@stalfh233/omc-cli 0.4.63 → 0.4.65

package/dist/cli.js

@@ -458,6 +458,15 @@ async function cmdArtifactGet(id, transport, options = {}) {
         if (options.summary) {
             const record = content && typeof content === "object" && !Array.isArray(content) ? content : undefined;
             const keys = record ? Object.entries(record).map(([key, value]) => ({ key, bytes: Buffer.byteLength(JSON.stringify(value) ?? "null", "utf8"), kind: Array.isArray(value) ? `array[${value.length}]` : value === null ? "null" : typeof value })).sort((left, right) => right.bytes - left.bytes) : [];
+            // `--summary --jq <path>`: shape AND the one value, in a single call. Without
+            // this the caller had to spend one round on the shape and another on the
+            // path (or pull the whole body); r5 hit that on 67 KB workflow templates.
+            if (options.jq !== undefined) {
+                const projected = projectJsonPath(artifact.content.toString("utf8") === "" ? undefined : content, options.jq);
+                return emitTransportResult(projected.missed
+                    ? { status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, projection: { path: options.jq, content: null, pathMiss: true, missedAt: projected.at, available: projected.available }, fetch: artifactFetchHint(id) }
+                    : { status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, projection: { path: options.jq, content: projected.value ?? null } }, transport);
+            }
             return emitTransportResult({ status: "ok", artifactId: id, sha256: artifact.sha256, bytes: artifact.content.length, keys, fetch: artifactFetchHint(id) }, transport);
         }
         if (options.keys !== undefined) {

package/dist/formula-lint.js

@@ -0,0 +1,73 @@
+/**
+ * Shared lint for the platform's formula engine (EXPRESSION actions and
+ * dataRuleType-2 CALCULATE carriers).
+ *
+ * Evidence (AI-Platform v1.1.25): the engine parses `formula` with Aviator and
+ * registers exactly the names in `CalculateMethodType` (cloudpivot-shared),
+ * one function per code, via `CalculateRuleExecutor`. A name outside that set
+ * fails at submit time with `errcode 101005 表达式格式错误`; text concatenation
+ * with `+` instead of `STRING(...)` does NOT fail — `+` is numeric addition and
+ * the target silently stores null (live 2026-10-20, r4-training: `{a}+"-X"`
+ * wrote null while `STRING({a},"-X")` wrote `CNAME-X`).
+ *
+ * The platform validates nothing at save time, so this lint runs before the
+ * wire. Severity is advisory: an unknown name is loud at submit, but the caller
+ * should see it at write time rather than after a data probe.
+ */
+export const FORMULA_FUNCTIONS = new Set([
+    "STRING", "SUBSTRING", "REPLACE", "UPPERMONEY", "IF", "CONTAINS", "GETADDRESS", "LEN",
+    "LOWER", "UPPER", "SEARCH", "STARTSWITH", "SUBSTITUTE", "TRIM", "GETUNITNAME", "LEFT",
+    "RIGHT", "TEXT", "UNION", "DATE", "COUNTIF", "SUM", "AVG", "MAX", "MIN", "COUNT", "ROUND",
+    "INTUP", "INTDOWN", "VALUE", "FIXED", "ABS", "CEILING", "FLOOR", "COS", "SIN", "LARGE",
+    "SMALL", "LOG", "MOD", "PI", "POWER", "RAND", "SQRT", "SUMIF", "DATEDIF", "YEAR", "MONTH",
+    "DAY", "WEEKNUM", "WEEKDAY", "QUARTER", "HOUR", "MINUTE", "SECOND", "ADDDAY", "ADDMONTH",
+    "ADDYEAR", "TODAY", "BETWEEN", "NOTBETWEEN", "ADDHOUR", "ADDMINUTE", "NOW", "CASE", "ISNULL",
+]);
+/** Names agents reach for that the engine does NOT register, with the real one. */
+export const FORMULA_FUNCTION_ALIASES = Object.freeze({
+    CONCAT: "STRING",
+    CONCATENATE: "STRING",
+    STRCAT: "STRING",
+    JOIN: "STRING",
+});
+const TEXT_PLUS_CONCAT = /(\{[^{}]+\}|[A-Za-z_][A-Za-z0-9_]*\s*\([^()]*\))\s*\+\s*["']|["']\s*\+\s*(\{[^{}]+\}|[A-Za-z_][A-Za-z0-9_]*\s*\()/;
+/**
+ * Lint one formula string. `where` names the carrier in the caller's own terms
+ * (e.g. `dataActions[0].value.formula`), so the message points at the key the
+ * caller has to fix.
+ */
+export function lintFormulaText(formula, where) {
+    if (typeof formula !== "string" || formula.trim().length === 0)
+        return [];
+    const entries = [];
+    for (const match of formula.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*\(/g)) {
+        const name = match[1].toUpperCase();
+        const alias = FORMULA_FUNCTION_ALIASES[name];
+        if (alias) {
+            entries.push({
+                code: "formula-function-alias",
+                severity: "warning",
+                functionName: match[1],
+                message: `${where}: 公式里的 ${match[1]}() 不是平台函数；文本合并用 ${alias}({a},"-",{b})。别名写法在提交时报 errcode 101005 表达式格式错误。`,
+            });
+            continue;
+        }
+        if (FORMULA_FUNCTIONS.has(name))
+            continue;
+        entries.push({
+            code: "formula-function-unknown",
+            severity: "warning",
+            functionName: match[1],
+            message: `${where}: 公式函数 ${match[1]}() 不在平台注册表（CalculateMethodType）——提交时会报 101005 表达式格式错误。文本合并用 STRING()；函数表见 cpdocs BusinessRulesTrigger.md「表达式函数」。`,
+        });
+    }
+    if (TEXT_PLUS_CONCAT.test(formula)) {
+        entries.push({
+            code: "formula-text-plus-concat",
+            severity: "warning",
+            message: `${where}: 公式用 + 拼接了字符串字面量——+ 是数值加法，文本目标上会静默写 null（真机 2026-10-20）。文本合并用 STRING({a},"-",{b})。`,
+        });
+    }
+    return entries;
+}
+//# sourceMappingURL=formula-lint.js.map

package/dist/lanes/datarule.js

@@ -1,3 +1,4 @@
+import { lintFormulaText } from "../formula-lint.js";
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
 import { capabilityArg, environmentArg } from "../args.js";
@@ -396,6 +397,20 @@ export function assertDataRuleOptions(dataRuleType, options, checkType) {
             assertStitchEditorTextRoundTrips(options);
     }
 }
+/**
+ * Advisory formula lint for the type-2 CALCULATE carrier. Same registry as the
+ * rule-graph EXPRESSION lint (src/formula-lint.ts): an unregistered function
+ * name fails at submit with 101005 and `+` on text silently writes null, and
+ * the platform validates neither at create time.
+ */
+export function dataRuleFormulaWarnings(dataRuleType, options) {
+    if (dataRuleType !== 2)
+        return [];
+    const formula = type2FormulaText(options);
+    if (formula === null)
+        return [];
+    return lintFormulaText(formula, "options.shortTextStitch.formula");
+}
 /** Extract the expression of a type-2 CALCULATE rule (mirrors calcExpressionShapeError's carrier choice). */
 function type2FormulaText(options) {
     const raw = typeof options.shortTextStitch === "string" ? options.shortTextStitch : typeof options.value === "string" ? options.value : undefined;
@@ -751,6 +766,7 @@ export function registerDataRuleLane(tools) {
                 matchedCount: rules.length,
                 rules: rules.map(decodeDataRule),
                 ...(args.dataRuleType >= 3 ? { advisory: DATARULE_FORM_INTERACTION_ADVISORY } : {}),
+                ...(() => { const w = dataRuleFormulaWarnings(args.dataRuleType, args.options); return w.length ? { lintWarnings: w } : {}; })(),
             },
         };
     }, 
@@ -759,7 +775,13 @@ export function registerDataRuleLane(tools) {
         assertDataRuleTarget(args);
         assertDataRuleOptions(args.dataRuleType, args.options, args.checkType);
         assertDataRuleCheckType(args.dataRuleType, args.checkType);
-    }, undefined, dataruleRollbackSpec("datarule.create"));
+    }, 
+    // Dry-run is the cheapest place to see the formula lint (the platform
+    // validates nothing at create time; the failure surfaces at submit).
+    async (_session, args) => {
+        const lintWarnings = dataRuleFormulaWarnings(args.dataRuleType, args.options);
+        return lintWarnings.length ? { lintWarnings } : {};
+    }, dataruleRollbackSpec("datarule.create"));
     writeTool(tools, "datarule.update", DATARULE_LANE, DATARULE_TOOLS["datarule.update"].scope, DATARULE_TOOLS["datarule.update"].description, {
         id: z.string().min(1).optional().describe("数据规则记录 id；省略时可改用业务键 schemaCode + propertyCode(+dataRuleType) 定位"),
         schemaCode: z.string().min(1),

package/dist/lanes/rule-graph.js

@@ -10,6 +10,7 @@
  * call (dry lint) so a mis-shaped graph cannot reach the platform.
  */
 export { DYNAMIC_CONDITION_SOURCE_KEY, DYNAMIC_ACTION_SOURCE_KEY } from "omc-core/wire-facts";
+import { lintFormulaText } from "../formula-lint.js";
 import { DYNAMIC_CONDITION_SOURCE_KEY, DYNAMIC_ACTION_SOURCE_KEY } from "omc-core/wire-facts";
 import { decodeJsonColumn, JSON_COLUMN_NULL_COALESCE } from "../json-column.js";
 export const RULE_VALUE_TYPES = ["DYNAMIC", "FIXED", "EMPTY", "VARIABLE", "EXPRESSION", "SYSTEM", "AGGREGATION"];
@@ -1092,32 +1093,8 @@ export function validateConditionLeaf(leaf, nodeCode, where, warnings, legacyTol
     return blockers;
 }
 /**
- * The formula engine's registered function names — the `CalculateMethodType`
- * enum in cloudpivot-shared (`CalculateRuleExecutor` registers one Aviator
- * function per code). A name outside this set makes the platform answer
- * `errcode 101005 表达式格式错误` at submit time (1.1.25 真机 2026-10-20).
- */
-const FORMULA_FUNCTIONS = new Set([
-    "STRING", "SUBSTRING", "REPLACE", "UPPERMONEY", "IF", "CONTAINS", "GETADDRESS", "LEN",
-    "LOWER", "UPPER", "SEARCH", "STARTSWITH", "SUBSTITUTE", "TRIM", "GETUNITNAME", "LEFT",
-    "RIGHT", "TEXT", "UNION", "DATE", "COUNTIF", "SUM", "AVG", "MAX", "MIN", "COUNT", "ROUND",
-    "INTUP", "INTDOWN", "VALUE", "FIXED", "ABS", "CEILING", "FLOOR", "COS", "SIN", "LARGE",
-    "SMALL", "LOG", "MOD", "PI", "POWER", "RAND", "SQRT", "SUMIF", "DATEDIF", "YEAR", "MONTH",
-    "DAY", "WEEKNUM", "WEEKDAY", "QUARTER", "HOUR", "MINUTE", "SECOND", "ADDDAY", "ADDMONTH",
-    "ADDYEAR", "TODAY", "BETWEEN", "NOTBETWEEN", "ADDHOUR", "ADDMINUTE", "NOW", "CASE", "ISNULL",
-]);
-/** Names agents reach for that the engine does NOT register, with the real one. */
-const FORMULA_FUNCTION_ALIASES = Object.freeze({
-    CONCAT: "STRING",
-    CONCATENATE: "STRING",
-    STRCAT: "STRING",
-    JOIN: "STRING",
-});
-/**
- * Advisory lint for EXPRESSION formulas. The platform validates formulas only at
- * submit time and the failure is loud for unknown functions (101005) but SILENT
- * for text arithmetic: `{a}+"-X"` on a text target stores null, because `+` is
- * numeric. Text concatenation must use `STRING(a,b,...)` (真机 2026-10-20).
+ * Advisory lint for EXPRESSION formulas (shared with datarule so both carriers
+ * use one function registry — see src/formula-lint.ts for the 1.1.25 evidence).
  */
 export function formulaWarnings(action, nodeCode, index) {
     if (String(action.ruleValueType ?? "") !== "EXPRESSION")
@@ -1128,20 +1105,13 @@ export function formulaWarnings(action, nodeCode, index) {
     const formula = value.formula;
     if (typeof formula !== "string" || !formula.trim())
         return [];
-    const warnings = [];
-    const where = `dataActions[${index}]`;
-    for (const match of formula.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*\(/g)) {
-        const name = match[1].toUpperCase();
-        const alias = FORMULA_FUNCTION_ALIASES[name];
-        if (alias) {
-            warnings.push({ code: "rule-graph-formula-function-alias", nodeCode, key: "value", severity: "warning", message: `${where}: 公式里的 ${match[1]}() 不是平台函数；文本合并用 ${alias}({a},"-",{b})。别名写法在提交时报 errcode 101005 表达式格式错误。` });
-            continue;
-        }
-        if (FORMULA_FUNCTIONS.has(name))
-            continue;
-        warnings.push({ code: "rule-graph-formula-function-unknown", nodeCode, key: "value", severity: "warning", message: `${where}: 公式函数 ${match[1]}() 不在平台注册表（CalculateMethodType）——提交时会报 101005 表达式格式错误。可用函数见 omc help omc-business-configuration 或 cpdocs BusinessRulesTrigger.md「表达式函数」。` });
-    }
-    return warnings;
+    return lintFormulaText(formula, `dataActions[${index}].value.formula`).map((entry) => ({
+        code: entry.code,
+        nodeCode,
+        key: "value",
+        severity: "warning",
+        message: entry.message,
+    }));
 }
 /** Validate one dataAction; returns blockers (empty = clean). */
 export function validateDataAction(action, nodeCode, index) {
@@ -1414,6 +1384,56 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
     // The graph shape (DYNAMIC filter `currentSchemaDataItem` → target `id`;
     // DYNAMIC action `currentDataItemValue`) is correct as-is. Surface the two
     // prerequisites as a non-gating note rather than the false "unverified" claim.
+    // A BRANCH that fans out to TWO cross-model UPDATE nodes answers 50000 at
+    // write/run time (r5-asset 2026-10-20: the "完好/损坏 → 各自回写资产台账"
+    // shape failed with 50000). Loud, but only after the whole rule is written, so
+    // warn before the wire and name the supported alternative.
+    if (schemaCode !== undefined && schemaCode.length > 0 && Array.isArray(routes)) {
+        const updates = new Map();
+        for (const node of nodeRecords) {
+            if (String(node.nodeType ?? "") !== "UPDATE")
+                continue;
+            const target = String(node.targetObjectCode ?? "").trim();
+            if (target === "" || target === schemaCode)
+                continue;
+            updates.set(String(node.nodeCode ?? ""), { nodeCode: String(node.nodeCode ?? ""), target });
+        }
+        const branches = nodeRecords.filter((node) => String(node.nodeType ?? "") === "BRANCH");
+        const fanOut = [];
+        for (const branch of branches) {
+            const start = String(branch.nodeCode ?? "");
+            const queue = [start];
+            const seen = new Set();
+            const hit = [];
+            while (queue.length > 0) {
+                const current = queue.shift();
+                if (seen.has(current))
+                    continue;
+                seen.add(current);
+                if (current !== start && updates.has(current))
+                    hit.push(current);
+                for (const route of routes) {
+                    if (!route || typeof route !== "object")
+                        continue;
+                    if (String(route.preNode ?? "") === current) {
+                        const post = String(route.postNode ?? "");
+                        if (post !== "")
+                            queue.push(post);
+                    }
+                }
+            }
+            if (new Set(hit).size > 1)
+                fanOut.push(`${start} → ${[...new Set(hit)].join("、")}`);
+        }
+        if (fanOut.length > 0)
+            blockers.push({
+                code: "rule-graph-branch-multi-cross-model-update",
+                severity: "warning",
+                nodeCode: String(branches[0]?.nodeCode ?? ""),
+                key: "routes",
+                message: `分支节点后接多个跨模型 UPDATE（${fanOut.join("；")}）——真机 2026-10-20 该组合在写/运行时报 50000。改成：① 单个跨模型 UPDATE + 条件动作（dataActions 内按条件区分），或 ② 通过 BIZ_ACTION 自调二开接口一次处理多行。`,
+            });
+    }
     if (schemaCode !== undefined && schemaCode.length > 0) {
         const writeTypes = new Set(["UPDATE", "CREATE", "DELETE"]);
         const crossModel = nodeRecords.filter((node) => {
@@ -1538,13 +1558,18 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
         // logged 「查找范围不存在数据」 and the field kept its old value; moving the
         // same node after SYSTEM_CREATE wrote it. This is the one action type that
         // must sit AFTER persistence (ASSIGN/BIZ_ACTION must sit before).
-        if (String(systemNode.nodeType ?? "") === "SYSTEM_CREATE" && schemaCode) {
+        if ((String(systemNode.nodeType ?? "") === "SYSTEM_CREATE" || String(systemNode.nodeType ?? "") === "SYSTEM_UPDATE") && schemaCode) {
             const selfUpdateIndex = nodeRecords.findIndex((node) => {
                 const target = String(node.targetObjectCode ?? "");
                 return String(node.nodeType) === "UPDATE" && (target === "" || target === schemaCode);
             });
-            if (selfUpdateIndex >= 0 && selfUpdateIndex < systemIndex)
-                blockers.push({ code: "rule-graph-update-before-persistence-order", nodeCode: String(nodeRecords[selfUpdateIndex].nodeCode ?? ""), key: "nodes", message: `Create 规则里的自更新 UPDATE 必须排在 SYSTEM_CREATE 之后（Start→SYSTEM_CREATE→UPDATE→End）——排在前面时规则能存能启用，但运行时查不到触发行（日志「查找范围不存在数据」），字段静默不写回（真机 2026-10-20 前后对照）。把它挪到系统节点之后。` });
+            if (selfUpdateIndex >= 0 && selfUpdateIndex < systemIndex) {
+                const systemType = String(systemNode.nodeType ?? "");
+                const detail = systemType === "SYSTEM_CREATE"
+                    ? "Create 触发时触发行尚未落库，按 id 查不到（日志「查找范围不存在数据」），字段静默不写回"
+                    : "Update 触发时随后的 SYSTEM_UPDATE 会用本次提交值覆盖刚写的值（真机 2026-10-20：UPDATE 在前 note 落回提交值，在后才保留 UPDATE 值）";
+                blockers.push({ code: "rule-graph-update-before-persistence-order", nodeCode: String(nodeRecords[selfUpdateIndex].nodeCode ?? ""), key: "nodes", message: `自更新 UPDATE 必须排在 ${systemType} 之后（Start→${systemType}→UPDATE→End）——排在前面时规则能存能启用，但${detail}。把它挪到系统节点之后。` });
+            }
         }
     }
     // inputParam chaining: only "_input" or "_<existing nodeCode>_output".
@@ -1601,6 +1626,54 @@ export function validateRuleNodeGraph(graph, ruleCode, schemaCode, options = {})
             const actions = Array.isArray(node.dataActions) ? node.dataActions : [];
             if (actions.length === 0)
                 blockers.push({ code: "rule-graph-update-without-actions", nodeCode, key: "dataActions", message: "UPDATE 节点至少需要 1 个 dataAction" });
+            // ---- cross-model UPDATE shapes (source: AI-Platform v1.1.25
+            // UpdateServiceExecutor + ActionMapping, re-decompiled 2026-10-20) ----
+            // targetObjectCode WITHOUT a dot = 目标主表; WITH a dot =
+            // "<目标主表>.<目标子表>" (ActionMapping.targetIsMainSchema splits on '.').
+            // Execution: getUpdatedMainBizObject() queries the TARGET main table once
+            // with mainConditions ONLY; sheetConditions is read only by
+            // doUpdateChildData() for the target child. So:
+            //   (a) a source child field (currentSchemaDataItem "child.field") is read
+            //       as a COLLECTION (DatasetImpl) and still produces ONE target query —
+            //       there is no per-source-child-row fan-out. Writing that shape looks
+            //       right, publishes, and silently matches nothing (r5-asset 2026-10-20:
+            //       id = asset_apply_items.asset updated zero rows).
+            //   (b) sheetConditions on a MAIN target is dead config.
+            const targetCode = String(node.targetObjectCode ?? "").trim();
+            const targetIsChild = targetCode.includes(".");
+            const targetMain = targetIsChild ? targetCode.split(".")[0] : targetCode;
+            const filterRecord = (node.filterCondition && typeof node.filterCondition === "object" ? node.filterCondition : {});
+            const mainGroups = Array.isArray(filterRecord.mainConditions) ? filterRecord.mainConditions : [];
+            const childSourcedLeaves = [];
+            for (const group of mainGroups) {
+                if (!Array.isArray(group))
+                    continue;
+                for (const leaf of group) {
+                    if (!leaf || typeof leaf !== "object")
+                        continue;
+                    const record = leaf;
+                    if (String(record.ruleValueType ?? "").toUpperCase() !== "DYNAMIC")
+                        continue;
+                    const source = String(record.currentSchemaDataItem ?? "").trim();
+                    if (source.includes("."))
+                        childSourcedLeaves.push(`${String(record.targetSchemaDataItem ?? "?")} = ${source}`);
+                }
+            }
+            if (!targetIsChild && targetMain !== schemaCode && childSourcedLeaves.length > 0)
+                blockers.push({
+                    code: "rule-graph-cross-model-child-source-fanout",
+                    nodeCode,
+                    key: "filterCondition.mainConditions",
+                    message: `${nodeCode}: 跨模型 UPDATE 的定位条件用了点号来源（${childSourcedLeaves.join("、")}）——1.1.25 的 DatasetImpl 把 "x.y" 当作**子表路径**解析（parts[0] 找子表、收集该列所有行的值），既不是"关联字段.id"，也不会按每行各更新一次：目标主表仍只查询一次，结果 0 行命中（r5/r6 真机：保存发布全绿、字段不变）。单跳关联字段直接用字段 code（引擎会取关联对象的 id，真机 2026-10-21 已验证）；多跳（a.b）没有可用形状——把目标 id 用表单映射落到本模型的一个字段上再引用它，或走二开。`,
+                });
+            if (!targetIsChild && Array.isArray(filterRecord.sheetConditions) && filterRecord.sheetConditions.length > 0)
+                blockers.push({
+                    code: "rule-graph-sheet-conditions-ignored-for-main-target",
+                    nodeCode,
+                    key: "filterCondition.sheetConditions",
+                    severity: "warning",
+                    message: `${nodeCode}: targetObjectCode "${targetCode}" 是主表目标，sheetConditions 只在目标是 "<主表>.<子表>" 时被 doUpdateChildData 读取——这里不会生效（UpdateServiceExecutor 只把 mainConditions 传给目标主表查询）。要筛目标子表请把 targetObjectCode 写成点号路径。`,
+                });
             actions.forEach((action, index) => {
                 if (action && typeof action === "object") {
                     blockers.push(...validateDataAction(action, nodeCode, index));

package/dist/lanes/runtime-data.js

@@ -290,6 +290,25 @@ async function portalRequiredViolations(session, schemaCode, sheetCode, formData
  * carrying its own `id` is "Modified", an id-less row is "Added"; an explicit
  * rowStatus is preserved verbatim.
  */
+/**
+ * Paths of non-empty child-table arrays anywhere inside a form payload. The
+ * platform appends every child row it finds on an approval submit, regardless
+ * of nesting, so detection must not stop at the top level.
+ */
+function collectChildArrayPaths(value, childCodes, prefix = "") {
+    if (value === null || typeof value !== "object")
+        return [];
+    if (Array.isArray(value))
+        return [];
+    const found = [];
+    for (const [key, child] of Object.entries(value)) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        if (childCodes.has(key) && Array.isArray(child) && child.length > 0)
+            found.push(path);
+        found.push(...collectChildArrayPaths(child, childCodes, path));
+    }
+    return found;
+}
 async function stampChildRowStatuses(session, schemaCode, formData) {
     const childCodes = new Set();
     try {
@@ -935,10 +954,11 @@ export function registerRuntimeDataLane(tools) {
         // and 30000 into 90000 while every call answered errcode 0 — node-level
         // `editable:false` does not stop it server-side. Refuse before the wire.
         if ((hasWorkItem || hasInstance) && args.allowChildRowAppend !== true) {
-            const carried = stampedSubmit.childCodes.filter((code) => {
-                const value = args.formData[code];
-                return Array.isArray(value) && value.length > 0;
-            });
+            // Scan at ANY depth: callers wrap the form as {data:{...}} or
+            // {bizObject:{data:{...}}}, and a top-level-only check let those through
+            // (the platform appends whatever it finds). The child codes come from the
+            // model's own field list.
+            const carried = collectChildArrayPaths(args.formData, new Set(stampedSubmit.childCodes));
             if (carried.length > 0)
                 throw new ToolRefusalError({
                     status: "refused",

package/dist/lanes/workflow.js

@@ -85,6 +85,57 @@ const WORKFLOW_ROUTE_CONDITION_KEYS = ["text", "formula", "utilizeElse", "fixedP
  * and the line silently never fires (the same class of silent no-op that bit
  * checkType=2). Only caller-supplied `routes`/`rules` are checked.
  */
+/**
+ * AI-Platform 1.1.25 rejects a template whose first activity after START is not
+ * the originator fill node: WorkflowTemplateValidateUtility.validateStartActivity
+ * emits 401035 「发起节点的参与者只能是{Originator}」 and publish answers
+ * errcode 0 with a ValidateMessage[] (nothing is stored). Live 2026-10-21: a
+ * role-approval node placed directly after START failed publish with exactly
+ * that code, and the generic message did not name the cause.
+ */
+function assertFirstActivityIsOriginator(template, tool, merged) {
+    // Only gate AUTHORING intent: the caller must have sent both a START node and
+    // routes. A partial/stored-draft publish is left to the platform validator
+    // (401035), which the tool already surfaces faithfully.
+    const callerRows = callerActivities(template);
+    const callerRoutes = template.routes ?? template.rules ?? template.edges;
+    if (!Array.isArray(callerRows) || !Array.isArray(callerRoutes))
+        return;
+    if (!callerRows.some((activity) => String(activity.activityType ?? activity.type ?? "") === "START"))
+        return;
+    // Assert on the MERGED body: participant shorthands ({type:Originator,name:…})
+    // are normalized to "{Originator}" there.
+    const activities = callerActivities(merged ?? template);
+    const rawRoutes = merged ? (merged.routes ?? merged.rules ?? merged.edges) : callerRoutes;
+    if (!Array.isArray(activities) || !Array.isArray(rawRoutes))
+        return;
+    const start = activities.find((activity) => String(activity.activityType ?? activity.type ?? "") === "START");
+    if (!start)
+        return;
+    const startCode = activityCodeOf(start);
+    const first = rawRoutes
+        .map((entry) => (entry ?? {}))
+        .find((route) => String(route.preNode ?? route.preActivityCode ?? route.pre ?? route.from ?? "") === startCode);
+    if (!first)
+        return;
+    const nextCode = String(first.postNode ?? first.postActivityCode ?? first.post ?? first.to ?? "");
+    const next = activities.find((activity) => activityCodeOf(activity) === nextCode);
+    if (!next)
+        return;
+    const type = String(next.activityType ?? next.type ?? "");
+    const participant = String(next.participant ?? "").trim();
+    if (type === "PARTICIPANT" && /^\{Originator\}$/i.test(participant))
+        return;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "workflow-first-activity-not-originator",
+        workflowCode: String(template.workflowCode ?? template.code ?? ""),
+        activityCode: nextCode,
+        message: `${tool}: START 之后的第一个节点必须是参与者为 {Originator} 的填写节点（当前是 ${type || "?"}「${String(next.activityName ?? next.name ?? nextCode)}」${participant ? `，参与者 ${participant}` : ""}）。` +
+            `平台校验 WorkflowTemplateValidateUtility.validateStartActivity 对此报 401035「发起节点的参与者只能是{Originator}」，publish 回 errcode 0 但一个 ValidateMessage[] 就把模板挡在门外、不落库（真机 2026-10-21）。` +
+            `正确形状：Start → 填写({Originator}) → 审批/条件分支 … → End；审批节点不能直接接在 START 后。`,
+    });
+}
 function validateWorkflowRouteConditions(template, tool) {
     const raw = template.routes ?? template.rules ?? template.edges;
     if (!Array.isArray(raw))
@@ -482,6 +533,84 @@ function mapCallerRules(callerRoutes, draftRules, activities) {
  * `org.role.list` / `org.department.list` first. Advisory (never blocks): the
  * platform accepts the save, so this is a readback lint, not a write gate.
  */
+/**
+ * Participant FUNCTION names that the runtime does not register. Read-back and
+ * seeded templates carry them (the CRM seed uses FindUsersSpecByRoleFunction),
+ * and 1.1.25 only ships FindUserByRoleFunction — the others throw
+ * FunctionNotFoundException inside ParticipantActivityRuntime, so the instance
+ * stalls in PROCESSING with no work item while every API call answers errCode 0.
+ * A warning was not enough (r4 lost ~200 rounds to it), so publish refuses.
+ */
+export function unregisteredParticipantFunctions(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const found = [];
+    for (const activity of activities) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const participant = String(activity.participant ?? "").trim();
+        const match = /^(FindUsersByRoleFunction|FindUsersSpecByRoleFunction)\s*\(/.exec(participant);
+        if (match)
+            found.push({ activityCode: String(activity.activityCode ?? ""), functionName: match[1] });
+    }
+    return found;
+}
+/**
+ * The designer default OMC backfills is `rejectToStart:true` on approval nodes
+ * (see backfillDesignerDefaults). With that flag, rejecting returns the instance
+ * to the fill node and the flow keeps running: endEventHandler and
+ * cancelEventHandler never fire (live 2026-10-20, r5-asset — instance stayed
+ * PROCESSING, todo back at A2, status still 审批中). A rule bound to `cancel`
+ * therefore silently never runs. Advisory: reject-to-start is a legitimate
+ * choice, only "I bound a cancel rule and expect it to run" is broken.
+ */
+/**
+ * A delta that omits `routes` keeps the draft's edges (mergeCallerDelta /
+ * completeWorkflowChain). That is the right default, but it is invisible: after
+ * 0.4.63's fix a branched draft survives an activities-only update, and a caller
+ * has no way to tell "I preserved 5 edges including the else fallback" from
+ * "the platform rebuilt a linear chain". Report the inherited branch edges.
+ */
+function inheritedBranchEdges(template) {
+    const rows = Array.isArray(template.activities) ? template.activities : [];
+    const rules = Array.isArray(template.rules) ? template.rules : [];
+    const outbound = new Map();
+    for (const rule of rules) {
+        const pre = String(rule.preActivityCode ?? "");
+        const post = String(rule.postActivityCode ?? "");
+        if (pre === "" || post === "")
+            continue;
+        outbound.set(pre, [...(outbound.get(pre) ?? []), post]);
+    }
+    const nameOf = new Map(rows.map((row) => [String(row.activityCode ?? ""), String(row.activityName ?? "")]));
+    return [...outbound.entries()]
+        .filter(([, targets]) => targets.length > 1)
+        .map(([pre, targets]) => `${pre}${nameOf.get(pre) ? `(${nameOf.get(pre)})` : ""} → ${targets.join(" | ")}`);
+}
+export function rejectToStartCancelWarnings(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const blocking = activities
+        .filter((activity) => String(activity.activityType ?? "") === "PARTICIPANT")
+        .filter((activity) => {
+        const action = activity.permittedAction;
+        if (action === undefined || action === null || typeof action !== "object")
+            return true; // designer default -> true
+        return action.rejectToStart !== false;
+    })
+        .map((activity) => String(activity.activityCode ?? ""));
+    if (blocking.length === 0)
+        return [];
+    const cancel = template.cancelEventHandler;
+    const cancelRules = cancel && typeof cancel === "object" ? cancel.bizActions : undefined;
+    const bound = Array.isArray(cancelRules) ? cancelRules.length : 0;
+    if (bound === 0)
+        return [];
+    return [{
+            code: "workflow-reject-to-start-suppresses-cancel-handler",
+            severity: "warning",
+            message: `cancelEventHandler 绑了 ${bound} 条规则，但审批节点 ${blocking.join("、")} 的 rejectToStart 为 true（设计器默认）：驳回会把实例退回填写节点并继续运行，end/cancel 处理器都不触发，这些规则不会执行（r5-asset 真机：实例仍 PROCESSING、待办回 A2）。` +
+                `两种改法：① 在这个节点的 permittedAction 里显式传 rejectToStart:false（驳回即结束，cancel 生效）；② 驳回后的状态改成由发起人手工处理或二开监听。`,
+        }];
+}
 function participantReferenceWarnings(template) {
     const activities = Array.isArray(template.activities) ? template.activities : [];
     const warnings = [];
@@ -1740,6 +1869,7 @@ export function registerWorkflowLane(tools) {
         const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
         const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
         await backfillDesignerDefaults(session, args.schemaCode, body, template);
+        assertFirstActivityIsOriginator(template, "workflow.update", body);
         validateWorkflowRender(body, "workflow.update");
         // Live: workflow/update does NOT run the template validator — it stores a
         // refused participant silently and only /publish answers the
@@ -1751,8 +1881,16 @@ export function registerWorkflowLane(tools) {
             throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
         validateWorkflowRender(data, "workflow.update readback");
         const participantWarnings = participantReferenceWarnings(data);
+        // Evaluate on `body` (post-backfill): the readback may drop the handler
+        // keys, and the backfilled permittedAction is exactly what will run.
+        const rejectWarnings = rejectToStartCancelWarnings(body);
         const renamedActivities = renamedActivityPairs(template, data);
         const renamedInPlace = inPlaceRenames(data);
+        // Caller sent no routes at all: the draft's edges (branches included) are
+        // what rides the wire. Say so, and name the branch edges, because the only
+        // other trace is a missing edge in a later getPublished readback.
+        const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
+        const branchEdges = callerSentRoutes ? [] : inheritedBranchEdges(data);
         // 改名验收的权威读数：每个节点的当前显示名（platform may keep
         // activityName or sync it; effectiveActivityName resolves both shapes).
         const rawActivityRows = Array.isArray(data.activities)
@@ -1763,7 +1901,7 @@ export function registerWorkflowLane(tools) {
         const activityNames = Object.fromEntries(rawActivityRows
             .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
             .filter(([code]) => code !== ""));
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, ...(participantWarnings.length ? { participantWarnings } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
     }, (args) => {
         // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
         // governed pipeline — including the rollback before-capture read.
@@ -1782,6 +1920,19 @@ export function registerWorkflowLane(tools) {
         // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
         const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
         await backfillDesignerDefaults(session, args.schemaCode, body, template);
+        assertFirstActivityIsOriginator(template, "workflow.publish", body);
+        const unregistered = unregisteredParticipantFunctions(body);
+        if (unregistered.length > 0)
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "workflow-participant-function-unregistered",
+                workflowCode: args.code,
+                activities: unregistered,
+                message: `流程发布被拒：参与人函数 ${[...new Set(unregistered.map((entry) => entry.functionName + "()"))].join("、")} 在 AI-Platform v1.1.25 未注册（节点 ${unregistered.map((entry) => entry.activityCode).join("、")}）。` +
+                    `发布能过，但运行期 ParticipantActivityRuntime 抛 FunctionNotFoundException：实例卡 PROCESSING、不生成待办，而 data.submit 仍回 errCode 0（r4-training 真机）。` +
+                    `内置函数只有 FindUserByRole({Originator.OU},"<roleCode>","random")；跨部门/全局角色改用参与者对象数组（角色 id）。` +
+                    `这两个名字常见于 workflow.get_published 读回与种子流程，不要回抄。`,
+            });
         validateWorkflowRender(body, "workflow.publish");
         const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
         // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
@@ -1806,7 +1957,8 @@ export function registerWorkflowLane(tools) {
             });
         validateWorkflowRender(data, "workflow.publish readback");
         const participantWarnings = participantReferenceWarnings(data);
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        const rejectWarnings = rejectToStartCancelWarnings(data);
+        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
     }, (args) => {
         assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");
     }, undefined, workflowRollbackSpec("workflow.publish"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.63",
+  "version": "0.4.65",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.63",
+    "@stalfh233/omc-fake-platform": "0.4.65",
     "commander": "14.0.3",
-    "omc-core": "0.4.63",
+    "omc-core": "0.4.65",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-business-configuration.md

@@ -151,6 +151,8 @@ rules:
 - **两条路**：模型+表单+流程一揽子交付走**意图**（`intent` 的 `workflow` 能力，声明式一次 apply）；只动流程或想逐步控制走**低层链** `workflow.create → workflow.update（权限/节点）→ workflow.publish`，标准链配方见 `omc describe workflow.update`（含多级审批/participant 三形态/自动回填说明）。流程权限细节见下节。
 - 一个模型只能有一个流程；已有流程的模型直接 `workflow.update`，不要另建。
 - **核验状态用投影，别重复整条读**：`data.load --args '{"schemaCode":..,"bizObjectId":..,"fields":["sequenceStatus","<业务状态字段>"]}'` 只回指定字段（缺失项在 `missingFields`）——r4 实测同一对象被整条读 74 次；大结果先 `artifact get <id> --summary` → `--keys/--jq`，别整包内联进推理。
+- **流程第一个节点必须是 `{Originator}` 填写节点**：平台 `WorkflowTemplateValidateUtility.validateStartActivity` 对「START 后直接接审批」报 401035「发起节点的参与者只能是{Originator}」，publish 回 errcode 0 但一个 ValidateMessage[] 就把模板挡在门外、不落库（真机 2026-10-21）。OMC 0.4.65 起在 `workflow.update`/`publish` 出门前拒绝（`workflow-first-activity-not-originator`）。
+- **跨模型回写的目标行必须已提交（COMPLETED）**：DRAFT 行不参与目标查询，运行 0 行命中且日志只有「查找范围不存在数据」。单跳关联字段可直接作 DYNAMIC 来源（引擎取关联对象 id）；点号路径按子表解析，`关联字段.id` / 两跳路径都不支持。
 - **参与人解析失败分两种，别当成同一种（1.1.25 实测）**：① **解析为空**（角色零成员、成员未挂部门、自由文本、角色码不存在）→ 引擎把任务**退回发起人**，流程继续，症状是「审批人显示成我自己」，`data.submit` 与 `workitem.list` 都正常；② **参与人函数未注册**（`FindUsersByRoleFunction` / `FindUsersSpecByRoleFunction`，1.1.25 未内置）→ `FunctionNotFoundException`、不生成待办、实例卡 PROCESSING 而接口仍回 `errCode 0`。区分用 `omc call workflow.instanceActivity --args '{"workflowInstanceId":"<id>"}'`：无 `status:1` 节点=卡住；`status:1` 且参与人全是发起人=`diagnosis.warnings` 给 `participant-fallback-to-originator`。不要从 `workflow.get_published` 的摘要回抄函数式参与人；内置写法只有 `FindUserByRole(org, roleCode[, order])`，跨部门/全局角色优先用参与者对象数组（角色 id）。
 
 ## 流程字段权限

package/skills/omc-write-hazards.md

@@ -133,10 +133,23 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
 **只传主表字段**；确需追加行时显式 `allowChildRowAppend:true`（0.4.63 起默认拒绝，blocker `submit-approval-child-rows`）。
 收尾时前后各读一次子表行数确认未变。
 
-## 跨表回写只能取主表字段（真机 2026-10-20）
+## 跨表回写的真实语义（1.1.25 源码 + 真机 2026-10-20）
+
+`targetObjectCode` 的**点号是目标侧路径**，不是来源字段路径：
+
+| 写法 | 语义 | 执行 |
+|------|------|------|
+| `"asset_ledger"` | 目标主表 | 先按 `mainConditions` 查目标主表（**只查一次**），再逐行改 |
+| `"asset_apply.asset_apply_items"` | 目标主表下的子表 | 先查目标主表，再用 `sheetConditions` 在**已查出的主表 ID 范围内**筛目标子表行 |
+
+对应源码：`UpdateServiceExecutor.getUpdatedMainBizObject()` 只把 `mainConditions` 交给目标主表查询；`sheetConditions` 只在 `doUpdateChildData()` 里被读取。
+
+两个前提（真机 2026-10-21）：① **目标行必须已提交**——DRAFT 行不参与目标查询，`data.save` 建的行永远改不到，日志只有「查找范围不存在数据」；② **单跳关联字段可直接作 DYNAMIC 来源**（引擎取关联对象 id），点号路径按子表解析，`关联字段.id` 与两跳都不支持——用表单映射把目标 id 落到本模型字段再引用。
+
+由此得到四条使用纪律：
+
+1. **主表目标上的 `sheetConditions` 是死配置**——不会生效（OMC 0.4.64 起给 warning）。
+2. **来源子表字段是集合，不是逐行扇出**：`currentSchemaDataItem:"items.asset"` 会被解析成该子表所有行的值集合，目标主表仍只查询一次。写这个形状能存能发布，但运行 0 行命中（r5-asset 真机）。OMC 0.4.64 起 `rule-graph-cross-model-child-source-fanout` **拒绝**。
+3. **一张单多行逐件回写**（每条明细各改一条另一模型的主表行）没有可用的纯配置形状——走 BIZ_ACTION 自调二开接口，一次处理多行；单行回写用主表字段做 DYNAMIC 来源。
+4. **BRANCH 后接两个跨表 UPDATE** 真机报 50000；改用单个 UPDATE + 条件动作，或二开。
 
-- `id = {子表code}.asset` / `...asset.id`：保存发布全绿，**运行不命中**，无日志。
-- 请求体直接引用子表关联（CREATE 的 dataActions 等）：提交报 `550010 业务规则使用的数据项不存在`。
-- BRANCH 后接两个跨表 UPDATE：`50000`。
-- 固定 id / 主表字段条件：可运行。
-逐件联动（一张单多件资产）纯配置做不到，走二开 BIZ_ACTION 或人工。