@stalfh233/omc-cli 0.4.62 → 0.4.64

package/dist/cli.js

@@ -458,6 +458,15 @@ async function cmdArtifactGet(id, transport, options = {}) {
         if (options.summary) {
             const record = content && typeof content === "object" && !Array.isArray(content) ? content : undefined;
             const keys = record ? Object.entries(record).map(([key, value]) => ({ key, bytes: Buffer.byteLength(JSON.stringify(value) ?? "null", "utf8"), kind: Array.isArray(value) ? `array[${value.length}]` : value === null ? "null" : typeof value })).sort((left, right) => right.bytes - left.bytes) : [];
+            // `--summary --jq <path>`: shape AND the one value, in a single call. Without
+            // this the caller had to spend one round on the shape and another on the
+            // path (or pull the whole body); r5 hit that on 67 KB workflow templates.
+            if (options.jq !== undefined) {
+                const projected = projectJsonPath(artifact.content.toString("utf8") === "" ? undefined : content, options.jq);
+                return emitTransportResult(projected.missed
+                    ? { status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, projection: { path: options.jq, content: null, pathMiss: true, missedAt: projected.at, available: projected.available }, fetch: artifactFetchHint(id) }
+                    : { status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, projection: { path: options.jq, content: projected.value ?? null } }, transport);
+            }
             return emitTransportResult({ status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, fetch: artifactFetchHint(id) }, transport);
         }
         if (options.keys !== undefined) {

package/dist/formula-lint.js

@@ -0,0 +1,73 @@
+/**
+ * Shared lint for the platform's formula engine (EXPRESSION actions and
+ * dataRuleType-2 CALCULATE carriers).
+ *
+ * Evidence (AI-Platform v1.1.25): the engine parses `formula` with Aviator and
+ * registers exactly the names in `CalculateMethodType` (cloudpivot-shared),
+ * one function per code, via `CalculateRuleExecutor`. A name outside that set
+ * fails at submit time with `errcode 101005 表达式格式错误`; text concatenation
+ * with `+` instead of `STRING(...)` does NOT fail — `+` is numeric addition and
+ * the target silently stores null (live 2026-10-20, r4-training: `{a}+"-X"`
+ * wrote null while `STRING({a},"-X")` wrote `CNAME-X`).
+ *
+ * The platform validates nothing at save time, so this lint runs before the
+ * wire. Severity is advisory: an unknown name is loud at submit, but the caller
+ * should see it at write time rather than after a data probe.
+ */
+export const FORMULA_FUNCTIONS = new Set([
+    "STRING", "SUBSTRING", "REPLACE", "UPPERMONEY", "IF", "CONTAINS", "GETADDRESS", "LEN",
+    "LOWER", "UPPER", "SEARCH", "STARTSWITH", "SUBSTITUTE", "TRIM", "GETUNITNAME", "LEFT",
+    "RIGHT", "TEXT", "UNION", "DATE", "COUNTIF", "SUM", "AVG", "MAX", "MIN", "COUNT", "ROUND",
+    "INTUP", "INTDOWN", "VALUE", "FIXED", "ABS", "CEILING", "FLOOR", "COS", "SIN", "LARGE",
+    "SMALL", "LOG", "MOD", "PI", "POWER", "RAND", "SQRT", "SUMIF", "DATEDIF", "YEAR", "MONTH",
+    "DAY", "WEEKNUM", "WEEKDAY", "QUARTER", "HOUR", "MINUTE", "SECOND", "ADDDAY", "ADDMONTH",
+    "ADDYEAR", "TODAY", "BETWEEN", "NOTBETWEEN", "ADDHOUR", "ADDMINUTE", "NOW", "CASE", "ISNULL",
+]);
+/** Names agents reach for that the engine does NOT register, with the real one. */
+export const FORMULA_FUNCTION_ALIASES = Object.freeze({
+    CONCAT: "STRING",
+    CONCATENATE: "STRING",
+    STRCAT: "STRING",
+    JOIN: "STRING",
+});
+const TEXT_PLUS_CONCAT = /(\{[^{}]+\}|[A-Za-z_][A-Za-z0-9_]*\s*\([^()]*\))\s*\+\s*["']|["']\s*\+\s*(\{[^{}]+\}|[A-Za-z_][A-Za-z0-9_]*\s*\()/;
+/**
+ * Lint one formula string. `where` names the carrier in the caller's own terms
+ * (e.g. `dataActions[0].value.formula`), so the message points at the key the
+ * caller has to fix.
+ */
+export function lintFormulaText(formula, where) {
+    if (typeof formula !== "string" || formula.trim().length === 0)
+        return [];
+    const entries = [];
+    for (const match of formula.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*\(/g)) {
+        const name = match[1].toUpperCase();
+        const alias = FORMULA_FUNCTION_ALIASES[name];
+        if (alias) {
+            entries.push({
+                code: "formula-function-alias",
+                severity: "warning",
+                functionName: match[1],
+                message: `${where}: 公式里的 ${match[1]}() 不是平台函数；文本合并用 ${alias}({a},"-",{b})。别名写法在提交时报 errcode 101005 表达式格式错误。`,
+            });
+            continue;
+        }
+        if (FORMULA_FUNCTIONS.has(name))
+            continue;
+        entries.push({
+            code: "formula-function-unknown",
+            severity: "warning",
+            functionName: match[1],
+            message: `${where}: 公式函数 ${match[1]}() 不在平台注册表（CalculateMethodType）——提交时会报 101005 表达式格式错误。文本合并用 STRING()；函数表见 cpdocs BusinessRulesTrigger.md「表达式函数」。`,
+        });
+    }
+    if (TEXT_PLUS_CONCAT.test(formula)) {
+        entries.push({
+            code: "formula-text-plus-concat",
+            severity: "warning",
+            message: `${where}: 公式用 + 拼接了字符串字面量——+ 是数值加法，文本目标上会静默写 null（真机 2026-10-20）。文本合并用 STRING({a},"-",{b})。`,
+        });
+    }
+    return entries;
+}
+//# sourceMappingURL=formula-lint.js.map

package/dist/lanes/datarule.js

@@ -1,3 +1,4 @@
+import { lintFormulaText } from "../formula-lint.js";
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
 import { capabilityArg, environmentArg } from "../args.js";
@@ -396,6 +397,20 @@ export function assertDataRuleOptions(dataRuleType, options, checkType) {
             assertStitchEditorTextRoundTrips(options);
     }
 }
+/**
+ * Advisory formula lint for the type-2 CALCULATE carrier. Same registry as the
+ * rule-graph EXPRESSION lint (src/formula-lint.ts): an unregistered function
+ * name fails at submit with 101005 and `+` on text silently writes null, and
+ * the platform validates neither at create time.
+ */
+export function dataRuleFormulaWarnings(dataRuleType, options) {
+    if (dataRuleType !== 2)
+        return [];
+    const formula = type2FormulaText(options);
+    if (formula === null)
+        return [];
+    return lintFormulaText(formula, "options.shortTextStitch.formula");
+}
 /** Extract the expression of a type-2 CALCULATE rule (mirrors calcExpressionShapeError's carrier choice). */
 function type2FormulaText(options) {
     const raw = typeof options.shortTextStitch === "string" ? options.shortTextStitch : typeof options.value === "string" ? options.value : undefined;
@@ -751,6 +766,7 @@ export function registerDataRuleLane(tools) {
                 matchedCount: rules.length,
                 rules: rules.map(decodeDataRule),
                 ...(args.dataRuleType >= 3 ? { advisory: DATARULE_FORM_INTERACTION_ADVISORY } : {}),
+                ...(() => { const w = dataRuleFormulaWarnings(args.dataRuleType, args.options); return w.length ? { lintWarnings: w } : {}; })(),
             },
         };
     }, 
@@ -759,7 +775,13 @@ export function registerDataRuleLane(tools) {
         assertDataRuleTarget(args);
         assertDataRuleOptions(args.dataRuleType, args.options, args.checkType);
         assertDataRuleCheckType(args.dataRuleType, args.checkType);
-    }, undefined, dataruleRollbackSpec("datarule.create"));
+    }, 
+    // Dry-run is the cheapest place to see the formula lint (the platform
+    // validates nothing at create time; the failure surfaces at submit).
+    async (_session, args) => {
+        const lintWarnings = dataRuleFormulaWarnings(args.dataRuleType, args.options);
+        return lintWarnings.length ? { lintWarnings } : {};
+    }, dataruleRollbackSpec("datarule.create"));
     writeTool(tools, "datarule.update", DATARULE_LANE, DATARULE_TOOLS["datarule.update"].scope, DATARULE_TOOLS["datarule.update"].description, {
         id: z.string().min(1).optional().describe("数据规则记录 id；省略时可改用业务键 schemaCode + propertyCode(+dataRuleType) 定位"),
         schemaCode: z.string().min(1),

package/dist/lanes/rule-graph.js

@@ -10,6 +10,7 @@
  * call (dry lint) so a mis-shaped graph cannot reach the platform.
  */
 export { DYNAMIC_CONDITION_SOURCE_KEY, DYNAMIC_ACTION_SOURCE_KEY } from "omc-core/wire-facts";
+import { lintFormulaText } from "../formula-lint.js";
 import { DYNAMIC_CONDITION_SOURCE_KEY, DYNAMIC_ACTION_SOURCE_KEY } from "omc-core/wire-facts";
 import { decodeJsonColumn, JSON_COLUMN_NULL_COALESCE } from "../json-column.js";
 export const RULE_VALUE_TYPES = ["DYNAMIC", "FIXED", "EMPTY", "VARIABLE", "EXPRESSION", "SYSTEM", "AGGREGATION"];
@@ -1092,32 +1093,8 @@ export function validateConditionLeaf(leaf, nodeCode, where, warnings, legacyTol
     return blockers;
 }
 /**
- * The formula engine's registered function names — the `CalculateMethodType`
- * enum in cloudpivot-shared (`CalculateRuleExecutor` registers one Aviator
- * function per code). A name outside this set makes the platform answer
- * `errcode 101005 表达式格式错误` at submit time (1.1.25 真机 2026-10-20).
- */
-const FORMULA_FUNCTIONS = new Set([
-    "STRING", "SUBSTRING", "REPLACE", "UPPERMONEY", "IF", "CONTAINS", "GETADDRESS", "LEN",
-    "LOWER", "UPPER", "SEARCH", "STARTSWITH", "SUBSTITUTE", "TRIM", "GETUNITNAME", "LEFT",
-    "RIGHT", "TEXT", "UNION", "DATE", "COUNTIF", "SUM", "AVG", "MAX", "MIN", "COUNT", "ROUND",
-    "INTUP", "INTDOWN", "VALUE", "FIXED", "ABS", "CEILING", "FLOOR", "COS", "SIN", "LARGE",
-    "SMALL", "LOG", "MOD", "PI", "POWER", "RAND", "SQRT", "SUMIF", "DATEDIF", "YEAR", "MONTH",
-    "DAY", "WEEKNUM", "WEEKDAY", "QUARTER", "HOUR", "MINUTE", "SECOND", "ADDDAY", "ADDMONTH",
-    "ADDYEAR", "TODAY", "BETWEEN", "NOTBETWEEN", "ADDHOUR", "ADDMINUTE", "NOW", "CASE", "ISNULL",
-]);
-/** Names agents reach for that the engine does NOT register, with the real one. */
-const FORMULA_FUNCTION_ALIASES = Object.freeze({
-    CONCAT: "STRING",
-    CONCATENATE: "STRING",
-    STRCAT: "STRING",
-    JOIN: "STRING",
-});
-/**
- * Advisory lint for EXPRESSION formulas. The platform validates formulas only at
- * submit time and the failure is loud for unknown functions (101005) but SILENT
- * for text arithmetic: `{a}+"-X"` on a text target stores null, because `+` is
- * numeric. Text concatenation must use `STRING(a,b,...)` (真机 2026-10-20).
+ * Advisory lint for EXPRESSION formulas (shared with datarule so both carriers
+ * use one function registry — see src/formula-lint.ts for the 1.1.25 evidence).
  */
 export function formulaWarnings(action, nodeCode, index) {
     if (String(action.ruleValueType ?? "") !== "EXPRESSION")
@@ -1128,20 +1105,13 @@ export function formulaWarnings(action, nodeCode, index) {
     const formula = value.formula;
     if (typeof formula !== "string" || !formula.trim())
         return [];
-    const warnings = [];
-    const where = `dataActions[${index}]`;
-    for (const match of formula.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*\(/g)) {
-        const name = match[1].toUpperCase();
-        const alias = FORMULA_FUNCTION_ALIASES[name];
-        if (alias) {
-            warnings.push({ code: "rule-graph-formula-function-alias", nodeCode, key: "value", severity: "warning", message: `${where}: 公式里的 ${match[1]}() 不是平台函数；文本合并用 ${alias}({a},"-",{b})。别名写法在提交时报 errcode 101005 表达式格式错误。` });
-            continue;
-        }
-        if (FORMULA_FUNCTIONS.has(name))
-            continue;
-        warnings.push({ code: "rule-graph-formula-function-unknown", nodeCode, key: "value", severity: "warning", message: `${where}: 公式函数 ${match[1]}() 不在平台注册表（CalculateMethodType）——提交时会报 101005 表达式格式错误。可用函数见 omc help omc-business-configuration 或 cpdocs BusinessRulesTrigger.md「表达式函数」。` });
-    }
-    return warnings;
+    return lintFormulaText(formula, `dataActions[${index}].value.formula`).map((entry) => ({
+        code: entry.code,
+        nodeCode,
+        key: "value",
+        severity: "warning",
+        message: entry.message,
+    }));
 }
 /** Validate one dataAction; returns blockers (empty = clean). */
 export function validateDataAction(action, nodeCode, index) {
@@ -1414,6 +1384,56 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
     // The graph shape (DYNAMIC filter `currentSchemaDataItem` → target `id`;
     // DYNAMIC action `currentDataItemValue`) is correct as-is. Surface the two
     // prerequisites as a non-gating note rather than the false "unverified" claim.
+    // A BRANCH that fans out to TWO cross-model UPDATE nodes answers 50000 at
+    // write/run time (r5-asset 2026-10-20: the "完好/损坏 → 各自回写资产台账"
+    // shape failed with 50000). Loud, but only after the whole rule is written, so
+    // warn before the wire and name the supported alternative.
+    if (schemaCode !== undefined && schemaCode.length > 0 && Array.isArray(routes)) {
+        const updates = new Map();
+        for (const node of nodeRecords) {
+            if (String(node.nodeType ?? "") !== "UPDATE")
+                continue;
+            const target = String(node.targetObjectCode ?? "").trim();
+            if (target === "" || target === schemaCode)
+                continue;
+            updates.set(String(node.nodeCode ?? ""), { nodeCode: String(node.nodeCode ?? ""), target });
+        }
+        const branches = nodeRecords.filter((node) => String(node.nodeType ?? "") === "BRANCH");
+        const fanOut = [];
+        for (const branch of branches) {
+            const start = String(branch.nodeCode ?? "");
+            const queue = [start];
+            const seen = new Set();
+            const hit = [];
+            while (queue.length > 0) {
+                const current = queue.shift();
+                if (seen.has(current))
+                    continue;
+                seen.add(current);
+                if (current !== start && updates.has(current))
+                    hit.push(current);
+                for (const route of routes) {
+                    if (!route || typeof route !== "object")
+                        continue;
+                    if (String(route.preNode ?? "") === current) {
+                        const post = String(route.postNode ?? "");
+                        if (post !== "")
+                            queue.push(post);
+                    }
+                }
+            }
+            if (new Set(hit).size > 1)
+                fanOut.push(`${start} → ${[...new Set(hit)].join("、")}`);
+        }
+        if (fanOut.length > 0)
+            blockers.push({
+                code: "rule-graph-branch-multi-cross-model-update",
+                severity: "warning",
+                nodeCode: String(branches[0]?.nodeCode ?? ""),
+                key: "routes",
+                message: `分支节点后接多个跨模型 UPDATE（${fanOut.join("；")}）——真机 2026-10-20 该组合在写/运行时报 50000。改成：① 单个跨模型 UPDATE + 条件动作（dataActions 内按条件区分），或 ② 通过 BIZ_ACTION 自调二开接口一次处理多行。`,
+            });
+    }
     if (schemaCode !== undefined && schemaCode.length > 0) {
         const writeTypes = new Set(["UPDATE", "CREATE", "DELETE"]);
         const crossModel = nodeRecords.filter((node) => {
@@ -1538,13 +1558,18 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
         // logged 「查找范围不存在数据」 and the field kept its old value; moving the
         // same node after SYSTEM_CREATE wrote it. This is the one action type that
         // must sit AFTER persistence (ASSIGN/BIZ_ACTION must sit before).
-        if (String(systemNode.nodeType ?? "") === "SYSTEM_CREATE" && schemaCode) {
+        if ((String(systemNode.nodeType ?? "") === "SYSTEM_CREATE" || String(systemNode.nodeType ?? "") === "SYSTEM_UPDATE") && schemaCode) {
             const selfUpdateIndex = nodeRecords.findIndex((node) => {
                 const target = String(node.targetObjectCode ?? "");
                 return String(node.nodeType) === "UPDATE" && (target === "" || target === schemaCode);
             });
-            if (selfUpdateIndex >= 0 && selfUpdateIndex < systemIndex)
-                blockers.push({ code: "rule-graph-update-before-persistence-order", nodeCode: String(nodeRecords[selfUpdateIndex].nodeCode ?? ""), key: "nodes", message: `Create 规则里的自更新 UPDATE 必须排在 SYSTEM_CREATE 之后（Start→SYSTEM_CREATE→UPDATE→End）——排在前面时规则能存能启用，但运行时查不到触发行（日志「查找范围不存在数据」），字段静默不写回（真机 2026-10-20 前后对照）。把它挪到系统节点之后。` });
+            if (selfUpdateIndex >= 0 && selfUpdateIndex < systemIndex) {
+                const systemType = String(systemNode.nodeType ?? "");
+                const detail = systemType === "SYSTEM_CREATE"
+                    ? "Create 触发时触发行尚未落库，按 id 查不到（日志「查找范围不存在数据」），字段静默不写回"
+                    : "Update 触发时随后的 SYSTEM_UPDATE 会用本次提交值覆盖刚写的值（真机 2026-10-20：UPDATE 在前 note 落回提交值，在后才保留 UPDATE 值）";
+                blockers.push({ code: "rule-graph-update-before-persistence-order", nodeCode: String(nodeRecords[selfUpdateIndex].nodeCode ?? ""), key: "nodes", message: `自更新 UPDATE 必须排在 ${systemType} 之后（Start→${systemType}→UPDATE→End）——排在前面时规则能存能启用，但${detail}。把它挪到系统节点之后。` });
+            }
         }
     }
     // inputParam chaining: only "_input" or "_<existing nodeCode>_output".
@@ -1601,6 +1626,54 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
             const actions = Array.isArray(node.dataActions) ? node.dataActions : [];
             if (actions.length === 0)
                 blockers.push({ code: "rule-graph-update-without-actions", nodeCode, key: "dataActions", message: "UPDATE 节点至少需要 1 个 dataAction" });
+            // ---- cross-model UPDATE shapes (source: AI-Platform v1.1.25
+            // UpdateServiceExecutor + ActionMapping, re-decompiled 2026-10-20) ----
+            // targetObjectCode WITHOUT a dot = 目标主表; WITH a dot =
+            // "<目标主表>.<目标子表>" (ActionMapping.targetIsMainSchema splits on '.').
+            // Execution: getUpdatedMainBizObject() queries the TARGET main table once
+            // with mainConditions ONLY; sheetConditions is read only by
+            // doUpdateChildData() for the target child. So:
+            //   (a) a source child field (currentSchemaDataItem "child.field") is read
+            //       as a COLLECTION (DatasetImpl) and still produces ONE target query —
+            //       there is no per-source-child-row fan-out. Writing that shape looks
+            //       right, publishes, and silently matches nothing (r5-asset 2026-10-20:
+            //       id = asset_apply_items.asset updated zero rows).
+            //   (b) sheetConditions on a MAIN target is dead config.
+            const targetCode = String(node.targetObjectCode ?? "").trim();
+            const targetIsChild = targetCode.includes(".");
+            const targetMain = targetIsChild ? targetCode.split(".")[0] : targetCode;
+            const filterRecord = (node.filterCondition && typeof node.filterCondition === "object" ? node.filterCondition : {});
+            const mainGroups = Array.isArray(filterRecord.mainConditions) ? filterRecord.mainConditions : [];
+            const childSourcedLeaves = [];
+            for (const group of mainGroups) {
+                if (!Array.isArray(group))
+                    continue;
+                for (const leaf of group) {
+                    if (!leaf || typeof leaf !== "object")
+                        continue;
+                    const record = leaf;
+                    if (String(record.ruleValueType ?? "").toUpperCase() !== "DYNAMIC")
+                        continue;
+                    const source = String(record.currentSchemaDataItem ?? "").trim();
+                    if (source.includes("."))
+                        childSourcedLeaves.push(`${String(record.targetSchemaDataItem ?? "?")} = ${source}`);
+                }
+            }
+            if (!targetIsChild && targetMain !== schemaCode && childSourcedLeaves.length > 0)
+                blockers.push({
+                    code: "rule-graph-cross-model-child-source-fanout",
+                    nodeCode,
+                    key: "filterCondition.mainConditions",
+                    message: `${nodeCode}: 跨模型 UPDATE 用子表字段做定位条件（${childSourcedLeaves.join("、")}）——1.1.25 把 "子表.字段" 解析成**集合**，目标主表仍只查询一次，不会按每条子表行各更新一次，运行结果是 0 行命中（r5-asset 2026-10-20 真机：保存/发布全绿、状态不变）。单行回写改用主表字段做 DYNAMIC 来源；一张单多行逐件回写需二开（BIZ_ACTION 自调接口一次处理多行）。`,
+                });
+            if (!targetIsChild && Array.isArray(filterRecord.sheetConditions) && filterRecord.sheetConditions.length > 0)
+                blockers.push({
+                    code: "rule-graph-sheet-conditions-ignored-for-main-target",
+                    nodeCode,
+                    key: "filterCondition.sheetConditions",
+                    severity: "warning",
+                    message: `${nodeCode}: targetObjectCode "${targetCode}" 是主表目标，sheetConditions 只在目标是 "<主表>.<子表>" 时被 doUpdateChildData 读取——这里不会生效（UpdateServiceExecutor 只把 mainConditions 传给目标主表查询）。要筛目标子表请把 targetObjectCode 写成点号路径。`,
+                });
             actions.forEach((action, index) => {
                 if (action && typeof action === "object") {
                     blockers.push(...validateDataAction(action, nodeCode, index));

package/dist/lanes/runtime-data.js

@@ -290,6 +290,25 @@ async function portalRequiredViolations(session, schemaCode, sheetCode, formData
  * carrying its own `id` is "Modified", an id-less row is "Added"; an explicit
  * rowStatus is preserved verbatim.
  */
+/**
+ * Paths of non-empty child-table arrays anywhere inside a form payload. The
+ * platform appends every child row it finds on an approval submit, regardless
+ * of nesting, so detection must not stop at the top level.
+ */
+function collectChildArrayPaths(value, childCodes, prefix = "") {
+    if (value === null || typeof value !== "object")
+        return [];
+    if (Array.isArray(value))
+        return [];
+    const found = [];
+    for (const [key, child] of Object.entries(value)) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        if (childCodes.has(key) && Array.isArray(child) && child.length > 0)
+            found.push(path);
+        found.push(...collectChildArrayPaths(child, childCodes, path));
+    }
+    return found;
+}
 async function stampChildRowStatuses(session, schemaCode, formData) {
     const childCodes = new Set();
     try {
@@ -300,10 +319,10 @@ async function stampChildRowStatuses(session, schemaCode, formData) {
         }
     }
     catch {
-        return formData;
+        return { formData, childCodes: [] };
     }
     if (childCodes.size === 0)
-        return formData;
+        return { formData, childCodes: [] };
     let changed = false;
     const next = { ...formData };
     for (const code of childCodes) {
@@ -321,7 +340,7 @@ async function stampChildRowStatuses(session, schemaCode, formData) {
             return { ...row, rowStatus: hasId ? "Modified" : "Added" };
         });
     }
-    return changed ? next : formData;
+    return { formData: changed ? next : formData, childCodes: [...childCodes] };
 }
 /** Runtime business-object data keyed by field code. */
 export function registerRuntimeDataLane(tools) {
@@ -646,7 +665,7 @@ export function registerRuntimeDataLane(tools) {
                 message: "submit:true 与 workflowCode 互斥——workflowCode 是流程草稿两段式的第一段（返回 workItemId 后用 data.submit 提交）；无流程模型的一调完成态用 submit:true 且不带 workflowCode",
             });
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
         if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
             // Portal draft-save shape. The row id travels in data.id (the portal
             // form SDK receives a pre-generated id from form/load and echoes it);
@@ -808,7 +827,7 @@ export function registerRuntimeDataLane(tools) {
                 message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
             });
         }
-        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
         const performed = await wireCall(session, {
             path: ENDPOINTS.runtimeFormSave,
             method: "POST",
@@ -907,6 +926,7 @@ export function registerRuntimeDataLane(tools) {
         workItemId: z.string().optional(),
         bizObjectId: z.string().optional().describe("existing record id; REQUIRED for workItem approval submits (formType=1 + workItemId) — the submit's bizObject must reference the in-flight record or the engine NPEs (DataChangeHandlerImpl.changeBizObject)"),
         agree: z.boolean().optional(),
+        allowChildRowAppend: z.boolean().optional().describe("默认 false：审批提交（带 workItemId/workflowInstanceId）时 formData 含子表数组会被拒——平台按追加插行，每次提交重复一份。确实要追加子行时才置 true。"),
         approval: z.record(z.string(), z.unknown()).optional(),
         runMode: z.string().optional(),
         isSimulative: z.boolean().optional(),
@@ -926,7 +946,28 @@ export function registerRuntimeDataLane(tools) {
             });
         }
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const formData = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const stampedSubmit = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const formData = stampedSubmit.formData;
+        // r5-asset 2026-10-20: the platform APPENDS child rows carried in an
+        // approval submit's formData (no upsert by row id, no error). Live: an
+        // approval that echoed the whole form twice turned 2 detail rows into 6
+        // and 30000 into 90000 while every call answered errcode 0 — node-level
+        // `editable:false` does not stop it server-side. Refuse before the wire.
+        if ((hasWorkItem || hasInstance) && args.allowChildRowAppend !== true) {
+            // Scan at ANY depth: callers wrap the form as {data:{...}} or
+            // {bizObject:{data:{...}}}, and a top-level-only check let those through
+            // (the platform appends whatever it finds). The child codes come from the
+            // model's own field list.
+            const carried = collectChildArrayPaths(args.formData, new Set(stampedSubmit.childCodes));
+            if (carried.length > 0)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-approval-child-rows",
+                    schemaCode: args.schemaCode,
+                    childTables: carried,
+                    message: `审批提交（workItemId/workflowInstanceId）的 formData 不要带子表数组：${carried.join("、")}。平台按「追加行」处理——每提交一次就再插一份（真机：2 行 → 6 行，30000 → 90000），且不报错、审批节点的 editable:false 也拦不住。只传主表字段；确实要在审批中追加子行时显式传 allowChildRowAppend:true。`,
+                });
+        }
         // Portal required-field semantics: the REST submit does NOT enforce them,
         // so a missing required value must be REPORTED, not silently accepted as a
         // portal-valid submit (dogfood R3). Best-effort read; a failure never

package/dist/lanes/workflow.js

@@ -482,6 +482,84 @@ function mapCallerRules(callerRoutes, draftRules, activities) {
  * `org.role.list` / `org.department.list` first. Advisory (never blocks): the
  * platform accepts the save, so this is a readback lint, not a write gate.
  */
+/**
+ * Participant FUNCTION names that the runtime does not register. Read-back and
+ * seeded templates carry them (the CRM seed uses FindUsersSpecByRoleFunction),
+ * and 1.1.25 only ships FindUserByRoleFunction — the others throw
+ * FunctionNotFoundException inside ParticipantActivityRuntime, so the instance
+ * stalls in PROCESSING with no work item while every API call answers errCode 0.
+ * A warning was not enough (r4 lost ~200 rounds to it), so publish refuses.
+ */
+export function unregisteredParticipantFunctions(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const found = [];
+    for (const activity of activities) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const participant = String(activity.participant ?? "").trim();
+        const match = /^(FindUsersByRoleFunction|FindUsersSpecByRoleFunction)\s*\(/.exec(participant);
+        if (match)
+            found.push({ activityCode: String(activity.activityCode ?? ""), functionName: match[1] });
+    }
+    return found;
+}
+/**
+ * The designer default OMC backfills is `rejectToStart:true` on approval nodes
+ * (see backfillDesignerDefaults). With that flag, rejecting returns the instance
+ * to the fill node and the flow keeps running: endEventHandler and
+ * cancelEventHandler never fire (live 2026-10-20, r5-asset — instance stayed
+ * PROCESSING, todo back at A2, status still 审批中). A rule bound to `cancel`
+ * therefore silently never runs. Advisory: reject-to-start is a legitimate
+ * choice, only "I bound a cancel rule and expect it to run" is broken.
+ */
+/**
+ * A delta that omits `routes` keeps the draft's edges (mergeCallerDelta /
+ * completeWorkflowChain). That is the right default, but it is invisible: after
+ * 0.4.63's fix a branched draft survives an activities-only update, and a caller
+ * has no way to tell "I preserved 5 edges including the else fallback" from
+ * "the platform rebuilt a linear chain". Report the inherited branch edges.
+ */
+function inheritedBranchEdges(template) {
+    const rows = Array.isArray(template.activities) ? template.activities : [];
+    const rules = Array.isArray(template.rules) ? template.rules : [];
+    const outbound = new Map();
+    for (const rule of rules) {
+        const pre = String(rule.preActivityCode ?? "");
+        const post = String(rule.postActivityCode ?? "");
+        if (pre === "" || post === "")
+            continue;
+        outbound.set(pre, [...(outbound.get(pre) ?? []), post]);
+    }
+    const nameOf = new Map(rows.map((row) => [String(row.activityCode ?? ""), String(row.activityName ?? "")]));
+    return [...outbound.entries()]
+        .filter(([, targets]) => targets.length > 1)
+        .map(([pre, targets]) => `${pre}${nameOf.get(pre) ? `(${nameOf.get(pre)})` : ""} → ${targets.join(" | ")}`);
+}
+export function rejectToStartCancelWarnings(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const blocking = activities
+        .filter((activity) => String(activity.activityType ?? "") === "PARTICIPANT")
+        .filter((activity) => {
+        const action = activity.permittedAction;
+        if (action === undefined || action === null || typeof action !== "object")
+            return true; // designer default -> true
+        return action.rejectToStart !== false;
+    })
+        .map((activity) => String(activity.activityCode ?? ""));
+    if (blocking.length === 0)
+        return [];
+    const cancel = template.cancelEventHandler;
+    const cancelRules = cancel && typeof cancel === "object" ? cancel.bizActions : undefined;
+    const bound = Array.isArray(cancelRules) ? cancelRules.length : 0;
+    if (bound === 0)
+        return [];
+    return [{
+            code: "workflow-reject-to-start-suppresses-cancel-handler",
+            severity: "warning",
+            message: `cancelEventHandler 绑了 ${bound} 条规则，但审批节点 ${blocking.join("、")} 的 rejectToStart 为 true（设计器默认）：驳回会把实例退回填写节点并继续运行，end/cancel 处理器都不触发，这些规则不会执行（r5-asset 真机：实例仍 PROCESSING、待办回 A2）。` +
+                `两种改法：① 在这个节点的 permittedAction 里显式传 rejectToStart:false（驳回即结束，cancel 生效）；② 驳回后的状态改成由发起人手工处理或二开监听。`,
+        }];
+}
 function participantReferenceWarnings(template) {
     const activities = Array.isArray(template.activities) ? template.activities : [];
     const warnings = [];
@@ -691,7 +769,7 @@ function validateWorkflowRender(template, tool) {
  * chain order" — reusing any edge whose endpoints survived. A draft whose
  * (possibly branching) graph is untouched passes the chain check verbatim.
  */
-function completeWorkflowChain(rules, activities) {
+export function completeWorkflowChain(rules, activities) {
     const codes = activities.map((activity) => String(activity.activityCode ?? "")).filter((code) => code.length > 0);
     if (codes.length < 2)
         return rules;
@@ -712,13 +790,24 @@ function completeWorkflowChain(rules, activities) {
     }
     for (const code of codes) {
         const type = typeOf(code);
-        if (type !== "START" && (inbound.get(code) ?? 0) !== 1)
+        if (type !== "START" && (inbound.get(code) ?? 0) < 1)
             valid = false;
-        if (type !== "END" && (outbound.get(code) ?? 0) !== 1)
+        if (type !== "END" && (outbound.get(code) ?? 0) < 1)
             valid = false;
     }
     if (valid)
         return rules;
+    // r5-asset 2026-10-20: a node with TWO outgoing edges is a conditional
+    // branch (condition edge + utilizeElse fallback), NOT an invalid chain. The
+    // old rule demanded outbound === 1, so every branched graph fell through to
+    // the linear rebuild below — which maps consecutive activity codes and
+    // silently DROPS the else edge. Live symptom: a workflow.update that sent
+    // activities without routes erased A3→A5, every low-amount instance stalled
+    // in PROCESSING with errcode 0, and the only trace was a missing edge in
+    // get_published. Never linearize a graph that already branches.
+    const branched = [...outbound.values()].some((count) => count > 1);
+    if (branched)
+        return rules;
     const byEdge = new Map(rules.map((rule) => [`${rule.preActivityCode}->${rule.postActivityCode}`, rule]));
     return codes.slice(0, -1).map((code, index) => byEdge.get(`${code}->${codes[index + 1]}`) ?? { preActivityCode: code, postActivityCode: codes[index + 1] });
 }
@@ -1740,8 +1829,16 @@ export function registerWorkflowLane(tools) {
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
         validateWorkflowRender(data, "workflow.update readback");
         const participantWarnings = participantReferenceWarnings(data);
+        // Evaluate on `body` (post-backfill): the readback may drop the handler
+        // keys, and the backfilled permittedAction is exactly what will run.
+        const rejectWarnings = rejectToStartCancelWarnings(body);
         const renamedActivities = renamedActivityPairs(template, data);
         const renamedInPlace = inPlaceRenames(data);
+        // Caller sent no routes at all: the draft's edges (branches included) are
+        // what rides the wire. Say so, and name the branch edges, because the only
+        // other trace is a missing edge in a later getPublished readback.
+        const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
+        const branchEdges = callerSentRoutes ? [] : inheritedBranchEdges(data);
         // 改名验收的权威读数：每个节点的当前显示名（platform may keep
         // activityName or sync it; effectiveActivityName resolves both shapes).
         const rawActivityRows = Array.isArray(data.activities)
@@ -1752,7 +1849,7 @@ export function registerWorkflowLane(tools) {
         const activityNames = Object.fromEntries(rawActivityRows
             .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
             .filter(([code]) => code !== ""));
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, ...(participantWarnings.length ? { participantWarnings } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
     }, (args) => {
         // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
         // governed pipeline — including the rollback before-capture read.
@@ -1771,6 +1868,18 @@ export function registerWorkflowLane(tools) {
         // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
         const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
         await backfillDesignerDefaults(session, args.schemaCode, body, template);
+        const unregistered = unregisteredParticipantFunctions(body);
+        if (unregistered.length > 0)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-participant-function-unregistered",
+                workflowCode: args.code,
+                activities: unregistered,
+                message: `流程发布被拒：参与人函数 ${[...new Set(unregistered.map((entry) => entry.functionName + "()"))].join("、")} 在 AI-Platform v1.1.25 未注册（节点 ${unregistered.map((entry) => entry.activityCode).join("、")}）。` +
+                    `发布能过，但运行期 ParticipantActivityRuntime 抛 FunctionNotFoundException：实例卡 PROCESSING、不生成待办，而 data.submit 仍回 errCode 0（r4-training 真机）。` +
+                    `内置函数只有 FindUserByRole({Originator.OU},"<roleCode>","random")；跨部门/全局角色改用参与者对象数组（角色 id）。` +
+                    `这两个名字常见于 workflow.get_published 读回与种子流程，不要回抄。`,
+            });
         validateWorkflowRender(body, "workflow.publish");
         const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
         // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
@@ -1795,7 +1904,8 @@ export function registerWorkflowLane(tools) {
             });
         validateWorkflowRender(data, "workflow.publish readback");
         const participantWarnings = participantReferenceWarnings(data);
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        const rejectWarnings = rejectToStartCancelWarnings(data);
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
     }, (args) => {
         assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");
     }, undefined, workflowRollbackSpec("workflow.publish"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.62",
+  "version": "0.4.64",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.62",
+    "@stalfh233/omc-fake-platform": "0.4.64",
     "commander": "14.0.3",
-    "omc-core": "0.4.62",
+    "omc-core": "0.4.64",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-write-hazards.md

@@ -125,3 +125,29 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
 ## 固定验收顺序
 
 执行阶段以 `omc-five-piece-flow` 为准；写面安全只额外强调两点：写前先 `commands/describe/contract` + dry-run 静态校验，写后权威 readback，必要时再用 CLI 触发运行验证。
+
+## 审批提交回传子表 = 追加行（真机 2026-10-20）
+
+带 `workItemId` / `workflowInstanceId` 的 `data.submit` 里放子表数组，平台按**追加**处理，不按行 `id` upsert、也不报错：
+2 行明细回传两次 → 6 行，`totalValue` 30000 → 90000，审批节点的 `editable:false` 拦不住服务端写入。
+**只传主表字段**；确需追加行时显式 `allowChildRowAppend:true`（0.4.63 起默认拒绝，blocker `submit-approval-child-rows`）。
+收尾时前后各读一次子表行数确认未变。
+
+## 跨表回写的真实语义（1.1.25 源码 + 真机 2026-10-20）
+
+`targetObjectCode` 的**点号是目标侧路径**，不是来源字段路径：
+
+| 写法 | 语义 | 执行 |
+|------|------|------|
+| `"asset_ledger"` | 目标主表 | 先按 `mainConditions` 查目标主表（**只查一次**），再逐行改 |
+| `"asset_apply.asset_apply_items"` | 目标主表下的子表 | 先查目标主表，再用 `sheetConditions` 在**已查出的主表 ID 范围内**筛目标子表行 |
+
+对应源码：`UpdateServiceExecutor.getUpdatedMainBizObject()` 只把 `mainConditions` 交给目标主表查询；`sheetConditions` 只在 `doUpdateChildData()` 里被读取。
+
+由此得到四条使用纪律：
+
+1. **主表目标上的 `sheetConditions` 是死配置**——不会生效（OMC 0.4.64 起给 warning）。
+2. **来源子表字段是集合，不是逐行扇出**：`currentSchemaDataItem:"items.asset"` 会被解析成该子表所有行的值集合，目标主表仍只查询一次。写这个形状能存能发布，但运行 0 行命中（r5-asset 真机）。OMC 0.4.64 起 `rule-graph-cross-model-child-source-fanout` **拒绝**。
+3. **一张单多行逐件回写**（每条明细各改一条另一模型的主表行）没有可用的纯配置形状——走 BIZ_ACTION 自调二开接口，一次处理多行；单行回写用主表字段做 DYNAMIC 来源。
+4. **BRANCH 后接两个跨表 UPDATE** 真机报 50000；改用单个 UPDATE + 条件动作，或二开。
+