@stalfh233/omc-cli 0.6.11 → 0.6.13

package/dist/lanes/workflow-contract.js

@@ -83,7 +83,7 @@ export const WORKFLOW_WIRE = Object.freeze({
 /** Workflow template object (workflow/update|publish raw body). */
 export const workflowTemplateArg = z
     .record(z.string(), z.unknown())
-    .describe(`workflow template object. Minimal valid shape (create via workflow.create first, then workflow.update with this, then workflow.publish): ${WORKFLOW_WIRE.templateShape}. Add approval activities between start/end (each with id/type/participant) and routes[] as needed. **连线写法**：routes（recipe）/ edges（同义）/ rules（平台 DTO 字段名，get_draft 原样读回）三选一，同传两种会被拒。**新节点必须带 type/activityType**（activityCode 命中草稿既有节点时可省）。**体积**：整模板含 propertyPermissions 常到 1.0–1.4MB，而 --args-file 上限 1MB（CLI_ARGS_MAX_BYTES=1048576）——只发改动节点/权限行，别回传整份正文。 **参与人解析陷阱（r5-crm 实证 2026-10-10）**：内置 FindUserByRole({Originator.OU},code,...) 按部门范围找人——目标角色**不挂部门**（如全公司唯一的总监）时 ParticipantActivityRuntime.initParticipants 抛 EngineRuntimeException、流程卡 PROCESSING 无待办；跨部门/全局角色**不要写 FindUsersSpecByRoleFunction(code)**——1.1.25 运行期未注册该函数（FunctionNotFoundException，接口仍回 errCode 0），改用参与者对象数组（角色 id）或给角色补上可覆盖的部门范围成员。解析为空（零成员/未挂部门/自由文本/角色码不存在）时引擎**把任务退回发起人**、流程继续，症状是「审批人成了我自己」，不是卡住；真正卡住的是参与人函数未注册（FunctionNotFoundException，无待办、PROCESSING、接口仍 errCode 0）。两者都用 workflow.instanceActivity 区分：无 status=1 节点=卡住；status=1 且参与人全是发起人=静默错派（r4-training 实证 2026-10-20）。 **START 之后必须保留发起节点**（如「填写申请单」participant={Originator}，删掉/缺失则 publish 401035——r5-crm 实证 2026-10-09）；流程模型的数据入口=直接 data.submit（创建+启流程+单据号生成，勿用 save+submit 两步）。 A route entry MAY carry the platform's structured branch condition ruleConditionGroup (outer OR / inner AND) plus childMatchType/utilizeElse/alternativeFlag/text — see the workflow contract's routeBranch: ${WORKFLOW_WIRE.routeBranch}. endEventHandler{bizActions,bizActionType} binds business rules — prefer workflow.bindRule instead of replacing the whole template（节点级事件用 bindRule 的 activityCode+nodeEvent）。`);
+    .describe(`workflow template object. Minimal valid shape (create via workflow.create first, then workflow.update with this, then workflow.publish): ${WORKFLOW_WIRE.templateShape}. **连线写法**：routes（recipe）/ edges（同义）/ rules（平台 DTO 字段名，get_draft 原样读回）三选一，同传两种会被拒。**新节点必须带 type/activityType**（activityCode 命中草稿既有节点时可省）。**体积**：整模板含 propertyPermissions 常到 1.0–1.4MB，而 --args-file 上限 1MB（CLI_ARGS_MAX_BYTES=1048576）——只发改动节点/权限行，别回传整份正文。 **参与人解析陷阱（r5-crm 实证 2026-10-10）**：内置 FindUserByRole({Originator.OU},code,...) 按部门范围找人——目标角色**不挂部门**（如全公司唯一的总监）时 ParticipantActivityRuntime.initParticipants 抛 EngineRuntimeException、流程卡 PROCESSING 无待办；跨部门/全局角色**不要写 FindUsersSpecByRoleFunction(code)**——1.1.25 运行期未注册该函数（FunctionNotFoundException，接口仍回 errCode 0），改用参与者对象数组（角色 id）或给角色补上可覆盖的部门范围成员。解析为空（零成员/未挂部门/自由文本/角色码不存在）时引擎**把任务退回发起人**、流程继续，症状「审批人成了我自己」；真正卡住是参与人函数未注册（无待办/PROCESSING/errcode 0）。用 workflow.instanceActivity 区分：无 status=1 节点=卡住；status=1 且参与人全是发起人=静默错派（r4-training 2026-10-20）。 **START 之后必须保留发起节点**（如「填写申请单」participant={Originator}，删掉/缺失则 publish 401035——r5-crm 实证 2026-10-09）；流程模型的数据入口=直接 data.submit（创建+启流程+单据号生成，勿用 save+submit 两步）。 routeBranch: ${WORKFLOW_WIRE.routeBranch}。endEventHandler{bizActions,bizActionType} 绑业务规则——用 workflow.bindRule（activityCode+nodeEvent），别替换整个模板。`);
 const WORKFLOW_SCOPE = "greenfield workflow authoring";
 export const WORKFLOW_LANE_CONTRACT = Object.freeze({
     lane: LANES.workflow,
@@ -176,7 +176,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "workflow.permissions": Object.freeze({
             scope: "workflow start permission (who may originate)",
-            description: "列出谁能发起该流程（`GET /api/api/workflow/list_permission?workflowCode=` → {id,name,unitType,fullName,corpId,code}；1=部门 2=角色 3=用户）。**`data.submit` 报 40009 时先看这里**：PART_VISIABLE 且本表无命中行 ⇒ 除平台管理员（`h_perm_admin` 的 ADMIN/SYS_MNG，非登录 isAdmin）外无人能发起；发布流程不会自动建这一行。",
+            description: "列出谁能发起该流程（`GET /api/api/workflow/list_permission` → {id,name,unitType,fullName,corpId,code}；1=部门 2=角色 3=用户；平台权限枚举 PART_VISIABLE）。回执带 `actor`/`effectiveFor`：管理员绕过白名单时 reason 标明，发起成功≠白名单生效。40009 先看这里；发布不会自动建行。",
         }),
         "workflow.addPermission": Object.freeze({
             scope: "workflow start permission (who may originate)",

package/dist/lanes/workflow.js

@@ -14,6 +14,7 @@ import { readSchemaFormButtons } from "../form-support.js";
 import { WORKFLOW_EVENT_HANDLER_FIELDS, WORKFLOW_NODE_EVENT_HANDLER_FIELDS, WORKFLOW_LANE_CONTRACT, workflowTemplateArg } from "./workflow-contract.js";
 import { PLATFORM_TRIGGER_RULE_CODES } from "./rule-graph.js";
 import { executeRuleEnableWrite } from "./rule-lifecycle.js";
+import { PLATFORM_ADMIN_START_BYPASS, resolvePermissionActor } from "../identity.js";
 const WORKFLOW_LANE = WORKFLOW_LANE_CONTRACT.lane;
 const WORKFLOW_TOOLS = WORKFLOW_LANE_CONTRACT.tools;
 const WORKFLOW_ACTIVITY_TYPES = new Set(["START", "END", "CONNECTION", "PARTICIPANT", "SUB_INSTANCE", "CIRCULATE", "SYSTEM_ACTIVITY", "AGENT_ACTIVITY"]);
@@ -1015,6 +1016,106 @@ function pickRouteSpelling(spellings, tool) {
  * chain order" — reusing any edge whose endpoints survived. A draft whose
  * (possibly branching) graph is untouched passes the chain check verbatim.
  */
+/**
+ * r31c F23: local reachability / else-coverage warnings for workflow.validate.
+ * Does NOT change `valid` (still ERROR-only). A node with only conditional
+ * outbounds and no utilizeElse/unconditional edge is a dead-end when the
+ * condition fails — platform validate still says valid:true.
+ */
+export function workflowReachabilityWarnings(template) {
+    const activitiesRaw = template.activities;
+    const activities = Array.isArray(activitiesRaw)
+        ? activitiesRaw
+        : activitiesRaw && typeof activitiesRaw === "object"
+            ? Object.values(activitiesRaw)
+            : [];
+    if (activities.length === 0)
+        return [];
+    const rulesRaw = template.rules ?? template.routes ?? template.edges;
+    const rules = Array.isArray(rulesRaw) ? rulesRaw : [];
+    const typeOf = new Map();
+    const nameOf = new Map();
+    for (const activity of activities) {
+        const code = String(activity.activityCode ?? "").trim();
+        if (!code)
+            continue;
+        typeOf.set(code, String(activity.activityType ?? "").trim());
+        nameOf.set(code, String(activity.activityName ?? activity.name ?? code));
+    }
+    const outbound = new Map();
+    for (const rule of rules) {
+        const pre = String(rule.preActivityCode ?? rule.preNode ?? rule.pre ?? rule.from ?? "").trim();
+        const post = String(rule.postActivityCode ?? rule.postNode ?? rule.post ?? rule.to ?? "").trim();
+        if (!pre || !post)
+            continue;
+        const hasGroup = Array.isArray(rule.ruleConditionGroup) && rule.ruleConditionGroup.length > 0;
+        const utilizeElse = rule.utilizeElse === true;
+        const list = outbound.get(pre) ?? [];
+        list.push({ post, conditional: hasGroup && !utilizeElse, utilizeElse });
+        outbound.set(pre, list);
+    }
+    const warnings = [];
+    // 1) Nodes with conditional outbounds must also have an else / unconditional exit.
+    for (const [code, edges] of outbound) {
+        if (typeOf.get(code) === "END")
+            continue;
+        const hasConditional = edges.some((edge) => edge.conditional);
+        if (!hasConditional)
+            continue;
+        const hasFallback = edges.some((edge) => edge.utilizeElse || !edge.conditional);
+        if (!hasFallback) {
+            warnings.push({
+                activityCode: code,
+                name: nameOf.get(code) ?? code,
+                problem: `节点 ${code} 在条件不满足时无出路（流程断头）：有条件出边但没有 utilizeElse/无条件兜底`,
+            });
+        }
+    }
+    // 2) Every non-END node must be able to reach some END along ANY outbound edge.
+    const endCodes = [...typeOf.entries()].filter(([, type]) => type === "END").map(([code]) => code);
+    if (endCodes.length === 0)
+        return warnings;
+    const canReachEnd = (start) => {
+        const seen = new Set();
+        const stack = [start];
+        while (stack.length > 0) {
+            const current = stack.pop();
+            if (typeOf.get(current) === "END")
+                return true;
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            for (const edge of outbound.get(current) ?? []) {
+                if (!seen.has(edge.post))
+                    stack.push(edge.post);
+            }
+        }
+        return false;
+    };
+    for (const [code, type] of typeOf) {
+        if (type === "END")
+            continue;
+        if ((outbound.get(code) ?? []).length === 0) {
+            // START with no edges is already a platform ERROR; still warn for PARTICIPANT dead-ends.
+            if (type === "PARTICIPANT" || type === "SUB_INSTANCE" || type === "SYSTEM") {
+                warnings.push({
+                    activityCode: code,
+                    name: nameOf.get(code) ?? code,
+                    problem: `节点 ${code} 没有任何出向边，无法到达 END（流程断头）`,
+                });
+            }
+            continue;
+        }
+        if (!canReachEnd(code)) {
+            warnings.push({
+                activityCode: code,
+                name: nameOf.get(code) ?? code,
+                problem: `节点 ${code} 沿现有出向边无法到达 END（流程断头）`,
+            });
+        }
+    }
+    return warnings;
+}
 export function completeWorkflowChain(rules, activities) {
     const codes = activities.map((activity) => String(activity.activityCode ?? "")).filter((code) => code.length > 0);
     if (codes.length < 2)
@@ -1977,6 +2078,23 @@ export function workflowCompactProjection(result) {
         }
     }
     const originate = data.originateActivity;
+    // Count ALL propertyPermissions rows on the native template (including
+    // all-false), so --full/--jq can answer "did my visibility edit land?" even
+    // when the compact permissions face filters defaults out.
+    const propertyPermissionsCount = Object.values(activities).reduce((sum, activity) => {
+        const rows = activity.propertyPermissions;
+        return sum + (Array.isArray(rows) ? rows.length : 0);
+    }, 0);
+    // r30d F14: --full externalizes the native body; keep a projectable top-level
+    // activities summary so callers do not need four hops (describe → get --full
+    // → pathMiss → artifact get) just to see node codes / participants.
+    const activitySummaries = nodes.map((node) => ({
+        code: node.code,
+        name: node.name,
+        type: node.type,
+        ...(node.participant !== undefined ? { participants: node.participant } : {}),
+        ...(node.permissions !== undefined ? { propertyPermissions: node.permissions } : {}),
+    }));
     return {
         workflowSummary: {
             workflowCode: data.workflowCode ?? result.workflowCode ?? null,
@@ -1988,11 +2106,15 @@ export function workflowCompactProjection(result) {
             ruleBindingCount: ruleBindings.reduce((sum, binding) => sum + binding.ruleCodes.length, 0),
             ...(originate ? { originateActivity: { code: originate.activityCode ?? null, type: originate.activityType ?? null, name: effectiveActivityName(originate), participant: originate.participant ?? null } } : {}),
         },
+        // Projectable top-level face for --full / --jq (r30d F9/F14).
+        activities: activitySummaries,
+        propertyPermissionsCount,
+        version: data.workflowVersion ?? data.version ?? null,
         // Editing needs only `activities` (array or index object) + `routes`: the tool
         // merges onto the stored draft, connects added nodes through to END, fills
         // sheetCode and geometry. Reading the 30–75 KB full body is NOT required —
         // bench17 pulled 61 KB `full:true` just to edit two node names.
-        summaryHint: "改流程只需把要改/新增的 activities（数组）+ routes 传给 workflow.update：缺 START/END 的部分模板会自动按增量 merge 到草稿（草稿为基，自动补 sheetCode/连线/坐标），无需读回整模板或 --full 正文；字段权限也只需在对应 PARTICIPANT 上给 propertyPermissions:[{propertyCode,...}]，工具按 propertyCode 合并、未列的字段权限保留。只有要整图替换时才给全 START..END 的完整模板；要看通知等完整节点正文才用 detailArtifactId 或 --full",
+        summaryHint: "改流程只需把要改/新增的 activities（数组）+ routes 传给 workflow.update：缺 START/END 的部分模板会自动按增量 merge 到草稿（草稿为基，自动补 sheetCode/连线/坐标），无需读回整模板或 --full 正文；字段权限也只需在对应 PARTICIPANT 上给 propertyPermissions:[{propertyCode,...}]，工具按 propertyCode 合并、未列的字段权限保留。只有要整图替换时才给全 START..END 的完整模板；要看通知等完整节点正文才用 detailArtifactId 或 --full。--full 外置时顶层仍有 activities[{code,name,participants}] + propertyPermissionsCount 可直接投影。",
     };
 }
 /**
@@ -2223,7 +2345,28 @@ export function registerWorkflowLane(tools) {
             const messages = Array.isArray(result.data) ? result.data : [];
             const errors = messages.filter((message) => message.errorLevel === "ERROR");
             const warnings = messages.filter((message) => message.errorLevel !== "ERROR");
-            return { workflowCode, valid: errors.length === 0, errorCount: errors.length, warningCount: warnings.length, errors, warnings };
+            // r31c F23: local reachability / else-coverage — warning only, never flips valid.
+            const reachability = workflowReachabilityWarnings(body);
+            const allWarnings = [
+                ...warnings,
+                ...reachability.map((entry) => ({
+                    errorLevel: "WARNING",
+                    errCode: "omc-reachability",
+                    errContent: entry.problem,
+                    activityCode: entry.activityCode,
+                    name: entry.name,
+                    problem: entry.problem,
+                })),
+            ];
+            return {
+                workflowCode,
+                valid: errors.length === 0,
+                errorCount: errors.length,
+                warningCount: allWarnings.length,
+                errors,
+                warnings: allWarnings,
+                ...(reachability.length > 0 ? { reachabilityWarnings: reachability } : {}),
+            };
         }, { target: `workflow.validate:${args.workflowCode ?? args.schemaCode}` }),
     }));
     writeTool({
@@ -2808,6 +2951,51 @@ export function registerWorkflowLane(tools) {
                             `正确顺序：① 先完结/清理实例的待办（workitem.list --workflowCode ${args.code} 看还有哪些在办）；② 再 workflow.delete；③ 最后才 model.delete。`,
                     });
                 }
+                // 303024 列表绑定了流程 — workflow.create auto-binds the default list
+                // view; delete refuses until that WORKFLOW association is removed
+                // (r30d F12/F13; r31 F48). Name the bound view + a pasteable unbind
+                // command that already carries real fieldCodes (no listview.get dig).
+                if (error instanceof WireError && error.kind === "business" && error.errcode === 303024) {
+                    const bound = await findListviewsBoundToWorkflow(session, args.schemaCode, args.code);
+                    const primary = bound[0];
+                    const viewCode = primary?.code ?? args.schemaCode;
+                    const fieldCodes = primary?.fieldCodes?.length
+                        ? primary.fieldCodes
+                        : ["createdTime", "creater", "name", "sequenceNo"];
+                    // Live-proven unbind (sandbox-r31f 2026-11-05): empty actions +
+                    // replaceActions:true clears the WORKFLOW add binding; platform then
+                    // re-injects non-workflow defaults. Prefer this over rewriting ADD→BIZSHEET
+                    // so the pasted command needs no action surgery.
+                    const detachArgs = {
+                        schemaCode: args.schemaCode,
+                        code: viewCode,
+                        fieldCodes,
+                        actions: [],
+                        replaceActions: true,
+                    };
+                    const detachExample = `omc call listview.configure --env <env> --args '${JSON.stringify(detachArgs)}'`;
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-bound-to-listview",
+                        errcode: 303024,
+                        workflowCode: args.code,
+                        schemaCode: args.schemaCode,
+                        boundListviews: bound.map(({ code, name, actionCode, associationCode, fieldCodes: cols }) => ({
+                            code,
+                            name,
+                            actionCode,
+                            associationCode,
+                            ...(cols.length > 0 ? { fieldCodes: cols } : {}),
+                        })),
+                        nextCommand: detachExample,
+                        message: `流程 ${args.code} 仍被列表视图绑定（303024「列表绑定了流程」）。` +
+                            (bound.length > 0
+                                ? `绑在：${bound.map((view) => `${view.code}（${view.name}）action=${view.actionCode ?? "?"}`).join("、")}。`
+                                : `默认视图多半是 ${args.schemaCode}（workflow.create 会自动绑）。`) +
+                            `先解绑再删：粘贴 nextCommand（listview.configure：actions:[] + replaceActions:true + 现有 fieldCodes），再重试 workflow.delete。` +
+                            `整体清理也可用 omc model-purge --code ${args.schemaCode}（级联带走流程模板与视图）。`,
+                    });
+                }
                 throw error;
             }
             const header = await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: args.code } }).catch(() => ({ data: null }));
@@ -3085,6 +3273,54 @@ export function registerWorkflowLane(tools) {
     // Publishing a flow creates NO permission row, so a freshly published flow is
     // unusable by anyone who is not a platform admin.
     const permissionRows = async (session, workflowCode) => wireRows((await wireCall(session, { path: ENDPOINTS.workflowListPermission, query: { workflowCode } })).data);
+    /** Best-effort: which list views still bind this workflow (303024 recovery). */
+    async function findListviewsBoundToWorkflow(session, schemaCode, workflowCode) {
+        const bound = [];
+        try {
+            const listed = wireRows((await wireCall(session, { path: ENDPOINTS.listQueryList, query: { schemaCode, clientType: "PC" } })).data);
+            for (const row of listed) {
+                const code = String(row.code ?? "");
+                if (!code)
+                    continue;
+                try {
+                    const got = await wireCall(session, { path: ENDPOINTS.listQueryGet, query: { schemaCode, code, clientType: "PC" } });
+                    const model = (got.data ?? null);
+                    if (!model)
+                        continue;
+                    const actions = Array.isArray(model.queryActions) ? model.queryActions : [];
+                    const fieldCodes = (Array.isArray(model.queryColumns) ? model.queryColumns : [])
+                        .map((column) => String(column.propertyCode ?? ""))
+                        .filter(Boolean);
+                    for (const action of actions) {
+                        const association = action.associationType ?? action.queryActionRelativeType;
+                        const associationCode = String(action.associationCode ?? action.relativeCode ?? "");
+                        const isWorkflow = association === 1 ||
+                            association === "1" ||
+                            association === "WORKFLOW" ||
+                            String(association).toUpperCase() === "WORKFLOW";
+                        if (!isWorkflow)
+                            continue;
+                        if (associationCode && associationCode !== workflowCode && associationCode !== schemaCode)
+                            continue;
+                        bound.push({
+                            code,
+                            name: String(row.name ?? model.name ?? code),
+                            actionCode: action.actionCode === undefined || action.actionCode === null ? null : String(action.actionCode),
+                            associationCode: associationCode || null,
+                            fieldCodes,
+                        });
+                    }
+                }
+                catch {
+                    // one view unreadable — keep scanning
+                }
+            }
+        }
+        catch {
+            // list unreadable — caller still gets a generic detach recipe
+        }
+        return bound;
+    }
     // `list_permission` echoes the PERMISSION row id plus the unit's display name
     // and code — never the unitId (WorkflowTemplateController.getPermissionMap).
     // So identity for readback/removal is resolved from the unit's own face.
@@ -3144,17 +3380,35 @@ export function registerWorkflowLane(tools) {
                 corpId: row.corpId ?? null,
                 code: row.code ?? null,
             }));
+            const actor = await resolvePermissionActor(session);
+            const effectiveFor = {
+                userId: actor.userId,
+                name: actor.name,
+                allowed: actor.isAdmin || permissions.length > 0,
+                reason: actor.isAdmin
+                    ? PLATFORM_ADMIN_START_BYPASS
+                    : permissions.length === 0
+                        ? "no-start-permission-row"
+                        : "whitelist-configured-not-evaluated-for-membership",
+                note: actor.isAdmin
+                    ? "当前登录人是平台管理员：发起成功不证明白名单生效。要用非管理员账号另建环境验证。"
+                    : "本读面只回配置行；membership 命中需非管理员实发 data.submit 才能证伪。",
+            };
             return {
                 workflowCode,
                 count: permissions.length,
                 permissions,
+                actor,
+                effectiveFor,
                 ...(permissions.length === 0
                     ? {
                         blocker: "workflow-start-permission-empty",
-                        note: "该流程没有任何发起权限行：除平台管理员（h_perm_admin 里 ADMIN/SYS_MNG）外**没有人能发起**，data.submit 会回 40009「流程发起权限不足」。发布流程不会自动建这一行，用 workflow.addPermission 授给部门/角色/用户（或把模板 visibleType 改成 ALL_VISIABLE）。",
+                        note: "该流程没有任何发起权限行：除平台管理员（h_perm_admin 里 ADMIN/SYS_MNG）外**没有人能发起**，data.submit 会回 40009「流程发起权限不足」。发布流程不会自动建这一行，用 workflow.addPermission 授给部门/角色/用户（或把模板 visibleType 改成 ALL_VISIABLE）。管理员发起成功 ≠ 白名单生效。",
                         nextCommand: `omc call workflow.addPermission --env <env> --args '{"workflowCode":"${workflowCode}","unitId":"<部门|角色|用户 id>","unitType":1}'`,
                     }
-                    : {}),
+                    : {
+                        note: "permissions 是配置白名单。若 actor.isAdmin=true，data.submit 成功可能只是管理员绕过，不证明白名单对普通用户生效。",
+                    }),
             };
         }),
     }));
@@ -3210,13 +3464,15 @@ export function registerWorkflowLane(tools) {
                         unitType,
                         message: `create_permission 被平台拒绝（err=${String(errcode ?? "n/a")}）。核对 unitId 是否真实存在（部门用 org.department.list、角色用 org.role.list、用户用 org.user.search），以及发起权限是否被企业策略禁用。原始错误：${error instanceof Error ? error.message : String(error)}`,
                     });
+                const actor = await resolvePermissionActor(session);
                 return {
                     performed: { skipped: "already-present" },
-                    readback: { workflowCode, alreadyPresent: true, unitId: args.unitId, unitType, count: before.length, note: "该主体已有发起权限（平台 402003），未重复写入" },
+                    readback: { workflowCode, alreadyPresent: true, unitId: args.unitId, unitType, count: before.length, note: "该主体已有发起权限（平台 402003），未重复写入", actor },
                 };
             }
             const after = await permissionRows(session, workflowCode);
             const created = after.find((row) => !before.some((old) => String(old.id ?? "") === String(row.id ?? ""))) ?? after[after.length - 1];
+            const actor = await resolvePermissionActor(session);
             return {
                 performed: { errcode: 0 },
                 readback: {
@@ -3225,10 +3481,28 @@ export function registerWorkflowLane(tools) {
                     permissionId: created?.id ?? null,
                     unitType: created?.unitType ?? unitType,
                     name: created?.name ?? null,
-                    note: "发起权限已授予。若之前 data.submit 回 40009，现在应可发起；仍失败先 workflow.permissions 确认行存在，并核对发起人所属部门/角色。",
+                    actor,
+                    note: "发起权限已授予。若之前 data.submit 回 40009，现在应可发起；仍失败先 workflow.permissions 确认行存在，并核对发起人所属部门/角色。管理员发起成功不证明白名单对普通人生效。",
                 },
             };
         },
+        rollback: {
+            target: (args) => `workflow-permission:${String(args.workflowCode ?? args.schemaCode ?? "")}`,
+            read: async (session, args) => {
+                const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode });
+                if (!workflowCode)
+                    return null;
+                return permissionRows(session, workflowCode);
+            },
+            inverse: ({ before, args, readback }) => {
+                if (readback.alreadyPresent === true)
+                    return { kind: "calls", calls: [], notes: ["权限行已存在（幂等），未写入，无需回滚"] };
+                const permissionId = readback.permissionId;
+                if (typeof permissionId === "string" && permissionId.length > 0)
+                    return { kind: "calls", calls: [{ tool: "workflow.removePermission", args: { permissionId } }] };
+                return { kind: "irreversible", reason: "addPermission 回执缺少 permissionId，无法自动撤权；用 workflow.permissions 找 id 后手工 removePermission" };
+            },
+        },
     });
     writeTool({
         tools,
@@ -3245,8 +3519,11 @@ export function registerWorkflowLane(tools) {
         },
         execute: async (session, args) => {
             let permissionId = args.permissionId;
+            let workflowCodeForActor;
+            let beforeRow = null;
             if (!permissionId) {
                 const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode });
+                workflowCodeForActor = workflowCode ?? undefined;
                 if (!workflowCode || !args.unitId || args.unitType === undefined)
                     throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "workflow.removePermission", message: "需要 permissionId（推荐），或 workflowCode（/schemaCode）+ unitId + unitType" });
                 const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
@@ -3254,22 +3531,115 @@ export function registerWorkflowLane(tools) {
                 const rows = await permissionRows(session, workflowCode);
                 const wantedType = String(unitType);
                 const hit = rows.find((row) => String(row.unitType ?? "") === wantedType && (String(row.id ?? "") === args.unitId ||
+                    // list_permission echoes `code` (unit business code or, on some faces, the
+                    // unitId itself) but never unitId — accept both spellings so remove by
+                    // unitId does not silently miss (r30d F11 / fake+live).
+                    String(row.code ?? "") === args.unitId ||
                     (identity.name !== null && String(row.name ?? "") === identity.name) ||
-                    (identity.code !== null && String(row.code ?? "") === identity.code)));
-                if (!hit)
+                    (identity.code !== null && String(row.code ?? "") === identity.code) ||
+                    (identity.name !== null && String(row.fullName ?? "") === identity.name)));
+                if (!hit) {
+                    const actor = await resolvePermissionActor(session);
                     return {
                         performed: { skipped: "absent" },
                         readback: {
                             workflowCode,
                             removed: false,
-                            note: `没有匹配该主体的权限行（幂等）。注意 list_permission 不回 unitId，匹配靠解析出的显示名「${identity.name ?? "?"}」；不确定时用 workflow.permissions 拿 id 再按 permissionId 删。`,
-                            permissions: rows.map((row) => ({ id: row.id ?? null, name: row.name ?? null, unitType: row.unitType ?? null })),
+                            note: `没有匹配该主体的权限行（幂等）。注意 list_permission 不回 unitId，匹配靠解析出的显示名「${identity.name ?? "?"}」/code；不确定时用 workflow.permissions 拿 id 再按 permissionId 删。`,
+                            permissions: rows.map((row) => ({ id: row.id ?? null, name: row.name ?? null, unitType: row.unitType ?? null, code: row.code ?? null })),
+                            actor,
                         },
                     };
+                }
+                beforeRow = {
+                    id: hit.id ?? null,
+                    name: hit.name ?? null,
+                    unitType: hit.unitType ?? unitType,
+                    fullName: hit.fullName ?? null,
+                    code: hit.code ?? null,
+                    corpId: hit.corpId ?? null,
+                    unitId: args.unitId,
+                };
                 permissionId = String(hit.id ?? "");
             }
+            else {
+                // Capture the row being removed so the receipt has a rebuildable before
+                // face even when the caller only passed permissionId (r30d F11).
+                const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode }).catch(() => null);
+                workflowCodeForActor = workflowCode ?? undefined;
+                if (workflowCode) {
+                    const rows = await permissionRows(session, workflowCode);
+                    const hit = rows.find((row) => String(row.id ?? "") === permissionId);
+                    if (hit)
+                        beforeRow = {
+                            id: hit.id ?? null,
+                            name: hit.name ?? null,
+                            unitType: hit.unitType ?? null,
+                            fullName: hit.fullName ?? null,
+                            code: hit.code ?? null,
+                            corpId: hit.corpId ?? null,
+                        };
+                }
+            }
             await wireCall(session, { path: ENDPOINTS.workflowDeletePermission, method: "POST", query: { permissionId } });
-            return { performed: { errcode: 0 }, readback: { permissionId, removed: true } };
+            const actor = await resolvePermissionActor(session);
+            return {
+                performed: { errcode: 0 },
+                readback: {
+                    permissionId,
+                    removed: true,
+                    ...(workflowCodeForActor ? { workflowCode: workflowCodeForActor } : {}),
+                    before: beforeRow,
+                    actor,
+                    ...(beforeRow
+                        ? {}
+                        : { rollbackable: false, rollbackNote: "删除前未捕获到权限行详情（只给了 permissionId 且未能解析所属流程）；撤错需手工按 id 复建。" }),
+                },
+            };
+        },
+        rollback: {
+            target: (args) => `workflow-permission:${String(args.workflowCode ?? args.schemaCode ?? args.permissionId ?? "")}`,
+            read: async (session, args) => {
+                // Prefer resolving the concrete row so inverse can re-add it.
+                const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode }).catch(() => null);
+                if (!workflowCode)
+                    return null;
+                const rows = await permissionRows(session, workflowCode);
+                if (typeof args.permissionId === "string" && args.permissionId) {
+                    return rows.find((row) => String(row.id ?? "") === args.permissionId) ?? null;
+                }
+                if (typeof args.unitId === "string" && args.unitType !== undefined) {
+                    const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
+                    const identity = await unitIdentity(session, unitType, args.unitId);
+                    return rows.find((row) => String(row.unitType ?? "") === String(unitType) && (String(row.id ?? "") === args.unitId ||
+                        String(row.code ?? "") === args.unitId ||
+                        (identity.name !== null && String(row.name ?? "") === identity.name) ||
+                        (identity.code !== null && String(row.code ?? "") === identity.code) ||
+                        (identity.name !== null && String(row.fullName ?? "") === identity.name))) ?? null;
+                }
+                return null;
+            },
+            inverse: ({ before, args }) => {
+                if (before == null)
+                    return { kind: "irreversible", reason: "removePermission 前未捕获到权限行（before 为空），无法自动复建；用 workflow.addPermission 手工补回" };
+                const row = before;
+                const workflowCode = String(args.workflowCode ?? "");
+                const unitId = typeof args.unitId === "string" && args.unitId ? args.unitId : null;
+                const unitType = args.unitType !== undefined
+                    ? (args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3)
+                    : (row.unitType === 1 || row.unitType === "1" ? 1 : row.unitType === 2 || row.unitType === "2" ? 2 : row.unitType === 3 || row.unitType === "3" ? 3 : null);
+                if (!workflowCode || !unitId || unitType === null)
+                    return {
+                        kind: "irreversible",
+                        reason: `before 有行（name=${String(row.name ?? "?")} unitType=${String(row.unitType ?? "?")}），但缺少可重放的 workflowCode+unitId+unitType；请手工：omc call workflow.addPermission --args '{"workflowCode":"<code>","unitId":"<id>","unitType":${unitType ?? 2}}'`,
+                        partial: [],
+                    };
+                return {
+                    kind: "calls",
+                    calls: [{ tool: "workflow.addPermission", args: { workflowCode, unitId, unitType } }],
+                    notes: [`复建被删行：name=${String(row.name ?? "?")} unitType=${unitType}`],
+                };
+            },
         },
     });
     tools.push(defineTool({

package/dist/model-scaffold.js

@@ -73,9 +73,11 @@ export async function cmdModelScaffold(args) {
     const forcePublish = args.includes("--force-publish");
     const usage = [
         "用法：omc model-scaffold --code <模型code> --name <模型名> --fields '<JSON 数组>' [--folder <目录id>] [--apply]",
-        "  --fields 每条是一个 field.create 的参数：{\"code\",\"name\",\"propertyType\",...}；子表加 \"childFields\":[...]。",
+        "  --fields 每条是一个 field.create 的参数：{\"code\",\"name\",\"propertyType\",...}；子表加 \"subFields\":[...]。",
+        "  子表键名统一用 subFields（field.create 平台键）；childFields 仍作别名接受，但 --help 只展示 subFields。",
         "  默认 dry-run（列出将要做什么）；--apply 依次执行 建模型→建字段→建子列→发布字段→发布表单。",
         "  幂等：模型/字段已存在记为 skipped 继续；有真失败时默认不发布（--force-publish 可强发）。",
+        "  每个子调用使用独立 requestId（避免同 id 不同参数被幂等门拒绝）；重入已存在字段记 skipped。",
         "  从文件读：--fields-file <配置根内路径>。",
     ].join("\n");
     const invalid = (message) => {
@@ -121,7 +123,7 @@ export async function cmdModelScaffold(args) {
         for (const field of preflightTargets) {
             const probe = await runToolCall("field.create", {
                 args: scaffoldFieldArgs(code, field),
-                requestId: request,
+                requestId: `${request}:preflight:${field.code}`,
                 dryRun: true,
                 ...(environment !== undefined ? { environment } : {}),
                 print: () => undefined,
@@ -168,11 +170,17 @@ export async function cmdModelScaffold(args) {
     // lets that through writes N extra lines to stdout and breaks the
     // one-envelope contract (the classic trap recorded in HANDOFF §6). Swallow the
     // per-call lines and surface the useful ones in `steps[]` instead.
+    // r31c F9: each sub-call needs its own requestId. Reusing the composer-level
+    // id makes the 2nd+ field.create look like "same id, different args" and the
+    // idempotency gate refuses them (probe: created:1 failed:6).
+    let subCallSeq = 0;
     const call = async (tool, toolArgs) => {
         const lines = [];
+        subCallSeq += 1;
+        const perCallRequestId = `${request}:${tool}:${subCallSeq}`;
         const outcome = await runToolCall(tool, {
             args: toolArgs,
-            requestId: request,
+            requestId: perCallRequestId,
             ...(environment !== undefined ? { environment } : {}),
             print: (line) => lines.push(line),
         });