@stalfh233/omc-cli 0.4.70 → 0.4.72

package/dist/artifacts.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 export const CLI_DEFAULT_OUTPUT_BYTES = 64 * 1024;
 export const CLI_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
@@ -13,8 +13,30 @@ function ensureRoot(root) {
     mkdirSync(resolved, { recursive: true, mode: 0o700 });
     return resolved;
 }
+const PRUNE_STAMP = ".prune-stamp";
+const PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const PRUNE_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Opportunistic hygiene: at most once per day, drop artifacts untouched for a
+ * week and enforce the size budget. Hooked into createArtifact so a long-running
+ * project never needs a manual sweep; the stamp keeps the scan off the hot path
+ * (one readdir per day, not per call).
+ */
+function maybeAutoPrune(resolvedRoot) {
+    const stampPath = join(resolvedRoot, PRUNE_STAMP);
+    try {
+        if (existsSync(stampPath) && Date.now() - statSync(stampPath).mtimeMs < PRUNE_INTERVAL_MS)
+            return;
+        pruneArtifacts(resolvedRoot, { olderThanMs: PRUNE_AGE_MS });
+        writeFileSync(stampPath, `${new Date().toISOString()}\n`, { mode: 0o600 });
+    }
+    catch {
+        // Hygiene is best-effort: never fail a write because cleanup did.
+    }
+}
 export function createArtifact(root, content) {
     const resolvedRoot = ensureRoot(root);
+    maybeAutoPrune(resolvedRoot);
     const artifactId = randomUUID();
     const path = artifactPath(resolvedRoot, artifactId);
     const bytes = typeof content === "string" ? Buffer.from(content, "utf8") : content;
@@ -116,4 +138,57 @@ export function assertSafeInputPath(root, candidate, label) {
     }
     return normalized;
 }
+export function pruneArtifacts(root, options = {}) {
+    const resolvedRoot = resolve(root);
+    if (!existsSync(resolvedRoot))
+        return { removed: 0, freedBytes: 0, kept: 0, keptBytes: 0 };
+    const now = options.now ?? Date.now();
+    const olderThanMs = options.olderThanMs;
+    const maxBytes = options.maxBytes ?? 256 * 1024 * 1024;
+    const entries = [];
+    let keptBytes = 0;
+    let removed = 0;
+    let freedBytes = 0;
+    const removePair = (path, size) => {
+        try {
+            rmSync(path, { force: true });
+            rmSync(`${path}.sha256`, { force: true });
+            removed += 1;
+            freedBytes += size;
+        }
+        catch { /* best effort */ }
+    };
+    for (const name of readdirSync(resolvedRoot)) {
+        if (!/^[a-f0-9-]{36}\.artifact$/u.test(name))
+            continue;
+        const path = join(resolvedRoot, name);
+        let stat;
+        try {
+            stat = lstatSync(path);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isSymbolicLink() || !stat.isFile())
+            continue;
+        if (olderThanMs !== undefined && now - stat.mtimeMs > olderThanMs) {
+            removePair(path, stat.size);
+            continue;
+        }
+        entries.push({ path, size: stat.size, mtimeMs: stat.mtimeMs });
+        keptBytes += stat.size;
+    }
+    // Budget sweep: oldest first until the store fits.
+    if (keptBytes > maxBytes) {
+        entries.sort((left, right) => left.mtimeMs - right.mtimeMs);
+        for (const entry of entries) {
+            if (keptBytes <= maxBytes)
+                break;
+            removePair(entry.path, entry.size);
+            keptBytes -= entry.size;
+        }
+    }
+    const kept = entries.filter((entry) => existsSync(entry.path)).length;
+    return { removed, freedBytes, kept, keptBytes };
+}
 //# sourceMappingURL=artifacts.js.map

package/dist/bench/evals.js

@@ -76,6 +76,11 @@ const GOLDEN_CASES = [
         async run(harness) {
             await call(harness, "model.create", { name: "金轨迹回填源", code: "omc_mcp_gd2" });
             await call(harness, "model.create", { name: "金轨迹回填目标", code: "omc_mcp_gp" });
+            // The platform's rule self-check resolves UPDATE targets against the
+            // TARGET model's PUBLISHED fields; an unseeded target would 550018 here
+            // and never exercise the DYNAMIC wire this case exists to pin.
+            await call(harness, "field.create", { schemaCode: "omc_mcp_gp", code: "latestPeriod", name: "最近申报期", propertyType: "SHORT_TEXT" });
+            await call(harness, "field.publish", { schemaCode: "omc_mcp_gp" });
             harness.fake.seedDataRow("omc_mcp_gp", { latestPeriod: "" }, "omc_mcp_gp_row");
             await call(harness, "rule.save", {
                 schemaCode: "omc_mcp_gd2",
@@ -107,6 +112,9 @@ const GOLDEN_CASES = [
         async run(harness) {
             await call(harness, "model.create", { name: "金轨迹固定值源", code: "omc_mcp_gf2" });
             await call(harness, "model.create", { name: "金轨迹固定值目标", code: "omc_mcp_gf" });
+            await call(harness, "field.create", { schemaCode: "omc_mcp_gf", code: "state", name: "状态", propertyType: "SHORT_TEXT" });
+            await call(harness, "field.create", { schemaCode: "omc_mcp_gf", code: "count", name: "次数", propertyType: "NUMERICAL", options: { scale: 0 } });
+            await call(harness, "field.publish", { schemaCode: "omc_mcp_gf" });
             harness.fake.seedDataRow("omc_mcp_gf", { state: "old", count: 0 }, "omc_mcp_gf_row");
             await call(harness, "rule.save", {
                 schemaCode: "omc_mcp_gf2",

package/dist/cli.js

@@ -16,7 +16,7 @@ import { CLI_EXIT_CODES, classifyResult, envelope, errorEnvelope, requestId } fr
 import { configureOutput, humanSummary, stripOutputFlags, writeEnvelope } from "./cli-output.js";
 import { beginUsage, completeUsage, recordUsageOutput, usageReport } from "./usage-log.js";
 import { artifactFetchHint, artifactRoot, boundResult, emitInvalid, emitResult, emitTransportResult, outputBudget, readArtifact, withTransport, } from "./command-transport.js";
-import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath } from "./artifacts.js";
+import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath, pruneArtifacts } from "./artifacts.js";
 import { resolve } from "node:path";
 import { buildToolRegistry } from "./tools.js";
 import { acquireWriteLock } from "./write-lock.js";
@@ -437,6 +437,22 @@ function projectJsonPath(value, path) {
     }
     return { missed: false, value: current };
 }
+function parseDurationMs(text) {
+    const match = /^\s*(\d+)\s*(ms|s|m|h|d|w)?\s*$/u.exec(text);
+    if (!match)
+        return undefined;
+    const amount = Number(match[1]);
+    const unit = match[2] ?? "d";
+    const factor = unit === "ms" ? 1 : unit === "s" ? 1000 : unit === "m" ? 60_000 : unit === "h" ? 3_600_000 : unit === "d" ? 86_400_000 : 604_800_000;
+    return amount * factor;
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)}KB`;
+    return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
+}
 async function cmdArtifactGet(id, transport, options = {}) {
     try {
         const artifact = readArtifact(artifactRoot(), id);
@@ -968,12 +984,33 @@ async function main() {
     command.command("setup").option("--list").option("--edit <environment>").option("--remove <environment>").action(async (options) => {
         commandExitCode = await cmdSetup(new ConfigStore(defaultPaths()), [...(options.list ? ["--list"] : []), ...(options.edit ? ["--edit", options.edit] : []), ...(options.remove ? ["--remove", options.remove] : [])]);
     });
-    command.command("env [action]").option("--json").action(async (action, options) => {
+    command.command("env [action] [name]").option("--json").action(async (action, name, options) => {
         // Read-only inventory of configured environment names. r18: the sandbox
         // guessed names instead of listing them; doctor's wording now points here.
         const store = new ConfigStore(defaultPaths());
+        if (action === "allow") {
+            // The only sanctioned way to widen a project's environment scope. The
+            // list stays project-scoped until the operator names the environment —
+            // an agent cannot discover another project's environments from here.
+            const target = name;
+            if (!target) {
+                console.error("用法：omc env allow <环境名>（把该项目需要的另一环境写入 .omc-envs；执行前须向用户报告并取得同意）");
+                commandExitCode = CLI_EXIT_CODES.invalidInput;
+                return;
+            }
+            try {
+                store.allowProjectEnvironment(target);
+                console.error(`已允许本项目使用环境 ${target}（写入 .omc-envs）`);
+                commandExitCode = CLI_EXIT_CODES.ok;
+            }
+            catch (error) {
+                console.error(error.message);
+                commandExitCode = CLI_EXIT_CODES.invalidInput;
+            }
+            return;
+        }
         if (action !== undefined && action !== "list") {
-            console.error("用法：omc env list [--json]");
+            console.error("用法：omc env list [--json] | omc env allow <环境名>");
             commandExitCode = CLI_EXIT_CODES.invalidInput;
             return;
         }
@@ -1050,7 +1087,34 @@ async function main() {
     rollbackCommand.command("apply <ref>").option("--env <environment>").option("--environment <environment>").option("--confirm-production").action(async (ref, options) => {
         commandExitCode = await withTransport(options, "rollback apply", (transport) => cmdRollbackApply(ref, { environment: options.env ?? options.environment, confirmProduction: options.confirmProduction === true }, transport));
     });
-    command.command("artifact").command("get <id>").option("--jq <path>").option("--path-only").option("--summary").option("--keys [a,b]").option("--max-output-bytes <bytes>").action(async (id, options) => {
+    const artifactCommand = command.command("artifact");
+    artifactCommand.command("prune").option("--older-than <duration>", "删除超过该时长的读回产物（如 7d/12h/30m）").option("--max-bytes <bytes>", "产物目录预算；超出时按最旧优先删除").option("--json").action((options) => {
+        // Machine-global store: oversized readbacks pile up (504 files / 3.4 MB
+        // after one sandbox round). Pruning is deterministic and safe to run at
+        // any time — it only removes this store's own artifact files.
+        const olderThanMs = options.olderThan === undefined ? undefined : parseDurationMs(options.olderThan);
+        if (options.olderThan !== undefined && olderThanMs === undefined) {
+            console.error("用法：omc artifact prune [--older-than 7d] [--max-bytes 268435456] [--json]");
+            commandExitCode = CLI_EXIT_CODES.invalidInput;
+            return;
+        }
+        const maxBytes = options.maxBytes === undefined ? undefined : Number(options.maxBytes);
+        if (options.maxBytes !== undefined && (!Number.isFinite(maxBytes) || Number(maxBytes) < 0)) {
+            console.error("--max-bytes 必须是非负整数");
+            commandExitCode = CLI_EXIT_CODES.invalidInput;
+            return;
+        }
+        const result = pruneArtifacts(artifactRoot(), {
+            ...(olderThanMs !== undefined ? { olderThanMs } : {}),
+            ...(maxBytes !== undefined ? { maxBytes } : {}),
+        });
+        if (options.json)
+            process.stdout.write(JSON.stringify({ ok: true, ...result }, null, 2) + "\n");
+        else
+            console.error(`已清理 ${result.removed} 个读回产物，释放 ${formatBytes(result.freedBytes)}；保留 ${result.kept} 个（${formatBytes(result.keptBytes)}）`);
+        commandExitCode = CLI_EXIT_CODES.ok;
+    });
+    artifactCommand.command("get <id>").option("--jq <path>").option("--path-only").option("--summary").option("--keys [a,b]").option("--max-output-bytes <bytes>").action(async (id, options) => {
         commandExitCode = await withTransport(options, request, (transport) => cmdArtifactGet(id, transport, { ...(options.jq ? { jq: options.jq } : {}), pathOnly: options.pathOnly === true, summary: options.summary === true || options.keys === true, ...(typeof options.keys === "string" ? { keys: options.keys } : {}) }));
     });
     command.command("bench").option("--live-sample").option("--env <environment>").action(async (options) => { commandExitCode = await cmdBench([...(options.liveSample ? ["--live-sample"] : []), ...(options.env ? ["--env", options.env] : [])]); });

package/dist/config-store.js

@@ -23,6 +23,7 @@ export function defaultPaths(projectDir = process.cwd()) {
         configPath: join(configRoot, "omc.config.json"),
         credentialsPath: join(configRoot, "credentials"),
         projectEnvPath: join(resolve(projectDir), ".omc-env"),
+        projectEnvsPath: join(resolve(projectDir), ".omc-envs"),
     };
 }
 export class ConfigStore {
@@ -124,8 +125,55 @@ export class ConfigStore {
         this.writeConfig({ environments });
         return config;
     }
-    listEnvironments() {
-        return Object.entries(this.readConfig().environments).map(([name, profile]) => ({ name, profile }));
+    /**
+     * Environments visible to THIS project. Project isolation is the default:
+     * the caller only ever sees the project's own environments, never the rest of
+     * the machine's config (a co-located project's baseUrl/credentials are its
+     * own business). `all:true` is for the operator-facing setup command, which
+     * must explicitly ask before revealing another project's environment.
+     */
+    listEnvironments(options = {}) {
+        const all = Object.entries(this.readConfig().environments).map(([name, profile]) => ({ name, profile }));
+        if (options.all === true)
+            return all;
+        const own = new Set(this.ownEnvironmentNames());
+        return all.filter((entry) => own.has(entry.name));
+    }
+    /** Names declared by this project: `.omc-envs` lines + the `.omc-env` binding. */
+    ownEnvironmentNames() {
+        const names = new Set(this.readProjectEnvsFile());
+        const bound = this.readProjectEnvBinding();
+        if (bound)
+            names.add(bound);
+        if (names.size === 0) {
+            const configured = this.listEnvironments({ all: true });
+            const fallback = configured.find((entry) => entry.profile.isDefault) ?? (configured.length === 1 ? configured[0] : undefined);
+            if (fallback)
+                names.add(fallback.name);
+        }
+        return [...names];
+    }
+    readProjectEnvBinding() {
+        if (!existsSync(this.paths.projectEnvPath))
+            return undefined;
+        const name = readFileSync(this.paths.projectEnvPath, "utf8").trim();
+        return name || undefined;
+    }
+    readProjectEnvsFile() {
+        if (!existsSync(this.paths.projectEnvsPath))
+            return [];
+        return readFileSync(this.paths.projectEnvsPath, "utf8")
+            .split(/\r?\n/u)
+            .map((line) => line.replace(/#.*$/u, "").trim())
+            .filter((line) => line !== "");
+    }
+    /** Declare another environment as usable by this project (cross-env approval). */
+    allowProjectEnvironment(name) {
+        if (!this.readConfig().environments[name]) {
+            throw new ConfigurationError(`unknown environment "${name}"; available: ${this.availableEnvironmentNames()}`);
+        }
+        const names = [...new Set([...this.readProjectEnvsFile(), name])].sort();
+        this.atomicWrite(this.paths.projectEnvsPath, names.join("\n") + "\n", 0o644);
     }
     readCredential(name) {
         const inline = process.env.OMC_CLOUDPIVOT_CREDENTIAL;
@@ -161,20 +209,25 @@ export class ConfigStore {
     }
     /** Available environment names, for error messages — stops agents guessing or spelunking ~/.config. */
     availableEnvironmentNames() {
-        return Object.keys(this.readConfig().environments).join("、") || "(none configured; run omc setup)";
+        return this.ownEnvironmentNames().join("、") || "(none configured for this project; run omc setup)";
     }
     /** Resolve the active environment for a call. */
     resolveEnvironment(explicit) {
+        const resolved = this.resolveCandidate(explicit);
+        this.assertProjectScope(resolved.name, resolved.source);
+        return resolved;
+    }
+    resolveCandidate(explicit) {
         if (explicit && explicit.trim()) {
             const profile = this.readConfig().environments[explicit];
             if (!profile)
-                throw new ConfigurationError(`unknown environment "${explicit}"; available: ${this.availableEnvironmentNames()} (doctor prints the bound 环境=; do not guess or read ~/.config/omc manually)`);
+                throw new ConfigurationError(`unknown environment "${explicit}"; available: ${this.availableEnvironmentNames()}（仅本项目；doctor prints the bound 环境=; do not guess or read ~/.config/omc manually)`);
             return { name: explicit, profile, source: "explicit" };
         }
         if (process.env.OMC_ENV) {
             const profile = this.readConfig().environments[process.env.OMC_ENV];
             if (!profile)
-                throw new ConfigurationError(`OMC_ENV=${process.env.OMC_ENV} is not configured; available: ${this.availableEnvironmentNames()}`);
+                throw new ConfigurationError(`OMC_ENV=${process.env.OMC_ENV} is not configured; available: ${this.availableEnvironmentNames()}（仅本项目）`);
             return { name: process.env.OMC_ENV, profile, source: "OMC_ENV" };
         }
         if (existsSync(this.paths.projectEnvPath)) {
@@ -182,15 +235,36 @@ export class ConfigStore {
             if (name) {
                 const profile = this.readConfig().environments[name];
                 if (!profile)
-                    throw new ConfigurationError(`project .omc-env binds "${name}" which is not configured in omc.config.json; available: ${this.availableEnvironmentNames()} (run omc setup)`);
+                    throw new ConfigurationError(`project .omc-env binds "${name}" which is not configured in omc.config.json; available: ${this.availableEnvironmentNames()}（仅本项目；run omc setup）`);
                 return { name, profile, source: ".omc-env" };
             }
         }
-        const entry = this.listEnvironments().find((item) => item.profile.isDefault);
+        const configured = this.listEnvironments({ all: true });
+        const entry = configured.find((item) => item.profile.isDefault) ?? (configured.length === 1 ? configured[0] : undefined);
         if (!entry)
             throw new ConfigurationError("no default environment; run omc setup or pass environment explicitly");
         return { name: entry.name, profile: entry.profile, source: "default" };
     }
+    /**
+     * Project isolation gate. A directory may hold several environments, but only
+     * those it declares (`.omc-envs` + `.omc-env`). Touching any other environment
+     * is a cross-project read: refuse BEFORE credentials/token/network, and tell
+     * the caller to obtain the user's approval. `OMC_ALLOW_CROSS_ENV=1` is the
+     * human-approved one-off escape hatch and announces itself on stderr.
+     */
+    assertProjectScope(name, source) {
+        const own = this.ownEnvironmentNames();
+        if (own.includes(name))
+            return;
+        if (process.env.OMC_ALLOW_CROSS_ENV === "1") {
+            console.error(`cross-env: 环境 "${name}" 不在本项目允许列表（${own.join("、") || "空"}）；已按 OMC_ALLOW_CROSS_ENV=1 放行本次访问。请确认这是用户批准的临时跨环境操作。`);
+            return;
+        }
+        throw new ConfigurationError(`跨环境访问被拒绝：环境 "${name}" 不属于本项目（本项目允许：${own.join("、") || "(none)"}）。` +
+            `每个项目目录只能使用自己声明的环境，不允许读取其他环境的信息。` +
+            `如确需跨环境，先向用户报告并取得同意，再由用户执行 \`omc env allow ${name}\`（写入项目 .omc-envs），` +
+            `或临时设置 OMC_ALLOW_CROSS_ENV=1 单次放行。`);
+    }
     bindProjectEnvironment(name) {
         const config = this.readConfig();
         if (!config.environments[name])

package/dist/form-support.js

@@ -343,6 +343,100 @@ function childTableColumns(parentCode, children) {
  * layered back from the previous draft. Child-table (201) controls are skipped:
  * their columns are regenerated from the model's subSchema.
  */
+/**
+ * Options that carry an expression the DESIGNER computed (formula, condition,
+ * default formula). A rebuild re-scaffolds controls from field metadata, which
+ * cannot reproduce them: the scaffold only knows the field family. Losing one
+ * is silent — the control still renders, the page still publishes, and the only
+ * signal is an empty string where an expression used to be. Live 2026-10-21
+ * (customer 8.2.96, 季度考评): `field.update cascadeRepublish:true` rebuilt the
+ * form and `totalScore`/`score`/`totalEvaluationScore` came back with
+ * `shortTextStitch: ""` while the pre-rebuild backup still had
+ * `SUM({evaluation_form.realScore})`.
+ */
+const FORMULA_BEARING_CONTROL_KEYS = [
+    "shortTextStitch",
+    "formulaConfig",
+    "displayFormula",
+    "requiredFormula",
+    "readonlyFormula",
+    "readonlyCondition",
+    "verifyFormula",
+    "computeFormula",
+];
+function nonEmptyExpression(value) {
+    if (typeof value === "string")
+        return value.trim() !== "" && value.trim() !== "{}" && value.trim() !== "[]";
+    if (value && typeof value === "object" && !Array.isArray(value))
+        return Object.keys(value).length > 0;
+    return false;
+}
+/**
+ * Layer two attributes faces (base = published, over = draft). Controls keep
+ * their own `options` merged per key, so a control edited on only one face
+ * still contributes its untouched options to the rebuild baseline. The draft
+ * wins wherever both define a key.
+ */
+function mergeAttributeFaces(base, over) {
+    if (base === undefined)
+        return over;
+    if (over === undefined)
+        return base;
+    const merged = { ...base };
+    for (const [code, control] of Object.entries(over)) {
+        const prior = base[code];
+        const options = control?.options;
+        if (prior && typeof prior === "object" && options && typeof options === "object" && !Array.isArray(options)
+            && prior.options && typeof prior.options === "object" && !Array.isArray(prior.options)) {
+            merged[code] = { ...control, options: { ...prior.options, ...options } };
+            continue;
+        }
+        merged[code] = control;
+    }
+    return merged;
+}
+/** controlCode → option keys that carried a real expression on that face. */
+export function formulaBearingControlOptions(face) {
+    const carry = new Map();
+    for (const [code, control] of Object.entries(face)) {
+        const options = control?.options;
+        if (!options || typeof options !== "object" || Array.isArray(options))
+            continue;
+        const keys = FORMULA_BEARING_CONTROL_KEYS.filter((key) => nonEmptyExpression(options[key]));
+        if (keys.length > 0)
+            carry.set(code, keys);
+    }
+    return carry;
+}
+/**
+ * Fail-closed guard for the rebuild path: every expression present on the
+ * baseline face must still be present afterwards. Refusing beats shipping a
+ * form whose formula silently became "". The caller can restore from a backup
+ * artifact or pass the layout explicitly.
+ */
+export function assertFormulasSurvivedRebuild(next, baseline, where) {
+    const lost = [];
+    for (const [code, optionKeys] of formulaBearingControlOptions(baseline)) {
+        const options = next[code]?.options;
+        const current = options && typeof options === "object" && !Array.isArray(options) ? options : {};
+        for (const key of optionKeys)
+            if (!nonEmptyExpression(current[key]))
+                lost.push({ control: code, option: key });
+    }
+    if (lost.length === 0)
+        return;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "form-rebuild-formula-would-be-lost",
+        schemaCode: where.schemaCode,
+        sheetCode: where.sheetCode,
+        losing: lost,
+        message: `重建表单会清空 ${lost.length} 处设计器公式（${lost.map((item) => `${item.control}.${item.option}`).join("、")}）——` +
+            `脚手架只能按字段元数据重建控件，公式/条件不在字段上。写前零 wire 拒绝，避免「回读 published:true 但公式已空」。` +
+            `先取备份（form.get --full 或表单版本历史 /api/api/app/bizsheet/history/list），或显式传 draftAttributesJson 原布局；` +
+            `只改字段时不要用 cascadeRepublish。`,
+    });
+}
 export function preserveDesignerControlOptions(next, previous) {
     const STRUCTURAL = new Set(["name", "name_i18n", "schemaCode", "displayField", "queryCode", "relativePropertyMatchCode"]);
     const preserved = [];
@@ -692,9 +786,21 @@ export async function executeFormDraftWrite(session, args) {
     // control visibility/width, label tweaks) are not derivable from field
     // metadata. A rebuild re-scaffolds, so capture the previous draft first and
     // layer those edits back on (see preserveDesignerControlOptions).
-    const previousAttributes = !args.rebuild || typeof pre?.draftAttributesJson !== "string"
+    // Baseline for the preserve/guard step. The DRAFT is the normal source, but a
+    // published form whose draft face is empty/stale is not a safe baseline: the
+    // designer's formulas then live only on publishedAttributesJson, and reading
+    // the draft alone makes a rebuild look like "nothing to preserve" while it
+    // drops every expression (live 2026-10-21). Merge draft-over-published so a
+    // control the designer edited only on one face still carries its options.
+    const draftAttributes = !args.rebuild || typeof pre?.draftAttributesJson !== "string"
         ? undefined
         : decodeJsonObjectColumn(pre.draftAttributesJson, { invalid: "undefined", array: "reject", object: "accept" });
+    const publishedAttributes = !args.rebuild || typeof pre?.publishedAttributesJson !== "string"
+        ? undefined
+        : decodeJsonObjectColumn(pre.publishedAttributesJson, { invalid: "undefined", array: "reject", object: "accept" });
+    const previousAttributes = draftAttributes === undefined && publishedAttributes === undefined
+        ? undefined
+        : mergeAttributeFaces(publishedAttributes, draftAttributes);
     // `rebuild: true` discards the existing draft layout and re-scaffolds from
     // the published fields, so fields added after the form was first built (a
     // child table, a new relation) land in the layout. The platform designer's
@@ -741,6 +847,15 @@ export async function executeFormDraftWrite(session, args) {
         // controls verbatim, so a later field.update never propagated (bench20).
         attributes = syncFieldDerivedControlOptions(attributes, publishedFields);
     }
+    // Fail-closed: a rebuild that would drop a designer formula must never reach
+    // the wire. The merge above normally carries them, but it cannot when the
+    // control was not re-scaffolded (field family without a control shape) or the
+    // baseline face was unreadable — those are exactly the silent-loss cases.
+    if (args.rebuild === true && previousAttributes !== undefined && typeof attributes === "string") {
+        const composed = decodeJsonObjectColumn(attributes, { invalid: "undefined", array: "reject", object: "accept" });
+        if (composed !== undefined)
+            assertFormulasSurvivedRebuild(composed, previousAttributes, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+    }
     const payload = {
         ...(pre ?? {}),
         schemaCode: args.schemaCode,

package/dist/lanes/meta.js

@@ -93,7 +93,13 @@ export function registerMetaLane(tools) {
                     writeRequiresConfirmation: requiresProductionConfirmation(resolved.profile),
                     removedConfigKeys: removedProfileKeys(resolved.profile),
                 },
+                // Project-scoped: never advertise another directory's environments.
                 configuredEnvironments: environments.map((e) => e.name),
+                environmentScope: {
+                    project: store.configPaths.projectEnvPath.replace(/[\\/][^\\/]+$/u, ""),
+                    own: store.ownEnvironmentNames(),
+                    policy: "本目录只能使用 .omc-envs / .omc-env 声明的环境；跨环境需先向用户报告并取得同意（omc env allow <name>）",
+                },
                 credentialsMode: store.credentialsMode(),
                 session: sessionState,
                 coverage: { total: ctx.manifest.items.length, byStatus: statusCounts },

package/dist/lanes/online-js-contract.js

@@ -78,7 +78,7 @@ export const ONLINE_JS_LANE_CONTRACT = Object.freeze({
         }),
         "onlinejs.compose": Object.freeze({
             scope: ONLINE_JS_SCOPE,
-            description: `Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause).`,
+            description: `Compose the Online JS source as the customScript element into the form's draftHtmlJson layout array (then publish, promoting it verbatim to publishedHtmlJson). Core contract: preserve the platform template and only extend customScript.innerHTML — the six-element skeleton includes the ${PLATFORM_LIFECYCLE_WRAPPER_MARKER} lifecycle wrapper; the style, toolbar, template, beforeCustomScript, customScript, and afterCustomScript elements are kept or synthesized with platform defaults, while every layout/control element is preserved. customScript is rebuilt canonically as {tagName:'script', id:'customScript', innerHTML:<platform lifecycle wrapper containing source>, attrs:[]} because the designer requires an ARRAY attrs (e.attrs.some) and tagName, else the Online JS editor fails with t.some is not a function. Drives bizsheet/update + bizsheet/publish; publishedHtmlJson is read back verbatim and SHA-256-fingerprinted so the caller can verify byte equality. Read the EXISTING script first with onlinejs.get (decide replace vs INCREMENTAL from what is actually stored). Never overwrites the layout with a standalone script object or a partial [customScript]-only array (regression for issue 11's root cause). summary:true answers "did it land?" without any HTML/JS body (sha + byte counts + draftPublishedInSync); the default readback dedupes the composed draft and the script when they equal the published face, so the same script is never returned three times.`,
         }),
     }),
 });

package/dist/lanes/online-js.js

@@ -101,6 +101,7 @@ export function registerOnlineJsLane(tools) {
         source: z.string().min(1).describe("在线 JS 代码。默认 INCREMENTAL：并入平台 (function(form){…}) 模板的既有脚本，模板与既有注册全部保留；配 replace:true 才是整段替换。脚本不得使用 export/import；事件名必须是平台事件（onLoad/onRendered/onValidate/onPreAction/onCustomAction/onActionDone/onPrintFormDataHandle/onPrintWorkflowLogDataHandle）"),
         replace: z.boolean().optional().describe("true = 以 source 整体替换 customScript（含完整 (function(form){…}) 脚本）。默认 false = 增量并入既有脚本，保留平台模板与既有逻辑"),
         publish: z.boolean().optional(),
+        summary: z.boolean().optional().describe("true = 只回同步状态（sha/字节数/是否同步/渲染兼容），不回任何 HTML/JS 原文。确认「改动是否生效」用这个；要看原文用 onlinejs.get"),
     }, async (session, args) => {
         const shouldPublish = args.publish !== false;
         // 1. Read the existing draftHtmlJson.
@@ -159,17 +160,56 @@ export function registerOnlineJsLane(tools) {
         const publishedElements = parseLayoutElements(publishedRaw);
         // 8. SHA-256 of the verbatim content.
         const publishedSha256 = createHash("sha256").update(publishedRaw).digest("hex");
+        const draftSha256 = createHash("sha256").update(composedDraftHtml).digest("hex");
+        const publishedScript = readCustomScriptSource(publishedRaw).script;
+        const customScriptSha256 = createHash("sha256").update(composedScript, "utf8").digest("hex");
+        const draftPublishedInSync = publishedScript !== null && publishedScript === composedScript;
+        const htmlRenderCompat = { draft: validateHtmlRender(composedDraftHtml, true), published: validateHtmlRender(publishedRaw, true) };
+        // Live 2026-10-21 (customer): this readback shipped the same ~10KB script
+        // three times (composedDraftHtmlJson + publishedHtmlJson + customScript),
+        // ~45KB for a call whose only question was "did publish land?" — the
+        // session's single largest context amplification. Answer that question
+        // directly and keep 原文 opt-in.
+        if (args.summary === true) {
+            return {
+                performed: { errcode: 0, published },
+                readback: {
+                    publishedSha256,
+                    draftSha256,
+                    draftPublishedInSync,
+                    publishedElementCount: publishedElements.length,
+                    scriptElementPresent: publishedElements.some((element) => element.id === "customScript"),
+                    customScriptMerged: args.replace !== true,
+                    customScriptSha256,
+                    customScriptBytes: Buffer.byteLength(composedScript, "utf8"),
+                    composedDraftBytes: Buffer.byteLength(composedDraftHtml, "utf8"),
+                    publishedHtmlBytes: Buffer.byteLength(publishedRaw, "utf8"),
+                    htmlRenderCompat,
+                    hint: "summary 模式不回原文；要脚本原文用 onlinejs.get，要完整布局用 artifact 或 form.get --full",
+                },
+            };
+        }
         return {
             performed: { errcode: 0, published },
             readback: {
+                // Dedupe: after a successful publish the draft and the published
+                // face are the same bytes, and the script also rides inside them.
+                // Return the composed payload ONCE (composedDraftHtmlJson keeps the
+                // field every consumer already reads) and state the equality instead
+                // of repeating ~11KB + ~10KB.
+                ...(composedDraftHtml === publishedRaw
+                    ? { draftEqualsPublished: true }
+                    : { publishedHtmlJson: publishedRaw }),
                 composedDraftHtmlJson: composedDraftHtml,
-                publishedHtmlJson: publishedRaw,
                 publishedSha256,
+                draftSha256,
+                draftPublishedInSync,
                 publishedElementCount: publishedElements.length,
                 scriptElementPresent: publishedElements.some((element) => element.id === "customScript"),
                 customScript: composedScript,
+                customScriptMatchesPublished: draftPublishedInSync,
                 customScriptMerged: args.replace !== true,
-                htmlRenderCompat: { draft: validateHtmlRender(composedDraftHtml, true), published: validateHtmlRender(publishedRaw, true) },
+                htmlRenderCompat,
             },
         };
     }, 

package/dist/lanes/rule-graph.js

@@ -615,6 +615,55 @@ export function graphGeometryNeedsLayout(nodesInput, routesInput) {
     const boxes = nodes.map(boxOf);
     return boxes.some((a, ai) => boxes.some((b, bi) => bi > ai && a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height));
 }
+/**
+ * System persistence nodes belong to the TOOL, never to the caller.
+ *
+ * `SYSTEM_CREATE/SYSTEM_UPDATE/SYSTEM_DELETE` are the platform's trigger-row
+ * persistence nodes: the correct one is a function of the rule code
+ * (Create→SYSTEM_CREATE, …) and its position is a function of the action nodes.
+ * A caller who hand-writes one can only get it wrong:
+ *
+ *  - wrong type inside a preset rule → data.submit 50000 (live 2026-09-25);
+ *  - any type inside a CUSTOM rule bound to a workflow event → the end/cancel
+ *    agenda has no serializable current object and every run throws
+ *    `Object <id> is not serialized` (live 2026-10-22, r8: 33 occurrences,
+ *    nothing written, every step still reported DELIVERED);
+ *  - right type but wrong seat → the merged result is persisted before the
+ *    action writes it (ASSIGN/BIZ_ACTION must precede the system node).
+ *
+ * So strip whatever the caller supplied and let `injectDefaultSystemNode` place
+ * the one platform default (preset rules only). Routes through the stripped
+ * node are bridged pre→post so the chain stays connected.
+ */
+export function stripCallerSystemNodes(nodesInput, routesInput) {
+    const nodes = asRecordArray(parseMaybeJson(nodesInput));
+    const routes = asRecordArray(parseMaybeJson(routesInput));
+    const systemTypes = new Set(["SYSTEM_CREATE", "SYSTEM_UPDATE", "SYSTEM_DELETE"]);
+    const stripped = nodes
+        .filter((node) => systemTypes.has(String(node.nodeType ?? "")))
+        .map((node) => String(node.nodeCode ?? ""));
+    if (stripped.length === 0)
+        return { nodes, routes, stripped };
+    let nextRoutes = routes;
+    for (const code of stripped) {
+        const incoming = nextRoutes.filter((route) => String(route.postNode ?? "") === code).map((route) => String(route.preNode ?? ""));
+        const outgoing = nextRoutes.filter((route) => String(route.preNode ?? "") === code).map((route) => String(route.postNode ?? ""));
+        nextRoutes = nextRoutes.filter((route) => String(route.preNode ?? "") !== code && String(route.postNode ?? "") !== code);
+        for (const pre of incoming)
+            for (const post of outgoing)
+                nextRoutes.push({ preNode: pre, postNode: post });
+    }
+    // Collapse duplicate edges produced by bridging (same endpoints + condition).
+    const seen = new Set();
+    nextRoutes = nextRoutes.filter((route) => {
+        const key = `${String(route.preNode ?? "")}->${String(route.postNode ?? "")}#${JSON.stringify(route.routeCondition ?? null)}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    return { nodes: nodes.filter((node) => !systemTypes.has(String(node.nodeType ?? ""))), routes: nextRoutes, stripped };
+}
 /**
  * The single rule-graph normalization used by BOTH the write preflight and the
  * executor, so preview and execute validate the SAME prepared graph (CFG-02
@@ -632,10 +681,20 @@ export function graphGeometryNeedsLayout(nodesInput, routesInput) {
  * in `warnings` (never gating) so the caller can replace it with a domain name.
  */
 export function prepareRuleGraph(ruleCode, graph, customTrigger, schemaCode) {
-    const injected = injectDefaultSystemNode(ruleCode, graph.nodes ?? graph.node, graph.routes ?? graph.route);
+    const warnings = [];
+    // The caller never owns a persistence node (see stripCallerSystemNodes).
+    const stripped = stripCallerSystemNodes(graph.nodes ?? graph.node, graph.routes ?? graph.route);
+    for (const nodeCode of stripped.stripped)
+        warnings.push({
+            code: "rule-graph-system-node-tool-owned",
+            nodeCode,
+            key: "nodes",
+            severity: "warning",
+            message: `已忽略调用方传入的系统持久化节点 ${nodeCode}：SYSTEM_CREATE/SYSTEM_UPDATE/SYSTEM_DELETE 由工具按规则类型注入，手写只会错配类型或位置（预置规则错配 → submit 50000；自定义规则/流程事件 → Object is not serialized 且静默不生效）`,
+        });
+    const injected = injectDefaultSystemNode(ruleCode, stripped.nodes, stripped.routes);
     let finalNodes = injected.nodes;
     let finalRoutes = injected.routes;
-    const warnings = [];
     // SCHEDULER ⇒ TIMING_TASK: the platform dispatches a schedule ONLY when the
     // RULE ROW's bizRuleType = 2 (BizRuleScheduling.java:202-205; see
     // lanes/businessrule-contract.ts:42). A caller who authors a SCHEDULER node but

package/dist/lanes/workflow-contract.js

@@ -144,7 +144,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "org.role.list": Object.freeze({
             scope: "workflow participant resolution",
-            description: "列出组织角色（`GET /api/api/organization/role/list`），扁平化为 {id,name,code,roleType,corpId}。用于把审批节点的参与者解析成平台认识的引用。**真实参与者语法**（2026-09-23 生产观察）：`participant` 只能是 (a) 关键字 `{Originator}`；(b) 参与者对象数组 JSON `[{\"code\":\"<roleCode>\",\"corpId\":\"<corpId|other>\",\"id\":\"<roleId>\",\"name\":\"<角色名>\",\"type\":2}]`（type 2=角色，3=用户；多个用 `+` 连接）；(c) 函数表达式如 `FindUserByRole({Originator.OU},\"<roleCode>\",\"random\")`。**自由文本角色名（如 `部门负责人`）能 publish 但解析不到人、不生成待办**——先用本工具拿到 `code`/`id` 再构造对象数组。",
+            description: "列出组织角色（`GET /api/api/organization/role/list`），递归展开角色组，返回 {count, roleCount, groupCount, roles[{id,name,code,roleType,corpId,group}], groups[{id,name,code,path,childCount}]}。**`count` 只数角色，不含角色组**——角色组是容器（平台行标记 `group:true`），旧版把空组当角色列出，曾让调用方把「19 个角色组」误读成「目标角色未创建」；`groups[].childCount` 才说明组内是否真的没有角色。用于把审批节点的参与者解析成平台认识的引用。**真实参与者语法**（2026-09-23 生产观察）：`participant` 只能是 (a) 关键字 `{Originator}`；(b) 参与者对象数组 JSON `[{\"code\":\"<roleCode>\",\"corpId\":\"<corpId|other>\",\"id\":\"<roleId>\",\"name\":\"<角色名>\",\"type\":2}]`（type 2=角色，3=用户；多个用 `+` 连接）；(c) 函数表达式如 `FindUserByRole({Originator.OU},\"<roleCode>\",\"random\")`。**自由文本角色名（如 `部门负责人`）能 publish 但解析不到人、不生成待办**——先用本工具拿到 `code`/`id` 再构造对象数组。",
         }),
         "org.department.list": Object.freeze({
             scope: "workflow participant resolution",

package/dist/lanes/workflow.js

@@ -913,7 +913,15 @@ function activityCodeOf(record) {
   * change still mints a collision-free fresh code. Returns the rewritten
   * activities plus the original→final code map for route remapping.
   */
-function reconcileCallerActivityCodes(callerActivities, draftActivities) {
+function reconcileCallerActivityCodes(callerActivities, draftActivities, options = {}) {
+    // 8.6 pins activityType on an existing code (live 2026-09-23), so a retype
+    // there needs a fresh code. AI-Platform 1.1.x does NOT pin it: a raw
+    // workflow/update that keeps the code and changes activityType returns
+    // errcode 0 and the draft reads back with the new type (live 2026-10-21,
+    // 1.1.25, END→PARTICIPANT in place). Minting `_2` there is OMC's own
+    // invention and churns every downstream reference (routes, buttons, logs),
+    // so only the pinned family mints.
+    const mintOnTypeChange = options.mintOnTypeChange !== false;
     const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
     const used = new Set(draftActivities.map((activity) => String(activity.activityCode ?? "")));
     const codeMap = new Map();
@@ -941,7 +949,7 @@ function reconcileCallerActivityCodes(callerActivities, draftActivities) {
             // the designer's own rename posts exactly that and activityName stays
             // the first-created value). Only a TYPE change still needs a fresh code
             // (activityType is pinned for existing codes).
-            if (typeChanged) {
+            if (typeChanged && mintOnTypeChange) {
                 let suffix = 2;
                 while (used.has(`${original}_${suffix}`))
                     suffix += 1;
@@ -1229,7 +1237,7 @@ async function refuseRequiredOnChildTableFields(session, schemaCode, template, t
  * same edge). This is the "read back, then send the delta" path — without it a
  * subset silently REPLACED the whole activity list and dropped nodes.
  */
-function mergeCallerDelta(template, draft) {
+function mergeCallerDelta(template, draft, options = {}) {
     const { routes: routesRaw, activities: _raw, edges: edgesRaw, ...rest } = template;
     const routes = routesRaw ?? edgesRaw;
     const draftActivities = Array.isArray(draft.activities) ? draft.activities : [];
@@ -1258,7 +1266,7 @@ function mergeCallerDelta(template, draft) {
     // that under the same code). reconcileCallerActivityCodes keeps the code for
     // a name change and stamps name_i18n; only a type change still mints a fresh
     // code and DROPS the old node (a retype, not a rename).
-    const { activities: reconciledCaller, codeMap } = reconcileCallerActivityCodes(caller, draftActivities);
+    const { activities: reconciledCaller, codeMap } = reconcileCallerActivityCodes(caller, draftActivities, options);
     const draftByCode = new Map(draftActivities.map((activity) => [String(activity.activityCode ?? ""), activity]));
     const originalOf = new Map();
     for (const [original, final] of codeMap)
@@ -1342,7 +1350,7 @@ function mergeCallerDelta(template, draft) {
     });
     return { ...rest, activities: laidOut.activities, rules };
 }
-function normalizeWorkflowTemplate(template, draft) {
+function normalizeWorkflowTemplate(template, draft, options = {}) {
     if (template === undefined || template === null)
         return {};
     const { routes: routesRaw, activities: rawActivities, edges: edgesRaw, ...rest } = template;
@@ -1356,7 +1364,7 @@ function normalizeWorkflowTemplate(template, draft) {
     // The platform cannot rename an existing activityCode (see the reconcile
     // comment); give every changed/new node a fresh code, and remap caller routes
     // so they follow.
-    const reconciled = rawCaller ? reconcileCallerActivityCodes(rawCaller, draftActivities) : undefined;
+    const reconciled = rawCaller ? reconcileCallerActivityCodes(rawCaller, draftActivities, options) : undefined;
     const activities = reconciled?.activities;
     const codeMap = reconciled?.codeMap ?? new Map();
     const remapCode = (value) => codeMap.get(String(value ?? "")) ?? value;
@@ -1477,7 +1485,13 @@ async function mergedTemplateBody(session, schemaCode, code, template, merge = f
             workflowCode: code,
             message: `流程 ${code} 不存在（get_draft 401001 缺席）——先 workflow.create 再 update/publish`,
         });
-    const normalized = merge ? mergeCallerDelta(template, draft) : normalizeWorkflowTemplate(template, draft);
+    // Type changes are only pinned on the 8.x family (see reconcileCallerActivityCodes).
+    // Unknown versions keep the conservative 8.x behaviour (mint) — writes fail
+    // closed elsewhere, and a spurious `_2` is recoverable while a silent
+    // in-place retype on a pinned platform is not.
+    const version = session.detectedVersion();
+    const mintOnTypeChange = !(version !== undefined && version.startsWith("1."));
+    const normalized = merge ? mergeCallerDelta(template, draft, { mintOnTypeChange }) : normalizeWorkflowTemplate(template, draft, { mintOnTypeChange });
     // S29 contract: a PARTICIPANT activity requires sheetCode = the schema's
     // sheet, else validate/publish answers 401026 WORKFLOW_ACTIVITY_NO_SHEET. The
     // platform's own draft sets each participant's sheetCode to the model code;
@@ -2302,16 +2316,7 @@ export function registerWorkflowLane(tools) {
         inputSchema: { environment: environmentArg, capability: capabilityArg },
         handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
             const data = (await wireCall(session, { path: ENDPOINTS.organizationRoleList })).data;
-            const roles = [];
-            for (const group of wireRows(data)) {
-                const children = Array.isArray(group.children) ? group.children : [];
-                if (children.length === 0)
-                    roles.push(roleOf(group, null));
-                else
-                    for (const child of children)
-                        roles.push(roleOf(child, String(group.name ?? "")));
-            }
-            return { count: roles.length, roles };
+            return flattenRoleTree(wireRows(data));
         }),
     }));
     tools.push(defineTool({
@@ -2381,6 +2386,74 @@ export function registerWorkflowLane(tools) {
     }));
 }
 /** Flatten a role-group/role row into the participant-construction fields. */
+/**
+ * Role groups are CONTAINERS, not roles. The platform's own row marks them
+ * `group:true` (children carry `group:false`), so membership must be decided by
+ * that flag — never by `children.length`. Live 2026-10-21 (customer 8.2.96,
+ * 季度考评): every entry was a group with `children:[]`, so the old
+ * `children.length === 0 ? role : …` shape returned 19 "roles" that were all
+ * groups; the agent read `count:19` as "the 6 roles were never created" and
+ * reported a false blocker to the user. Groups also nest, so flatten
+ * recursively and keep them in a separate `groups` list.
+ */
+const ROLE_CHILD_KEYS = ["children", "roles", "childRoles", "childList", "list"];
+function roleChildren(row) {
+    for (const key of ROLE_CHILD_KEYS) {
+        const value = row[key];
+        if (Array.isArray(value))
+            return value;
+    }
+    return [];
+}
+function isRoleGroup(row) {
+    if (row.group === true)
+        return true;
+    // Older builds omit `group`; a container with children is still a container.
+    // A row that carries `groupId` is a leaf role even if it has an empty array.
+    if (row.groupId !== undefined && row.groupId !== null)
+        return false;
+    return roleChildren(row).length > 0;
+}
+export function flattenRoleTree(rows) {
+    const roles = [];
+    const groups = [];
+    const walk = (nodes, containerPath) => {
+        for (const node of nodes) {
+            if (!isRoleGroup(node)) {
+                roles.push(roleOf(node, containerPath.length > 0 ? containerPath[containerPath.length - 1] : null));
+                continue;
+            }
+            const name = String(node.name ?? "");
+            const path = [...containerPath, name];
+            const children = roleChildren(node);
+            groups.push({
+                id: node.id ?? null,
+                name: node.name ?? null,
+                code: node.code ?? null,
+                corpId: node.corpId ?? null,
+                path: path.join(" / "),
+                childCount: children.length,
+            });
+            if (children.length > 0)
+                walk(children, path);
+        }
+    };
+    walk(rows, []);
+    return {
+        // `count` stays role-only: it is what participant resolution consumes, and
+        // counting containers as roles is exactly the misread this fixes.
+        count: roles.length,
+        roleCount: roles.length,
+        groupCount: groups.length,
+        roles,
+        groups,
+        ...(roles.length === 0
+            ? {
+                hint: "本次返回里没有任何角色行（只有角色组或无数据）。角色组不是角色：不要据此断言「角色未创建」。若预期有角色，先看 groups[].childCount —— 组内为空说明该组下确实未建角色；若要验证某个 roleCode 在运行期可用，用业务数据反证（如 data.list 读取引用该 roleCode 的记录，或 org.user.search 找到人后用其角色字段）。",
+            }
+            : {}),
+    };
+}
 function roleOf(row, group) {
     return {
         id: row.id ?? null,

package/dist/rule-support.js

@@ -4,7 +4,7 @@ import { ENDPOINTS } from "./endpoints.js";
 import { ToolRefusalError } from "./tool-types.js";
 import { decodeJsonColumn, JSON_COLUMN_NULL_COALESCE } from "./json-column.js";
 import { RULE_BIZ_RULE_TYPE_DESCRIPTION, RULE_CREATE_BODY, RULE_ROUTES_DESCRIPTION, ruleNodeGraphDescription, schedulerSettingDescription, } from "./lanes/businessrule-contract.js";
-import { validateRuleNodeGraph, prepareRuleGraph, PLATFORM_TRIGGER_RULE_CODES } from "./lanes/rule-graph.js";
+import { validateRuleNodeGraph, prepareRuleGraph, PLATFORM_TRIGGER_RULE_CODES, DEFAULT_SYSTEM_NODE_BY_RULE_CODE } from "./lanes/rule-graph.js";
 import { compileMethodConfigPlain } from "./bizservice-config.js";
 import { RESERVED_CODES } from "./code-rules.js";
 /** Business-rule node graph. Platform trigger rules are addressed by ruleCode: Create / Update / Delete / Available / Cancel / GetList / Load. */
@@ -624,10 +624,36 @@ export async function executeRuleSaveWrite(session, args) {
         : typeof schedulerInput === "string"
             ? schedulerInput
             : JSON.stringify(schedulerInput);
-    const nodeJson = typeof nodes === "string" ? nodes : JSON.stringify(nodes);
-    const routeJson = typeof routes === "string" ? routes : JSON.stringify(routes);
     const list = await wireCall(session, { path: ENDPOINTS.businessRuleListBySchemaCode, query: { schemaCode: args.schemaCode } });
     const existing = wireRows(list.data).find((row) => row.code === args.ruleCode);
+    // Persistence nodes belong to the PLATFORM, not to us and not to the caller.
+    // The preset row already carries its own (Start → Create(SYSTEM_CREATE) →
+    // End). Copy that node verbatim instead of fabricating our own: nodeCode,
+    // nodeName, isSystemNode and geometry then always match what the designer
+    // itself writes. Only its SEAT (relative to the caller's action nodes) is
+    // ours, and the fingerprint of a hand-made replica drifting from the
+    // platform's is exactly what breaks publish later.
+    const systemSpec = DEFAULT_SYSTEM_NODE_BY_RULE_CODE[args.ruleCode];
+    if (existing?.id && systemSpec) {
+        try {
+            const baselineRow = (await wireCall(session, { path: ENDPOINTS.businessRuleGet, query: { id: String(existing.id) } })).data;
+            const baselineNodes = parseJsonColumn(baselineRow?.node);
+            const platformNode = Array.isArray(baselineNodes)
+                ? baselineNodes.find((node) => String(node.nodeType ?? "") === systemSpec.nodeType)
+                : undefined;
+            if (platformNode) {
+                const index = nodes.findIndex((node) => String(node.nodeType ?? "") === systemSpec.nodeType);
+                if (index >= 0)
+                    nodes[index] = { ...platformNode, isSystemNode: true };
+            }
+        }
+        catch {
+            // Best-effort: the documented default keeps the chain valid if the
+            // baseline cannot be read (the save itself will report the real error).
+        }
+    }
+    const nodeJson = typeof nodes === "string" ? nodes : JSON.stringify(nodes);
+    const routeJson = typeof routes === "string" ? routes : JSON.stringify(routes);
     const schedulerField = schedulerSetting === undefined ? {} : { schedulerSetting };
     // Preset trigger rules (Create/Update/Delete/Load/GetList/Available/Cancel
     // and 流程 code) are platform-managed: their `name` is a platform default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.70",
+  "version": "0.4.72",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.70",
+    "@stalfh233/omc-fake-platform": "0.4.72",
     "commander": "14.0.3",
-    "omc-core": "0.4.70",
+    "omc-core": "0.4.72",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-business-configuration.md

@@ -151,7 +151,9 @@ rules:
 - **两条路**：模型+表单+流程一揽子交付走**意图**（`intent` 的 `workflow` 能力，声明式一次 apply）；只动流程或想逐步控制走**低层链** `workflow.create → workflow.update（权限/节点）→ workflow.publish`，标准链配方见 `omc describe workflow.update`（含多级审批/participant 三形态/自动回填说明）。流程权限细节见下节。
 - 一个模型只能有一个流程；已有流程的模型直接 `workflow.update`，不要另建。
 - **清理测试数据用批量删除**：`data.delete --args '{"schemaCode":"<code>","bizObjectIds":["id1","id2"]}'` 一次往返删多条（真机 r6：207 次逐条 `data.delete` 占 13.5% 调用）。
+- **系统持久化节点是平台自带的，不要手写**：预置 `Create/Update/Delete` 行本来就带 `SYSTEM_CREATE/SYSTEM_UPDATE/SYSTEM_DELETE`（实测基线 `Start → Create(SYSTEM_CREATE) → End`）。`rule.save` 会丢弃调用方传入的 `SYSTEM_*` 并**从平台基线原样携带**那一个节点（code/name/几何都不由我们猜）。手写的后果：预置规则里类型错配 → `data.submit` 50000；自定义规则/流程事件里带系统节点 → 结束事件无当前对象，`Object <id> is not serialized`，每步仍回 DELIVERED 但什么都没写。只写平台允许配置的业务节点（UPDATE/CREATE/DELETE/BRANCH/ASSIGN/MESSAGE/BIZ_ACTION…）。
 - **取 artifact 先投影**：`artifact get <id> --summary` 看形状 → `--jq '<path>'` 取那一段；只有确实要整份时才裸取（r6：47 次整包拉取 650KB，0 次用投影）。
+- **读回产物会自动清理，也可手动清**：每次大结果落一个 artifact（机器级目录，跨项目累积；实测一轮沙盒 504 个/3.4MB）。`createArtifact` 每 24h 顺手删 7 天未动的；要立刻回收用 `omc artifact prune --older-than 7d --max-bytes 268435456`（默认预算 256MB，超出按最旧优先删），`--json` 回 removed/freedBytes/kept。
 - **核验状态用投影，别重复整条读**：`data.load --args '{"schemaCode":..,"bizObjectId":..,"fields":["sequenceStatus","<业务状态字段>"]}'` 只回指定字段（缺失项在 `missingFields`）——r4 实测同一对象被整条读 74 次；大结果先 `artifact get <id> --summary` → `--keys/--jq`，别整包内联进推理。
 - **流程第一个节点必须是 `{Originator}` 填写节点**：平台 `WorkflowTemplateValidateUtility.validateStartActivity` 对「START 后直接接审批」报 401035「发起节点的参与者只能是{Originator}」，publish 回 errcode 0 但一个 ValidateMessage[] 就把模板挡在门外、不落库（真机 2026-10-21）。OMC 0.4.65 起在 `workflow.update`/`publish` 出门前拒绝（`workflow-first-activity-not-originator`）。
 - **跨模型回写的目标行必须已提交（COMPLETED）**：DRAFT 行不参与目标查询，运行 0 行命中且日志只有「查找范围不存在数据」。单跳关联字段可直接作 DYNAMIC 来源（引擎取关联对象 id）；点号路径按子表解析，`关联字段.id` / 两跳路径都不支持。
@@ -274,7 +276,7 @@ BIZ_ACTION：
 - 直接执行规则：`useLocation: ROW` + `operateType: WITH_OUT_VIEW`。
 - `WITH_VIEW` 是打开表单。
 - FLOW 按钮需要 workflowCode；CLI 会补安全的 actionConfig。
-- **在线 JS 分两条**：本 CLI 只做**读写与发布**——**读现存脚本用 `onlinejs.get`**（抽 customScript innerHTML 原文+SHA-256，不必拉 form.get --full 六份 JSON；据此决定 replace 还是默认 INCREMENTAL 并入），用 `onlinejs.compose` 把已定稿的 `source` 组合进平台 skeleton 的 `customScript` 再 publish，回读 `publishedHtmlJson`+SHA-256。**脚本内容的编写/增量合并不在本 CLI**：若当前项目自带在线 JS 编写规范（例如其 `.cpdocs`/技能或项目文档），遵循它；否则向用户/设计者索取已定稿的 `source`。不要在 omc 侧手写或臆造 JS 逻辑。
+- **在线 JS 分两条**：本 CLI 只做**读写与发布**——**读现存脚本用 `onlinejs.get`**（抽 customScript innerHTML 原文+SHA-256，不必拉 form.get --full 六份 JSON；据此决定 replace 还是默认 INCREMENTAL 并入），用 `onlinejs.compose` 把已定稿的 `source` 组合进平台 skeleton 的 `customScript` 再 publish，回读 `publishedHtmlJson`+SHA-256。**确认是否落地用 `summary:true`**（只回 sha/字节数/`draftPublishedInSync`，不回原文，约 600B；默认回显也已去重，不再把同一段脚本回三次）。**脚本内容的编写/增量合并不在本 CLI**：若当前项目自带在线 JS 编写规范（例如其 `.cpdocs`/技能或项目文档），遵循它；否则向用户/设计者索取已定稿的 `source`。不要在 omc 侧手写或臆造 JS 逻辑。
 
 ## 运行验收与清理
 

package/skills/omc-config-draft-review.md

@@ -164,7 +164,7 @@ you can wait for.
 
 视图与表单脚手架都从**发布面**读字段元数据——字段未发布，列/控件就生成不出来。
 `data.list` 对未配列的自定义字段投影为 null（显示面缺配置，不是数据缺失）；核值用 `data.load`。
-字段级变更（如关联展示字段）改完后，必须重走 `field.publish` → `form.draft` → `form.publish` 运行时才生效（表单控件快照字段 options）；`field.update` 带 `"cascadeRepublish":true` 一调完成整条链（中途失败按 partial steps 如实报告），只刷新表单用 `form.publish rebuild:true`。
+字段级变更（如关联展示字段）改完后，必须重走 `field.publish` → `form.draft` → `form.publish` 运行时才生效（表单控件快照字段 options）；`field.update` 带 `"cascadeRepublish":true` 一调完成整条链（中途失败按 partial steps 如实报告），只刷新表单用 `form.publish rebuild:true`。**重建会按字段元数据重生成控件，设计器公式（`shortTextStitch`/条件/默认值）不在字段上**：0.4.71 起写前校验，会丢公式即拒绝 `form-rebuild-formula-would-be-lost`；不需要重建布局时不要带此参数。
 
 ## Invariants
 

package/skills/omc-start-here.md

@@ -82,7 +82,20 @@ execute → readback/cleanup** (`omc-five-piece-flow`).
 There is no approval token, no `--yes`, and no self-approval switch. If a call
 refuses, work out which gate or boundary produced it from `omc-refusals`.
 
-## 3. Boundaries
+## 3. Project environment isolation
+
+Each project directory may use only the environments it declares: `.omc-env` (this
+project's binding) and `.omc-envs` (its allowlist, one name per line). Any other
+environment on the machine is another project's — `resolveEnvironment` refuses it
+**before** credentials, token cache or network access, so nothing leaks. Lists
+(`omc env list`, `get_status.configuredEnvironments`) are project-scoped too.
+
+To use another environment you must ask the user first, then either
+`omc env allow <name>` (writes `.omc-envs`, durable) or a one-off
+`OMC_ALLOW_CROSS_ENV=1` (prints a `cross-env:` line to stderr). Never widen the
+scope on your own initiative.
+
+## 4. Boundaries
 
 Out-of-coverage, blocked, or unsupported faces refuse with a manifest citation —
 that refusal is the answer, not an obstacle to route around with another tool.

package/skills/omc-write-hazards.md

@@ -34,7 +34,7 @@ omc help omc-write-hazards
 - 有映射时传非空 JSON 数组字符串，并在 draft/published 两面读回。
 - **运行时写关联值是另一种形状**（`data.save`/`data.update` 的 formData）：单选关联（`propertyType 9`）传 **id 字符串或 `{ id }`**，传**数组会稳定 50000**；**多选关联（11）传分号分隔的 id 字符串 `"id1;id2"`（或 `{id:"id1;id2"}`），传数组稳定 50000**；**人员/组织（50/51/60/61）传 `[{"id","type","name"}]`，`type` 必填**（缺它稳定 50000）——`type` 是 UnitType 索引：**用户=3、部门=1**。用错形状只会拿到一个不透明的 50000。
 - **`mappings` 由表单运行时在用户选择时套用**，服务端 `data.save` **不会**自动回填映射目标字段。API 侧要自己写被映射字段，否则读回为空——别把它误判成“映射配置失败”。
-- **关联映射的事实源在字段行 `options.mappings`，不在表单控件属性**（真机 2026-10-14 实证：改表单 attributes 里的映射会被平台按字段重算覆盖、回读不生效）。改映射走：`field.update` 按完整 options 提交（只改 mappings，其余键原值保留）→ `field.publish` → `form.draft`（**rebuild:false**，保留现有布局与在线JS）重存 → `form.publish` → 回读核对。**别用 field.update 的 cascadeRepublish 刷已带自定义布局/在线JS 的表单**（它会 rebuild 脚手架）。
+- **关联映射的事实源在字段行 `options.mappings`，不在表单控件属性**（真机 2026-10-14 实证：改表单 attributes 里的映射会被平台按字段重算覆盖、回读不生效）。改映射走：`field.update` 按完整 options 提交（只改 mappings，其余键原值保留）→ `field.publish` → `form.draft`（**rebuild:false**，保留现有布局与在线JS）重存 → `form.publish` → 回读核对。**别用 cascadeRepublish 刷带布局/在线JS 的表单**：rebuild 会清空设计器公式（已做写前拒绝）。
 - **运行时写值的最小形状**（组合出错只会得到一个不透明的 `50000`/NPE，逐一最小化再合）：单选关联(9) → id 字符串 `"<id>"`；**多选关联(11) → 分号串 `"<id1>;<id2>"`**；**人员/组织(50/51/60/61) → `[{"id":"<id>","type":3,"name":"<名>"}]`，`type` 必填且为整数**（缺/非整数 → `BizField.parseFromClient` 拆箱 NPE→50000；用户=3、部门=1）；日期(3) → 字符串 `"2026-09-30 10:00:00"`；子表(8) → 行对象数组 `[{"<子列code>":<值>, ...}]`。先各写一条最小行通过，再组合。
 - **DATE(3) 字段的 `options.format` 必须是平台大写枚举**（`YYYY-MM-DD`、`YYYY-MM-DD HH:mm:ss`、`YYYY年MM月DD日`…），**不是 Java 的 `yyyy-MM-dd`**：平台 `DateBizField` 按字面比较，Java 写法能创建字段但**首次运行时 save 稳定 `50000`（`不支持的format`）**（2026-09-30 R5 实测）。`field.create`/`intent` 会就地拒绝非枚举值。