@stalfh233/omc-cli 0.4.96 → 0.4.97

package/dist/lanes/organization.js

@@ -324,12 +324,61 @@ export function registerOrganizationLane(tools) {
         const after = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentGet, query: { ...orgQuery(session), deptId: args.deptId } })).data;
         return { performed: { errcode: 0 }, readback: { deptId: args.deptId, name: after?.name ?? null, parentId: after?.parentId ?? null, managerId: after?.managerId ?? null, enabled: after?.enabled ?? null } };
     });
-    writeTool(tools, "org.department.delete", LANE, SCOPES.deptDelete, "删除部门（`GET organization/department/strike_out?id=`）。平台会拒绝：有子部门 → 200009「部门下面存在子部门，不能删除！」；有用户 → 200002「部门下面存在用户，不能删除！」。工具先计数并在回读里给出，仍由平台裁决。", { deptId: z.string().min(1), force: z.boolean().optional().describe("true = 先逐个删除子部门（仅当子部门无用户）再删本部门；有用户仍由平台裁决") }, async (session, args) => {
+    writeTool(tools, "org.department.delete", LANE, SCOPES.deptDelete, "删除部门（`GET organization/department/strike_out?id=`）。平台会拒绝：有子部门 → 200009「部门下面存在子部门，不能删除！」；有用户 → 200002「部门下面存在用户，不能删除！」。工具先计数并在回读里给出，仍由平台裁决。", {
+        deptId: z.string().min(1),
+        force: z.boolean().optional().describe("true = 先逐个删除子部门（仅当子部门无用户）再删本部门；有用户仍由平台裁决"),
+        transferUsersTo: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("有员工时的转出目标部门 id：给了它就先把本部门（及 force 时的子树各部门）的员工逐人 transferDepartment 到该部门再删；不给则带人即拒绝。目标必须是现存部门，且不能是被删子树的一部分"),
+    }, async (session, args) => {
         const users = wireRows((await wireCall(session, { path: ENDPOINTS.organizationDepartmentUsers, query: { ...orgQuery(session), deptId: args.deptId } })).data);
         // Pre-check children: the platform's 200009 ("部门下面存在子部门") is
         // accurate but sends the caller hunting for ids. Name them and hand over
         // the child-delete command (found during r15 org cleanup).
         const walked = await collectOrgDepartments(session);
+        // transferUsersTo (opt-in member evacuation): the target must be a real
+        // department and must NOT be inside the subtree being deleted — moving
+        // people into a dept that is about to be deleted would lose them.
+        const transferTarget = typeof args.transferUsersTo === "string" ? args.transferUsersTo.trim() : "";
+        let transferUsers;
+        if (transferTarget) {
+            if (!walked.rows.some((row) => row.id === transferTarget))
+                throw new ToolRefusalError({
+                    status: "refused", blocker: "department-transfer-target-absent", deptId: String(args.deptId), transferUsersTo: transferTarget,
+                    message: `transferUsersTo 的目标部门 ${transferTarget} 不存在（org.department.list 里没有）。先确认部门 id，或先创建目标部门。`,
+                });
+            const subtreeIds = new Set([String(args.deptId)]);
+            let grew = true;
+            while (grew) {
+                grew = false;
+                for (const row of walked.rows)
+                    if (subtreeIds.has(row.parentId) && !subtreeIds.has(row.id)) {
+                        subtreeIds.add(row.id);
+                        grew = true;
+                    }
+            }
+            if (subtreeIds.has(transferTarget))
+                throw new ToolRefusalError({
+                    status: "refused", blocker: "department-transfer-into-subtree", deptId: String(args.deptId), transferUsersTo: transferTarget,
+                    message: `transferUsersTo=${transferTarget} 在被删除的子树里——把人转进一个即将被删的部门会丢成员。换一个子树外的部门。`,
+                });
+            transferUsers = async (fromDeptId, deptUsers) => {
+                let moved = 0;
+                for (const member of deptUsers) {
+                    const userId = String(member.id ?? member.userId ?? "");
+                    if (!userId)
+                        continue;
+                    await wireCall(session, {
+                        path: ENDPOINTS.organizationUserDeptTransfer, method: "POST", query: orgQuery(session),
+                        body: { userIds: [userId], sourceDept: fromDeptId, targetDept: transferTarget },
+                    });
+                    moved += 1;
+                }
+                return moved;
+            };
+        }
         const children = walked.rows
             .filter((row) => row.parentId === String(args.deptId))
             .map((row) => ({ id: row.id, name: row.name }))
@@ -363,6 +412,11 @@ export function registerOrganizationLane(tools) {
             deletedChildren = ordered.length;
             for (const child of ordered) {
                 try {
+                    if (transferUsers) {
+                        const childUsers = wireRows((await wireCall(session, { path: ENDPOINTS.organizationDepartmentUsers, query: { ...orgQuery(session), deptId: child.id } })).data);
+                        if (childUsers.length > 0)
+                            await transferUsers(child.id, childUsers);
+                    }
                     await wireCall(session, { path: ENDPOINTS.organizationDepartmentDelete, query: { ...orgQuery(session), id: child.id } });
                 }
                 catch (error) {
@@ -372,12 +426,16 @@ export function registerOrganizationLane(tools) {
                         status: "refused", blocker: usersPending ? "department-has-users" : "department-delete-failed",
                         deptId: String(args.deptId), blockedChild: child,
                         nextCommand: `omc call org.department.users --args '${JSON.stringify({ deptId: child.id })}'`,
-                        message: `force 清理到子部门 ${child.name}(${child.id}) 时失败：${message}。${usersPending ? "该部门下还有员工——先转出再删。" : "平台拒绝删除该子部门。"}`,
+                        message: `force 清理到子部门 ${child.name}(${child.id}) 时失败：${message}。${usersPending ? "该部门下还有员工——先转出再删（或传 transferUsersTo 让工具搬）。" : "平台拒绝删除该子部门。"}`,
                     });
                 }
             }
         }
-        if (users.length > 0) {
+        let transferredUsers = 0;
+        if (users.length > 0 && transferUsers) {
+            transferredUsers = await transferUsers(String(args.deptId), users);
+        }
+        if (users.length > 0 && !transferUsers) {
             // Name every member and hand over a runnable transfer for the first one:
             // "先看人再转出" left the caller to assemble the transfer args (item 9).
             const members = users.map((row) => ({ id: row.id ?? row.userId ?? null, name: row.name ?? null, username: row.username ?? null }));
@@ -389,12 +447,20 @@ export function registerOrganizationLane(tools) {
                     ? `omc call org.user.transferDepartment --args '${JSON.stringify({ userId: first.id, departmentId: parentId })}'`
                     : `omc call org.department.users --args '${JSON.stringify({ deptId: String(args.deptId) })}'`,
                 message: `部门 ${args.deptId} 下还有 ${users.length} 名员工，平台拒绝删除（200002）。成员：${members.map((member) => `${member.name ?? "?"}(${member.id ?? "?"})`).join("、")}。` +
-                    `平台不允许删带人的部门，也不提供"随部门级联转出"；逐个 org.user.transferDepartment 转到 ${parentId ? `父部门 ${parentId}` : "目标部门"} 后再删。` +
-                    `（force 只处理子部门，不搬人——搬人是组织语义决策，工具不替你做。）`,
+                    `平台不允许删带人的部门，也不提供"随部门级联转出"。两个选择：` +
+                    `① 逐个 org.user.transferDepartment 转到 ${parentId ? `父部门 ${parentId}` : "目标部门"} 后再删；` +
+                    `② 本命令直接带 transferUsersTo:"<目标部门id>"，工具会先把人逐人转出（含 force 时的子树各部门）再删。` +
+                    `（默认不搬人——搬人是组织语义决策，不替你选目标部门。）`,
             });
         }
         await wireCall(session, { path: ENDPOINTS.organizationDepartmentDelete, query: { ...orgQuery(session), id: args.deptId } });
-        return { performed: { errcode: 0 }, readback: { deptId: args.deptId, deleted: true, usersBeforeDelete: users.length, deletedChildren } };
+        return {
+            performed: { errcode: 0 },
+            readback: {
+                deptId: args.deptId, deleted: true, usersBeforeDelete: users.length, deletedChildren,
+                ...(transferredUsers > 0 ? { transferredUsers, transferredTo: transferTarget } : {}),
+            },
+        };
     });
     tools.push(defineTool({
         name: "org.department.users",

package/dist/lanes/runtime-data.js

@@ -410,20 +410,46 @@ function collectChildArrayPaths(value, childCodes, prefix = "") {
     }
     return found;
 }
-async function stampChildRowStatuses(session, schemaCode, formData) {
-    const childCodes = new Set();
+/**
+ * One published field.list read, reused by the child-row stamping AND the
+ * value-shape gates below, so the gates add zero extra wire calls.
+ */
+async function loadPublishedFieldMeta(session, schemaCode) {
     try {
         const rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+        const childCodes = [];
+        const meta = new Map();
         for (const row of rows) {
-            if (Number(row.propertyType ?? row.type) === CHILD_TABLE_PROPERTY_TYPE)
-                childCodes.add(String(row.code ?? row.propertyCode ?? ""));
+            const code = String(row.code ?? row.propertyCode ?? "");
+            if (!code)
+                continue;
+            const type = Number(row.propertyType ?? row.type);
+            let format;
+            if (typeof row.options === "string" && row.options) {
+                try {
+                    const parsed = JSON.parse(row.options);
+                    if (typeof parsed.format === "string")
+                        format = parsed.format;
+                }
+                catch {
+                    // unparsable options: shape gates for this field are skipped
+                }
+            }
+            meta.set(code, { type, ...(format !== undefined ? { format } : {}) });
+            if (type === CHILD_TABLE_PROPERTY_TYPE)
+                childCodes.push(code);
         }
+        return { childCodes, meta };
     }
     catch {
-        return { formData, childCodes: [] };
+        return null;
     }
-    if (childCodes.size === 0)
-        return { formData, childCodes: [] };
+}
+async function stampChildRowStatuses(session, schemaCode, formData, preloaded) {
+    const loaded = preloaded !== undefined ? preloaded : await loadPublishedFieldMeta(session, schemaCode);
+    if (!loaded || loaded.childCodes.length === 0)
+        return { formData, childCodes: loaded?.childCodes ?? [], meta: loaded?.meta ?? new Map() };
+    const childCodes = new Set(loaded.childCodes);
     let changed = false;
     const next = { ...formData };
     for (const code of childCodes) {
@@ -441,7 +467,136 @@ async function stampChildRowStatuses(session, schemaCode, formData) {
             return { ...row, rowStatus: hasId ? "Modified" : "Added" };
         });
     }
-    return { formData: changed ? next : formData, childCodes: [...childCodes] };
+    return { formData: changed ? next : formData, childCodes: [...childCodes], meta: loaded.meta };
+}
+/**
+ * The one write-path preflight shared by data.save / data.update / data.submit:
+ * load the published field metadata ONCE, refuse the proven bad value shapes
+ * (date/relation/child-row-id) BEFORE any mutation, then stamp rowStatus.
+ */
+async function prepareRuntimeFormData(session, schemaCode, formData, opts) {
+    const loaded = await loadPublishedFieldMeta(session, schemaCode);
+    if (loaded)
+        assertRuntimeFieldValueShapes(loaded.meta, formData, loaded.childCodes, { schemaCode, isUpdate: opts.isUpdate });
+    const stamped = await stampChildRowStatuses(session, schemaCode, formData, loaded);
+    return { formData: stamped.formData, childCodes: stamped.childCodes };
+}
+/**
+ * Translate a platform DATE options.format into a validator regex. The format
+ * enum is UPPERCASE (`YYYY-MM-DD HH:mm:ss`), tokenized longest-first; literals
+ * (`-`, `/`, `:`, space, 年/月/日) are escaped. Unknown formats return null —
+ * the gate then stays silent rather than guessing.
+ */
+function dateFormatRegex(format) {
+    const KNOWN = new Set([
+        "YYYY", "YYYY-MM", "YYYY/MM", "YYYY-MM-DD", "YYYY/MM/DD",
+        "YYYY-MM-DD HH:mm", "YYYY/MM/DD HH:mm", "YYYY-MM-DD HH:mm:ss", "YYYY/MM/DD HH:mm:ss",
+        "YYYY-MM-DD CN-APM", "YYYY/MM/DD CN-APM", "YYYY-MM-DD CN-APM HH:mm", "YYYY/MM/DD CN-APM HH:mm",
+        "YYYY-MM-DD EN-APM", "YYYY/MM/DD EN-APM", "YYYY-MM-DD EN-APM HH:mm", "YYYY/MM/DD EN-APM HH:mm",
+        "YYYY年MM月DD日", "YYYY年MM月",
+    ]);
+    if (!KNOWN.has(format))
+        return null;
+    const pattern = format
+        .split("CN-APM").join("\u0001")
+        .split("EN-APM").join("\u0002")
+        .split("YYYY").join("\\d{4}")
+        .split("MM").join("\\d{2}")
+        .split("DD").join("\\d{2}")
+        .split("HH").join("\\d{2}")
+        .split("mm").join("\\d{2}")
+        .split("ss").join("\\d{2}")
+        .split("\u0001").join("(?:上午|下午)")
+        .split("\u0002").join("(?:AM|PM)")
+        .replace(/[-/]/g, (ch) => `\\${ch}`);
+    return new RegExp(`^${pattern}$`);
+}
+/**
+ * r17 (2026-10-26) live write-shape evidence on 1.1.25 — every case below was
+ * observed on the wire, none is speculative:
+ *  - DATE(3): a plain string in the field's declared format lands correctly;
+ *    a millisecond timestamp is ACCEPTED and stored NULL (silent data loss);
+ *    a date-only or ISO-8601-with-timezone string against a datetime format
+ *    answers 50000 服务异常.
+ *  - WORK_SHEET(9): a single relation field takes the bare object id string;
+ *    an array answers 50000 服务异常.
+ *  - CHILD_TABLE rows on an UPDATE of an existing record: a row without `id`
+ *    is INSERTED as a NEW child row (no upsert) — r17: four updates each
+ *    resending two id-less rows turned 2 child rows into 8, and a roll-up
+ *    SUM over them silently doubled. The portal always sends the id (→
+ *    rowStatus Modified) for existing rows; a hand-built payload must too.
+ */
+export function assertRuntimeFieldValueShapes(meta, formData, childCodes, context) {
+    for (const [code, value] of Object.entries(formData)) {
+        if (value === null || value === undefined)
+            continue;
+        const field = meta.get(code);
+        if (!field)
+            continue;
+        if (field.type === 3 && typeof value === "number") {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-date-shape",
+                schemaCode: context.schemaCode,
+                field: code,
+                message: `日期字段 ${code} 收到数字 ${value}（毫秒时间戳）：平台接受但**静默落库 NULL**（r17 真机）。` +
+                    `日期必须写成字段 format 对应的字符串（本字段 format=${field.format ?? "未知"}），如 "2026-10-26 11:00:00"。`,
+            });
+        }
+        if (field.type === 3 && typeof value === "string" && field.format) {
+            const re = dateFormatRegex(field.format);
+            if (re && !re.test(value.trim())) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-date-shape",
+                    schemaCode: context.schemaCode,
+                    field: code,
+                    format: field.format,
+                    message: `日期字段 ${code} 的值 "${value}" 不匹配字段声明的 format "${field.format}"——平台直接回 50000 服务异常（r17 真机：仅日期串/ISO8601 带时区都打回）。` +
+                        `按 format 逐位对齐；改格式走 field.update。`,
+                });
+            }
+        }
+        if (field.type === 9 && Array.isArray(value)) {
+            // Same refusal as the post-hoc diagnoseRelationShapeFailure (which stays
+            // as the backstop for nested child-row relations); pre-write is cheaper.
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "relation-single-array-shape",
+                schemaCode: context.schemaCode,
+                fields: [code],
+                message: `单选关联字段 ${code}（WORK_SHEET/propertyType 9）传了数组：平台稳定回 50000（r17b 2026-10-26 真机）。` +
+                    `单值关联写 **id 字符串或 {id}**；多值关联（MULT_WORK_SHEET 11）与人员/组织（50/51）才用数组。`,
+            });
+        }
+    }
+    if (context.isUpdate) {
+        const problems = [];
+        for (const code of childCodes) {
+            const rows = formData[code];
+            if (!Array.isArray(rows))
+                continue;
+            const missing = rows.filter((row) => row !== null &&
+                typeof row === "object" &&
+                !Array.isArray(row) &&
+                !(typeof row.id === "string" && row.id.trim().length > 0) &&
+                !(typeof row.rowStatus === "string" && row.rowStatus.trim().length > 0));
+            if (missing.length > 0)
+                problems.push(`${code}（${missing.length}/${rows.length} 行无 id/rowStatus）`);
+        }
+        if (problems.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-child-rows-missing-id",
+                schemaCode: context.schemaCode,
+                childTables: problems,
+                message: `更新既有记录时子表行必须带 id：${problems.join("、")}。平台对无 id 的子行按**新增插入**（不判重）——` +
+                    `r17 真机：同一条记录连发 4 次带 2 行无 id 子表的 update，子行从 2 变 8，聚合 SUM 翻倍。` +
+                    `改既有行：先 data.load 拿子行 id 原样带回（平台走 rowStatus=Modified）；` +
+                    `有意追加新行：显式给该行 rowStatus:"Added"。`,
+            });
+        }
+    }
 }
 /** Runtime business-object data keyed by field code. */
 export function registerRuntimeDataLane(tools) {
@@ -766,7 +921,9 @@ export function registerRuntimeDataLane(tools) {
                 message: "submit:true 与 workflowCode 互斥——workflowCode 是流程草稿两段式的第一段（返回 workItemId 后用 data.submit 提交）；无流程模型的一调完成态用 submit:true 且不带 workflowCode",
             });
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
+        const rawSaveData = args.formData;
+        const saveIsUpdate = typeof rawSaveData.id === "string" && rawSaveData.id.trim().length > 0;
+        const formData = (await prepareRuntimeFormData(session, args.schemaCode, rawSaveData, { isUpdate: saveIsUpdate })).formData;
         if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
             // Portal draft-save shape. The row id travels in data.id (the portal
             // form SDK receives a pre-generated id from form/load and echoes it);
@@ -932,7 +1089,7 @@ export function registerRuntimeDataLane(tools) {
                 message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
             });
         }
-        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
+        const formData = (await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true })).formData;
         const performed = await wireCall(session, {
             path: ENDPOINTS.runtimeFormSave,
             method: "POST",
@@ -1066,7 +1223,7 @@ export function registerRuntimeDataLane(tools) {
             });
         }
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const stampedSubmit = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const stampedSubmit = await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: targetObjectId !== null });
         const formData = stampedSubmit.formData;
         // r5-asset 2026-10-20: the platform APPENDS child rows carried in an
         // approval submit's formData (no upsert by row id, no error). Live: an

package/dist/recipes/field.js

@@ -260,14 +260,14 @@ const formulaAggregationCrossModel = Object.freeze({
         "`propertyType`/`currentPropertyType` 是 BizPropertyType 的**整数码**（0=SHORT_TEXT 2=NUMERICAL 9=WORK_SHEET…），`operatorType` 是 OperatorType 的**整数码**（1=EQ 6=ITEQ 9=IS_NULL 10=IS_NOT_NULL…）。写名字会被 ObjectMapperUtils 抛 json processing exception 并掩码成 305003；工具会自动转码。",
         "`calculateType` 是**字符串**（SUM/COUNT/COUNTIF/SUMIF/AVG/MAX/MIN/LARGE/SMALL/UNION），不是枚举 code。",
         "发布后平台会**自动生成一条 t100 CALCULATE_RULE 镜像行**（h_biz_data_rule，propertyCode=字段 code），它是回算触发的前置条件，别手动删。",
-        "回算时机 = **来源模型的行被 submit/update/delete**（`FormulaPropertySupport.onTriggerObjectChanged`）。目标行本身写入不会触发聚合。",
+        "**回算时机（r17b 2026-10-26 真机完整行为图谱）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠，不依赖事件）；② 来源行 submit/update/delete 触发 `RollUpEventListener`→`FormulaPropertySupport` 事件回算——FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件（propertyCode 带 `.`）都验证过，DELETE 也会回算；③ ⚠️ 事件回算**只在目标模型发布后的几分钟内可靠**，之后静默停止（源端数据变了目标字段不更新、无报错）——重新 `field.publish --force` 目标模型即可恢复。定时巡检/对账场景务必重发或依赖目标行写入路径。",
     ],
     priorToolReferences: [
         { tool: "field.list", args: { environment, schemaCode: "r17_c", published: true }, purpose: "确认来源模型与其列已发布，取 dataItemCode 与 DYNAMIC 条件的 propertyCode" },
         { tool: "field.list", args: { environment, schemaCode: "r17_d", published: true }, purpose: "确认目标模型已有所承载匹配值的字段（currentPropertyCode）" },
     ],
     dryRun: { supported: true, command: `omc call field.create --env ${environment} --dry-run --args '<recipe.args>'`, notes: "dry-run 校验 options 形状与聚合目标；同模型聚合在此拒绝" },
-    expectedReadback: { readback: { fieldPresent: true, options: { formulaConfig: "<含 AGGREGATION + DYNAMIC 条件>" } }, next: ["field.publish", "data.submit 来源行 ×2 → data.load 目标行读到合计", "form.publish"] },
+    expectedReadback: { readback: { fieldPresent: true, options: { formulaConfig: "<含 AGGREGATION + DYNAMIC 条件>" } }, next: ["field.publish", "data.submit 来源行（紧接发布后几分钟内）→ data.load 目标行读到合计", "form.publish"] },
     refusalRecovery: [
         { code: "aggregation-self-schema-cycle", action: "把 schemaCode 换成另一个模型；同模型/自己的子表聚合平台不支持" },
         { code: "duplicate-field", action: "字段已存在改用 field.update 或换 code" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.96",
+  "version": "0.4.97",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.96",
+    "@stalfh233/omc-fake-platform": "0.4.97",
     "commander": "14.0.3",
-    "omc-core": "0.4.96",
+    "omc-core": "0.4.97",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-business-configuration.md

@@ -156,7 +156,7 @@ rules:
   - **`queryConditions` 不能为空**：它是反向过滤器的唯一输入，空数组时回算日志照打但目标字段恒 0（r17 实测）。
   - **DYNAMIC 条件的两个 code 分属两侧，写反了静默 0**：`propertyCode` = 来源模型字段，`currentPropertyCode` = 目标模型字段；语义「来源行的 X 等于本目标行的 Y」。
   - **`propertyType`/`currentPropertyType`（BizPropertyType）与 `operatorType`（OperatorType）必须写整数**——两者都是 `@JsonCreator get(int)`：propertyType 0=SHORT_TEXT 2=NUMERICAL 3=DATE 9=WORK_SHEET…；operatorType 1=EQ 2=NEQ 3=GT 4=IT（小于）5=GTEQ 6=ITEQ（小于等于）9=IS_NULL 10=IS_NOT_NULL…。写名字会被 `ObjectMapperUtils` 抛 json processing exception，再被死循环校验掩码成 305003（工具接受名字并自动转码）。`calculateType` 相反，是**字符串**（SUM/COUNT/COUNTIF/SUMIF/AVG/MAX/MIN/LARGE/SMALL/UNION）。
-  - **回算时机**：来源模型的行 submit/update/delete 触发 `FormulaPropertySupport.onTriggerObjectChanged`；目标行自己写入不触发。发布后平台自动生成 t100 `CALCULATE_RULE` 镜像行，别删。r17 真机：目标行 srcNo=C1、来源 C1 行 amt=100 → 读 100；再提交一条 C1/amt=5 的来源行 → 读 105。
+  - **回算时机（r17b 2026-10-26 完整行为图谱）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠）；② 来源行 submit/update/**delete** 触发 `RollUpEventListener`→`FormulaPropertySupport` 事件回算（FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件都验过）；③ ⚠️ 事件回算**只在目标模型发布后几分钟内可靠**，之后静默停止（无报错）——`field.publish --force` 目标模型恢复。发布后平台自动生成 t100 `CALCULATE_RULE` 镜像行，别删。r17 真机：目标行 srcNo=C1、来源 C1 行 amt=100 → 读 100；再提交一条 C1/amt=5 → 读 105。
   - **普通数值字段 + 计算规则（type2）不能替代**：REST 路径永不执行（`CalculateHandler.java:50` 的 `forceExecuteCalculateRule` 从不置真），门户里才算。
 - **DYNAMIC 来源不要写点号**：`dataActions` 的 `currentDataItemValue` 写 `items.sealNo` 会被引擎当成**子表列集合**（DatasetImpl），标量目标收到集合 → 运行期 `submit/update` 报 50000（`WorkSheetBizField.fillClientContent: Incorrect value type`）。单跳关联字段直接写字段 code（引擎取 `.id`）；子表列只能用于公式/聚合。`rule.save` 已写前拒绝（`rule-graph-create-dynamic-source-is-child-collection`）。
 - **单选字段的 `dataCondition` 在 1.1.25 不生效**：用 FIXED 值比较 RADIO/CHECKBOX/DROPDOWN 时，运行时日志「解析选框类型数据项的比较值失败」，条件被跳过、节点**无条件执行**（r8：异常归还被当成已归还回写）。`rule.save` 会把它放进 `readback.lintHazards`（`rule-graph-radio-condition-unparseable`）；改用 BRANCH 判断该字段，或拆两条规则。

package/skills/omc-write-hazards.md

@@ -36,6 +36,7 @@ omc help omc-write-hazards
 - **`mappings` 由表单运行时在用户选择时套用**，服务端 `data.save` **不会**自动回填映射目标字段。API 侧要自己写被映射字段，否则读回为空——别把它误判成“映射配置失败”。
 - **关联映射的事实源在字段行 `options.mappings`，不在表单控件属性**（真机 2026-10-14 实证：改表单 attributes 里的映射会被平台按字段重算覆盖、回读不生效）。改映射走：`field.update` 按完整 options 提交（只改 mappings，其余键原值保留）→ `field.publish` → `form.draft`（**rebuild:false**，保留现有布局与在线JS）重存 → `form.publish` → 回读核对。**别用 cascadeRepublish 刷带布局/在线JS 的表单**：rebuild 会清空设计器公式（已做写前拒绝）。
 - **运行时写值的最小形状**（组合出错只会得到一个不透明的 `50000`/NPE，逐一最小化再合）：单选关联(9) → id 字符串 `"<id>"`；**多选关联(11) → 分号串 `"<id1>;<id2>"`**；**人员/组织(50/51/60/61) → `[{"id":"<id>","type":3,"name":"<名>"}]`，`type` 必填且为整数**（缺/非整数 → `BizField.parseFromClient` 拆箱 NPE→50000；用户=3、部门=1）；日期(3) → 字符串 `"2026-09-30 10:00:00"`；子表(8) → 行对象数组 `[{"<子列code>":<值>, ...}]`。先各写一条最小行通过，再组合。
+  其中三类已有**写前拒绝**（r17b 2026-10-26 起）：日期收到毫秒时间戳（平台接受但落库 NULL）、日期字符串不匹配字段声明 format（50000）、单值关联收到数组（50000）——blocker `submit-date-shape` / `submit-relation-shape`。
 - **DATE(3) 字段的 `options.format` 必须是平台大写枚举**（`YYYY-MM-DD`、`YYYY-MM-DD HH:mm:ss`、`YYYY年MM月DD日`…），**不是 Java 的 `yyyy-MM-dd`**：平台 `DateBizField` 按字面比较，Java 写法能创建字段但**首次运行时 save 稳定 `50000`（`不支持的format`）**（2026-09-30 R5 实测）。`field.create`/`intent` 会就地拒绝非枚举值。
 
 - **多选关联(11) 的写入源码依据**（1.1.25 实机 jar）：`WorkSheetMultiBizField.contentFromClient` 只接受 `String` 或 `Map`，其它类型直接 `AppAsserts.isTrue(false, "Incorrect value type, should be string or map.")` → 表现为 50000；`contentToDbValue()` 返回 `map.get("id")`，而读回时按 `";"` 切分（`MULTI_WORK_SHEET_SPILT`）并组装 `items` 数组。所以**数组是读写不对称的读侧形状，不能拿来写**；分号串才是写侧形状。实测三种形状：`"<id>"`/`"<id>;<id>"` 成功、`["<id>"]` 50000。
@@ -89,6 +90,7 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
 
 父 `CHILD_TABLE` 行不接受 `options/choices/subFields` 更新；子列直接走上面的 CRUD 面。
 
+- **更新既有记录时，子表行必须带 `id`**（r17b 2026-10-26 真机）：`data.update`/`data.submit(bizObjectId)` 里无 `id` 也无显式 `rowStatus` 的子行，平台按**新增插入**（不判重）——同一条记录连发 4 次带 2 行无 id 子表的 update，子行从 2 变 8，聚合 SUM 翻倍。改既有行：先 `data.load` 拿子行 id 原样带回（→ rowStatus=Modified）；有意追加新行显式写 `rowStatus:"Added"`。OMC 已写前拒绝 `submit-child-rows-missing-id`。
 - **提交/审批都不要再回传子表数组**（真机 2026-10-19/20）：`data.save` 建草稿后 `data.submit` 若带子表行（无 `id`），平台按新增追加（3→9）；**审批提交同样**——`data.submit` 带 `workItemId`+`agree` 推进一步时回传子表，每级再 +1 行（1→2→3）。金额若显式传了合计不会翻倍，但行数与 SUM 口径已被污染，且没有报错。审批只回传标量字段（`agree`/意见/被改标量）；确需改子行时带 `id`+`rowStatus:"Modified"`。验收加一条"审批后子表行数不变"。
 
 ## 写调用纪律
@@ -103,10 +105,11 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
     （早前「覆盖传入值、API 可判定」的结论来自 r12，已被推翻——不要再用它做验收。）
   - 源码门控：`CalculateHandler.java:50` 的 `forceExecuteCalculateRule` 只在 `BizObjectOptions.executeCalRule()` 为真时求值，而该 builder 全库 0 调用方（REST 路径从不置真）。
   - 所以「计算规则是否生效」**不能用 API 判定**；正确性只能在门户表单里验。API 调用方请自己算好再写。
-- **跨模型汇总可以走 FORMULA(100) + AGGREGATION，而且 REST 能回算**（r17 真机 100→105）：
+- **跨模型汇总可以走 FORMULA(100) + AGGREGATION，而且 REST 能回算**（r17 真机 100→105；r17b 2026-10-26 补齐行为图谱）：
   `aggregation.schemaCode` 指向**另一个模型**，`queryConditions` 必须给 DYNAMIC 条件
-  （`propertyCode`=来源模型字段、`currentPropertyCode`=目标模型字段）；来源行 submit/update/delete 触发
-  `FormulaPropertySupport.onTriggerObjectChanged`。配方：`omc describe field.create --example formula-aggregation-cross-model`。
+  （`propertyCode`=来源模型字段、`currentPropertyCode`=目标模型字段）。配方：`omc describe field.create --example formula-aggregation-cross-model`。
+  已验证的形状：FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件（`propertyCode` 带 `.`）、来源行 DELETE 也会回算。
+  **回算可靠性（重要）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠）；② 来源行 submit/update/delete 的事件回算**只在目标模型发布后几分钟内可靠**，之后静默停止（无报错，源变了目标不更新）——重新 `field.publish --force` 目标模型恢复。验收：发布后立刻改来源行并读目标字段；长期对账别依赖事件回算。
 - **同模型（含自己的子表）聚合不可用**：`field.publish` 必抛 305003 —— `publishFormula` 把相对码改写成子表父模型（= 本模型），
   `checkCycleOfAggregation:1032` 判成环。与 payload 无关，8.6.26 与 1.1.25 代码相同。OMC 已写前拒绝 `aggregation-self-schema-cycle`。
 - **区别：`FORMULA`（计算公式，`propertyType:100`）字段的 EXPRESSION 模式仍只在前端算** —— API 写入不回填。