@stalfh233/omc-cli 0.4.96 → 0.4.98

package/dist/capability-overview.js

@@ -231,7 +231,12 @@ export const CAPABILITY_CUES = Object.freeze({
     onlinejs: ["在线js", "脚本", "联动", "onload", "onvalidate"],
     bizservice: ["集成", "接口", "服务", "回调", "对接", "外部系统", "datasql", "restful"],
     report: ["报表", "图表", "看板", "bi", "dashboard"],
-    data: ["运行数据", "提交数据", "保存记录", "查记录"],
+    // r18 (2026-10-26): "造数据 / 造测试单据 / 录数据" is the RUN-DATA capability, but
+    // the goal usually also says 子表/明细 (field cues) — without these compound
+    // cues the router sent the probe to `field` in read mode (write:false), so it
+    // never reached data.submit. Compound (not bare 数据) to avoid stealing
+    // ordinary model/field asks that merely mention data.
+    data: ["运行数据", "提交数据", "保存记录", "查记录", "造数据", "测试数据", "测试单据", "造单据", "造单", "录数据", "填数据", "模拟数据", "业务数据", "造几条", "造两张", "造几张", "验数据"],
 });
 /**
  * Boundary cues — authored alongside CAPABILITY_CUES (same runtime authority).

package/dist/compute.js

@@ -212,8 +212,27 @@ export async function cmdCompute(args) {
     // data.save / data.submit / data.update never refresh the target field, no
     // matter how correct the formula is. Say so in the receipt instead of letting
     // the caller believe the write took effect (r12 believed it; r16 disproved it).
+    // r18: the dry-run receipt showed only an optionsSummary hash, so the probe
+    // could not tell whether `{items.qty} * {items.price}` means per-row or
+    // aggregate-after-multiply — a semantic difference that changes the answer.
+    // Echo the exact compiled formula (and its editor twin) on the dry-run face.
+    const compiled = !apply
+        ? (() => {
+            const stitch = createArgs.options?.shortTextStitch;
+            if (typeof stitch !== "string")
+                return undefined;
+            try {
+                const parsed = JSON.parse(stitch);
+                return { formula: parsed.formula ?? null, editorText: parsed.editorText ?? null, editorMark: parsed.editorMark ?? null };
+            }
+            catch {
+                return undefined;
+            }
+        })()
+        : undefined;
     const withWarning = apply && classified.status === "ok" ? { ...result, ...computeExecutionNotice() } : result;
-    writeEnvelope(envelope(classified.status, withWarning, request, classified.error));
+    const withCompiled = compiled ? { ...withWarning, compiledFormula: compiled } : withWarning;
+    writeEnvelope(envelope(classified.status, withCompiled, request, classified.error));
     return exitCode;
 }
 //# sourceMappingURL=compute.js.map

package/dist/field-families.js

@@ -954,6 +954,16 @@ export function assertFieldOptionsAllowed(type, options, schemaCode) {
                 const agg = parseOptionsObject(config.aggregation);
                 if (!agg || !isNonEmptyString(agg.schemaCode) || !isNonEmptyString(agg.dataItemCode) || !isNonEmptyString(agg.formula))
                     refuseFieldOptions("AGGREGATION aggregation is missing schemaCode/dataItemCode/formula", 'rejected: aggregation 形状 {schemaCode:"<目标模型schemaCode>", dataItemCode:"<目标字段code>", formula:"SUM({<目标模型>.<字段>})", calculateType:"SUM", queryConditions:[[…]]}（FormulaProcessor.executeMainAggregation + AggregationFormula）');
+                if (String(agg.dataItemCode).includes("."))
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "aggregation-data-item-not-scalar",
+                        schemaCode: schemaCode ?? null,
+                        dataItemCode: String(agg.dataItemCode),
+                        message: `聚合数据项 ${String(agg.dataItemCode)} 带点号：平台只接受**来源模型的主表标量列 code**（不带 schema 前缀）。` +
+                            `写成 <子表>.<子列> 会在 field.publish 回 309004「使用的聚合数据项不存在」（r18 真机）。` +
+                            `要汇总子表列：先在来源主模型上物化一个数值字段（门户计算规则或写入方维护），再聚合那个标量列。`,
+                    });
                 if (schemaCode !== undefined && aggregationTargetsOwnSchema(schemaCode, String(agg.schemaCode)))
                     throw new ToolRefusalError({
                         status: "refused",

package/dist/goal-routes.js

@@ -13,7 +13,7 @@ import { listSkills, readSkillSection } from "./skills.js";
 const SCOUT_CUES = ["能不能", "能不能够", "能否", "是否支持", "支持吗", "支持不支持", "可不可以", "有没有办法", "有没有可能", "怎么实现", "如何实现", "怎么写", "怎么配置"];
 const MODIFY_CUES = ["修改", "调整", "更新", "重命名", "改名", "编辑", "删除", "去掉", "移除", "改为", "改成"];
 const READ_CUES = ["查看", "读回", "盘点", "现状", "列出", "有哪些", "有没有", "检查", "审计", "导出", "只读", "看看", "看下", "查一下", "查询一下", "查一查", "梳理", "清点", "给我一份", "哪些", "是什么", "是否", "是否正确", "现有", "已有"];
-const BUILD_CUES = ["新建", "创建", "搭建", "从零", "从无到有", "做", "建", "加", "实现", "生成", "新增", "保存", "启用", "录入", "添加"];
+const BUILD_CUES = ["新建", "创建", "搭建", "从零", "从无到有", "做", "建", "加", "实现", "生成", "新增", "保存", "启用", "录入", "添加", "造", "填报", "打卡", "录"];
 /** Whole-application asks — a single-model atom is the wrong shape for these. */
 const WHOLE_APP_CUES = ["应用", "系统", "整套", "从零", "从无到有", "端到端", "一条龙", "一整套", "业务应用", "平台"];
 function looksWholePackage(goal, capabilityCount) {
@@ -122,6 +122,10 @@ function capabilityScores(registry, goal) {
 const DEFAULT_LADDER_RECIPES = {
     businessrule: { tool: "rule.save", recipe: "business-rule-branch-conditional" },
     datarule: { tool: "datarule.create", recipe: "field-compute-rule" },
+    // r18: a "造数据 / 录测试单据" ask reached the `data` capability but had no
+    // runnable shape — the probe had to fetch `describe data.submit --example`
+    // itself. These lane defaults give every ladder step a copyable command.
+    data: { tool: "data.submit", recipe: "plain-data-submit" },
 };
 function defaultRecipeFor(registry, capabilityId, lane) {
     const wanted = DEFAULT_LADDER_RECIPES[capabilityId];
@@ -609,6 +613,13 @@ export function goalRoute(registry, goal) {
             route: {
                 ...(whole ? { primary: "intent", atomicSupplement } : { ladder }),
                 ...routeReads(readSections),
+                // r18: when a step already carries a goal-matched recipe, the generic
+                // first section ("3. Draft template") is noise — the probe read it and
+                // got nothing. Say that the recipe command is the answer and the
+                // sections are only a fallback.
+                ...(ladder.some((step) => step.recipe)
+                    ? { readHint: "已命中配方：先跑 firstCommands 里的 `omc describe … --example …` 取形状；下面的 readSections 只是补充，不必先读（确实需要时用 `omc help <topic> --section \"<节>\"`，按 readMore 逐节补）。" }
+                    : {}),
                 // Each ladder step already carried a runnable recipe command, but it sat
                 // buried at `ladder[i].recipe.command` behind a readiness line — r14's
                 // probe reported "ladder 本身没给可直接跑的命令" and hand-built the rule

package/dist/lanes/field.js

@@ -141,6 +141,21 @@ function assertNameI18nArg(nameI18n) {
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
         refuse("JSON 解析结果不是对象");
 }
+/**
+ * r18 (2026-10-26 live): aggregating a CHILD-TABLE schema (`schemaCode:"items"`)
+ * publishes fine but makes the TARGET model unwritable — every data.submit /
+ * data.update answers `40000 调用数据库发生异常` with no detail (the probe spent
+ * ~40 calls bisecting it). The child schema also has no parent-document column,
+ * so matching by the parent's document number can never work: even when the
+ * write goes through the value is always 0.
+ *
+ * Child schemas are recognizable from their field list: they alone carry the
+ * system columns `parentId`（子表业务对象父类ID）and `sortKey`（子表排序号）.
+ */
+function childSchemaCodes(rows) {
+    const codes = new Set(rows.map((row) => String(row.code ?? row.propertyCode ?? "")));
+    return codes.has("parentId") && codes.has("sortKey");
+}
 /**
  * r17 (2026-10-25, live + decompiled A/B): a FORMULA field CANNOT aggregate its
  * own model's child table. `BizPropertyManagerImpl.publishFormula` rewrites
@@ -184,6 +199,43 @@ function assertNoSelfSchemaAggregation(args, published) {
         message: aggregationSelfSchemaMessage(target, args.schemaCode),
     });
 }
+/**
+ * The async half of the aggregation gate: a FOREIGN child schema cannot be
+ * detected syntactically, so read the target's field list once (only for
+ * AGGREGATION) and refuse when it carries the child-schema system columns.
+ */
+async function assertNoChildSchemaAggregation(session, schemaCode, propertyType, options) {
+    const resolved = typeof propertyType === "number" ? propertyType : FIELD_PROPERTY_TYPES[String(propertyType)];
+    if (resolved !== FIELD_PROPERTY_TYPES.FORMULA)
+        return;
+    const config = decodeJsonObjectColumn(options.formulaConfig, { invalid: "undefined", array: "reject", object: "reject" });
+    if (!config || config.formulaType !== "AGGREGATION" || typeof config.aggregation !== "string")
+        return;
+    const agg = decodeJsonObjectColumn(config.aggregation, { invalid: "undefined", array: "reject", object: "reject" });
+    const target = typeof agg?.schemaCode === "string" ? agg.schemaCode.trim() : "";
+    if (!target)
+        return;
+    let rows;
+    try {
+        rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: target, isPublish: "true" } })).data);
+    }
+    catch {
+        return;
+    }
+    if (!childSchemaCodes(rows))
+        return;
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "aggregation-target-is-child-schema",
+        schemaCode,
+        aggregationSchemaCode: target,
+        message: `聚合目标 ${target} 是**子表 schema**（字段清单里带 parentId/sortKey 系统列）。` +
+            `平台允许发布，但目标模型从此**整个不可写**：data.submit/data.update 一律回 40000「调用数据库发生异常」且无明细（r18 真机，二分 40 次调用才定位）。` +
+            `而且子表 schema 没有父单单号列，按父单匹配恒为 0——即使不报错也算不出值。` +
+            `正确做法：聚合**来源模型的主表标量列**。需要子表合计时，先在来源主模型物化一个数值字段` +
+            `（门户计算规则 / 写入方维护），再用 AGGREGATION 聚合该标量。配方：omc describe field.create --example formula-aggregation-cross-model。`,
+    });
+}
 export function registerFieldLane(tools) {
     tools.push(defineTool({
         name: "field.list",
@@ -344,6 +396,7 @@ export function registerFieldLane(tools) {
         // One seam owns field-change normalization, every reproduced gate, and the
         // wire body (src/field-change.ts), so configure_model and intent share it.
         assertNoSelfSchemaAggregation(args, published);
+        await assertNoChildSchemaAggregation(session, args.schemaCode, args.propertyType, args.options ?? {});
         const prepared = prepareFieldChange(args);
         let performed;
         try {
@@ -437,6 +490,7 @@ async function runFieldUpdate(session, args) {
             .then((response) => wireRows(response.data))
             .catch(() => []);
         assertNoSelfSchemaAggregation({ schemaCode: args.schemaCode, propertyType: record.type ?? record.propertyType, options: args.options }, publishedRows);
+        await assertNoChildSchemaAggregation(session, args.schemaCode, record.type ?? record.propertyType, args.options);
     }
     const update = {
         schemaCode: args.schemaCode,

package/dist/lanes/organization.js

@@ -324,12 +324,61 @@ export function registerOrganizationLane(tools) {
         const after = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentGet, query: { ...orgQuery(session), deptId: args.deptId } })).data;
         return { performed: { errcode: 0 }, readback: { deptId: args.deptId, name: after?.name ?? null, parentId: after?.parentId ?? null, managerId: after?.managerId ?? null, enabled: after?.enabled ?? null } };
     });
-    writeTool(tools, "org.department.delete", LANE, SCOPES.deptDelete, "删除部门（`GET organization/department/strike_out?id=`）。平台会拒绝：有子部门 → 200009「部门下面存在子部门，不能删除！」；有用户 → 200002「部门下面存在用户，不能删除！」。工具先计数并在回读里给出，仍由平台裁决。", { deptId: z.string().min(1), force: z.boolean().optional().describe("true = 先逐个删除子部门（仅当子部门无用户）再删本部门；有用户仍由平台裁决") }, async (session, args) => {
+    writeTool(tools, "org.department.delete", LANE, SCOPES.deptDelete, "删除部门（`GET organization/department/strike_out?id=`）。平台会拒绝：有子部门 → 200009「部门下面存在子部门，不能删除！」；有用户 → 200002「部门下面存在用户，不能删除！」。工具先计数并在回读里给出，仍由平台裁决。", {
+        deptId: z.string().min(1),
+        force: z.boolean().optional().describe("true = 先逐个删除子部门（仅当子部门无用户）再删本部门；有用户仍由平台裁决"),
+        transferUsersTo: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("有员工时的转出目标部门 id：给了它就先把本部门（及 force 时的子树各部门）的员工逐人 transferDepartment 到该部门再删；不给则带人即拒绝。目标必须是现存部门，且不能是被删子树的一部分"),
+    }, async (session, args) => {
         const users = wireRows((await wireCall(session, { path: ENDPOINTS.organizationDepartmentUsers, query: { ...orgQuery(session), deptId: args.deptId } })).data);
         // Pre-check children: the platform's 200009 ("部门下面存在子部门") is
         // accurate but sends the caller hunting for ids. Name them and hand over
         // the child-delete command (found during r15 org cleanup).
         const walked = await collectOrgDepartments(session);
+        // transferUsersTo (opt-in member evacuation): the target must be a real
+        // department and must NOT be inside the subtree being deleted — moving
+        // people into a dept that is about to be deleted would lose them.
+        const transferTarget = typeof args.transferUsersTo === "string" ? args.transferUsersTo.trim() : "";
+        let transferUsers;
+        if (transferTarget) {
+            if (!walked.rows.some((row) => row.id === transferTarget))
+                throw new ToolRefusalError({
+                    status: "refused", blocker: "department-transfer-target-absent", deptId: String(args.deptId), transferUsersTo: transferTarget,
+                    message: `transferUsersTo 的目标部门 ${transferTarget} 不存在（org.department.list 里没有）。先确认部门 id，或先创建目标部门。`,
+                });
+            const subtreeIds = new Set([String(args.deptId)]);
+            let grew = true;
+            while (grew) {
+                grew = false;
+                for (const row of walked.rows)
+                    if (subtreeIds.has(row.parentId) && !subtreeIds.has(row.id)) {
+                        subtreeIds.add(row.id);
+                        grew = true;
+                    }
+            }
+            if (subtreeIds.has(transferTarget))
+                throw new ToolRefusalError({
+                    status: "refused", blocker: "department-transfer-into-subtree", deptId: String(args.deptId), transferUsersTo: transferTarget,
+                    message: `transferUsersTo=${transferTarget} 在被删除的子树里——把人转进一个即将被删的部门会丢成员。换一个子树外的部门。`,
+                });
+            transferUsers = async (fromDeptId, deptUsers) => {
+                let moved = 0;
+                for (const member of deptUsers) {
+                    const userId = String(member.id ?? member.userId ?? "");
+                    if (!userId)
+                        continue;
+                    await wireCall(session, {
+                        path: ENDPOINTS.organizationUserDeptTransfer, method: "POST", query: orgQuery(session),
+                        body: { userIds: [userId], sourceDept: fromDeptId, targetDept: transferTarget },
+                    });
+                    moved += 1;
+                }
+                return moved;
+            };
+        }
         const children = walked.rows
             .filter((row) => row.parentId === String(args.deptId))
             .map((row) => ({ id: row.id, name: row.name }))
@@ -363,6 +412,11 @@ export function registerOrganizationLane(tools) {
             deletedChildren = ordered.length;
             for (const child of ordered) {
                 try {
+                    if (transferUsers) {
+                        const childUsers = wireRows((await wireCall(session, { path: ENDPOINTS.organizationDepartmentUsers, query: { ...orgQuery(session), deptId: child.id } })).data);
+                        if (childUsers.length > 0)
+                            await transferUsers(child.id, childUsers);
+                    }
                     await wireCall(session, { path: ENDPOINTS.organizationDepartmentDelete, query: { ...orgQuery(session), id: child.id } });
                 }
                 catch (error) {
@@ -372,12 +426,16 @@ export function registerOrganizationLane(tools) {
                         status: "refused", blocker: usersPending ? "department-has-users" : "department-delete-failed",
                         deptId: String(args.deptId), blockedChild: child,
                         nextCommand: `omc call org.department.users --args '${JSON.stringify({ deptId: child.id })}'`,
-                        message: `force 清理到子部门 ${child.name}(${child.id}) 时失败：${message}。${usersPending ? "该部门下还有员工——先转出再删。" : "平台拒绝删除该子部门。"}`,
+                        message: `force 清理到子部门 ${child.name}(${child.id}) 时失败：${message}。${usersPending ? "该部门下还有员工——先转出再删（或传 transferUsersTo 让工具搬）。" : "平台拒绝删除该子部门。"}`,
                     });
                 }
             }
         }
-        if (users.length > 0) {
+        let transferredUsers = 0;
+        if (users.length > 0 && transferUsers) {
+            transferredUsers = await transferUsers(String(args.deptId), users);
+        }
+        if (users.length > 0 && !transferUsers) {
             // Name every member and hand over a runnable transfer for the first one:
             // "先看人再转出" left the caller to assemble the transfer args (item 9).
             const members = users.map((row) => ({ id: row.id ?? row.userId ?? null, name: row.name ?? null, username: row.username ?? null }));
@@ -389,12 +447,20 @@ export function registerOrganizationLane(tools) {
                     ? `omc call org.user.transferDepartment --args '${JSON.stringify({ userId: first.id, departmentId: parentId })}'`
                     : `omc call org.department.users --args '${JSON.stringify({ deptId: String(args.deptId) })}'`,
                 message: `部门 ${args.deptId} 下还有 ${users.length} 名员工，平台拒绝删除（200002）。成员：${members.map((member) => `${member.name ?? "?"}(${member.id ?? "?"})`).join("、")}。` +
-                    `平台不允许删带人的部门，也不提供"随部门级联转出"；逐个 org.user.transferDepartment 转到 ${parentId ? `父部门 ${parentId}` : "目标部门"} 后再删。` +
-                    `（force 只处理子部门，不搬人——搬人是组织语义决策，工具不替你做。）`,
+                    `平台不允许删带人的部门，也不提供"随部门级联转出"。两个选择：` +
+                    `① 逐个 org.user.transferDepartment 转到 ${parentId ? `父部门 ${parentId}` : "目标部门"} 后再删；` +
+                    `② 本命令直接带 transferUsersTo:"<目标部门id>"，工具会先把人逐人转出（含 force 时的子树各部门）再删。` +
+                    `（默认不搬人——搬人是组织语义决策，不替你选目标部门。）`,
             });
         }
         await wireCall(session, { path: ENDPOINTS.organizationDepartmentDelete, query: { ...orgQuery(session), id: args.deptId } });
-        return { performed: { errcode: 0 }, readback: { deptId: args.deptId, deleted: true, usersBeforeDelete: users.length, deletedChildren } };
+        return {
+            performed: { errcode: 0 },
+            readback: {
+                deptId: args.deptId, deleted: true, usersBeforeDelete: users.length, deletedChildren,
+                ...(transferredUsers > 0 ? { transferredUsers, transferredTo: transferTarget } : {}),
+            },
+        };
     });
     tools.push(defineTool({
         name: "org.department.users",

package/dist/lanes/runtime-data.js

@@ -410,20 +410,46 @@ function collectChildArrayPaths(value, childCodes, prefix = "") {
     }
     return found;
 }
-async function stampChildRowStatuses(session, schemaCode, formData) {
-    const childCodes = new Set();
+/**
+ * One published field.list read, reused by the child-row stamping AND the
+ * value-shape gates below, so the gates add zero extra wire calls.
+ */
+async function loadPublishedFieldMeta(session, schemaCode) {
     try {
         const rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+        const childCodes = [];
+        const meta = new Map();
         for (const row of rows) {
-            if (Number(row.propertyType ?? row.type) === CHILD_TABLE_PROPERTY_TYPE)
-                childCodes.add(String(row.code ?? row.propertyCode ?? ""));
+            const code = String(row.code ?? row.propertyCode ?? "");
+            if (!code)
+                continue;
+            const type = Number(row.propertyType ?? row.type);
+            let format;
+            if (typeof row.options === "string" && row.options) {
+                try {
+                    const parsed = JSON.parse(row.options);
+                    if (typeof parsed.format === "string")
+                        format = parsed.format;
+                }
+                catch {
+                    // unparsable options: shape gates for this field are skipped
+                }
+            }
+            meta.set(code, { type, ...(format !== undefined ? { format } : {}) });
+            if (type === CHILD_TABLE_PROPERTY_TYPE)
+                childCodes.push(code);
         }
+        return { childCodes, meta };
     }
     catch {
-        return { formData, childCodes: [] };
+        return null;
     }
-    if (childCodes.size === 0)
-        return { formData, childCodes: [] };
+}
+async function stampChildRowStatuses(session, schemaCode, formData, preloaded) {
+    const loaded = preloaded !== undefined ? preloaded : await loadPublishedFieldMeta(session, schemaCode);
+    if (!loaded || loaded.childCodes.length === 0)
+        return { formData, childCodes: loaded?.childCodes ?? [], meta: loaded?.meta ?? new Map() };
+    const childCodes = new Set(loaded.childCodes);
     let changed = false;
     const next = { ...formData };
     for (const code of childCodes) {
@@ -441,7 +467,195 @@ async function stampChildRowStatuses(session, schemaCode, formData) {
             return { ...row, rowStatus: hasId ? "Modified" : "Added" };
         });
     }
-    return { formData: changed ? next : formData, childCodes: [...childCodes] };
+    return { formData: changed ? next : formData, childCodes: [...childCodes], meta: loaded.meta };
+}
+/**
+ * The one write-path preflight shared by data.save / data.update / data.submit:
+ * load the published field metadata ONCE, refuse the proven bad value shapes
+ * (date/relation/child-row-id) BEFORE any mutation, then stamp rowStatus.
+ */
+async function prepareRuntimeFormData(session, schemaCode, formData, opts) {
+    const loaded = await loadPublishedFieldMeta(session, schemaCode);
+    if (loaded)
+        assertRuntimeFieldValueShapes(loaded.meta, formData, loaded.childCodes, { schemaCode, isUpdate: opts.isUpdate });
+    const stamped = await stampChildRowStatuses(session, schemaCode, formData, loaded);
+    return { formData: stamped.formData, childCodes: stamped.childCodes };
+}
+/**
+ * Translate a platform DATE options.format into a validator regex. The format
+ * enum is UPPERCASE (`YYYY-MM-DD HH:mm:ss`), tokenized longest-first; literals
+ * (`-`, `/`, `:`, space, 年/月/日) are escaped. Unknown formats return null —
+ * the gate then stays silent rather than guessing.
+ */
+function dateFormatRegex(format) {
+    const KNOWN = new Set([
+        "YYYY", "YYYY-MM", "YYYY/MM", "YYYY-MM-DD", "YYYY/MM/DD",
+        "YYYY-MM-DD HH:mm", "YYYY/MM/DD HH:mm", "YYYY-MM-DD HH:mm:ss", "YYYY/MM/DD HH:mm:ss",
+        "YYYY-MM-DD CN-APM", "YYYY/MM/DD CN-APM", "YYYY-MM-DD CN-APM HH:mm", "YYYY/MM/DD CN-APM HH:mm",
+        "YYYY-MM-DD EN-APM", "YYYY/MM/DD EN-APM", "YYYY-MM-DD EN-APM HH:mm", "YYYY/MM/DD EN-APM HH:mm",
+        "YYYY年MM月DD日", "YYYY年MM月",
+    ]);
+    if (!KNOWN.has(format))
+        return null;
+    const pattern = format
+        .split("CN-APM").join("\u0001")
+        .split("EN-APM").join("\u0002")
+        .split("YYYY").join("\\d{4}")
+        .split("MM").join("\\d{2}")
+        .split("DD").join("\\d{2}")
+        .split("HH").join("\\d{2}")
+        .split("mm").join("\\d{2}")
+        .split("ss").join("\\d{2}")
+        .split("\u0001").join("(?:上午|下午)")
+        .split("\u0002").join("(?:AM|PM)")
+        .replace(/[-/]/g, (ch) => `\\${ch}`);
+    return new RegExp(`^${pattern}$`);
+}
+/**
+ * r17 (2026-10-26) live write-shape evidence on 1.1.25 — every case below was
+ * observed on the wire, none is speculative:
+ *  - DATE(3): a plain string in the field's declared format lands correctly;
+ *    a millisecond timestamp is ACCEPTED and stored NULL (silent data loss);
+ *    a date-only or ISO-8601-with-timezone string against a datetime format
+ *    answers 50000 服务异常.
+ *  - WORK_SHEET(9): a single relation field takes the bare object id string;
+ *    an array answers 50000 服务异常.
+ *  - CHILD_TABLE rows on an UPDATE of an existing record: a row without `id`
+ *    is INSERTED as a NEW child row (no upsert) — r17: four updates each
+ *    resending two id-less rows turned 2 child rows into 8, and a roll-up
+ *    SUM over them silently doubled. The portal always sends the id (→
+ *    rowStatus Modified) for existing rows; a hand-built payload must too.
+ */
+export function assertRuntimeFieldValueShapes(meta, formData, childCodes, context) {
+    for (const [code, value] of Object.entries(formData)) {
+        if (value === null || value === undefined)
+            continue;
+        const field = meta.get(code);
+        if (!field)
+            continue;
+        if (field.type === 3 && typeof value === "number") {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-date-shape",
+                schemaCode: context.schemaCode,
+                field: code,
+                message: `日期字段 ${code} 收到数字 ${value}（毫秒时间戳）：平台接受但**静默落库 NULL**（r17 真机）。` +
+                    `日期必须写成字段 format 对应的字符串（本字段 format=${field.format ?? "未知"}），如 "2026-10-26 11:00:00"。`,
+            });
+        }
+        if (field.type === 3 && typeof value === "string" && field.format) {
+            const re = dateFormatRegex(field.format);
+            if (re && !re.test(value.trim())) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "submit-date-shape",
+                    schemaCode: context.schemaCode,
+                    field: code,
+                    format: field.format,
+                    message: `日期字段 ${code} 的值 "${value}" 不匹配字段声明的 format "${field.format}"——平台直接回 50000 服务异常（r17 真机：仅日期串/ISO8601 带时区都打回）。` +
+                        `按 format 逐位对齐；改格式走 field.update。`,
+                });
+            }
+        }
+        if (field.type === 9 && Array.isArray(value)) {
+            // Same refusal as the post-hoc diagnoseRelationShapeFailure (which stays
+            // as the backstop for nested child-row relations); pre-write is cheaper.
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "relation-single-array-shape",
+                schemaCode: context.schemaCode,
+                fields: [code],
+                message: `单选关联字段 ${code}（WORK_SHEET/propertyType 9）传了数组：平台稳定回 50000（r17b 2026-10-26 真机）。` +
+                    `单值关联写 **id 字符串或 {id}**；多值关联（MULT_WORK_SHEET 11）与人员/组织（50/51）才用数组。`,
+            });
+        }
+    }
+    if (context.isUpdate) {
+        const problems = [];
+        for (const code of childCodes) {
+            const rows = formData[code];
+            if (!Array.isArray(rows))
+                continue;
+            const missing = rows.filter((row) => row !== null &&
+                typeof row === "object" &&
+                !Array.isArray(row) &&
+                !(typeof row.id === "string" && row.id.trim().length > 0) &&
+                !(typeof row.rowStatus === "string" && row.rowStatus.trim().length > 0));
+            if (missing.length > 0)
+                problems.push(`${code}（${missing.length}/${rows.length} 行无 id/rowStatus）`);
+        }
+        if (problems.length > 0) {
+            throw new ToolRefusalError({
+                status: "refused",
+                blocker: "submit-child-rows-missing-id",
+                schemaCode: context.schemaCode,
+                childTables: problems,
+                message: `更新既有记录时子表行必须带 id：${problems.join("、")}。平台对无 id 的子行按**新增插入**（不判重）——` +
+                    `r17 真机：同一条记录连发 4 次带 2 行无 id 子表的 update，子行从 2 变 8，聚合 SUM 翻倍。` +
+                    `改既有行：先 data.load 拿子行 id 原样带回（平台走 rowStatus=Modified）；` +
+                    `有意追加新行：显式给该行 rowStatus:"Added"。`,
+            });
+        }
+    }
+}
+/**
+ * r18 (2026-10-26 live): `errcode 40000 调用数据库发生异常` carries NO detail and
+ * `omc-refusals` had nothing for it. A probe burned ~40 calls bisecting it:
+ * the cause was an AGGREGATION field whose `schemaCode` pointed at a CHILD-TABLE
+ * schema — publish succeeds, then every write on that model 40000s. A FORMULA
+ * field whose config cannot serialize does the same.
+ *
+ * Metadata is read ONLY on failure (zero cost on the success path). The refusal
+ * names the model's FORMULA/AGGREGATION fields so the caller bisects the right
+ * thing instead of guessing at forms/permissions.
+ */
+async function diagnoseDbException(session, schemaCode, error) {
+    // Non-40000 errors fall through untouched (callers keep their own branches).
+    if (!(error instanceof WireError && error.kind === "business" && error.errcode === 40000))
+        return false;
+    let rows = [];
+    try {
+        rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+    }
+    catch {
+        // metadata unavailable: still explain what 40000 means
+    }
+    const formulaFields = [];
+    for (const row of rows) {
+        if (Number(row.propertyType ?? row.type) !== 100)
+            continue;
+        let formulaType;
+        let aggregationSchemaCode;
+        if (typeof row.options === "string" && row.options) {
+            try {
+                const options = JSON.parse(row.options);
+                const config = typeof options.formulaConfig === "string" ? JSON.parse(options.formulaConfig) : undefined;
+                if (typeof config?.formulaType === "string")
+                    formulaType = config.formulaType;
+                if (typeof config?.aggregation === "string") {
+                    const agg = JSON.parse(config.aggregation);
+                    if (typeof agg.schemaCode === "string")
+                        aggregationSchemaCode = agg.schemaCode;
+                }
+            }
+            catch {
+                formulaType = "unparsable-formulaConfig";
+            }
+        }
+        formulaFields.push({ code: String(row.code ?? row.propertyCode ?? ""), ...(formulaType ? { formulaType } : {}), ...(aggregationSchemaCode ? { aggregationSchemaCode } : {}) });
+    }
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "runtime-write-db-exception",
+        schemaCode,
+        errcode: 40000,
+        formulaFields,
+        message: `平台回 40000「调用数据库发生异常」——这是**无明细的掩码**，不是表单/权限问题（r18 真机）。` +
+            `本模型上的公式字段：${formulaFields.length > 0 ? formulaFields.map((field) => `${field.code}(${field.formulaType ?? "?"}${field.aggregationSchemaCode ? `→${field.aggregationSchemaCode}` : ""})`).join("、") : "（读不到 field.list，或没有 FORMULA 字段）"}。` +
+            `最常见原因：**AGGREGATION 字段的 schemaCode 指向子表 schema** —— 平台允许发布，但该模型从此整个不可写。` +
+            `其次是 FORMULA 的 formulaConfig 无法序列化。` +
+            `定位：依次禁用/删除可疑公式字段再写一次（可逆）；形状见 omc describe field.create --example formula-aggregation-cross-model。`,
+    });
 }
 /** Runtime business-object data keyed by field code. */
 export function registerRuntimeDataLane(tools) {
@@ -766,7 +980,9 @@ export function registerRuntimeDataLane(tools) {
                 message: "submit:true 与 workflowCode 互斥——workflowCode 是流程草稿两段式的第一段（返回 workItemId 后用 data.submit 提交）；无流程模型的一调完成态用 submit:true 且不带 workflowCode",
             });
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
+        const rawSaveData = args.formData;
+        const saveIsUpdate = typeof rawSaveData.id === "string" && rawSaveData.id.trim().length > 0;
+        const formData = (await prepareRuntimeFormData(session, args.schemaCode, rawSaveData, { isUpdate: saveIsUpdate })).formData;
         if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
             // Portal draft-save shape. The row id travels in data.id (the portal
             // form SDK receives a pre-generated id from form/load and echoes it);
@@ -792,15 +1008,22 @@ export function registerRuntimeDataLane(tools) {
             // isStartWf branch runs verifyReplay; the instance is DRAFT only when
             // data carries sequenceStatus DRAFT (an empty default builds PROCESSING).
             const replayToken = await getReplayToken(session);
-            const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
-                path: ENDPOINTS.runtimeFormSave,
-                method: "POST",
-                body: {
-                    workflowCode: args.workflowCode,
-                    ...(replayToken ? { replayToken } : {}),
-                    bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
-                },
-            }), formData, args.workflowCode);
+            let performed;
+            try {
+                performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
+                    path: ENDPOINTS.runtimeFormSave,
+                    method: "POST",
+                    body: {
+                        workflowCode: args.workflowCode,
+                        ...(replayToken ? { replayToken } : {}),
+                        bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
+                    },
+                }), formData, args.workflowCode);
+            }
+            catch (error) {
+                await diagnoseDbException(session, args.schemaCode, error);
+                throw error;
+            }
             const vo = (performed.data ?? {});
             const returnedId = typeof vo.objectId === "string" && vo.objectId ? vo.objectId : typeof vo.bizObjectId === "string" && vo.bizObjectId ? vo.bizObjectId : objectId;
             const workflowInstanceId = typeof vo.workflowInstanceId === "string" ? vo.workflowInstanceId : null;
@@ -835,11 +1058,18 @@ export function registerRuntimeDataLane(tools) {
                 readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
             };
         }
-        const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
-            path: ENDPOINTS.runtimeFormSave,
-            method: "POST",
-            body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
-        }), formData);
+        let performed;
+        try {
+            performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
+                path: ENDPOINTS.runtimeFormSave,
+                method: "POST",
+                body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
+            }), formData);
+        }
+        catch (error) {
+            await diagnoseDbException(session, args.schemaCode, error);
+            throw error;
+        }
         const bizObjectId = performed.data?.bizObjectId ?? performed.data?.objectId ?? performed.data;
         let readbackData = null;
         if (typeof bizObjectId === "string" && bizObjectId) {
@@ -932,15 +1162,22 @@ export function registerRuntimeDataLane(tools) {
                 message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
             });
         }
-        const formData = (await stampChildRowStatuses(session, args.schemaCode, args.formData)).formData;
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.runtimeFormSave,
-            method: "POST",
-            // Live-proven shape: BizObjectModel.getId() reads data["id"], so the
-            // target id MUST travel inside `data`; a top-level bizObject.id is
-            // ignored and the platform silently creates a new row.
-            body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: args.bizObjectId } } },
-        });
+        const formData = (await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true })).formData;
+        let performed;
+        try {
+            performed = await wireCall(session, {
+                path: ENDPOINTS.runtimeFormSave,
+                method: "POST",
+                // Live-proven shape: BizObjectModel.getId() reads data["id"], so the
+                // target id MUST travel inside `data`; a top-level bizObject.id is
+                // ignored and the platform silently creates a new row.
+                body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: args.bizObjectId } } },
+            });
+        }
+        catch (error) {
+            await diagnoseDbException(session, args.schemaCode, error);
+            throw error;
+        }
         const performedData = (performed.data ?? {});
         const returnedId = typeof performedData.objectId === "string" ? performedData.objectId : typeof performedData.bizObjectId === "string" ? performedData.bizObjectId : args.bizObjectId;
         const readbackData = await loadExistingBizObject(session, args.schemaCode, sheetCode, returnedId);
@@ -1066,7 +1303,7 @@ export function registerRuntimeDataLane(tools) {
             });
         }
         const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const stampedSubmit = await stampChildRowStatuses(session, args.schemaCode, args.formData);
+        const stampedSubmit = await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: targetObjectId !== null });
         const formData = stampedSubmit.formData;
         // r5-asset 2026-10-20: the platform APPENDS child rows carried in an
         // approval submit's formData (no upsert by row id, no error). Live: an
@@ -1267,6 +1504,7 @@ export function registerRuntimeDataLane(tools) {
             }), undefined, hasWorkflowCode ? explicitWorkflowCode : undefined);
         }
         catch (error) {
+            await diagnoseDbException(session, args.schemaCode, error);
             // r16 P4: 100005 is SYS_REPLAY_ERROR「频繁重复提交！」(ErrorCode.java:68 —
             // the same numeric code as TEST_CONNECTION_FAIL, so only the text
             // separates them). The platform rate-limits per WORK ITEM, so a different

package/dist/model-scaffold.js

@@ -108,11 +108,50 @@ export async function cmdModelScaffold(args) {
         ...(environment !== undefined ? { environment } : {}),
     };
     const plan = describeScaffoldPlan(options);
+    // r18: run the field-family preflight even in DRY-RUN. It is zero-wire
+    // (`field.create --dry-run` runs only the local capability gate), and the
+    // probe's first attempt — NUMERICAL without options.scale — passed the old
+    // plan-only dry-run and would have half-built a model on --apply.
+    const preflightProblems = [];
+    const preflightTargets = [
+        ...fields.filter((field) => scaffoldChildrenOf(field).length === 0),
+        ...fields.filter((field) => scaffoldChildrenOf(field).length > 0),
+    ];
+    {
+        for (const field of preflightTargets) {
+            const probe = await runToolCall("field.create", {
+                args: scaffoldFieldArgs(code, field),
+                requestId: request,
+                dryRun: true,
+                ...(environment !== undefined ? { environment } : {}),
+                print: () => undefined,
+            });
+            const status = String(probe.result.status ?? "ok");
+            if (probe.exitCode !== 0 || (status !== "dry-run" && status !== "ok")) {
+                preflightProblems.push({ code: field.code, message: refusalText(probe.result) });
+            }
+        }
+        if (preflightProblems.length > 0) {
+            writeEnvelope(envelope("error", {
+                status: "refused",
+                blocker: "scaffold-preflight-failed",
+                model: code,
+                written: false,
+                failed: preflightProblems.length,
+                preflightProblems,
+                message: `有 ${preflightProblems.length} 个字段的预检没过，**尚未写入任何东西**。` +
+                    `按 message 改 --fields 后重跑（常见：NUMERICAL 缺 options.scale、文本/数值字段用了自定义键名）。` +
+                    `--fields 的每一项就是 field.create 的参数（形状见 omc describe field.create），子表列用 subFields（childFields 是别名）。`,
+            }, request, { code: "policy-refused", message: "字段形状预检未通过（未写入）", retryable: false }));
+            return CLI_EXIT_CODES.policyRefused;
+        }
+    }
     if (!apply) {
         writeEnvelope(envelope("ok", {
             status: "dry-run",
             ...plan,
-            note: "dry-run 只列计划；--apply 依次执行 建模型 → 建字段 → 建子列 → 发布字段 → 发布表单。",
+            preflight: { checked: fields.length, passed: true },
+            note: "dry-run 只列计划；已对每个字段跑过本地形状预检（零 wire）。--apply 依次执行 建模型 → 建字段 → 建子列 → 发布字段 → 发布表单。",
         }, request));
         return CLI_EXIT_CODES.ok;
     }
@@ -138,43 +177,7 @@ export async function cmdModelScaffold(args) {
         return { ok: outcome.exitCode === 0, result };
     };
     const lastSummaries = [];
-    // 0) 前置校验：把每个字段先跑一次 dry-run（走完整字段族 preflight，不写库）。
-    // r13 真机：`NUMERICAL` 少 options.scale 时，前两个字段已经建好了才在第 3 个
-    // 报错，留下一个半成品模型要手工清。半成品比慢一点贵得多。
-    // 子列不在这里校验：它们的目标 schema（子表）此刻还不存在，dry-run 会误报。
-    const preflightTargets = [
-        ...fields.filter((field) => scaffoldChildrenOf(field).length === 0),
-        ...fields.filter((field) => scaffoldChildrenOf(field).length > 0),
-    ];
-    const preflightProblems = [];
-    for (const field of preflightTargets) {
-        const probe = await runToolCall("field.create", {
-            args: scaffoldFieldArgs(code, field),
-            requestId: request,
-            dryRun: true,
-            ...(environment !== undefined ? { environment } : {}),
-            print: () => undefined,
-        });
-        const status = String(probe.result.status ?? "ok");
-        if (probe.exitCode !== 0 || (status !== "dry-run" && status !== "ok")) {
-            preflightProblems.push({ code: field.code, message: refusalText(probe.result) });
-        }
-    }
-    if (preflightProblems.length > 0) {
-        const result = {
-            status: "refused",
-            blocker: "scaffold-preflight-failed",
-            model: code,
-            // Nothing was written — that is the point.
-            written: false,
-            failed: preflightProblems.length,
-            preflightProblems,
-            message: `有 ${preflightProblems.length} 个字段的 dry-run 预检没过，**尚未写入任何东西**。` +
-                `按下面的 message 改 --fields 后重跑（常见：NUMERICAL 缺 options.scale、SELECTION/RADIO 缺 choices、CHILD_TABLE 缺 subFields）。`,
-        };
-        writeEnvelope(envelope("refused", result, request, { code: "policy-refused", message: String(result.message), retryable: false }));
-        return CLI_EXIT_CODES.policyRefused;
-    }
+    // 0) 字段形状预检已在上面的 dry-run 分支前完成（零 wire）；这里只记录。
     steps.push({ step: "preflight", status: "ok", detail: { checked: preflightTargets.length, wrote: false } });
     // 1) 模型：已存在是常态（补建场景），不是失败。
     const created = await call("model.create", {

package/dist/recipes/field.js

@@ -253,21 +253,22 @@ const formulaAggregationCrossModel = Object.freeze({
     preconditions: [
         "**只能汇总「别的模型」**：同模型（含自己的子表）聚合在 field.publish 必抛 305003（平台 publishFormula 把相对码改写成子表父模型 = 本模型，checkCycleOfAggregation:1032 判成环）。工具已写前拒绝 `aggregation-self-schema-cycle`。",
         "目标字段用 FORMULA(100)（不是普通字段 + 计算规则——type2 计算规则在 REST 路径永不执行）。",
-        "`schemaCode` 是被汇总的**来源模型**；`dataItemCode` 是来源模型的列；`queryConditions` **不能为空**，否则反向过滤器为空、找不到要回算的目标行（真机：空条件时 recalc 日志照常打印但目标字段恒为 0）。",
+        "`schemaCode` 是被汇总的**来源模型**；`dataItemCode` 是来源模型的**主表标量列**（不带 schema 前缀）；`queryConditions` **不能为空**，否则反向过滤器为空、找不到要回算的目标行（真机：空条件时 recalc 日志照常打印但目标字段恒为 0）。",
+        "**不要指向子表 schema**（r18 2026-10-26 真机）：`schemaCode:\"<子表>\"` 能发布，但目标模型从此**整个不可写** —— `data.submit`/`data.update` 一律回 40000「调用数据库发生异常」且无明细；而且子表 schema 没有父单单号列，按父单匹配恒为 0。`dataItemCode` 写成 `<子表>.<子列>` 则在 publish 直接 309004「使用的聚合数据项不存在」。要汇总子表：先在来源**主模型**上物化一个数值字段（门户计算规则或写入方维护），再聚合该标量。OMC 已写前拒绝 `aggregation-target-is-child-schema` / `aggregation-data-item-not-scalar`。",
     ],
     conditionalRequirements: [
         "**DYNAMIC 条件的两个 code 分属两侧，写反了就静默 0**：`propertyCode` = **来源模型**的字段（这里是 r17_c.nm），`currentPropertyCode` = **目标模型**的字段（这里是 r17_d.srcNo）。语义 = 「来源行的 nm 等于本目标行的 srcNo」。",
         "`propertyType`/`currentPropertyType` 是 BizPropertyType 的**整数码**（0=SHORT_TEXT 2=NUMERICAL 9=WORK_SHEET…），`operatorType` 是 OperatorType 的**整数码**（1=EQ 6=ITEQ 9=IS_NULL 10=IS_NOT_NULL…）。写名字会被 ObjectMapperUtils 抛 json processing exception 并掩码成 305003；工具会自动转码。",
         "`calculateType` 是**字符串**（SUM/COUNT/COUNTIF/SUMIF/AVG/MAX/MIN/LARGE/SMALL/UNION），不是枚举 code。",
         "发布后平台会**自动生成一条 t100 CALCULATE_RULE 镜像行**（h_biz_data_rule，propertyCode=字段 code），它是回算触发的前置条件，别手动删。",
-        "回算时机 = **来源模型的行被 submit/update/delete**（`FormulaPropertySupport.onTriggerObjectChanged`）。目标行本身写入不会触发聚合。",
+        "**回算时机（r17b 2026-10-26 真机完整行为图谱）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠，不依赖事件）；② 来源行 submit/update/delete 触发 `RollUpEventListener`→`FormulaPropertySupport` 事件回算——FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件（propertyCode 带 `.`）都验证过，DELETE 也会回算；③ ⚠️ 事件回算**只在目标模型发布后的几分钟内可靠**，之后静默停止（源端数据变了目标字段不更新、无报错）——重新 `field.publish --force` 目标模型即可恢复。定时巡检/对账场景务必重发或依赖目标行写入路径。",
     ],
     priorToolReferences: [
         { tool: "field.list", args: { environment, schemaCode: "r17_c", published: true }, purpose: "确认来源模型与其列已发布，取 dataItemCode 与 DYNAMIC 条件的 propertyCode" },
         { tool: "field.list", args: { environment, schemaCode: "r17_d", published: true }, purpose: "确认目标模型已有所承载匹配值的字段（currentPropertyCode）" },
     ],
     dryRun: { supported: true, command: `omc call field.create --env ${environment} --dry-run --args '<recipe.args>'`, notes: "dry-run 校验 options 形状与聚合目标；同模型聚合在此拒绝" },
-    expectedReadback: { readback: { fieldPresent: true, options: { formulaConfig: "<含 AGGREGATION + DYNAMIC 条件>" } }, next: ["field.publish", "data.submit 来源行 ×2 → data.load 目标行读到合计", "form.publish"] },
+    expectedReadback: { readback: { fieldPresent: true, options: { formulaConfig: "<含 AGGREGATION + DYNAMIC 条件>" } }, next: ["field.publish", "data.submit 来源行（紧接发布后几分钟内）→ data.load 目标行读到合计", "form.publish"] },
     refusalRecovery: [
         { code: "aggregation-self-schema-cycle", action: "把 schemaCode 换成另一个模型；同模型/自己的子表聚合平台不支持" },
         { code: "duplicate-field", action: "字段已存在改用 field.update 或换 code" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.96",
+  "version": "0.4.98",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.96",
+    "@stalfh233/omc-fake-platform": "0.4.98",
     "commander": "14.0.3",
-    "omc-core": "0.4.96",
+    "omc-core": "0.4.98",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-business-configuration.md

@@ -154,9 +154,10 @@ rules:
 - **「聚合计算」是字段能力，不是规则节点**：FORMULA(计算公式)字段的 `options.formulaConfig.formulaType="AGGREGATION"` 就是 UI 里的「配置方式 → 聚合计算」。**只能汇总另一个模型**（跨模型），**同模型/自己的子表会 305003**（`field.publish` 时 `publishFormula` 把相对码改写成子表父模型 = 本模型，`checkCycleOfAggregation:1032` 判成环；工具已写前拒绝 `aggregation-self-schema-cycle`）。可直接抄 `omc describe field.create --example formula-aggregation-cross-model`。形状：
   `options = {persistent:true, formulaConfig: JSON字符串({resultType:2, formulaType:"AGGREGATION", aggregation: JSON字符串({schemaCode:"<来源模型>", dataItemCode:"<来源列>", calculateType:"SUM", formula:"SUM({<来源模型>.<列>})", queryConditions:[[{propertyCode:"<来源模型字段>", currentPropertyCode:"<目标模型字段>", operatorType:1, valueType:"DYNAMIC"}]]})})}`。
   - **`queryConditions` 不能为空**：它是反向过滤器的唯一输入，空数组时回算日志照打但目标字段恒 0（r17 实测）。
+  - **聚合目标必须是来源主表的标量列**（r18 2026-10-26 真机）：`aggregation.schemaCode` 指向**子表 schema** 时能发布，但目标模型从此整个不可写（`data.submit`/`data.update` 全回 40000 无明细），且子表无父单单号列、匹配恒 0；`dataItemCode` 写 `<子表>.<子列>` 则 publish 回 309004。要子表合计：先在来源主模型物化一个数值字段，再聚合该标量。
   - **DYNAMIC 条件的两个 code 分属两侧，写反了静默 0**：`propertyCode` = 来源模型字段，`currentPropertyCode` = 目标模型字段；语义「来源行的 X 等于本目标行的 Y」。
   - **`propertyType`/`currentPropertyType`（BizPropertyType）与 `operatorType`（OperatorType）必须写整数**——两者都是 `@JsonCreator get(int)`：propertyType 0=SHORT_TEXT 2=NUMERICAL 3=DATE 9=WORK_SHEET…；operatorType 1=EQ 2=NEQ 3=GT 4=IT（小于）5=GTEQ 6=ITEQ（小于等于）9=IS_NULL 10=IS_NOT_NULL…。写名字会被 `ObjectMapperUtils` 抛 json processing exception，再被死循环校验掩码成 305003（工具接受名字并自动转码）。`calculateType` 相反，是**字符串**（SUM/COUNT/COUNTIF/SUMIF/AVG/MAX/MIN/LARGE/SMALL/UNION）。
-  - **回算时机**：来源模型的行 submit/update/delete 触发 `FormulaPropertySupport.onTriggerObjectChanged`；目标行自己写入不触发。发布后平台自动生成 t100 `CALCULATE_RULE` 镜像行，别删。r17 真机：目标行 srcNo=C1、来源 C1 行 amt=100 → 读 100；再提交一条 C1/amt=5 的来源行 → 读 105。
+  - **回算时机（r17b 2026-10-26 完整行为图谱）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠）；② 来源行 submit/update/**delete** 触发 `RollUpEventListener`→`FormulaPropertySupport` 事件回算（FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件都验过）；③ ⚠️ 事件回算**只在目标模型发布后几分钟内可靠**，之后静默停止（无报错）——`field.publish --force` 目标模型恢复。发布后平台自动生成 t100 `CALCULATE_RULE` 镜像行，别删。r17 真机：目标行 srcNo=C1、来源 C1 行 amt=100 → 读 100；再提交一条 C1/amt=5 → 读 105。
   - **普通数值字段 + 计算规则（type2）不能替代**：REST 路径永不执行（`CalculateHandler.java:50` 的 `forceExecuteCalculateRule` 从不置真），门户里才算。
 - **DYNAMIC 来源不要写点号**：`dataActions` 的 `currentDataItemValue` 写 `items.sealNo` 会被引擎当成**子表列集合**（DatasetImpl），标量目标收到集合 → 运行期 `submit/update` 报 50000（`WorkSheetBizField.fillClientContent: Incorrect value type`）。单跳关联字段直接写字段 code（引擎取 `.id`）；子表列只能用于公式/聚合。`rule.save` 已写前拒绝（`rule-graph-create-dynamic-source-is-child-collection`）。
 - **单选字段的 `dataCondition` 在 1.1.25 不生效**：用 FIXED 值比较 RADIO/CHECKBOX/DROPDOWN 时，运行时日志「解析选框类型数据项的比较值失败」，条件被跳过、节点**无条件执行**（r8：异常归还被当成已归还回写）。`rule.save` 会把它放进 `readback.lintHazards`（`rule-graph-radio-condition-unparseable`）；改用 BRANCH 判断该字段，或拆两条规则。

package/skills/omc-refusals.md

@@ -62,6 +62,14 @@ condition/expression/query shape is off. Compare against
 `omc describe <tool> --example …` and the node-graph prose, then re-save.
 Escalate to 二开 **only** for a real `capability-out-of-coverage` (§2).
 
+`40000 调用数据库发生异常` is the **most opaque** shape code — no detail at all.
+Line up the model's field-level config first: an `AGGREGATION` FORMULA field whose
+`aggregation.schemaCode` points at a **child-table schema** publishes fine and then
+makes every `data.submit`/`data.update` on that model 40000 (r18 2026-10-26 live;
+bisect by deleting/disabling the suspect formula field, which is reversible).
+`omc` now answers `runtime-write-db-exception` and lists the model's formula
+fields; the fix is to aggregate a MAIN-table scalar column instead.
+
 ## 4. Readback mismatch — the write landed but does not match
 
 `*-readback-failed`, `*-readback-mismatch`, `cleanup-absence-readback`,

package/skills/omc-write-hazards.md

@@ -36,6 +36,7 @@ omc help omc-write-hazards
 - **`mappings` 由表单运行时在用户选择时套用**，服务端 `data.save` **不会**自动回填映射目标字段。API 侧要自己写被映射字段，否则读回为空——别把它误判成“映射配置失败”。
 - **关联映射的事实源在字段行 `options.mappings`，不在表单控件属性**（真机 2026-10-14 实证：改表单 attributes 里的映射会被平台按字段重算覆盖、回读不生效）。改映射走：`field.update` 按完整 options 提交（只改 mappings，其余键原值保留）→ `field.publish` → `form.draft`（**rebuild:false**，保留现有布局与在线JS）重存 → `form.publish` → 回读核对。**别用 cascadeRepublish 刷带布局/在线JS 的表单**：rebuild 会清空设计器公式（已做写前拒绝）。
 - **运行时写值的最小形状**（组合出错只会得到一个不透明的 `50000`/NPE，逐一最小化再合）：单选关联(9) → id 字符串 `"<id>"`；**多选关联(11) → 分号串 `"<id1>;<id2>"`**；**人员/组织(50/51/60/61) → `[{"id":"<id>","type":3,"name":"<名>"}]`，`type` 必填且为整数**（缺/非整数 → `BizField.parseFromClient` 拆箱 NPE→50000；用户=3、部门=1）；日期(3) → 字符串 `"2026-09-30 10:00:00"`；子表(8) → 行对象数组 `[{"<子列code>":<值>, ...}]`。先各写一条最小行通过，再组合。
+  其中三类已有**写前拒绝**（r17b 2026-10-26 起）：日期收到毫秒时间戳（平台接受但落库 NULL）、日期字符串不匹配字段声明 format（50000）、单值关联收到数组（50000）——blocker `submit-date-shape` / `submit-relation-shape`。
 - **DATE(3) 字段的 `options.format` 必须是平台大写枚举**（`YYYY-MM-DD`、`YYYY-MM-DD HH:mm:ss`、`YYYY年MM月DD日`…），**不是 Java 的 `yyyy-MM-dd`**：平台 `DateBizField` 按字面比较，Java 写法能创建字段但**首次运行时 save 稳定 `50000`（`不支持的format`）**（2026-09-30 R5 实测）。`field.create`/`intent` 会就地拒绝非枚举值。
 
 - **多选关联(11) 的写入源码依据**（1.1.25 实机 jar）：`WorkSheetMultiBizField.contentFromClient` 只接受 `String` 或 `Map`，其它类型直接 `AppAsserts.isTrue(false, "Incorrect value type, should be string or map.")` → 表现为 50000；`contentToDbValue()` 返回 `map.get("id")`，而读回时按 `";"` 切分（`MULTI_WORK_SHEET_SPILT`）并组装 `items` 数组。所以**数组是读写不对称的读侧形状，不能拿来写**；分号串才是写侧形状。实测三种形状：`"<id>"`/`"<id>;<id>"` 成功、`["<id>"]` 50000。
@@ -89,6 +90,7 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
 
 父 `CHILD_TABLE` 行不接受 `options/choices/subFields` 更新；子列直接走上面的 CRUD 面。
 
+- **更新既有记录时，子表行必须带 `id`**（r17b 2026-10-26 真机）：`data.update`/`data.submit(bizObjectId)` 里无 `id` 也无显式 `rowStatus` 的子行，平台按**新增插入**（不判重）——同一条记录连发 4 次带 2 行无 id 子表的 update，子行从 2 变 8，聚合 SUM 翻倍。改既有行：先 `data.load` 拿子行 id 原样带回（→ rowStatus=Modified）；有意追加新行显式写 `rowStatus:"Added"`。OMC 已写前拒绝 `submit-child-rows-missing-id`。
 - **提交/审批都不要再回传子表数组**（真机 2026-10-19/20）：`data.save` 建草稿后 `data.submit` 若带子表行（无 `id`），平台按新增追加（3→9）；**审批提交同样**——`data.submit` 带 `workItemId`+`agree` 推进一步时回传子表，每级再 +1 行（1→2→3）。金额若显式传了合计不会翻倍，但行数与 SUM 口径已被污染，且没有报错。审批只回传标量字段（`agree`/意见/被改标量）；确需改子行时带 `id`+`rowStatus:"Modified"`。验收加一条"审批后子表行数不变"。
 
 ## 写调用纪律
@@ -103,12 +105,22 @@ omc call field.publish --env local --args '{"schemaCode":"expense"}'
     （早前「覆盖传入值、API 可判定」的结论来自 r12，已被推翻——不要再用它做验收。）
   - 源码门控：`CalculateHandler.java:50` 的 `forceExecuteCalculateRule` 只在 `BizObjectOptions.executeCalRule()` 为真时求值，而该 builder 全库 0 调用方（REST 路径从不置真）。
   - 所以「计算规则是否生效」**不能用 API 判定**；正确性只能在门户表单里验。API 调用方请自己算好再写。
-- **跨模型汇总可以走 FORMULA(100) + AGGREGATION，而且 REST 能回算**（r17 真机 100→105）：
+- **跨模型汇总可以走 FORMULA(100) + AGGREGATION，而且 REST 能回算**（r17 真机 100→105；r17b 2026-10-26 补齐行为图谱）：
   `aggregation.schemaCode` 指向**另一个模型**，`queryConditions` 必须给 DYNAMIC 条件
-  （`propertyCode`=来源模型字段、`currentPropertyCode`=目标模型字段）；来源行 submit/update/delete 触发
-  `FormulaPropertySupport.onTriggerObjectChanged`。配方：`omc describe field.create --example formula-aggregation-cross-model`。
+  （`propertyCode`=来源模型字段、`currentPropertyCode`=目标模型字段）。配方：`omc describe field.create --example formula-aggregation-cross-model`。
+  已验证的形状：FIXED+DYNAMIC 混用、多组 OR、COUNTIF/MAX、子表行级条件（`propertyCode` 带 `.`）、来源行 DELETE 也会回算。
+  **回算可靠性（重要）**：① 目标行**自己 submit** 时镜像规则一定算（最可靠）；② 来源行 submit/update/delete 的事件回算**只在目标模型发布后几分钟内可靠**，之后静默停止（无报错，源变了目标不更新）——重新 `field.publish --force` 目标模型恢复。验收：发布后立刻改来源行并读目标字段；长期对账别依赖事件回算。
 - **同模型（含自己的子表）聚合不可用**：`field.publish` 必抛 305003 —— `publishFormula` 把相对码改写成子表父模型（= 本模型），
   `checkCycleOfAggregation:1032` 判成环。与 payload 无关，8.6.26 与 1.1.25 代码相同。OMC 已写前拒绝 `aggregation-self-schema-cycle`。
+- **聚合目标不能是任何子表 schema，数据项必须是来源主表的标量列**（r18 2026-10-26 真机，代价约 40 次调用）：
+  `aggregation.schemaCode` 指向子表时**能发布**，但目标模型从此整个不可写 —— `data.submit`/`data.update` 全部回
+  `40000 调用数据库发生异常`（无明细）；且子表 schema 无父单单号列，按父单匹配恒为 0。
+  `dataItemCode` 写成 `<子表>.<子列>` 则在 publish 回 309004「使用的聚合数据项不存在」。
+  正解：要子表合计，先在来源**主模型**物化一个数值字段（门户计算规则 / 写入方维护），再聚合该标量。
+  OMC 已写前拒绝 `aggregation-target-is-child-schema`（读一次来源字段清单识别 parentId+sortKey）与
+  `aggregation-data-item-not-scalar`（点号）。
+- **`40000` 的无明细掩码怎么查**：先怀疑字段级配置（上面的聚合/公式），用「删/禁一个公式字段再写一次」二分，
+  不要从表单/权限开始查。OMC 现在会把 40000 转成 `runtime-write-db-exception` 并列出该模型的公式字段。
 - **区别：`FORMULA`（计算公式，`propertyType:100`）字段的 EXPRESSION 模式仍只在前端算** —— API 写入不回填。
 
 ## 规则与业务集成