@stalfh233/omc-cli 0.4.75 → 0.4.76

package/dist/artifacts.js

@@ -83,7 +83,7 @@ export function isWithinRoot(root, candidate) {
 export function assertSafeOutputPath(root, candidate, label) {
     const normalized = resolve(root, candidate);
     if (!isWithinRoot(root, normalized))
-        throw new Error(`${label} must be inside the configuration root`);
+        throw new Error(`${label} must be inside the configuration root（配置根 ${resolve(root)}；本次解析为 ${normalized}）`);
     const parent = resolve(normalized, "..");
     if (!existsSync(parent))
         throw new Error(`${label} parent directory does not exist`);
@@ -101,7 +101,7 @@ export function assertSafeInputPath(root, candidate, label) {
     const resolvedRoot = resolve(root);
     const normalized = resolve(root, candidate);
     if (!isWithinRoot(root, normalized))
-        throw new Error(`${label} must be inside the configuration root`);
+        throw new Error(`${label} must be inside the configuration root（配置根 ${resolvedRoot}；本次解析为 ${normalized}）`);
     let current = normalized;
     while (current !== resolvedRoot) {
         try {

package/dist/cli.js

@@ -17,7 +17,8 @@ import { configureOutput, humanSummary, stripOutputFlags, writeEnvelope } from "
 import { beginUsage, completeUsage, recordUsageOutput, usageReport } from "./usage-log.js";
 import { artifactFetchHint, artifactRoot, boundResult, emitInvalid, emitResult, emitTransportResult, outputBudget, readArtifact, withTransport, } from "./command-transport.js";
 import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath, pruneArtifacts } from "./artifacts.js";
-import { resolve } from "node:path";
+import { projectJsonPath, projectResultExtract } from "./path-projection.js";
+import { basename, join, resolve } from "node:path";
 import { buildToolRegistry } from "./tools.js";
 import { acquireWriteLock } from "./write-lock.js";
 import { cmdCompute } from "./compute.js";
@@ -274,12 +275,19 @@ async function cmdCall(store, args) {
     const positional = args.filter((token, index) => !token.startsWith("--") && (index === 0 || !args[index - 1]?.startsWith("--env") && !args[index - 1]?.startsWith("--environment") && !args[index - 1]?.startsWith("--args")));
     const toolName = positional[0];
     if (!toolName || toolName === "help" || args.includes("--help")) {
-        console.error("用法：omc call <tool> [--env <环境>] [--args '<json>' | --args - (stdin) | --args-file <path>]");
+        console.error("用法：omc call <tool> [--env <环境>] [--args '<json>' | --args - (stdin) | --args-file <配置根内路径>] [--extract <path>]... [--extract-keys]");
         console.error("写入：由环境 writable 决定（只读环境拒写）；生产环境的写必须在 args 里带 confirmProduction:true。");
         return emit(toolName && toolName !== "help" ? "error" : "ok", {}, toolName && toolName !== "help" ? CLI_EXIT_CODES.invalidInput : 0);
     }
     const environment = flag("--env") ?? flag("--environment");
     const requestValue = flag("--request-id");
+    // 1.2 of issue 2026-10-23: read faces answer {detailArtifactId, sha256} and the
+    // caller then needs a SECOND call to see one value (16 two-step chains in one
+    // session; 15 more were pure --keys probes). `--extract <path>` (repeatable)
+    // resolves the path inside the artifact of THIS result and returns only the
+    // value; `--extract-keys` lists the artifact's top-level keys with sizes.
+    const extractPaths = argvValues(args, "--extract");
+    const extractKeys = args.includes("--extract-keys");
     const dryRun = args.includes("--dry-run");
     const waitValue = flag("--wait");
     let waitMs = 0;
@@ -331,11 +339,22 @@ async function cmdCall(store, args) {
         // r10 F9: an out-of-root `--args-file` was reported under "--args 必须是
         // 合法 JSON", which points the reader at the wrong flag. Name the real
         // cause (and the configuration root) when the failure came from the file.
-        const message = /must be inside the configuration root/.test(detail)
-            ? `--args-file 越界：${detail}（只接受配置根 ${resolve(process.env.OMC_CONFIG_HOME ?? process.cwd())} 内的路径；把参数文件放进项目目录后重试）`
-            : `--args 必须是合法 JSON：${detail}（Windows PowerShell 下内联 JSON 引号转义不可靠，请改用 --args-file <path> 写入临时文件后引用）`;
+        const configRoot = resolve(process.env.OMC_CONFIG_HOME ?? process.cwd());
+        // 1.1 of issue 2026-10-23: the old hint told the caller to write a TEMP file
+        // while the validator only accepts paths under the config root — the two
+        // instructions contradicted each other and neither named the root. Offer a
+        // single executable recipe: an absolute path inside the root.
+        const outOfRoot = /must be inside the configuration root/.test(detail);
+        const message = outOfRoot
+            ? `--args-file 越界：${detail}。可执行做法：把参数文件放到 ${configRoot} 之下（如 ${join(configRoot, "args.json")}），再用 --args-file 引用；不要把参数文件放在系统临时目录（配置根之外一律拒绝）`
+            : `--args 必须是合法 JSON：${detail}。若问题在引号转义（Windows PowerShell），改用 --args-file <配置根内的路径>`;
         console.error(message);
-        writeEnvelope(envelope("error", {}, request, { code: "invalid-input", message: detail, retryable: false }));
+        // The MACHINE envelope must carry the same actionable text: agents read
+        // stdout, and the old envelope only repeated the English detail.
+        // Keep the REJECTED path on stderr only: the machine envelope must not leak
+        // host layout (ticket 103), so it carries the root plus the bare file name.
+        const rejectedName = typeof argsFile === "string" ? basename(resolve(configRoot, argsFile)) : "";
+        writeEnvelope(envelope("error", {}, request, { code: "invalid-input", message: outOfRoot ? `--args-file 必须位于配置根内（配置根 ${configRoot}${rejectedName ? `；本次文件 ${rejectedName}` : ""}）` : detail, retryable: false, ...(outOfRoot ? { configurationRoot: configRoot } : {}) }));
         return CLI_EXIT_CODES.invalidInput;
     }
     const registry = buildToolRegistry();
@@ -404,9 +423,26 @@ async function cmdCall(store, args) {
                 await lock.release();
         }
     }
+    if (extractPaths.length > 0 || extractKeys) {
+        const projected = projectResultExtract(result, extractPaths, extractKeys);
+        if (projected !== undefined)
+            result = projected;
+    }
     const classified = classifyResult(result);
     return emit(classified.status, result, classified.exitCode);
 }
+/** Collect every value of a repeatable flag (`--extract a --extract b`). */
+function argvValues(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] !== name)
+            continue;
+        const value = args[index + 1];
+        if (value !== undefined && !value.startsWith("--"))
+            values.push(value);
+    }
+    return values;
+}
 function resolvedDefaultEnvironment(store) {
     try {
         return store.resolveEnvironment(undefined).name;
@@ -415,36 +451,6 @@ function resolvedDefaultEnvironment(store) {
         return "default";
     }
 }
-function projectJsonPath(value, path) {
-    const normalized = path
-        .trim()
-        .replace(/^[.\/]+/, "")
-        .replace(/\[(\d+)\]/g, ".$1")
-        .replace(/\[(?:"([^"]+)"|'([^']+)')\]/g, (_all, dq, sq) => `.${dq || sq}`)
-        .replace(/\.{2,}/g, ".");
-    const segments = normalized.split(/[./]/).filter((segment) => segment.length > 0);
-    let current = value;
-    for (const segment of segments) {
-        if (Array.isArray(current)) {
-            const index = Number(segment);
-            if (!Number.isInteger(index) || index < 0 || index >= current.length)
-                return { missed: true, at: segment, available: `数组长度 ${current.length}（下标 0-${Math.max(current.length - 1, 0)}）` };
-            current = current[index];
-        }
-        else if (current && typeof current === "object") {
-            const record = current;
-            if (!Object.prototype.hasOwnProperty.call(record, segment)) {
-                const keys = Object.keys(record);
-                return { missed: true, at: segment, available: keys.length > 0 ? keys.slice(0, 12) : "（该层是空对象）" };
-            }
-            current = record[segment];
-        }
-        else {
-            return { missed: true, at: segment, available: `路径在第 ${segments.indexOf(segment) + 1} 段之前已到标量/undefined（前段类型 ${current === null ? "null" : typeof current}）` };
-        }
-    }
-    return { missed: false, value: current };
-}
 function parseDurationMs(text) {
     const match = /^\s*(\d+)\s*(ms|s|m|h|d|w)?\s*$/u.exec(text);
     if (!match)
@@ -950,11 +956,47 @@ function onboardingHelp() {
     return [
         "首次使用、或不确定从哪开始：omc help omc-start-here（随包权威 topic 路线）；被拒或状态异常：omc help omc-refusals。",
         "目标→工具一步定位：omc next \"<你要做什么>\"（离线、只读，给能力/说明/首批命令；不确定会明说并回退到 omc-requirement-analysis）。",
+        "大结果取值一步到位：读面回 detailArtifactId 时，用 omc call <tool> … --extract <path>（可重复）或 --extract-keys，省掉再跑一次 omc artifact get。",
         "工具发现：omc commands --json（含 capability id/lane/recipes；加 --compact 只回工具行、无目录散文）· omc capabilities（能力 id/lane/aliases/tools/依赖顺序）· omc capability <id> --executable（单能力完整执行包）。",
         "单工具/契约：omc describe <tool>（schema+recipe+能力路由）· omc contract <lane>（wire 契约+能力路由）；环境就绪：omc call discover_environment --env <env> --args '{}'。",
         "写入两道门：对话层草稿确认（omc help omc-config-draft-review）+ 环境 writable 开关；生产环境每笔写需在 args 里带 confirmProduction:true。",
     ].join("\n");
 }
+/** Last command-level failure, so the no-envelope fallback can name the cause. */
+let lastFailureDetail;
+function failureDetail() {
+    return process.env.OMC_LAST_FAILURE ?? lastFailureDetail;
+}
+/**
+ * 1.5 of issue 2026-10-23: a `--jq` expression containing spaces/pipes arrives as
+ * multiple argv entries when the caller's shell splits it. Commander then
+ * answers "too many arguments for 'get'" — an arity complaint, not a quoting
+ * hint. Re-join the value before parsing.
+ */
+function joinSplitFlagValues(raw, flags) {
+    const out = [];
+    for (let index = 0; index < raw.length; index += 1) {
+        const token = raw[index];
+        if (!flags.includes(token)) {
+            out.push(token);
+            continue;
+        }
+        const value = raw[index + 1];
+        if (value === undefined) {
+            out.push(token);
+            continue;
+        }
+        const parts = [value];
+        let cursor = index + 2;
+        while (cursor < raw.length && !raw[cursor].startsWith("--")) {
+            parts.push(raw[cursor]);
+            cursor += 1;
+        }
+        out.push(token, parts.join(" "));
+        index = cursor - 1;
+    }
+    return out;
+}
 async function main() {
     let commandExitCode = 0;
     beginUsage(argv);
@@ -1038,8 +1080,8 @@ async function main() {
         commandExitCode = CLI_EXIT_CODES.ok;
     });
     command.command("doctor").option("--environment <environment>").option("--env <environment>").option("--service <serviceCode>", "可选：体检单个业务集成服务的鉴权参数形状（掩码/占位/全 0 检出，WARN 非致命）").action(async (options) => { commandExitCode = await cmdDoctor(new ConfigStore(defaultPaths()), options.environment ?? options.env, options.service); });
-    command.command("call <tool>").option("--env <environment>").option("--environment <environment>").option("--args <json>").option("--args-file <path>").option("--max-output-bytes <bytes>").option("--request-id <requestId>").option("--timeout-ms <milliseconds>").option("--wait <milliseconds>").option("--dry-run").addHelpText("after", `\n${onboardingHelp()}\n`).action(async (tool, options) => {
-        const rest = [tool, ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.args !== undefined ? ["--args", options.args] : []), ...(options.argsFile !== undefined ? ["--args-file", options.argsFile] : []), ...(options.maxOutputBytes !== undefined ? ["--max-output-bytes", options.maxOutputBytes] : []), ...(options.requestId ? ["--request-id", options.requestId] : []), ...(options.timeoutMs !== undefined ? ["--timeout-ms", options.timeoutMs] : []), ...(options.wait !== undefined ? ["--wait", options.wait] : []), ...(options.dryRun ? ["--dry-run"] : [])];
+    command.command("call <tool>").option("--env <environment>").option("--environment <environment>").option("--args <json>").option("--args-file <path>").addOption(new Option("--extract <path>", "在本次结果的 artifact 内取一个路径的值（可重复；省掉一次 artifact get）").argParser((value, previous = []) => [...previous, value]).default([])).option("--extract-keys", "列出本次结果 artifact 的顶层键与体积（省掉一次 artifact get --keys）").option("--max-output-bytes <bytes>").option("--request-id <requestId>").option("--timeout-ms <milliseconds>").option("--wait <milliseconds>").option("--dry-run").addHelpText("after", `\n${onboardingHelp()}\n`).action(async (tool, options) => {
+        const rest = [tool, ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.args !== undefined ? ["--args", options.args] : []), ...(options.argsFile !== undefined ? ["--args-file", options.argsFile] : []), ...(Array.isArray(options.extract) ? options.extract.flatMap((path) => ["--extract", path]) : []), ...(options.extractKeys ? ["--extract-keys"] : []), ...(options.maxOutputBytes !== undefined ? ["--max-output-bytes", options.maxOutputBytes] : []), ...(options.requestId ? ["--request-id", options.requestId] : []), ...(options.timeoutMs !== undefined ? ["--timeout-ms", options.timeoutMs] : []), ...(options.wait !== undefined ? ["--wait", options.wait] : []), ...(options.dryRun ? ["--dry-run"] : [])];
         commandExitCode = await cmdCall(new ConfigStore(defaultPaths()), rest);
     });
     command.command("compute").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--target <propertyCode>").option("--property <propertyCode>").option("--formula <formula>").option("--name <name>").option("--env <environment>").option("--environment <environment>").option("--apply").addHelpText("after", "\n字段计算规则拼装器：公式 {字段} 引用 → datarule type2 完整形状（editorText/editorMark 自动生成）。默认 dry-run，--apply 写入。复杂场景（条件分支/跨模型）走 omc next 的 recipe 路径。\n").action(async (options) => {
@@ -1161,7 +1203,8 @@ async function main() {
     intentCommand.command("readback <file>").option("--env <environment>").option("--max-output-bytes <bytes>").action(async (file, options) => {
         commandExitCode = await withTransport(options, request, (transport) => cmdIntentReadback(file, options.env, transport));
     });
-    await command.parseAsync(stripOutputFlags(argv));
+    // `--jq` expressions the shell split arrive as several tokens; re-join them.
+    await command.parseAsync(joinSplitFlagValues(stripOutputFlags(argv), ["--jq"]));
     return commandExitCode;
 }
 /**
@@ -1194,7 +1237,15 @@ main().then((code) => {
         finish(code);
         return;
     }
-    writeEnvelope(envelope(code === 0 ? "ok" : "error", {}, request, code === 0 ? null : { code: "internal", message: "command failed", retryable: false }));
+    // 1.6 of issue 2026-10-23: a bare "command failed" gives no stage and no cause.
+    writeEnvelope(envelope(code === 0 ? "ok" : "error", {}, request, code === 0
+        ? null
+        : {
+            code: "internal",
+            message: `${argv[2] ?? "omc"} 以退出码 ${code} 结束但没有写出结果信封${failureDetail() ? `：${failureDetail()}` : "（没有捕获到具体异常；加 --verbose 复现，或用相同参数再跑一次看 stderr）"}`,
+            retryable: false,
+            ...(failureDetail() ? { stage: "post-command" } : {}),
+        }));
     completeUsage(code);
     finish(code);
 }, (error) => {

package/dist/command-transport.js

@@ -82,7 +82,7 @@ export function artifactFetchHint(artifactId) {
     // raw. `--summary` shows the key/size map so they fetch only what they need.
     // Kept terse on purpose: this line rides EVERY write and every spilled read
     // (2026-09-25 cost pass — the parenthetical prose was 80 B of the 133 B).
-    return `omc artifact get ${artifactId} --summary（再 --keys/--jq）`;
+    return `omc artifact get ${artifactId} --summary（再 --keys/--jq）；或原调用加 --extract <path> / --extract-keys 一次拿到`;
 }
 /** Replace local paths with a redaction marker (never leak the host layout). */
 function sanitizePaths(value) {

package/dist/compute.js

@@ -74,9 +74,10 @@ export async function cmdCompute(args) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
+        process.env.OMC_LAST_FAILURE = `compute → datarule.create: ${message}`;
         writeEnvelope(envelope("error", {}, request, {
             code: "compute-write-failed",
-            message: `compute 调用 datarule.create 失败：${message}\n` +
+            message: `compute 调用 datarule.create 失败（stage=datarule.create）：${message}\n` +
                 "若 --schema 是**子表 code**（子表列计算），改用可跑样例直接发：omc describe datarule.create --example field-compute-child-column，" +
                 "或 omc call datarule.create --args '<该样例 args>'（含 resultType/formulaType/expression 的嵌套 JSON）。",
             retryable: false,

package/dist/discovery.js

@@ -200,11 +200,29 @@ export function describeTool(registry, name) {
         // of a 133 KB task even though a matching recipe existed.
         ...(hasRecipe ? { exampleHint: `可运行参数用 --example <id>（~1–2KB）；单参数用 --param <name>；仅当二者都缺形状才 --full` } : {}),
         ...(!hasRecipe ? { exampleHint: `无静态 recipe：required + params 已够常规调用；单参数说明用 --param <name>；仅当需要全部参数注释/拒绝形状才 --full（5–20KB）` } : {}),
+        // 1.7 of issue 2026-10-23: the parameter DOC for `subFields` was only
+        // reachable through --param/--full, i.e. discovering a param needed its
+        // name first. Name the documented params inline (cheap: names only) so one
+        // `describe` answers "does this tool take X, and what is X called".
+        ...(documentedParamNames(tool).length > 0
+            ? { paramDocs: { available: documentedParamNames(tool), read: `omc describe ${tool.name} --param <name>（单个参数注释，几百字节）` } }
+            : {}),
         // Keep the cost salient at the decision point: agents reached for --full even
         // when --example/--param existed (sandbox22: 8 --full calls, one 19 KB).
         full: `omc describe ${tool.name} --full（5–20KB；先试 --example/--param）`,
     };
 }
+/** Param names whose schema entry carries a `.describe()` (documented params). */
+function documentedParamNames(tool) {
+    const shape = (tool.inputSchema ?? {});
+    const names = [];
+    for (const [key, value] of Object.entries(shape)) {
+        const description = value?.description;
+        if (typeof description === "string" && description.trim() !== "")
+            names.push(key);
+    }
+    return names.sort();
+}
 /** `omc describe <tool> --example <id>`: one recipe in full, by id. */
 export function describeExample(registry, name, exampleId) {
     const tool = registry.find((entry) => entry.name === name);

package/dist/form-layout.js

@@ -14,6 +14,23 @@
  */
 export const ALLOWED_SPANS = new Set([6, 8, 12, 16, 18, 24]);
 export const FULL_SPAN = 24;
+/**
+ * 1.3 of issue 2026-10-23: these three classifications describe shapes the
+ * PLATFORM ITSELF stores — its default scaffold puts creater/createdTime/
+ * sequenceNo on one row (each defaulting to span 24 → "overflow"), and some
+ * published layouts list child columns as rows. Refusing them makes a
+ * read→write round-trip impossible, so they are warnings, not blockers.
+ * Coverage/span/options/type violations stay hard.
+ */
+export const SOFT_LAYOUT_CLASSIFICATIONS = new Set();
+// No classification is unconditionally soft: a caller-authored bad layout must
+// still refuse with ZERO wire. The platform's own readback is tolerated by
+// `form.draft`'s `fromReadback` path instead (issue 2026-10-23 §1.3), where the
+// supplied faces can be compared against the stored sheet. The default-width
+// row rule below still keeps the platform's scaffold rows from tripping.
+export function hardLayoutViolations(violations) {
+    return violations.filter((violation) => !SOFT_LAYOUT_CLASSIFICATIONS.has(violation.classification));
+}
 /** Child-table (Sheet 201) column keys, which must live on `columns`, never in rows. */
 function childColumnKeys(attrs) {
     const keys = new Set();
@@ -99,10 +116,16 @@ export function validateFormLayout(rows, attributes) {
         const codes = row.map((code) => String(code));
         const widths = codes.map((code) => spanOf(attrs, code, violations));
         const total = widths.reduce((sum, width) => sum + width, 0);
-        if (total > FULL_SPAN) {
+        // The platform's OWN scaffold writes rows like creater+createdTime+
+        // sequenceNo with NO explicit span (each defaults to 24) — rows made only of
+        // default-width system controls are the platform's shape, not a caller
+        // error (issue 2026-10-23 §1.3). Only a row that sets a span explicitly is
+        // judged by the width rules.
+        const hasExplicitSpan = codes.some((code) => attrs[code]?.options !== undefined && (attrs[code]?.options).span !== undefined);
+        if (hasExplicitSpan && total > FULL_SPAN) {
             violations.push({ classification: "layout_row_overflow", row: index + 1, message: `第 ${index + 1} 行 span 合计 ${total}，超过 ${FULL_SPAN}（${codes.join(" + ")}）` });
         }
-        if (codes.length !== 1 && widths.some((width) => width === FULL_SPAN)) {
+        if (hasExplicitSpan && codes.length !== 1 && widths.some((width) => width === FULL_SPAN)) {
             violations.push({ classification: "full_row_control_conflict", row: index + 1, message: `第 ${index + 1} 行含整行控件（span=24），不能与其他控件同行（${codes.join(" + ")}）` });
         }
     });

package/dist/form-support.js

@@ -4,7 +4,7 @@ import { decodeJsonObjectColumn } from "./json-column.js";
 import { ToolRefusalError } from "./tool-types.js";
 import { FIELD_CONTROL_TYPES, SYSTEM_FIELD_CODES, fieldControlOptions, relationDisplayField, relationMappings, } from "./field-families.js";
 import { deriveControlOptions } from "./capability-shape.js";
-import { validateFormLayoutShape } from "./form-layout.js";
+import { hardLayoutViolations, validateFormLayoutShape } from "./form-layout.js";
 /**
  * Propagate each relation field's `options.mappings` into its form control so
  * the form-fill carry is configured where the form renderer reads it. The
@@ -602,9 +602,7 @@ export function isEmptyLayoutJson(value) {
  * face (one-sided included), covering configure_form/apply_changes paths that
  * do not pass through the `form.draft` write permission gate.
  */
-export function assertCallerFormLayout(args) {
-    if (args.draftViewJson === undefined && args.draftAttributesJson === undefined)
-        return;
+export function formLayoutViolations(args) {
     const parse = (value) => {
         if (typeof value !== "string")
             return undefined;
@@ -615,7 +613,12 @@ export function assertCallerFormLayout(args) {
             return undefined;
         }
     };
-    const violations = validateFormLayoutShape(parse(args.draftViewJson), parse(args.draftAttributesJson));
+    return validateFormLayoutShape(parse(args.draftViewJson), parse(args.draftAttributesJson));
+}
+export function assertCallerFormLayout(args) {
+    if (args.draftViewJson === undefined && args.draftAttributesJson === undefined)
+        return;
+    const violations = hardLayoutViolations(formLayoutViolations(args));
     if (violations.length > 0) {
         throw new ToolRefusalError({
             status: "refused",
@@ -836,8 +839,6 @@ export async function executeFormDraftWrite(session, args) {
     }
     // Caller-provided layouts get the distribution-grade shape gate (options
     // objects, string viewJson cells, no child keys as rows) before any wire.
-    if (args.draftViewJson !== undefined || args.draftAttributesJson !== undefined)
-        assertCallerFormLayout(args);
     // Ticket 74 — refuse CALLER-PROVIDED empty layouts before any wire call.
     // The platform designer's Save clears draft faces to "[]"/"{}" (non-lossless);
     // re-writing that shape explicitly is how the 13-control loss happened.
@@ -888,6 +889,42 @@ export async function executeFormDraftWrite(session, args) {
         if (pre === null)
             throw new WireError("business", `form ${args.sheetCode} was created but is not readable`, 302024);
     }
+    //
+    // 1.3 of issue 2026-10-23: the platform's OWN readback can carry shapes this
+    // gate rejects (`child_column_in_rows` when a published layout lists child
+    // columns as rows; `layout_row_overflow` on the auto system row). Refusing a
+    // byte-identical round-trip makes "read → write back" impossible, so a face
+    // that matches the sheet's own published/draft face is allowed through with
+    // the violations reported as warnings. Caller-authored layouts stay strict.
+    const roundTripFaces = new Set();
+    let layoutWarnings = [];
+    if (args.draftViewJson !== undefined || args.draftAttributesJson !== undefined) {
+        const pre2 = pre;
+        const same = (provided, stored) => typeof provided === "string" && typeof stored === "string" && provided.trim() === stored.trim();
+        const viewRoundTrip = same(args.draftViewJson, pre2?.publishedViewJson) || same(args.draftViewJson, pre2?.draftViewJson);
+        const attributesRoundTrip = same(args.draftAttributesJson, pre2?.publishedAttributesJson) || same(args.draftAttributesJson, pre2?.draftAttributesJson);
+        const allProvidedAreRoundTrip = (args.draftViewJson === undefined || viewRoundTrip) && (args.draftAttributesJson === undefined || attributesRoundTrip);
+        if (!allProvidedAreRoundTrip && args.fromReadback === true) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "form-layout-invalid",
+                schemaCode: args.schemaCode,
+                sheetCode: args.sheetCode,
+                message: "fromReadback:true 但本次布局与已存草稿/发布面不一致——读过之后又改过就必须按普通写面校验（去掉 fromReadback，或按 validation 修正）",
+                validation: formLayoutViolations(args),
+            });
+        }
+        if (allProvidedAreRoundTrip) {
+            layoutWarnings = formLayoutViolations(args);
+            if (args.draftViewJson !== undefined)
+                roundTripFaces.add("draftViewJson");
+            if (args.draftAttributesJson !== undefined)
+                roundTripFaces.add("draftAttributesJson");
+        }
+        else {
+            assertCallerFormLayout(args);
+        }
+    }
     // Field-level relation mappings are the source of truth; read the published
     // fields so the scaffold (or an existing draft) can carry them into the
     // matching form control, where the form renderer reads them at fill time.
@@ -1056,6 +1093,14 @@ export async function executeFormDraftWrite(session, args) {
             hasDraft: sheet.existDraft === true || typeof sheet.draftViewJson === "string",
             ...(formButtons !== null ? { formButtons, formButtonCodes: formButtons.map((button) => String(button.code ?? "")) } : {}),
             ...(mergedOptions !== undefined ? { customButtonJsonWritten: true } : {}),
+            ...(roundTripFaces.size > 0
+                ? {
+                    layoutGate: "platform-roundtrip",
+                    layoutRoundTripFaces: [...roundTripFaces],
+                    layoutNote: "本次布局与平台读回的原样布局一致，形状告警只提示不拒绝（平台自身产出可能含子表列行/系统行超宽）",
+                    ...(layoutWarnings.length > 0 ? { layoutWarnings } : {}),
+                }
+                : {}),
             ...(args.rebuild === true && previousAttributes ? { rebuildPreservedControls } : {}),
         },
     };

package/dist/lanes/datarule.js

@@ -453,14 +453,37 @@ function childFormulaBareReferences(formula, childFieldCodes) {
  * field (→ platform 50000 on submit). Field-aware via the child schema's
  * published fields; a caller-provided set avoids a duplicate fieldList read.
  */
+/**
+ * 1.4 of issue 2026-10-23: `datarule.list` resolves a CHILD-table schema
+ * (bizdatarule/list answers rows) while `bizproperty/list?schemaCode=<child>`
+ * answers 601003 业务模型不存在 — the same schema code reads on one face and
+ * fails on the other. Do not let the field-metadata probe veto a write that the
+ * rule face itself accepts: return null (metadata unavailable) and let callers
+ * skip the field-level guards with a warning.
+ */
+async function readPublishedFieldCodesOrNull(session, schemaCode) {
+    try {
+        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+        return new Set(rows.map((row) => String(row.code ?? row.propertyCode ?? "")));
+    }
+    catch (error) {
+        if (error instanceof WireError && error.kind === "business" && (error.errcode === 601003 || error.errcode === 10011))
+            return null;
+        throw error;
+    }
+}
 async function assertChildFormulaRefs(session, args, knownChildFields) {
     if (args.dataRuleType !== 2 || args.childRule !== true)
         return;
     const formula = type2FormulaText(args.options);
     if (formula === null)
         return;
-    const codes = knownChildFields ??
-        new Set(wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } })).data).map((row) => String(row.code ?? row.propertyCode ?? "")));
+    const codes = knownChildFields === undefined ? await readPublishedFieldCodesOrNull(session, args.schemaCode) : knownChildFields;
+    // Metadata unavailable (child-table schema on a face that only answers the
+    // rule side): the bare-reference heuristic needs the field list, so skip it
+    // rather than refusing a write the platform accepts.
+    if (codes === null)
+        return;
     const bare = childFormulaBareReferences(formula, codes);
     if (bare.length === 0)
         return;
@@ -658,8 +681,8 @@ export async function syncFormConditionDataRules(session, schemaCode, fieldCode,
     const existing = await listDataRules(session, schemaCode);
     // The designer's rule rows live on the PUBLISHED face (like datarule.create's
     // own guard); a draft-only field cannot carry a designer-visible row yet.
-    const published = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data)
-        .some((row) => String(row.code ?? row.propertyCode ?? "") === fieldCode);
+    const publishedCodes = await readPublishedFieldCodesOrNull(session, schemaCode);
+    const published = publishedCodes === null ? true : publishedCodes.has(fieldCode);
     for (const key of changedKeys) {
         const dataRuleType = FORM_CONDITION_RULE_TYPES[key];
         const next = text(nextOptions, key);
@@ -726,12 +749,13 @@ export function registerDataRuleLane(tools) {
         assertDataRuleCheckType(args.dataRuleType, args.checkType);
         assertDataRuleTarget(args);
         const codes = dataRuleTargetCodes(args);
-        const fields = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } })).data);
-        const published = new Set(fields.map((row) => String(row.code ?? row.propertyCode ?? "")));
+        const published = await readPublishedFieldCodesOrNull(session, args.schemaCode);
         await assertChildFormulaRefs(session, args, published);
-        const missing = codes.filter((code) => !published.has(code));
-        if (missing.length > 0)
-            throw new ToolRefusalError({ status: "refused", blocker: "datarule-property-not-published", schemaCode: args.schemaCode, propertyCodes: codes, missing, message: `字段 ${args.schemaCode}.${missing.join(",")} 不在发布面上；拒绝 datarule.create POST` });
+        if (published !== null) {
+            const missing = codes.filter((code) => !published.has(code));
+            if (missing.length > 0)
+                throw new ToolRefusalError({ status: "refused", blocker: "datarule-property-not-published", schemaCode: args.schemaCode, propertyCodes: codes, missing, message: `字段 ${args.schemaCode}.${missing.join(",")} 不在发布面上；拒绝 datarule.create POST` });
+        }
         const existingRules = await listDataRules(session, args.schemaCode);
         // dataRuleType 1 (CHECK_RULE) fans out into 5 checkTypes that COEXIST on one
         // field (the platform auto-creates a checkType 4 maxLength row per text

package/dist/lanes/form-contract.js

@@ -19,7 +19,7 @@ export const FORM_WIRE = Object.freeze({
     actionsColumns: "ticket 100: draftActionsJson/publishedActionsJson are REAL bizsheet columns (BizForm.java:95-100 @SerializableField; BizFormModel.java:59-62 serialized by bizsheet/get) — the designer writes draftActionsJson on save and both faces on publish (frontend-dist/admin/js/4280.cfa75764.js offsets 193538/185347); form.get full:true surfaces them; publish promotes draftActionsJson → publishedActionsJson",
 });
 const FORM_GET_DESCRIPTION = '读取默认表单（bizsheet/get）的发布状态与控件清单（紧凑默认）。**发布态以返回的 `published` / `existDraft` 布尔为准**（`published:true`=已发布；`published:false,existDraft:true`=只有草稿，**未发布**）——不要用 `publishedControlCodes` 是否非空来推断（草稿字段会让它非空，误判为已发布）。**每个模型交付前其默认表单必须 `published:true`**：用 `configure_form` 或 `form.draft(rebuild:true)`+`form.publish` 发布，并逐模型 `form.get` 核对。`full:true` 还返回 `options` 与解析后的 `customButtonJson`（表单工具栏按钮）。传 `controls:["code",…]` 只取指定控件的 options（如关联控件的 mappings）；传 `full:true` 才返回 draft/published 的完整 view/attributes/html/actions JSON（actions 列为设计器保存/发布的表单级按钮动作）。体积大，仅在需要整体布局时用。';
-const FORM_DRAFT_DESCRIPTION = "Save the default-form DRAFT (bizsheet/update). Reads the current sheet, merges the caller's explicit draftViewJson/draftAttributesJson (or preserves the existing draft); when both are absent on a fresh default form, composes the designer-standard scaffold from the model's published fields. A redundant field (relation-mapping carry-through target) always stays bound; with no workflow it is hidden in the design (options.visible=false), with a workflow it stays visible for per-node propertyPermissions. Pass `draftHtmlJson` to thread custom online-script HTML through. Empty-layout guard: explicitly passing \"[]\"/\"{}\" view/attributes is refused (form-empty-layout) — the platform designer's Save is NOT lossless and clears drafts to exactly that shape; escape with allowEmptyLayout:true, and recover cleared drafts from the form version history (/api/api/app/bizsheet/history/list). **表单工具栏按钮**：`buttons`（数组）或 `customButtonJson`（原样字符串）写进 `biz_sheet.options.customButtonJson`；**要到 form.publish 才生成 h_biz_button(triggerType=FORM)**，且表单页是否显示还取决于流程节点 `buttonPermission.customBtns[].enabled`（设计器「表单操作」勾选）。`useLocation` 用 FORM/ROW/LIST，表单工具栏按钮用 FORM。 **表单控件属性（含关联填充 mappings）从字段行派生**：改关联映射的事实源在字段 options.mappings（field.update → field.publish），直接改这里的控件映射会被平台按字段重算覆盖（真机 2026-10-14 实证）；字段发布后如需刷新已发布表单的控件映射，用本工具 rebuild:false 重存（保留现有布局与在线JS）再 form.publish。";
+const FORM_DRAFT_DESCRIPTION = "Save the default-form DRAFT (bizsheet/update). Reads the current sheet, merges the caller's explicit draftViewJson/draftAttributesJson (or preserves the existing draft); when both are absent on a fresh default form, composes the designer-standard scaffold from the model's published fields. A redundant field (relation-mapping carry-through target) always stays bound; with no workflow it is hidden in the design (options.visible=false), with a workflow it stays visible for per-node propertyPermissions. Pass `draftHtmlJson` to thread custom online-script HTML through. Empty-layout guard: explicitly passing \"[]\"/\"{}\" view/attributes is refused (form-empty-layout) — the platform designer's Save is NOT lossless and clears drafts to exactly that shape; escape with allowEmptyLayout:true, and recover cleared drafts from the form version history (/api/api/app/bizsheet/history/list). **读回原样回写**：从 `form.get` 取回的 view/attributes 直接回传时加 `fromReadback:true`——工具会与已存草稿/发布面逐字比对，一致才放行（平台自身布局可能含子表列行/系统行默认宽度），被改动过的面照常按 validation 拒绝。**表单工具栏按钮**：`buttons`（数组）或 `customButtonJson`（原样字符串）写进 `biz_sheet.options.customButtonJson`；**要到 form.publish 才生成 h_biz_button(triggerType=FORM)**，且表单页是否显示还取决于流程节点 `buttonPermission.customBtns[].enabled`（设计器「表单操作」勾选）。`useLocation` 用 FORM/ROW/LIST，表单工具栏按钮用 FORM。 **表单控件属性（含关联填充 mappings）从字段行派生**：改关联映射的事实源在字段 options.mappings（field.update → field.publish），直接改这里的控件映射会被平台按字段重算覆盖（真机 2026-10-14 实证）；字段发布后如需刷新已发布表单的控件映射，用本工具 rebuild:false 重存（保留现有布局与在线JS）再 form.publish。";
 const FORM_PUBLISH_DESCRIPTION = "Publish the default form (bizsheet/publish, proven shape: draft*Json promoted to published*Json verbatim) with published-face readback. Degrade guard: refuses to promote a draft carrying FEWER controls than the published face (form-publish-degrade) — the designer's Save clears drafts non-losslessly; recover via the form version history (/api/api/app/bizsheet/history/list) and rewrite the draft first, or pass allowDegrade:true to force the reduction. rebuild:true is the one-call refresh: discard the existing draft, re-scaffold from the published fields (non-structural control options preserved), then force-promote — use it after a field shape change. **表单工具栏按钮**：传 `buttons`（或 `customButtonJson`）→ 写进 `options.customButtonJson` 并在本次 publish 生成 `h_biz_button(triggerType=FORM, triggerCode=<formCode>)`（平台 `publishBizForm:1022`）；`options.customButtonJson` 必须是**字符串化数组**（对象会 50000 syntax error）；表单页是否显示再由流程节点 `buttonPermission.customBtns[].enabled` 过滤。";
 const FORM_RUN_BUTTON_DESCRIPTION = "执行表单工具栏按钮（平台同款面：`POST /api/api/runtime/form/executeCustomButton`，body `{bizButtonModel, bizObjectList:[<完整业务对象>], reacquireDataFromDb:true}`）。**与列表行按钮不同**：列表按钮发 `launcher/domain_service_runtime/<schema>/<rule>` + `ids[]`（用 `rule.run`），表单按钮带**整条记录**，不能互换。按钮来源 `GET /api/api/system/getCustomButtons`（只列 triggerType=FORM 的 h_biz_button）。前提：按钮已由 `form.publish` 的 `buttons`/`customButtonJson` 生成。返回是执行结果信封，规则副作用用 `data.load` 另读；被规则 UPDATE 的目标行须是 COMPLETED（引擎查不到 DRAFT）。`302045` = 数据被占用。";
 const CONFIGURE_FORM_DESCRIPTION = "High-level: bind fields into the default form and publish it (form.draft → form.publish), subject to the write permission gate. Delegates to the proven form.draft scaffold + form.publish paths so the real empty-form layout (and any caller-supplied draftHtmlJson) is persisted and promoted — never bypasses with a shortcut body. `sheetCode` is optional: omitted means the model's default sheet (sheetCode = schemaCode).";
@@ -79,7 +79,7 @@ export function assertFormContract() {
     assertDescriptionCarries(FORM_LANE_CONTRACT, "form.get", ["bizsheet/get", "draft/published", "mappings", "`full:true`", "actions"]);
     if (!FORM_WIRE.actionsColumns.includes("BizForm.java:95-100"))
         throw new Error("form contract must pin the actions-columns evidence (ticket 100)");
-    assertDescriptionCarries(FORM_LANE_CONTRACT, "form.draft", ["bizsheet/update", "draftViewJson", "draftAttributesJson", "scaffold", "draftHtmlJson", "form-empty-layout"]);
+    assertDescriptionCarries(FORM_LANE_CONTRACT, "form.draft", ["bizsheet/update", "draftViewJson", "draftAttributesJson", "scaffold", "draftHtmlJson", "form-empty-layout", "fromReadback"]);
     if (!FORM_WIRE.redundantFieldVisibility.includes("propertyPermissions"))
         throw new Error("form contract must carry the redundant-field visibility (propertyPermissions) fact");
     assertDescriptionCarries(FORM_LANE_CONTRACT, "form.publish", ["bizsheet/publish", "draft*Json", "published*Json", "verbatim", "form-publish-degrade", "history/list", "rebuild:true", "force-promote"]);

package/dist/lanes/form.js

@@ -148,6 +148,7 @@ export function registerFormLane(tools) {
         draftHtmlJson: z.string().optional(),
         fieldCodes: z.array(z.string().min(1)).optional().describe("脚手架绑定的已发布字段（按此顺序）；由 configure_form/intent 显式传入"),
         rebuild: z.boolean().optional().describe("true 时丢弃现有草稿布局，按已发布字段重新生成（新增字段/子表要用它；默认保留现有草稿）"),
+        fromReadback: z.boolean().optional().describe("true = 本次 draftViewJson/draftAttributesJson 来自 form.get 的原样读回（平台自身布局可能含子表列行/系统行超宽）；工具会与已存面逐字比对，只有确实一致才放行，被改动过的面照常拒绝"),
         allowEmptyLayout: z.boolean().optional().describe("显式放行空布局（\"[]\"/\"{}\"）写入；默认拒绝（form-empty-layout），防设计器 Save 清空后照写丢控件"),
         buttons: z
             .array(z.record(z.unknown()))

package/dist/path-projection.js

@@ -0,0 +1,129 @@
+import { readFileSync } from "node:fs";
+import { readArtifact } from "./artifacts.js";
+import { artifactRoot } from "./command-transport.js";
+export function projectJsonPath(value, path) {
+    // 1.5 of issue 2026-10-23: an array-of-objects selection WITHOUT jq pipes.
+    // `.rules[code=Create]` (or `[code="Create"]`) picks the FIRST element whose
+    // key matches — exactly the shape callers reached for with
+    // `jq '.[] | select(...)'`, which then died on shell quoting.
+    const selector = /\[\s*([A-Za-z_][\w.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\]]*?))\s*\]/.exec(path);
+    if (selector !== null) {
+        const [, key, dq, sq, bare] = selector;
+        const expected = String(dq ?? sq ?? bare ?? "").trim();
+        const before = path.slice(0, selector.index);
+        const after = path.slice(selector.index + selector[0].length);
+        const base = projectJsonPath(value, before);
+        if (base.missed)
+            return base;
+        const array = base.value;
+        if (!Array.isArray(array))
+            return { missed: true, at: before || "$", available: `该层不是数组（是 ${array === null ? "null" : typeof array}）；选择器 [${key}=${expected}] 需要数组` };
+        const readKey = (entry) => (entry !== null && typeof entry === "object" ? String(entry[key] ?? "") : "");
+        const index = array.findIndex((entry) => readKey(entry) === expected);
+        if (index < 0)
+            return { missed: true, at: `${before}[${key}=${expected}]`, available: `数组长度 ${array.length}；${key} 的候选值：${[...new Set(array.map(readKey))].slice(0, 12).join("、") || "（无）"}` };
+        return after === "" ? { missed: false, value: array[index] } : projectJsonPath(array[index], after);
+    }
+    const normalized = path
+        .trim()
+        .replace(/^[.\/]+/, "")
+        .replace(/\[(\d+)\]/g, ".$1")
+        .replace(/\[(?:"([^"]+)"|'([^']+)')\]/g, (_all, dq, sq) => `.${dq || sq}`)
+        .replace(/\.{2,}/g, ".");
+    const segments = normalized.split(/[./]/).filter((segment) => segment.length > 0);
+    let current = value;
+    for (const segment of segments) {
+        if (Array.isArray(current)) {
+            const index = Number(segment);
+            if (!Number.isInteger(index) || index < 0 || index >= current.length)
+                return { missed: true, at: segment, available: `数组长度 ${current.length}（下标 0-${Math.max(current.length - 1, 0)}）` };
+            current = current[index];
+        }
+        else if (current && typeof current === "object") {
+            const record = current;
+            if (!Object.prototype.hasOwnProperty.call(record, segment)) {
+                const keys = Object.keys(record);
+                return { missed: true, at: segment, available: keys.length > 0 ? keys.slice(0, 12) : "（该层是空对象）" };
+            }
+            current = record[segment];
+        }
+        else {
+            return { missed: true, at: segment, available: `路径在第 ${segments.indexOf(segment) + 1} 段之前已到标量/undefined（前段类型 ${current === null ? "null" : typeof current}）` };
+        }
+    }
+    return { missed: false, value: current };
+}
+/** Collect every value of a repeatable flag (`--extract a --extract b`). */
+function argvValues(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] !== name)
+            continue;
+        const value = args[index + 1];
+        if (value !== undefined && !value.startsWith("--"))
+            values.push(value);
+    }
+    return values;
+}
+/**
+ * `call --extract/--extract-keys`: resolve paths inside the result's own
+ * artifact (or inside the result object when the tool returned no artifact).
+ * Returns undefined when there is nothing to project so the caller's result is
+ * emitted unchanged.
+ */
+export function projectResultExtract(result, paths, keysOnly) {
+    const artifactId = typeof result.detailArtifactId === "string" ? result.detailArtifactId : typeof result.artifactId === "string" ? result.artifactId : undefined;
+    // Tools hand an in-process artifact as `detailFile` (a local path);
+    // command-transport later swaps it for detailArtifactId. Extraction runs
+    // BEFORE that swap, so accept both.
+    const detailFile = typeof result.detailFile === "string" ? result.detailFile : undefined;
+    let source = result;
+    let artifact;
+    let readFromArtifact = false;
+    try {
+        const content = artifactId !== undefined
+            ? (artifact = readArtifact(artifactRoot(), artifactId)).content
+            : detailFile !== undefined
+                ? readFileSync(detailFile)
+                : undefined;
+        if (content !== undefined) {
+            readFromArtifact = true;
+            const text = content.toString("utf8");
+            try {
+                source = JSON.parse(text);
+            }
+            catch {
+                source = text;
+            }
+        }
+    }
+    catch {
+        // A pruned/expired artifact must not mask the real tool answer.
+        return { ...result, extract: { artifactId: artifactId ?? null, error: "artifact not found", hint: "产物已过期或被清理；去掉 --extract 重新调用该工具即可重新生成" } };
+    }
+    const out = {
+        status: result.status ?? "ok",
+        ...(artifactId !== undefined ? { artifactId, sha256: artifact?.sha256 } : {}),
+        from: readFromArtifact ? "artifact" : "result",
+    };
+    if (keysOnly) {
+        const record = source && typeof source === "object" && !Array.isArray(source) ? source : undefined;
+        out.keys = record
+            ? Object.entries(record)
+                .map(([key, value]) => ({ key, bytes: Buffer.byteLength(JSON.stringify(value) ?? "null", "utf8"), kind: Array.isArray(value) ? `array[${value.length}]` : value === null ? "null" : typeof value }))
+                .sort((left, right) => right.bytes - left.bytes)
+            : [];
+    }
+    if (paths.length > 0) {
+        out.extract = paths.map((path) => {
+            const projected = projectJsonPath(source, path);
+            return projected.missed
+                ? { path, content: null, pathMiss: true, missedAt: projected.at, available: projected.available }
+                : { path, content: projected.value ?? null };
+        });
+        if (paths.length === 1)
+            out.content = out.extract[0]?.content ?? null;
+    }
+    return out;
+}
+//# sourceMappingURL=path-projection.js.map

package/dist/write.js

@@ -22,7 +22,7 @@ import { plannableArgsRaw } from "./plan.js";
 import { defineTool, ToolRefusalError } from "./tool-types.js";
 import { assertFieldFamilyAllowed } from "./field-families.js";
 import { validateBusinessCode } from "./code-rules.js";
-import { validateFormLayout } from "./form-layout.js";
+import { hardLayoutViolations, validateFormLayout } from "./form-layout.js";
 import { prepareRuleGraph, validateRuleNodeGraph } from "./lanes/rule-graph.js";
 import { WireError } from "./wire.js";
 /**
@@ -219,8 +219,14 @@ export function writeTool(tools, name, lane, scope, description, inputSchema, ex
         }
         // CFG-form-layout: a supplied draft layout must satisfy the platform's
         // span/row/coverage invariants before it reaches the environment.
-        if (name === "form.draft" && typeof args.draftViewJson === "string" && typeof args.draftAttributesJson === "string") {
-            const violations = validateFormLayout(parseJsonOrUndefined(args.draftViewJson), parseJsonOrUndefined(args.draftAttributesJson));
+        // `fromReadback:true` means "these faces came from form.get" — the strict
+        // shape gate cannot tell a platform layout from a hand-written one without
+        // the session, so defer to form.draft's session-aware comparison (which
+        // still refuses a modified face). See issue 2026-10-23 §1.3.
+        if (name === "form.draft" && args.fromReadback !== true && typeof args.draftViewJson === "string" && typeof args.draftAttributesJson === "string") {
+            // Only HARD violations refuse here: the platform's own scaffold/layouts
+            // carry overflow/full-row/child-column shapes (issue 2026-10-23 §1.3).
+            const violations = hardLayoutViolations(validateFormLayout(parseJsonOrUndefined(args.draftViewJson), parseJsonOrUndefined(args.draftAttributesJson)));
             if (violations.length > 0)
                 throw new ToolRefusalError({ status: "refused", blocker: "form-layout-invalid", message: "表单布局未过出门前校验；按 validation 修正（span 白名单/行宽≤24/整行独占/控件覆盖率）", validation: violations });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.75",
+  "version": "0.4.76",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.75",
+    "@stalfh233/omc-fake-platform": "0.4.76",
     "commander": "14.0.3",
-    "omc-core": "0.4.75",
+    "omc-core": "0.4.76",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",