         }
         return values;
     };

package/dist/session.js

@@ -58,8 +58,28 @@ export class CloudPivotSession {
                 administrator: cached.administrator,
                 ...(cached.accountIdentity !== undefined ? { accountIdentity: cached.accountIdentity } : {}),
             };
-            if (cached.version !== undefined)
+            if (cached.version !== undefined) {
                 this.version = cached.version;
+            }
+            else {
+                // Legacy cache written while version evidence was unavailable: probe the
+                // public system config once and backfill the cache, otherwise every
+                // later write stays fail-closed even after the probe itself is fixed
+                // (live 2026-10-17: AI-Platform deployment, pcServerUrl null).
+                const systemConfig = await core
+                    .fetchCloudPivotSystemConfig(this.profile.baseUrl, undefined, fetch, core.cloudPivotTenantHeaders(this.profile.engineCode))
+                    .catch(() => undefined);
+                this.version = detectVersion(systemConfig);
+                if (this.version !== undefined) {
+                    this.tokenCache?.save({
+                        token: cached.token,
+                        enterpriseId: cached.enterpriseId,
+                        administrator: cached.administrator,
+                        ...(cached.accountIdentity !== undefined ? { accountIdentity: cached.accountIdentity } : {}),
+                        version: this.version,
+                    });
+                }
+            }
             return this.loginResult;
         }
         const core = await omcCore();
@@ -67,9 +87,12 @@ export class CloudPivotSession {
             this.fingerprintOf = core.canonicalCloudPivotEnvironmentFingerprint;
         let systemConfig = this.systemConfig;
         if (!systemConfig) {
+            // Version evidence and login need the public system config only; the
+            // authoritative-origin resolver stays strict for callers that need an
+            // origin (AI-Platform answers pcServerUrl:null — live 2026-10-17).
             systemConfig = await core
-                .resolveCloudPivotAuthoritativeOrigin(this.profile.baseUrl, undefined, fetch, core.cloudPivotTenantHeaders(this.profile.engineCode))
-                .then((r) => r.systemConfig, () => undefined);
+                .fetchCloudPivotSystemConfig(this.profile.baseUrl, undefined, fetch, core.cloudPivotTenantHeaders(this.profile.engineCode))
+                .catch(() => undefined);
         }
         const authenticator = new core.CloudPivotAuthenticator(await this.http());
         this.loginResult = await authenticator.login({

package/dist/write.js

@@ -110,6 +110,11 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload) {
             return { status: executed.status, steps: executed.steps, failedStep: executed.failedStep, ...executed.envelope, ...(args.requestId ? { requestId: args.requestId } : {}), artifactFingerprint: artifactRef.detailSha256 };
         }
         const { performed, readback, steps } = executed;
+        // Readback gate (live 2026-10-17): a tool that reports `readback.present:false`
+        // has NOT proven its own write — the platform accepted the request but the
+        // object is absent from the authoritative face. "Called without error" must
+        // never be stamped DELIVERED; downgrade to WRITE_UNVERIFIED and surface why.
+        const { deliveryState, readbackWarning } = deliveryStateFor(readback);
         // Every production write echoes the explicit acknowledgement into the audit
         // trail, so the record can always answer "was this a confirmed production
         // write?".
@@ -133,7 +138,8 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload) {
                     ...(rollbackBefore !== undefined ? { before: rollbackBefore } : {}),
                 }
                 : {}),
-            deliveryState: "DELIVERED",
+            deliveryState,
+            ...(readbackWarning ? { readbackWarning } : {}),
             recordedAt: new Date().toISOString(),
         };
         const artifactRef = writeArtifact(ctx, `${tool.name}-${randomUUID().slice(0, 8)}.json`, artifact);
@@ -156,9 +162,24 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload) {
             });
             rollbackRef = { seq: entry.seq, hint: `omc rollback plan ${entry.seq}（--env ${entry.environment}）` };
         }
-        return { status: "ok", deliveryState: "DELIVERED", performed, readback, ...(steps !== undefined ? { steps } : {}), ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name) } : {}), ...(productionConfirmed ? { productionConfirmed: true } : {}), ...(rollbackRef ? { rollback: rollbackRef } : {}), summary: writeSummary(tool.name, args, { performed, readback }, "done"), detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256, artifactFingerprint: artifactRef.detailSha256 };
+        return { status: "ok", deliveryState, performed, readback, ...(readbackWarning ? { readbackWarning } : {}), ...(steps !== undefined ? { steps } : {}), ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name) } : {}), ...(productionConfirmed ? { productionConfirmed: true } : {}), ...(rollbackRef ? { rollback: rollbackRef } : {}), summary: writeSummary(tool.name, args, { performed, readback }, "done"), detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256, artifactFingerprint: artifactRef.detailSha256 };
     });
 }
+/**
+ * Readback gate: a tool whose authoritative readback says the target is ABSENT
+ * has not proven its write. "Called without error" must never be stamped
+ * DELIVERED (live 2026-10-17: model.create returned errcode 0 + present:false
+ * while the menu row was orphaned; the AI read DELIVERED as success).
+ */
+export function deliveryStateFor(readback) {
+    const presentFalse = readback !== null && typeof readback === "object" && readback.present === false;
+    return presentFalse
+        ? {
+            deliveryState: "WRITE_UNVERIFIED",
+            readbackWarning: "读回显示目标不存在（readback.present=false）：平台接受了请求但权威面查不到——不要当作最终一致性豁免，按失败排查（模型挂载/路径/权限）",
+        }
+        : { deliveryState: "DELIVERED" };
+}
 function idempotencyDeclaration(tool) {
     if (tool.includes("delete"))
         return { key: "requestId", replay: "completed", duplicate: "already-absent-no-op" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.53",
+  "version": "0.4.54",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.44",
+    "@stalfh233/omc-fake-platform": "0.4.54",
     "commander": "14.0.3",
-    "omc-core": "0.4.44",
+    "omc-core": "0.4.54",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",