@stalfh233/omc-cli 0.4.81 → 0.4.83

package/README.md

@@ -130,10 +130,12 @@ omc call discover_environment --env <env> --args '{}'   # 环境就绪（真实
 - **intent**：`partial` 表示该能力可声明式（`omc intent`）覆盖一部分——通常 create/update；
   `none` 表示只走 `omc call`。删除类、方法面、分类/连接池等仍走 `omc call` 逃生舱。
 
-## 近期能力（0.4.74 → 0.4.81）
+## 近期能力（0.4.74 → 0.4.83）
 
 | 版本 | 新增 / 修复 |
 |---|---|
+| 0.4.83 | **r12 真机探针修正（最重要：文档纠错）**：字段计算规则（`datarule` type2）**由服务端在 `data.submit`/`data.update` 时计算并回填，且覆盖传入值**——此前 skills/describe 六处写的「API 不回填、服务端聚合需二开」是错的（旧证据只覆盖 `FORMULA(100)` 字段）。另：`omc compute` 新增 `--where "<子列> = <值>"`（编译 COUNTIF/SUMIF）并**拒绝无条件子表聚合**（`--allow-unfiltered` 显式放行）；`model.delete` 把「孤儿模型」死锁变成一次明确回答——先复查读缓存，仍存在则回 `model-orphaned-record` 并给平台侧出路 |
+| 0.4.82 | **流程发起权限（40009）**：新增 `workflow.permissions` / `workflow.addPermission` / `workflow.removePermission`（`/workflow/list_permission`、`create_permission`、`delete_permission`，unitType 线上为枚举序号 1=部门 2=角色 3=用户）。`data.submit`/`data.save+workflowCode` 的 40009 现在直接回 `workflow-start-permission-denied`：带上该流程的权限行现状、两种成因（无权限行 / 发起人部门记录已失效）与可粘贴的修复命令，不再是「流程发起权限不足」五个字 |
 | 0.4.81 | **r11 真机探针修复**：`rule.save` 对 `AGGREGATION` 规则节点**写前 fail-closed**（平台会存进去、运行时 50000，真实路径是 `omc compute`/datarule type2）；`omc next "统计子表行数"` 路由补 `datarule` 阶梯与 `field-compute-subtable-sum` 配方；`org.user.search` 省略关键字时**按部门树列全员**（平台 `wd` 不支持空串，此前只能枚举 0–9）；`omc artifact get --jq` 无值回键清单（不再 commander 报错）；`usage` 的 `faces` 纳入 `--jq/--summary/--keys/--path-only/--extract`（此前读面投影完全不记账） |
 | 0.4.80 | **省 token 与用量账本**：`omc help <topic>` 默认只回节索引（约 1KB，含每节字节数），`--all` 才读整篇；`omc artifact get` 正文 >8KB 默认只回形状（`--full` 才整包）；`omc usage` 默认只回汇总（`byTool`/`redundancy`/`estimatedTokens`），`--records` 才展开；`omc script` 的**每行工具调用单独记账**（`script-call` + `parentId`）；未绑定环境的目录回落 `$OMC_CONFIG_HOME/usage/<cwd-hash>.jsonl` |
 | 0.4.79 | README 对齐 0.4.79 实际工具面（142 工具 / 16 能力） |

package/coverage/m1-coverage-manifest-v1.json

@@ -339,6 +339,9 @@
         "workflow.bindRule",
         "workflow.setButtons",
         "workflow.delete",
+        "workflow.permissions",
+        "workflow.addPermission",
+        "workflow.removePermission",
         "configure_workflow",
         "workflow.validate",
         "org.role.users",
@@ -365,6 +368,7 @@
       "scopes": [
         "greenfield workflow authoring",
         "workflow node form-button checkboxes",
+        "workflow start permission (who may originate)",
         "organization role member read (role/users)",
         "organization role member management scope read (role/get_ouscope)",
         "organization role group create (role/add_role_group)",

package/dist/capability-overview.js

@@ -71,7 +71,7 @@ const SURFACES = [
         description: "字段族全链：create→publish→表单绑定；CHILD_TABLE 子列；FORMULA 计算（子表求和回主表、子表列同行运算）。",
         operations: ["create", "update", "publish", "delete"],
         intent: { level: "partial", note: "create/update（含 CHILD_TABLE subFields、FORMULA 计算）、publish 与 delete（absent:true）已声明式。" },
-        notes: "子表列是 schemaCode=父字段 code 上的普通字段；field.update 不接受 subFields。子列支持标量族 + WORK_SHEET 关联列（需 relativeCode + options）。**计算类已覆盖（默认走计算规则，非 FORMULA 字段）**：子表求和、子表列同行运算用「普通字段 + 计算规则」（`describe datarule.create --example field-compute-rule|field-compute-subtable-sum|field-compute-child-column`）；计算由**门户前端**执行、API 不回填（写测试数据带预算值，正确性人工前台确认）。嵌套子表/MULT_WORK_SHEET/RELEVANCE_DATA 不覆盖。",
+        notes: "子表列是 schemaCode=父字段 code 上的普通字段；field.update 不接受 subFields。子列支持标量族 + WORK_SHEET 关联列（需 relativeCode + options）。**计算类已覆盖（默认走计算规则，非 FORMULA 字段）**：子表求和、子表列同行运算用「普通字段 + 计算规则」（`describe datarule.create --example field-compute-rule|field-compute-subtable-sum|field-compute-child-column`）；计算规则由**服务端**在 data.submit/data.update 时计算并回填且覆盖传入值（真机 1.1.25 复核）。嵌套子表/MULT_WORK_SHEET/RELEVANCE_DATA 不覆盖。",
     },
     {
         id: "form",

package/dist/cli.js

@@ -1146,8 +1146,8 @@ async function main() {
         const rest = [tool, ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.args !== undefined ? ["--args", options.args] : []), ...(options.argsFile !== undefined ? ["--args-file", options.argsFile] : []), ...(Array.isArray(options.extract) ? options.extract.flatMap((path) => ["--extract", path]) : []), ...(options.extractKeys ? ["--extract-keys"] : []), ...(options.maxOutputBytes !== undefined ? ["--max-output-bytes", options.maxOutputBytes] : []), ...(options.requestId ? ["--request-id", options.requestId] : []), ...(options.timeoutMs !== undefined ? ["--timeout-ms", options.timeoutMs] : []), ...(options.wait !== undefined ? ["--wait", options.wait] : []), ...(options.dryRun ? ["--dry-run"] : [])];
         commandExitCode = await cmdCall(new ConfigStore(defaultPaths()), rest);
     });
-    command.command("compute").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--target <propertyCode>").option("--property <propertyCode>").option("--formula <formula>").option("--name <name>").option("--env <environment>").option("--environment <environment>").option("--apply").addHelpText("after", "\n字段计算规则拼装器：公式 {字段} 引用 → datarule type2 完整形状（editorText/editorMark 自动生成）。默认 dry-run，--apply 写入。复杂场景（条件分支/跨模型）走 omc next 的 recipe 路径。\n").action(async (options) => {
-        const rest = ["compute", ...(options.schema ? ["--schema", options.schema] : []), ...(options.schemaCode ? ["--schema-code", options.schemaCode] : []), ...(options.target ? ["--target", options.target] : []), ...(options.property ? ["--property", options.property] : []), ...(options.formula !== undefined ? ["--formula", options.formula] : []), ...(options.name ? ["--name", options.name] : []), ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.apply ? ["--apply"] : [])];
+    command.command("compute").option("--schema <schemaCode>").option("--schema-code <schemaCode>").option("--target <propertyCode>").option("--property <propertyCode>").option("--formula <formula>").option("--where <condition>", "条件聚合：\"<子列code> = <值>\"，与 --formula \"{<子表code>.<子列code>}\" 配合编译为 COUNTIF/SUMIF").option("--aggregate <count|sum>", "条件聚合用哪种：count（默认，→COUNTIF）/ sum（→SUMIF）").option("--allow-unfiltered", "显式接受「对整个子表列无条件聚合」；不给则拒绝（会把不符合条件的行也算进去）").option("--name <name>").option("--env <environment>").option("--environment <environment>").option("--apply").addHelpText("after", "\n字段计算规则拼装器：公式 {字段} 引用 → datarule type2 完整形状（editorText/editorMark 自动生成）。默认 dry-run，--apply 写入。条件聚合用 --formula \"{子表.子列}\" --where \"子列 = 值\"。复杂场景（条件分支/跨模型）走 omc next 的 recipe 路径。\n").action(async (options) => {
+        const rest = ["compute", ...(options.schema ? ["--schema", options.schema] : []), ...(options.schemaCode ? ["--schema-code", options.schemaCode] : []), ...(options.target ? ["--target", options.target] : []), ...(options.property ? ["--property", options.property] : []), ...(options.formula !== undefined ? ["--formula", options.formula] : []), ...(options.where !== undefined ? ["--where", options.where] : []), ...(options.aggregate !== undefined ? ["--aggregate", options.aggregate] : []), ...(options.allowUnfiltered ? ["--allow-unfiltered"] : []), ...(options.name ? ["--name", options.name] : []), ...(options.env ? ["--env", options.env] : []), ...(options.environment ? ["--environment", options.environment] : []), ...(options.apply ? ["--apply"] : [])];
         commandExitCode = await cmdCompute(rest);
     });
     // Commander 14 needs a real variadic Option; the old `{variadic:true}` cast

package/dist/compute.js

@@ -17,23 +17,90 @@ import { runToolCall } from "./call.js";
 import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
 import { argvValue } from "./args.js";
+/**
+ * The offending aggregate call when a formula aggregates a whole child column
+ * with no filter function, else undefined. COUNTIF/SUMIF/IF-wrapped calls are
+ * filtered by construction and pass.
+ */
+export function childAggregateWithoutFilter(formula) {
+    const upper = formula.toUpperCase();
+    if (upper.includes("COUNTIF") || upper.includes("SUMIF"))
+        return undefined;
+    // An IF(...) around the aggregate is the hand-written filtered form.
+    if (upper.trimStart().startsWith("IF("))
+        return undefined;
+    for (const fn of CHILD_AGGREGATES) {
+        const pattern = new RegExp(`${fn}\\(\\s*\\{([^{}]+\\.[^{}]+)\\}\\s*\\)`, "i");
+        const match = pattern.exec(formula);
+        if (match)
+            return `${fn}(${match[1]})`;
+    }
+    return undefined;
+}
 /** 编译 formula → editorText：每个 {token} 引用包成 <field-mark>裸token</field-mark>。 */
 export function compileEditorText(formula, editorMark) {
     return formula.replace(/\{([^{}]+)\}/g, (_match, token) => `<${editorMark}>${token.trim()}</${editorMark}>`);
 }
+/** Aggregation functions that consume a whole child column. */
+const CHILD_AGGREGATES = ["SUM", "COUNT", "MAX", "MIN", "AVG", "UNION"];
+/**
+ * Compile `--where "<子列> = <值>"` into the platform's conditional aggregate.
+ *
+ * Shape: `COUNTIF({<child>.<column>}, "<value>")` / `SUMIF({<child>.<column>}, "<value>")`.
+ * Only equality is supported: the platform's aggregator takes a value, not a
+ * predicate, and inventing operator support would silently emit a formula the
+ * engine reads differently.
+ */
+export function compileConditionalAggregate(options) {
+    const source = options.formula.trim();
+    const where = options.where.trim();
+    const requested = (options.aggregate ?? "count").toLowerCase();
+    // The formula must already be a bare child-column reference: `{child.column}`.
+    const reference = /^\{([^{}]+)\}$/.exec(source);
+    if (!reference)
+        throw new Error(`--where 需要 --formula 是单个子表列引用，如 --formula "{<子表code>.<子列code>}"（当前："${source}"）`);
+    const token = reference[1].trim();
+    if (!token.includes("."))
+        throw new Error(`--where 的 --formula 必须是「子表code.子列code」形式（当前："${token}"）`);
+    const columnCode = token.split(".").pop().trim();
+    const condition = /^([^=<>!]+?)\s*=\s*(.+)$/.exec(where);
+    if (!condition)
+        throw new Error(`--where 只支持「<子列code> = <值>」（平台聚合器接受的是值，不是谓词；当前："${where}"）`);
+    const whereColumn = condition[1].trim().split(".").pop().trim();
+    const expected = condition[2].trim().replace(/^["']|["']$/g, "");
+    if (whereColumn !== columnCode)
+        throw new Error(`--where 的列（${whereColumn}）与 --formula 引用列（${columnCode}）不一致；条件聚合只作用于同一列，如 --formula "{items.checkResult}" --where "checkResult = 异常"`);
+    if (requested !== "count" && requested !== "sum")
+        throw new Error(`--aggregate 只支持 count/sum（条件聚合映射为 COUNTIF/SUMIF，当前 "${String(options.aggregate)}"）`);
+    return `${requested === "sum" ? "SUMIF" : "COUNTIF"}({${token}},${JSON.stringify(expected)})`;
+}
 /** 组装 datarule.create 的完整 args（导出供测试直接断言形状）。 */
 export function composeComputeArgs(options) {
     const editorMark = "field-omc0001";
-    const editorText = compileEditorText(options.formula, editorMark);
-    if (!/\{[^{}]+\}/.test(options.formula))
+    // Conditional aggregation REPLACES the formula: the caller describes the
+    // intent ("count where X = Y") and the composer emits the platform's IF form.
+    const effectiveFormula = options.where !== undefined ? compileConditionalAggregate(options) : options.formula;
+    const editorText = compileEditorText(effectiveFormula, editorMark);
+    if (!/\{[^{}]+\}/.test(effectiveFormula))
         throw new Error("--formula 至少含一个字段引用（如 {amount}）；纯常量没有计算规则意义");
     if (editorText.includes("{") || editorText.includes("}"))
         throw new Error("公式内出现嵌套花括号（{{...}}），拼装器暂不支持；请展开为简单引用");
+    // r12: an unfiltered COUNT/SUM over a child column dry-runs clean and then
+    // counts EVERY row. That is occasionally what you want, but "统计子表中满足
+    // 条件的行数" is the common ask, and silently aggregating everything is the
+    // wrong answer written to the platform. Refuse instead of warning: `--apply`
+    // makes this a data defect, not a hint.
+    const unfilteredChild = childAggregateWithoutFilter(effectiveFormula);
+    if (unfilteredChild !== undefined && options.where === undefined && options.allowUnfiltered !== true)
+        throw new Error(`公式 ${unfilteredChild} 对整个子表列聚合，没有任何过滤条件——会把不符合条件的行也算进去。` +
+            `若要「统计满足条件的行数」，用 --where：omc compute --schema ${options.schema} --target ${options.target} ` +
+            `--formula "{<子表code>.<子列code>}" --where "<子列code> = <值>"（编译为 COUNTIF / SUMIF）。` +
+            `确实要无条件聚合时，加 --allow-unfiltered 显式确认。`);
     return {
         schemaCode: options.schema,
         propertyCode: options.target,
         dataRuleType: 2,
-        options: { shortTextStitch: JSON.stringify({ formula: options.formula, editorText, editorMark }) },
+        options: { shortTextStitch: JSON.stringify({ formula: effectiveFormula, editorText, editorMark }) },
         name: options.name ?? `${options.target} 计算规则`,
         ...(options.environment ? { environment: options.environment } : {}),
         dryRun: !options.apply,
@@ -48,7 +115,15 @@ export async function cmdCompute(args) {
     const name = flag("--name");
     const environment = flag("--env") ?? flag("--environment");
     const apply = args.includes("--apply");
-    const usage = "用法：omc compute --schema <模型code> --target <目标字段> --formula \"<公式，{字段} 引用>\" [--name 规则名] [--env 环境] [--apply]\n公式语法：同类字段 {字段code}；子表列 {子表code.子列code}；聚合 SUM({子表.子列})。默认 dry-run，--apply 才写入。";
+    const where = flag("--where");
+    const aggregateFlag = flag("--aggregate");
+    const allowUnfiltered = args.includes("--allow-unfiltered");
+    const usage = [
+        "用法：omc compute --schema <模型code> --target <目标字段> --formula \"<公式，{字段} 引用>\" [--name 规则名] [--env 环境] [--apply]",
+        "条件聚合：--formula \"{<子表code>.<子列code>}\" --where \"<子列code> = <值>\" [--aggregate count|sum]  → 编译为 COUNTIF / SUMIF",
+        "公式语法：同类字段 {字段code}；子表列 {子表code.子列code}；无条件聚合 SUM/COUNT/MAX/MIN/AVG({子表.子列}) 需加 --allow-unfiltered 显式确认。",
+        "默认 dry-run，--apply 才写入。",
+    ].join("\n");
     const invalid = (message) => {
         writeEnvelope(envelope("error", {}, request, { code: "invalid-input", message: `${message}\n${usage}`, retryable: false }));
         return CLI_EXIT_CODES.invalidInput;
@@ -57,7 +132,14 @@ export async function cmdCompute(args) {
         return invalid("--schema/--target/--formula 均必填");
     let createArgs;
     try {
-        createArgs = composeComputeArgs({ schema, target, formula, name, environment, apply });
+        if (aggregateFlag !== undefined && !["count", "sum"].includes(aggregateFlag))
+            return invalid(`--aggregate 只支持 count 或 sum（当前 "${aggregateFlag}"）`);
+        createArgs = composeComputeArgs({
+            schema, target, formula, name, environment, apply,
+            ...(where !== undefined ? { where } : {}),
+            ...(aggregateFlag !== undefined ? { aggregate: aggregateFlag } : {}),
+            ...(allowUnfiltered ? { allowUnfiltered: true } : {}),
+        });
     }
     catch (error) {
         return invalid(error instanceof Error ? error.message : String(error));

package/dist/endpoints.js

@@ -152,6 +152,18 @@ export const ENDPOINTS = {
     workflowValidate: "/api/api/workflow/validate",
     workflowPublish: "/api/api/workflow/publish",
     workflowDelete: "/api/api/workflow/delete",
+    // 发起权限 (who may START the flow). Without a row here — or with a role/
+    // department row the caller is not in — `data.submit`/`data.save+workflowCode`
+    // answers 40009 流程发起权限不足 (WorkflowAspect.validateWorkflowPermission →
+    // WorkflowManagementFacadeImpl.getWorkflowTemplateHeadersBySchemaCode). Endpoints
+    // from WorkflowTemplateController (cloudpivot-engine 8.6.26; live 1.1.25):
+    //   GET  /workflow/list_permission?workflowCode=        → [{id,name,unitType,fullName,corpId,code}]
+    //   POST /workflow/create_permission  body {workflowCode,unitId,unitType,corpId?}
+    //        unitType is the ENUM INDEX on the wire: 1=部门 2=角色 3=用户 (UnitType @JsonValue)
+    //   POST/DELETE /workflow/delete_permission?permissionId=
+    workflowListPermission: "/api/api/workflow/list_permission",
+    workflowCreatePermission: "/api/api/workflow/create_permission",
+    workflowDeletePermission: "/api/api/workflow/delete_permission",
     workflowSearchWorkItems: "/api/api/runtime/workflow/search_workitems",
     workflowGetBizObjectByWfInstanceId: "/api/api/runtime/workflow/getBizObjectByWfInstanceId",
     workflowListInstanceActivity: "/api/api/runtime/workflow/list_workflow_instance_activity",

package/dist/field-families.js

@@ -171,7 +171,7 @@ export const fieldOptionsArg = z
     searchFormula: jsonString().optional().describe("WORK_SHEET / MULT_WORK_SHEET data restriction range JSON"),
     conditions: jsonString().optional().describe("WORK_SHEET / MULT_WORK_SHEET query conditions JSON"),
     optionsSet: optionsSetArg.optional().describe("selection source: custom, dictionary, or businessModel"),
-    formulaConfig: z.string().optional().describe('FORMULA(计算公式)字段 required: nested JSON string. **计算类需求默认不要建本字段类型**，改用普通字段(数值/单行文本)+计算规则(datarule.create dataRuleType 2, 裸 {字段} 引用)。本字段类型用于明确的「计算公式」列。形状 {"resultType":0|2,"resultFormat":""|"percentile","formulaType":"EXPRESSION","expression":"<JSON string {formula,editorText,editorMark}>"}；计算由门户前端执行、API 不回填。'),
+    formulaConfig: z.string().optional().describe('FORMULA(计算公式)字段 required: nested JSON string. **计算类需求默认不要建本字段类型**，改用普通字段(数值/单行文本)+计算规则(datarule.create dataRuleType 2, 裸 {字段} 引用)。本字段类型用于明确的「计算公式」列。形状 {"resultType":0|2,"resultFormat":""|"percentile","formulaType":"EXPRESSION","expression":"<JSON string {formula,editorText,editorMark}>"}；本类型字段由门户前端计算、API 不回填（计算规则 datarule type2 则是服务端回填）。'),
     persistent: z.boolean().optional().describe("FORMULA(100): must be true; persistent=false is outside the evidenced contract"),
     relevanceField: z.string().optional().describe("RELEVANCE_DATA(16) required: local WORK_SHEET field code the reference resolves through"),
     referenceField: z.string().optional().describe("RELEVANCE_DATA(16) required: referenced field code on the related model"),

package/dist/lanes/field-contract.js

@@ -90,9 +90,9 @@ export const FIELD_FORMULA_WIRE = Object.freeze({
     outerOptions: '{"formulaConfig":"<JSON string>","persistent":true[, "format":""|"percentile" — readback-only mirror, fwb §100]}',
     innerConfig: '{"resultType":0|2,"resultFormat":""|"percentile","formulaType":"EXPRESSION","expression":"<JSON string {formula,editorText,editorMark}>"}',
     expressionFormula: '<fieldCode> placeholders, e.g. {omc_a} + {omc_b}',
-    aggregationConfig: 'AGGREGATION nested {schemaCode,dataItemCode,calculateType,formula,queryConditions} = 表单「计算」控件的「聚合计算」(UI 实测 2026-10-07：跨模型聚合，求和/最大/最小/…). FormulaProcessor.executeMainAggregation 用 queryConditions 查该 schema、对匹配行的 dataItemCode 求值 formula. shape-validated & allowed. **计算类需求默认不用 FORMULA 字段**：子表求和回主表、子表列同行运算一律「普通字段 + 计算规则」（`datarule.create` dataRuleType:2，recipes `field-compute-subtable-sum` / `field-compute-child-column`，前台真机算得 7.00/350）；FORMULA 字段仅作已存量读取。计算由**门户前端**执行、API 不回填（写测试数据带预算值；正确性人工前台确认）。',
+    aggregationConfig: 'AGGREGATION nested {schemaCode,dataItemCode,calculateType,formula,queryConditions} = 表单「计算」控件的「聚合计算」(UI 实测 2026-10-07：跨模型聚合，求和/最大/最小/…). FormulaProcessor.executeMainAggregation 用 queryConditions 查该 schema、对匹配行的 dataItemCode 求值 formula. shape-validated & allowed. **计算类需求默认不用 FORMULA 字段**：子表求和回主表、子表列同行运算一律「普通字段 + 计算规则」（`datarule.create` dataRuleType:2，recipes `field-compute-subtable-sum` / `field-compute-child-column`，前台真机算得 7.00/350）；FORMULA 字段仅作已存量读取。计算规则（`datarule.create` dataRuleType:2）**由服务端在 data.submit/data.update 时计算并回填，且覆盖传入值**（真机 1.1.25 复核 2026-10-24）；本 FORMULA 类型字段才是仅前端计算、API 不回填。',
     legacyRejected: "resultType/expression top-level keys are not read by the platform and are refused",
-    runtimeVerification: "FORMULA 字段视为「配置好即在前台会算」：计算由门户**前端**执行，API save/update/submit 不回填/重算（真机 2026-09-25/2026-10-07）。写测试数据时显式带上预算好的计算值；**公式正确性由人工在前台（配表单→填表）确认**，不要用 API 回读断言。带子表计算字段的模型 API data.save/update 可能 50000（服务端重算 NPE），前台正常。",
+    runtimeVerification: "本 FORMULA(100) 字段类型：计算由门户**前端**执行，API save/update/submit 不回填/重算（真机 2026-09-25/2026-10-07，仅覆盖该字段类型）。**不要**把这条套到字段计算规则（datarule dataRuleType:2）上——后者由服务端在 data.submit/data.update 时计算并回填，且覆盖传入值（真机 1.1.25 复核 2026-10-24，含删除规则后传入值生效的对照组）。带子表计算字段的模型 API data.save/update 可能 50000（服务端重算 NPE），前台正常。",
 });
 /** RELEVANCE_DATA(16) options wire (8.6.26 RelevanceDataOptions + admin field serializer). */
 export const FIELD_RELEVANCE_WIRE = Object.freeze({

package/dist/lanes/model.js

@@ -364,7 +364,11 @@ export function registerModelLane(tools) {
                     blocker: "model-create-duplicate-orphan",
                     schemaCode: args.code,
                     applicationCode: args.applicationCode ?? null,
-                    message: `模型 ${args.code} 在册（bizmodels/get_all 可读）但不在应用树中——疑似挂载孤儿（h_app_function.parentId 无效）。请修 parentId 为目录行 id，不要 create；否则会再建一条孤儿`,
+                    nextCommand: `omc call model.delete --env <env> --args '{"schemaCode":"${args.code}"}'`,
+                    message: `模型 ${args.code} 在册（bizmodels/get_all 可读）但不在应用树中。**先跑一次 model.delete**——它现在会把两种成因分开：` +
+                        `① 读缓存滞后（记录其实已删）→ 回 already-absent/stale-record-cache，随后可直接 create；` +
+                        `② 真孤儿（删除级联中断留下的残骸）→ 回 model-orphaned-record 并给平台侧出路（回收站物理删除 / 换 code），因为 8.6 平台无法删除没有 AppFunction 行的业务模型。` +
+                        `不要重复 create（会再造一条孤儿），也不要只信这一条拒绝信息。`,
                 });
             }
         }
@@ -500,11 +504,51 @@ export function registerModelLane(tools) {
         if (!node) {
             if (record === null)
                 return { performed: { skipped: "already-absent" }, readback: { absent: true } };
+            // r12 (2026-10-24): "record readable but no tree node" has TWO causes and
+            // the caller could not tell them apart — create said "go fix parentId",
+            // model.move said "there is no node", model.delete said "no node means
+            // no delete": a closed loop with no exit.
+            //
+            // Cause A: a stale read face. `bizmodels/get_all` is served through a
+            // cache, so a record already removed by a previous delete (or by an
+            // interrupted cascade) keeps answering for a while. Re-read after a
+            // short wait before declaring anything.
+            // ~7s total: long enough to clear a warm read cache, short enough that
+            // a genuine orphan is reported without a long stall. Tests can shrink it
+            // with OMC_MODEL_ORPHAN_RECHECK_MS.
+            const recheckDelay = Number(process.env.OMC_MODEL_ORPHAN_RECHECK_MS ?? 1000);
+            let stillPresent = record;
+            for (let attempt = 0; attempt < 4 && stillPresent !== null; attempt += 1) {
+                await new Promise((resolve) => setTimeout(resolve, Number.isFinite(recheckDelay) ? recheckDelay : 1000));
+                stillPresent = await readRecord();
+            }
+            if (stillPresent === null) {
+                return {
+                    performed: { skipped: "stale-record-cache" },
+                    readback: {
+                        absent: true,
+                        note: "业务模型记录读取面（bizmodels/get_all）先前仍返回该 code，复查后已消失——这是读缓存滞后的残留，模型实际已删除。若刚跑过 model.create 又被拒「已在册」，现在可以重试。",
+                    },
+                };
+            }
+            // Cause B: a genuine orphan. The platform has no path: physically_delete
+            // resolves the id through AppFunction and `removeBizModel` throws
+            // APP_FUNCTION_MODEL_NOTEXIST when the row is gone
+            // (AppIntegrationFacadeImpl:1905-1910), so no id can satisfy it.
             throw new ToolRefusalError({
                 status: "refused",
-                blocker: "model-application-unresolved",
+                blocker: "model-orphaned-record",
                 schemaCode: args.schemaCode,
-                message: `${args.schemaCode} 的业务模型记录仍存在，但在任何应用树中都找不到它的节点（AppFunction）——不能删：physically_delete 需要 AppFunction id，传入业务模型记录 id 会被平台以 601003 业务模型不存在拒绝（不猜测 id）。请显式传 applicationCode（模型所属应用），或用 discover_environment 确认该模型的归属应用后再删。`,
+                retryable: false,
+                platformLimitation: "removeBizModel(AppIntegrationFacadeImpl:1905) 先 getAppFunction(id)，找不到即抛 APP_FUNCTION_MODEL_NOTEXIST——没有 AppFunction 行的业务模型记录在 8.6 平台上无法通过 physically_delete 删除。",
+                message: `${args.schemaCode} 的业务模型记录仍在（bizmodels/get_all 持续返回），但应用树里没有它的节点（AppFunction）。` +
+                    `**这是平台侧的不可删状态**：physically_delete 用 AppFunction id 定位，而平台 removeBizModel 找不到 AppFunction 行时抛 APP_FUNCTION_MODEL_NOTEXIST——本工具不猜测 id（传业务记录 id 只会得到 601003 业务模型不存在），因此无法通过 physically_delete 删除。` +
+                    `已连续复查 4 次、间隔约 1s，记录仍在，因此不是读缓存滞后。` +
+                    `已知成因：删除级联被中断（逐列异步 40-60s，中途失败会留下「记录在、节点没了」的残骸）。` +
+                    `可行出路（按代价排序）：① 用平台「回收站 → 物理删除」清理该残留（apppackage/physically_deleteAll 同一路径）；` +
+                    `② 换一个未占用的 schema code 继续（r11/r12 探针均采用此法）；` +
+                    `③ 若你有平台数据库权限，删除 h_biz_schema/h_biz_property/h_biz_sheet 对应行并重启 launcher 清缓存——但这是维护者操作，不在工具权限内。` +
+                    `**不要再重复调用 model.delete / model.move / model.create**：三方都会给出同样的答复。`,
             });
         }
         const targetId = node.id;

package/dist/lanes/rule-graph.js

@@ -1237,7 +1237,7 @@ export function validateDataAction(action, nodeCode, index) {
                 code: "rule-graph-aggregation-is-a-field-feature",
                 nodeCode,
                 key: `dataActions[${index}].ruleValueType`,
-                message: `${nodeCode}: 规则节点不支持 AGGREGATION 赋值——平台会存进去并启用，但运行期聚合结果是集合（ArrayList），标量目标收到集合即 50000「服务异常」（DecimalBizField.fillClientContent）。**子表计数/求和/取最值回主表用字段计算规则**：目标字段建成普通数值字段，然后 \`omc compute --schema <主表> --target <目标字段> --formula 'COUNTIF({<子表code>.<子列code>},"异常")'\`（默认 dry-run，--apply 写入；等价 datarule.create dataRuleType:2，配方 \`field-compute-subtable-sum\`）。规则图里只做 FIXED/DYNAMIC/EXPRESSION 的直接赋值。注意计算由门户前端执行、API data.load 不回填（平台既有行为，见 FIELD_FORMULA_WIRE.runtimeVerification）：要 API 侧断言结果，请在测试数据里显式写预算值，不要用回读判定公式对错。来源：r11 巡检沙盒 2026-10-24（1.1.25）。`,
+                message: `${nodeCode}: 规则节点不支持 AGGREGATION 赋值——平台会存进去并启用，但运行期聚合结果是集合（ArrayList），标量目标收到集合即 50000「服务异常」（DecimalBizField.fillClientContent）。**子表计数/求和/取最值回主表用字段计算规则**：目标字段建成普通数值字段，然后 \`omc compute --schema <主表> --target <目标字段> --formula 'COUNTIF({<子表code>.<子列code>},"异常")'\`（默认 dry-run，--apply 写入；等价 datarule.create dataRuleType:2，配方 \`field-compute-subtable-sum\`）。规则图里只做 FIXED/DYNAMIC/EXPRESSION 的直接赋值。该计算规则由**服务端**在 data.submit/data.update 时计算并回填（真机 1.1.25 复核），写完可直接 data.load 断言结果；注意它会**覆盖**你传入的同名字段值。来源：r11 巡检沙盒 2026-10-24（1.1.25）。`,
             }];
     if (!RULE_VALUE_TYPES.includes(valueType))
         blockers.push({ code: "rule-graph-action-value-type", nodeCode, key: "ruleValueType", message: `${where}: ruleValueType "${valueType}" 不在 ${RULE_VALUE_TYPES.join("/")}` });

package/dist/lanes/runtime-data.js

@@ -699,7 +699,7 @@ export function registerRuntimeDataLane(tools) {
                     ...(replayToken ? { replayToken } : {}),
                     bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
                 },
-            }), formData);
+            }), formData, args.workflowCode);
             const vo = (performed.data ?? {});
             const returnedId = typeof vo.objectId === "string" && vo.objectId ? vo.objectId : typeof vo.bizObjectId === "string" && vo.bizObjectId ? vo.bizObjectId : objectId;
             const workflowInstanceId = typeof vo.workflowInstanceId === "string" ? vo.workflowInstanceId : null;
@@ -1087,7 +1087,7 @@ export function registerRuntimeDataLane(tools) {
             path: ENDPOINTS.runtimeFormSubmit,
             method: "POST",
             body: payload,
-        }));
+        }), undefined, hasWorkflowCode ? explicitWorkflowCode : undefined);
         const performedData = (performed.data ?? {});
         let readback = { formType };
         if (formType === "2") {

package/dist/lanes/workflow-contract.js

@@ -174,6 +174,18 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
             scope: WORKFLOW_SCOPE,
             description: "删除工作流模板（`/api/api/workflow/delete`），回读确认缺失。",
         }),
+        "workflow.permissions": Object.freeze({
+            scope: "workflow start permission (who may originate)",
+            description: "列出谁能发起该流程（`GET /api/api/workflow/list_permission?workflowCode=` → {id,name,unitType,fullName,corpId,code}；1=部门 2=角色 3=用户）。**`data.submit` 报 40009 时先看这里**：PART_VISIABLE 且本表无命中行 ⇒ 除平台管理员（`h_perm_admin` 的 ADMIN/SYS_MNG，非登录 isAdmin）外无人能发起；发布流程不会自动建这一行。",
+        }),
+        "workflow.addPermission": Object.freeze({
+            scope: "workflow start permission (who may originate)",
+            description: "授予发起权限（`POST /api/api/workflow/create_permission`，body `{workflowCode,unitId,unitType,corpId}`；unitType 取枚举序号 1=部门 2=角色 3=用户）。unitId 用 org.department.list / org.role.list / org.user.search 取。重复授予按 402003 幂等跳过，写后回读确认。",
+        }),
+        "workflow.removePermission": Object.freeze({
+            scope: "workflow start permission (who may originate)",
+            description: "撤销发起权限（`POST /api/api/workflow/delete_permission?permissionId=`）。首选传 `permissionId`（`workflow.permissions` 的 id）；也可传 `workflowCode`+`unitId`+`unitType`，工具解析该主体的显示名后匹配（`list_permission` 不回 unitId）。缺失即幂等成功。",
+        }),
         "workflow.validate": Object.freeze({
             scope: WORKFLOW_SCOPE,
             description: "只读预检（`POST /api/api/workflow/validate`）：合成草稿模板（或可选 `template` 按 merge 语义）后返回 ValidateMessage[]，拆出 errors/warnings，`valid = 无 ERROR`。用于 publish 前先看平台会不会拒——平台对 publish 常回 errcode:0 但 ValidateMessage[] 里带 ERROR，本工具把它显式暴露，避免「publish 看似成功却没落库」。不写任何状态。",
@@ -223,6 +235,9 @@ export function assertWorkflowContract() {
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.publish", ["workflow/publish", "template"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.setButtons", ["buttonPermission", "customBtns", "childTableBtns", "formButtonCodes", "form-button-absent", "publish:false"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.bindRule", ["startEventHandler", "cancelEventHandler", "activateEventHandler", "endEventHandler", "bizActions", "bizActionType", "BIZ_RULE", "publish:false", "enabledRuleCodes", "workflow-bind-rule-absent", "activityCode", "nodeEvent", "endActivity", "activityApproved"]);
+    assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.permissions", ["list_permission", "40009", "PART_VISIABLE"]);
+    assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.addPermission", ["create_permission", "unitType", "unitId"]);
+    assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.removePermission", ["delete_permission", "permissionId"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.role.list", ["organization/role/list", "type", "Originator"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.department.list", ["organization/department/tree", "parentId"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.user.search", ["organization/user/search", "wd", "type 3"]);

package/dist/lanes/workflow-coverage.js

@@ -18,6 +18,9 @@ export const WORKFLOW_COVERAGE = declareLaneCoverage(WORKFLOW_LANE_CONTRACT.lane
             claim("workflow.bindRule", T["workflow.bindRule"].scope),
             claim("workflow.setButtons", T["workflow.setButtons"].scope),
             claim("workflow.delete", T["workflow.delete"].scope),
+            claim("workflow.permissions", T["workflow.permissions"].scope),
+            claim("workflow.addPermission", T["workflow.addPermission"].scope),
+            claim("workflow.removePermission", T["workflow.removePermission"].scope),
             claim("configure_workflow", T["configure_workflow"].scope),
             claim("workflow.validate", T["workflow.validate"].scope),
             // Organization writes (role group / role / members / management scope).

package/dist/lanes/workflow.js

@@ -2724,6 +2724,194 @@ export function registerWorkflowLane(tools) {
             };
         }),
     }));
+    // ── 发起权限 (who may originate) ────────────────────────────────────────────
+    //
+    // 40009 流程发起权限不足 is the single most opaque refusal on this platform:
+    // `data.submit` (and `data.save` with workflowCode) answers it, the message
+    // names no permission, and there is no CLI face to inspect or grant one. r11
+    // (2026-10-24) burned 7 submit attempts and could not deliver the whole
+    // workflow section; the platform source shows the check is concrete:
+    // `WorkflowAspect.validateWorkflowPermission` → template header must exist and
+    // be published → `getWorkflowTemplateHeadersBySchemaCode(userId, schemaCode)`:
+    //   • the user's root department must resolve (`getAllParentIds` non-empty),
+    //   • `visibleType=ALL_VISIABLE` templates are open to everyone,
+    //   • otherwise a `h_workflow_permission` row must match the user, their
+    //     department (or any ancestor), or one of their roles,
+    //   • platform admins (`h_perm_admin` ADMIN/SYS_MNG) bypass all of it.
+    // Publishing a flow creates NO permission row, so a freshly published flow is
+    // unusable by anyone who is not a platform admin.
+    const permissionRows = async (session, workflowCode) => wireRows((await wireCall(session, { path: ENDPOINTS.workflowListPermission, query: { workflowCode } })).data);
+    // `list_permission` echoes the PERMISSION row id plus the unit's display name
+    // and code — never the unitId (WorkflowTemplateController.getPermissionMap).
+    // So identity for readback/removal is resolved from the unit's own face.
+    const unitIdentity = async (session, unitType, unitId) => {
+        try {
+            if (unitType === 1) {
+                const row = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentGet, query: { deptId: unitId } })).data;
+                return { name: row ? String(row.name ?? "") || null : null, code: row ? (String(row.code ?? "") || null) : null };
+            }
+            if (unitType === 2) {
+                const rows = wireRows((await wireCall(session, { path: ENDPOINTS.organizationRoleList, query: { expandAll: "true" } })).data);
+                const walk = (entries) => {
+                    for (const entry of entries) {
+                        if (String(entry.id ?? "") === unitId)
+                            return entry;
+                        const children = Array.isArray(entry.children) ? entry.children : [];
+                        const hit = walk(children);
+                        if (hit)
+                            return hit;
+                    }
+                    return undefined;
+                };
+                const hit = walk(rows);
+                return { name: hit ? String(hit.name ?? "") || null : null, code: hit ? (String(hit.code ?? "") || null) : null };
+            }
+            const row = (await wireCall(session, { path: ENDPOINTS.organizationUserInfo, query: { id: unitId } })).data;
+            return { name: row ? String(row.name ?? "") || null : null, code: row ? (String(row.username ?? "") || null) : null };
+        }
+        catch {
+            return { name: null, code: null };
+        }
+    };
+    tools.push(defineTool({
+        name: "workflow.permissions",
+        layer: "low",
+        kind: "read",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.permissions"].scope,
+        description: WORKFLOW_TOOLS["workflow.permissions"].description,
+        inputSchema: {
+            environment: environmentArg,
+            workflowCode: z.string().optional().describe("流程 code；省略则用 schemaCode 解析"),
+            schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型的流程"),
+            capability: capabilityArg,
+        },
+        handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
+            const workflowCode = await resolveWorkflowArg(session, args);
+            if (!workflowCode)
+                return { schemaCode: args.schemaCode, exists: false, permissions: [], note: "该模型没有流程" };
+            const rows = await permissionRows(session, workflowCode);
+            const permissions = rows.map((row) => ({
+                id: row.id ?? null,
+                name: row.name ?? null,
+                unitType: row.unitType ?? null,
+                unitTypeName: row.unitType === 1 || row.unitType === "1" ? "部门" : row.unitType === 2 || row.unitType === "2" ? "角色" : row.unitType === 3 || row.unitType === "3" ? "用户" : null,
+                fullName: row.fullName ?? null,
+                corpId: row.corpId ?? null,
+                code: row.code ?? null,
+            }));
+            return {
+                workflowCode,
+                count: permissions.length,
+                permissions,
+                ...(permissions.length === 0
+                    ? {
+                        blocker: "workflow-start-permission-empty",
+                        note: "该流程没有任何发起权限行：除平台管理员（h_perm_admin 里 ADMIN/SYS_MNG）外**没有人能发起**，data.submit 会回 40009「流程发起权限不足」。发布流程不会自动建这一行，用 workflow.addPermission 授给部门/角色/用户（或把模板 visibleType 改成 ALL_VISIABLE）。",
+                        nextCommand: `omc call workflow.addPermission --env <env> --args '{"workflowCode":"${workflowCode}","unitId":"<部门|角色|用户 id>","unitType":1}'`,
+                    }
+                    : {}),
+            };
+        }),
+    }));
+    writeTool(tools, "workflow.addPermission", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.addPermission"].scope, WORKFLOW_TOOLS["workflow.addPermission"].description, {
+        workflowCode: z.string().optional().describe("流程 code；省略则用 schemaCode 解析"),
+        schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型的流程"),
+        unitId: z.string().min(1).describe("部门 id / 角色 id / 用户 id（看 unitType）"),
+        unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).describe("1=部门 2=角色 3=用户；也接受 DEPARTMENT/ROLE/USER"),
+        corpId: z.string().optional().describe("企业 id；省略则用当前会话企业"),
+    }, async (session, args) => {
+        const workflowCode = await resolveWorkflowArg(session, args);
+        if (!workflowCode)
+            throw new ToolRefusalError({ status: "refused", blocker: "workflow-not-found", message: `模型 ${String(args.schemaCode ?? "")} 没有流程；先 workflow.create` });
+        const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
+        // Idempotent retry: the platform answers 402003 WORKFLOW_PERMISSION_EXIST
+        // for a duplicate unitId, which would read as a failure. `list_permission`
+        // does NOT echo unitId (only id/name/unitType/fullName/code), so identity
+        // is decided by the platform's own refusal rather than a guessed pre-read.
+        const before = await permissionRows(session, workflowCode);
+        try {
+            // Send the unit's own name/code too: `list_permission` reads them back
+            // (it echoes `name`/`code`), which is the only way `workflow.permissions`
+            // can describe a row by more than its opaque permission id.
+            const identity = await unitIdentity(session, unitType, args.unitId);
+            await wireCall(session, {
+                path: ENDPOINTS.workflowCreatePermission,
+                method: "POST",
+                body: {
+                    workflowCode,
+                    unitId: args.unitId,
+                    unitType,
+                    corpId: args.corpId ?? session.enterpriseId(),
+                    ...(identity.name ? { name: identity.name } : {}),
+                    ...(identity.code ? { code: identity.code } : {}),
+                },
+            });
+        }
+        catch (error) {
+            const errcode = error.details?.errcode ?? error.errcode;
+            if (String(errcode ?? "") !== "402003")
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-permission-write-failed",
+                    workflowCode,
+                    unitId: args.unitId,
+                    unitType,
+                    message: `create_permission 被平台拒绝（err=${String(errcode ?? "n/a")}）。核对 unitId 是否真实存在（部门用 org.department.list、角色用 org.role.list、用户用 org.user.search），以及发起权限是否被企业策略禁用。原始错误：${error instanceof Error ? error.message : String(error)}`,
+                });
+            return {
+                performed: { skipped: "already-present" },
+                readback: { workflowCode, alreadyPresent: true, unitId: args.unitId, unitType, count: before.length, note: "该主体已有发起权限（平台 402003），未重复写入" },
+            };
+        }
+        const after = await permissionRows(session, workflowCode);
+        const created = after.find((row) => !before.some((old) => String(old.id ?? "") === String(row.id ?? ""))) ?? after[after.length - 1];
+        return {
+            performed: { errcode: 0 },
+            readback: {
+                workflowCode,
+                count: after.length,
+                permissionId: created?.id ?? null,
+                unitType: created?.unitType ?? unitType,
+                name: created?.name ?? null,
+                note: "发起权限已授予。若之前 data.submit 回 40009，现在应可发起；仍失败先 workflow.permissions 确认行存在，并核对发起人所属部门/角色。",
+            },
+        };
+    });
+    writeTool(tools, "workflow.removePermission", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.removePermission"].scope, WORKFLOW_TOOLS["workflow.removePermission"].description, {
+        permissionId: z.string().min(1).optional().describe("首选：workflow.permissions 返回的 id（唯一确定）"),
+        workflowCode: z.string().optional().describe("配合 unitId+unitType 使用（平台的 list_permission 不回 unitId，需按显示名解析）"),
+        unitId: z.string().min(1).optional().describe("部门/角色/用户 id；按 unitType 解析显示名后匹配权限行"),
+        unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).optional().describe("unitId 的类型：1=部门 2=角色 3=用户"),
+        schemaCode: z.string().optional(),
+    }, async (session, args) => {
+        let permissionId = args.permissionId;
+        if (!permissionId) {
+            const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode });
+            if (!workflowCode || !args.unitId || args.unitType === undefined)
+                throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "workflow.removePermission", message: "需要 permissionId（推荐），或 workflowCode（/schemaCode）+ unitId + unitType" });
+            const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
+            const identity = await unitIdentity(session, unitType, args.unitId);
+            const rows = await permissionRows(session, workflowCode);
+            const wantedType = String(unitType);
+            const hit = rows.find((row) => String(row.unitType ?? "") === wantedType && (String(row.id ?? "") === args.unitId ||
+                (identity.name !== null && String(row.name ?? "") === identity.name) ||
+                (identity.code !== null && String(row.code ?? "") === identity.code)));
+            if (!hit)
+                return {
+                    performed: { skipped: "absent" },
+                    readback: {
+                        workflowCode,
+                        removed: false,
+                        note: `没有匹配该主体的权限行（幂等）。注意 list_permission 不回 unitId，匹配靠解析出的显示名「${identity.name ?? "?"}」；不确定时用 workflow.permissions 拿 id 再按 permissionId 删。`,
+                        permissions: rows.map((row) => ({ id: row.id ?? null, name: row.name ?? null, unitType: row.unitType ?? null })),
+                    },
+                };
+            permissionId = String(hit.id ?? "");
+        }
+        await wireCall(session, { path: ENDPOINTS.workflowDeletePermission, method: "POST", query: { permissionId } });
+        return { performed: { errcode: 0 }, readback: { permissionId, removed: true } };
+    });
     tools.push(defineTool({
         name: "org.role.list",
         layer: "low",

package/dist/recipes/datarule.js

@@ -54,7 +54,7 @@ const dataruleCalcRule = Object.freeze({
         },
         name: "c=a+b",
     },
-    preconditions: ["**拼装器优先**：简单表达式/子表聚合一条 `omc compute --schema <s> --target <f> --formula '{a}*0.4+{b}*0.3'` 直接编译（默认 dry-run，--apply 写入），本配方仅用于条件分支等复杂场景。",
+    preconditions: ["**拼装器优先**：简单表达式用 `omc compute --formula '{a}*0.4+{b}*0.3'`；**条件聚合**用 `omc compute --formula '{<子表>.<子列>}' --where '<子列> = <值>'`（自动编译 COUNTIF/SUMIF）——两者都默认 dry-run、`--apply` 写入。本配方仅用于拼装器表达不了的条件分支等复杂场景。",
         "**计算类需求：建普通业务字段（数值优先，文本亦可）+ 本计算规则；不要用「计算公式」字段类型（FORMULA）**——平台约定是普通字段顺带配计算规则（真机 2026-10-08 复核：普通数值字段 + type2 计算规则，门户算出 7.00，设计器「计算规则」弹窗显示公式）。",
         "参与计算的字段已发布",
     ],
@@ -95,7 +95,7 @@ const dataruleSubtableSum = Object.freeze({
         },
         name: "合计=明细金额之和",
     },
-    preconditions: ["**拼装器优先**：简单表达式/子表聚合一条 `omc compute --schema <s> --target <f> --formula '{a}*0.4+{b}*0.3'` 直接编译（默认 dry-run，--apply 写入），本配方仅用于条件分支等复杂场景。",
+    preconditions: ["**拼装器优先**：简单表达式用 `omc compute --formula '{a}*0.4+{b}*0.3'`；**条件聚合**用 `omc compute --formula '{<子表>.<子列>}' --where '<子列> = <值>'`（自动编译 COUNTIF/SUMIF）——两者都默认 dry-run、`--apply` 写入。本配方仅用于拼装器表达不了的条件分支等复杂场景。",
         "**目标 `total` 是普通数值字段（不是「计算公式」字段）**；`<childSchemaCode>` 是子表字段的 code（如 `prop_repair_detail` / `Sub_item_information_table`），`amount` 是其子列 code",
         "子表与其列已发布",
     ],
@@ -131,7 +131,7 @@ const dataruleChildColumn = Object.freeze({
         },
         name: "金额=数量×单价",
     },
-    preconditions: ["**拼装器优先**：简单表达式/子表聚合一条 `omc compute --schema <s> --target <f> --formula '{a}*0.4+{b}*0.3'` 直接编译（默认 dry-run，--apply 写入），本配方仅用于条件分支等复杂场景。",
+    preconditions: ["**拼装器优先**：简单表达式用 `omc compute --formula '{a}*0.4+{b}*0.3'`；**条件聚合**用 `omc compute --formula '{<子表>.<子列>}' --where '<子列> = <值>'`（自动编译 COUNTIF/SUMIF）——两者都默认 dry-run、`--apply` 写入。本配方仅用于拼装器表达不了的条件分支等复杂场景。",
         "**子表列 `amount` 是普通数值字段（不是「计算公式」字段）**，且是子表内的列（schemaCode=子表字段 code）"],
     conditionalRequirements: [
         "**子表内列引用用 `{子表schemaCode.子列code}` 点号全限定**（真机 2026-10-08 设计器产出：`{prop_repair_detail.qty}*{prop_repair_detail.unit_price}`）；不要写裸 `{qty}`。",

package/dist/runtime-support.js

@@ -54,11 +54,17 @@ export async function mapUnpublishedAppFailure(session, schemaCode, errcode, roo
  * unpublished-app failure. Used by data.save/data.submit (errcode 50000) and
  * datarule.create type2 (errcode 305003) so the try/catch wiring lives once.
  */
-export async function runtimeWriteWithAppMapping(session, schemaCode, errcode, rootCause, call, formData) {
+export async function runtimeWriteWithAppMapping(session, schemaCode, errcode, rootCause, call, formData, workflowCode) {
     try {
         return await call();
     }
     catch (error) {
+        // 40009 is diagnosed FIRST: it names a cause the app/relation mappings
+        // cannot see, and it is the one refusal whose fix is a concrete next
+        // command (r11: seven blind submit attempts). Guarded by the errcode so
+        // every other failure keeps its existing mapping.
+        if (error instanceof WireError && error.kind === "business" && error.errcode === 40009)
+            await diagnoseWorkflowStartPermission(session, schemaCode, workflowCode, error);
         let mapped;
         try {
             mapped = await mapUnpublishedAppFailure(session, schemaCode, errcode, rootCause, error);
@@ -131,4 +137,89 @@ export async function diagnoseRelationShapeFailure(session, schemaCode, errcode,
         message: `errcode ${errcode}——根因：单选关联字段 ${culprits.join(", ")} 传了数组（WORK_SHEET/propertyType 9 只接受 id 字符串或 {id}；数组会稳定 ${errcode}）。多选关联（11）与人员/组织（50/51）才用数组`,
     });
 }
+/**
+ * 40009 流程发起权限不足 — the most opaque refusal on this platform.
+ *
+ * r11 (2026-10-24, 1.1.25) could not deliver an entire workflow section: seven
+ * `data.submit` attempts all answered the same two words, and neither the
+ * message nor any CLI face said WHY. The platform source
+ * (`WorkflowAspect.validateWorkflowPermission` →
+ * `WorkflowManagementFacadeImpl.getWorkflowTemplateHeadersBySchemaCode`) shows
+ * three independent causes, all of which produce the identical code:
+ *
+ *   1. `h_workflow_template` header missing / not published;
+ *   2. the caller's root department does not resolve (`getAllParentIds` empty →
+ *      the allowed-template list is short-circuited to EMPTY, so a user whose
+ *      department row was deleted/moved can never start anything);
+ *   3. no `h_workflow_permission` row matching the user, their department (or an
+ *      ancestor), or one of their roles — and `visibleType != ALL_VISIABLE`.
+ *      Publishing a flow creates NO permission row, so a freshly published flow
+ *      is unusable by everyone except a `h_perm_admin` ADMIN/SYS_MNG.
+ *
+ * The diagnosis here reads only the cheap, authoritative faces (permission list
+ * + header presence) and names the recovery command instead of leaving the
+ * caller to guess. Anything that fails is swallowed: a diagnosis must never
+ * replace the original refusal.
+ */
+export async function diagnoseWorkflowStartPermission(session, schemaCode, workflowCode, error) {
+    if (!(error instanceof WireError && error.kind === "business" && error.errcode === 40009))
+        throw error;
+    const resolvedCode = workflowCode ?? (await resolvePublishedWorkflowCodeQuiet(session, schemaCode));
+    if (!resolvedCode)
+        throw error;
+    let permissions = [];
+    let headerPresent = true;
+    try {
+        headerPresent = (await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: resolvedCode } })).data != null;
+    }
+    catch {
+        headerPresent = true;
+    }
+    try {
+        permissions = wireRows((await wireCall(session, { path: ENDPOINTS.workflowListPermission, query: { workflowCode: resolvedCode } })).data);
+    }
+    catch {
+        permissions = [];
+    }
+    const headerHint = headerPresent ? "" : ` 流程头 ${resolvedCode} 不存在或未发布（先 workflow.publish）。`;
+    const message = permissions.length === 0
+        ? `流程 ${resolvedCode} 没有任何发起权限行。§ 发布流程不会自动建发起权限§：` +
+            `除平台管理员（平台 h_perm_admin 里的 ADMIN/SYS_MNG，注意这与登录接口返回的 isAdmin 不是一回事）外，任何人都无法发起，` +
+            `data.submit / data.save+workflowCode 一律回 40009。${headerHint}` +
+            ` 修复：把发起权限授给一个部门/角色/用户 —— ` +
+            `omc call workflow.addPermission --env <env> --args '{"workflowCode":"${resolvedCode}","unitId":"<org.department.list|org.role.list|org.user.search 的 id>","unitType":1}'` +
+            `（1=部门 2=角色 3=用户；同一行也可用 workflow.permissions 复核）。` +
+            `另一种原因同样报 40009 且无法从权限行看出来：发起人所属部门记录已被删除/移动（平台 getRootDeptId 解析为空时直接短路成"无任何可发起模板"）——` +
+            `用 org.user.search 看自己的 departmentId，再用 org.department.list 确认该部门仍在。`
+        : `流程 ${resolvedCode} 已有 ${permissions.length} 条发起权限行（${permissions.map((row) => `${String(row.name ?? row.code ?? "?")}/unitType=${String(row.unitType ?? "?")}`).join("、")}），` +
+            `但当前调用者不在其中。${headerHint}` +
+            ` 核对顺序：① 发起人的 departmentId（org.user.search）是否等于某条 unitType=1 的部门，或是其祖先链上的一级；` +
+            `② 发起人是否属于某条 unitType=2 的角色（org.role.users）；③ 是否该 unitType=3 的用户本人；` +
+            `④ 若部门记录已被删除/移动，平台会把可发起列表短路成空——同样报 40009，但与权限行无关。` +
+            ` 补授权：omc call workflow.addPermission --env <env> --args '{"workflowCode":"${resolvedCode}","unitId":"<id>","unitType":1}'；查看现状用 omc call workflow.permissions。`;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "workflow-start-permission-denied",
+        schemaCode,
+        workflowCode: resolvedCode,
+        errcode: 40009,
+        permissionCount: permissions.length,
+        permissions,
+        message,
+    });
+}
+/** The published workflow code for a schema, or undefined (never throws). */
+async function resolvePublishedWorkflowCodeQuiet(session, schemaCode) {
+    try {
+        const isWorkflow = (await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode } })).data === true;
+        if (!isWorkflow)
+            return undefined;
+        const template = (await wireCall(session, { path: ENDPOINTS.workflowGetBySchema, query: { schemaCode } })).data;
+        const code = template && typeof template.workflowCode === "string" && template.workflowCode.length > 0 ? template.workflowCode : null;
+        return code ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=runtime-support.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.81",
+  "version": "0.4.83",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.81",
+    "@stalfh233/omc-fake-platform": "0.4.83",
     "commander": "14.0.3",
-    "omc-core": "0.4.81",
+    "omc-core": "0.4.83",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-capabilities.md

@@ -91,8 +91,8 @@ only the section for the capability you need —
 - **边界 / 陷阱**：
   - **计算类需求默认走「普通字段 + 计算规则」，不要建「计算公式」字段类型（FORMULA）**：建一个**数值/单行文本**业务字段，再配一条**字段级计算规则**（`datarule.create` `dataRuleType:2`，`options.shortTextStitch={"formula","editorText","editorMark"}`）。理由：平台约定用正常业务字段承载、顺带配计算规则（真机 2026-10-08 production 表单核验 + 设计器弹窗显示）。「计算公式」字段类型不是默认，仅当确需一列专用公式时才用。
   - **计算规则公式引用**：同类字段裸 `{字段code}`（`{a}+{b}`）；**子表列用 `{子表字段code.子列code}`**（`{Sub_item_information_table.taxInclusiveAmount}`）；子表求和 `SUM({子表.子列})`；支持 `IF(cond,a,b)`、`CASE(v,c1,r1,c2,r2)`、`VALUE()`、`AND`、比较 `=`、字符串字面量与运算符空格。recipe：`omc describe datarule.create --example field-compute-rule|field-compute-subtable-sum|field-compute-child-column`。
-  - 计算由**门户前端**执行，API（`data.save/update`）不回填/重算——写测试数据带预算值，正确性人工前台确认。（FORMULA 字段类型仍受支持，但非默认。）
-  - 计算由**门户前端**执行，API（`data.save/update`）不回填/重算——写测试数据带预算值，正确性人工前台确认。
+  - 计算规则（`dataRuleType:2`）**由服务端在 `data.submit`/`data.update` 时计算并回填，且覆盖传入值**（真机 1.1.25，2026-10-24 复核；对照组：删规则后传入值生效）。可直接 `data.load` 读回验证，无需前台人工确认。
+  - 只有 `FORMULA`（计算公式，`propertyType:100`）字段是**门户前端**计算、API 不回填（旧证据 2026-09-25/10-07，仅覆盖该字段类型）。
   - 子表列支持标量族 + WORK_SHEET 关联列（需 `relativeCode`+options）；**嵌套子表 / MULT_WORK_SHEET / RELEVANCE_DATA 不覆盖**。
 
 ## 默认表单 `form`
@@ -148,7 +148,7 @@ only the section for the capability you need —
 ## 流程模板 `workflow`
 
 - **能做哪些事**：流程模板 get_draft/get_published、create、update、publish、bindRule（事件处理器规则绑定）、delete、workitem.list、workflow.instanceActivity（实例节点状态诊断）；参与人用组织对象。
-- **工具**：`workflow.get_draft`、`workflow.setButtons`（节点「表单操作」按钮勾选）、`workflow.get_published`、`workflow.validate`、`workflow.create`、`workflow.update`、`workflow.publish`、`workflow.bindRule`、`workflow.delete`、`configure_workflow`、`workitem.list`、`workflow.instanceActivity`、`org.role.list`、`org.department.list`、`org.user.search`、`org.role.users`、`org.role.userScope`、`org.roleGroup.create`、`org.role.create`、`org.role.update`、`org.role.addUsers`、`org.role.removeUsers`、`org.role.setUserScope`、`org.department.create`、`org.department.update`、`org.department.delete`、`org.department.users`、`org.user.create`、`org.user.update`、`org.user.delete`、`org.user.info`、`org.user.departments`、`org.role.delete`、`org.roleGroup.delete`、`org.user.transferDepartment`
+- **工具**：`workflow.get_draft`、`workflow.setButtons`（节点「表单操作」按钮勾选）、`workflow.get_published`、`workflow.validate`、`workflow.create`、`workflow.update`、`workflow.publish`、`workflow.bindRule`、`workflow.delete`、`workflow.permissions`、`workflow.addPermission`、`workflow.removePermission`（发起权限：发布流程不会自动建这一行，缺它一律 40009）、`configure_workflow`、`workitem.list`、`workflow.instanceActivity`、`org.role.list`、`org.department.list`、`org.user.search`、`org.role.users`、`org.role.userScope`、`org.roleGroup.create`、`org.role.create`、`org.role.update`、`org.role.addUsers`、`org.role.removeUsers`、`org.role.setUserScope`、`org.department.create`、`org.department.update`、`org.department.delete`、`org.department.users`、`org.user.create`、`org.user.update`、`org.user.delete`、`org.user.info`、`org.user.departments`、`org.role.delete`、`org.roleGroup.delete`、`org.user.transferDepartment`
 - **recipe**：`omc describe workflow.bindRule --example workflow-handler-binding`
 - **边界 / 陷阱**：greenfield 首版；`publish`/`bindRule` 不得在 `ValidateMessage[]` 拒绝时报告成功。运行时 workitem（提交/审批）走 `data.submit`；想知道实例停在哪/是否错派，用 `workflow.instanceActivity`（无 status=1=真停，参与人全是发起人=解析为空退回）。
 

package/skills/omc-requirement-vocabulary.md

@@ -45,11 +45,12 @@ Coverage status and boundaries for every capability (including 权限/子表/聚
 上线/内联/OCR) live in **`omc-capabilities`** — its 能力索引 table and
 [边界] section are the authority; read the relevant section there rather than a
 copy here. In particular, **跨模型/子表聚合、汇总、求和是配置能力**，不要当二开。
-落点是**字段计算规则**：`omc compute --schema <主表> --target <目标字段> --formula 'COUNTIF({<子表code>.<子列code>},"异常")'`
+落点是**字段计算规则**：条件计数/求和用拼装器的 `--where`——
+`omc compute --schema <主表> --target <目标字段> --formula '{<子表code>.<子列code>}' --where "<子列code> = <值>"`（编译为 COUNTIF/SUMIF；等价手写 `--formula 'COUNTIF({<子表code>.<子列code>},"异常")'`）
 （等价 `datarule.create` `dataRuleType:2`，配方 `field-compute-subtable-sum` / `field-compute-child-column`）。
 **不要**在规则图（`rule.save`）里用 `ruleValueType:"AGGREGATION"` —— 平台会存进去并启用，运行期聚合结果是集合，
 标量目标收到集合即 50000「服务异常」（r11 巡检沙盒 2026-10-24，1.1.25；OMC 现已写前 fail-closed）。
-计算由门户前端执行、API `data.load` 不回填，属平台既有行为：要断言结果请在测试数据里写预算值。
+字段计算规则（`dataRuleType:2`）由**服务端**在 `data.submit`/`data.update` 时计算并回填（且覆盖传入值，真机 1.1.25 复核）：写完直接 `data.load` 读目标字段即可验证。只有 `FORMULA`(100) 字段是前端计算、API 不回填。
 
 Cue → capability is a starting point, never a substitute for 定面. A cue that
 could name two faces is resolved by the 定面表 in the parent skill.

package/skills/omc-write-hazards.md

@@ -97,9 +97,13 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
 
 ## 计算规则（datarule）的取值时机
 
-- **计算由门户前端执行，API 写入不回填**：`datarule.create` 接受 `IF({实际日期}>{需求日期},"是","否")` 这类比较式并落库，但 `data.save`/`data.submit` 不计算结果值，读回仍是 null。
-- 所以"计算规则是否生效"**无法用 API 判定**，必须在门户录一条看结果；验收清单要写"计算类字段前台确认"。
-- 需要服务端就有值（参与汇总、流程分流、超期判定）时不要依赖 datarule：改用二开接口在保存/审批时算好并回写标量。
+- **字段计算规则（`datarule.create` `dataRuleType:2`）由服务端在写入时计算并回填**（真机 1.1.25 复核 2026-10-24）：
+  `data.submit` 与 `data.update` 都会算，且**计算值覆盖调用方传入的值**。
+  - 实测：`COUNTIF({子表.checkResult},"异常")` → submit 4 行（3 异常）回读 `3`；update 传 `9` 回读仍是重算的 `2`；删除该规则后同一 update 传 `7` 则回读 `7`（对照组）。
+  - 所以「计算规则是否生效」**可以用 API 判定**：写一条带子表的数据后 `data.load` 读目标字段。
+  - 服务端聚合（子表计数/求和/回主表）**不需要二开**，用普通字段 + type2 计算规则即可参与流程分流、报表、后续 update。
+- **区别：`FORMULA`（计算公式，`propertyType:100`）字段仍只在前端算** —— 旧证据（2026-09-25 / 2026-10-07）只覆盖该字段类型，API 写入不回填。计算类需求默认不要建 FORMULA 字段（见 `omc-capabilities` §字段）。
+- ⚠️ **计算字段不要靠 `data.update` 主动赋值**：规则在时会重算并丢弃你传的值。要让某字段取特定值，先确认它没有计算规则（或删规则），再写。
 
 ## 规则与业务集成