@stalfh233/omc-cli 0.6.11 → 0.6.13

package/dist/tools.js

@@ -1,3 +1,5 @@
+import { basename } from "node:path";
+import { z } from "zod";
 import { loadCoverageManifest } from "./coverage.js";
 import { makeToolContext } from "./context.js";
 import { registerMetaLane } from "./lanes/meta.js";
@@ -23,9 +25,18 @@ import { registerReportLane } from "./lanes/report.js";
 import { registerApplyChangesLane } from "./lanes/apply-changes.js";
 import { executionMetadataFor } from "./execution-metadata.js";
 import { attachRefusalRecovery } from "./refusal-guidance.js";
-import { ToolRefusalError } from "./tool-types.js";
+import { defineTool, ToolRefusalError } from "./tool-types.js";
+import { environmentArg } from "./args.js";
+import { appendJournalEntry } from "./journal.js";
+import { listRequestArtifacts } from "./write.js";
 export { ToolRefusalError, ToolUncertainError } from "./tool-types.js";
 export { makeToolContext };
+/** Compound package writes that need an honest non-rollbackable journal line (r30a F9/F11). */
+const COMPOUND_JOURNAL_TOOLS = new Set(["configure_model", "configure_form"]);
+const COMPOUND_IRREVERSIBLE = Object.freeze({
+    configure_model: "复合写无单一逆操作，只记 journal（rollbackable:false）；清理请 model-purge / 逐项回滚子步骤",
+    configure_form: "复合写无单一逆操作，只记 journal（rollbackable:false）；表单无删除端点，请用 form.draft 覆盖",
+});
 /**
  * Composition root: assemble the governed tool surface from one adapter
  * module per configuration lane. The lane modules own their tool
@@ -58,11 +69,61 @@ export function buildToolRegistry() {
     // LAST: apply_changes looks up sibling write tools at call time, so it must
     // capture the fully-populated registry array.
     registerApplyChangesLane(tools);
+    // r30a F4: read-only requestId lookup over local write artifacts (no new store).
+    registerRequestStatusTool(tools);
     for (const tool of tools) {
         const metadata = executionMetadataFor(tool);
         if (metadata)
             tool.executionMetadata = metadata;
     }
+    // r30a F9/F11/F23: wrap compound package writes so they leave one honest
+    // journal line (rollbackable:false) + receipt.rollback.seq + irreversible hint.
+    for (const tool of tools) {
+        if (!COMPOUND_JOURNAL_TOOLS.has(tool.name))
+            continue;
+        const inner = tool.handler;
+        const toolName = tool.name;
+        tool.handler = async (ctx, args, self) => {
+            const result = await inner(ctx, args, self);
+            if (!result || typeof result !== "object")
+                return result;
+            const record = result;
+            if (record.status !== "ok" || record.deliveryState !== "DELIVERED")
+                return result;
+            if (record.rollback && typeof record.rollback === "object")
+                return result;
+            const environment = typeof args.environment === "string" && args.environment.length > 0
+                ? args.environment
+                : "local";
+            let environmentFingerprint = "compound-write";
+            try {
+                const session = await ctx.sessions.session(args.environment);
+                environmentFingerprint = session.environmentFingerprint();
+            }
+            catch { /* journal still useful without fingerprint */ }
+            const code = typeof args.code === "string" ? args.code : typeof args.schemaCode === "string" ? args.schemaCode : toolName;
+            const steps = Array.isArray(record.steps) ? record.steps : undefined;
+            const entry = appendJournalEntry(ctx.artifactsDir, {
+                v: 1,
+                environment,
+                environmentFingerprint,
+                tool: toolName,
+                target: `${toolName}:${code}`,
+                beforeSha: null,
+                rollbackable: false,
+                note: "复合写无逆操作，只记录（不假装可回滚）",
+                ...(steps !== undefined ? { steps: steps.map((step) => (step && typeof step === "object" ? { step: step.step, skipped: step.skipped } : step)) } : {}),
+                artifactFile: typeof record.detailFile === "string" ? record.detailFile : `${toolName}.compound.json`,
+                artifactId: typeof record.detailFile === "string" ? basename(record.detailFile) : `${toolName}-compound`,
+                artifactSha: typeof record.artifactFingerprint === "string" ? record.artifactFingerprint : typeof record.detailSha256 === "string" ? record.detailSha256 : "compound",
+            });
+            return {
+                ...record,
+                rollback: { seq: entry.seq, rollbackable: false, hint: `omc rollback plan ${entry.seq}（--env ${entry.environment}）→ irreversible/skipped` },
+                irreversible: COMPOUND_IRREVERSIBLE[toolName] ?? "复合写无逆操作，只记 journal",
+            };
+        };
+    }
     // r19 ticket 06 — 拒绝即教学，收口在最深的一层：每个 handler 返回/抛出的
     // refused 结果在这里统一附加 recovery（同源配方命令、正确形状、不要做什么）。
     // 收口在 registry 而不是 CLI 出口，是因为 runToolCall、测试 harness、MCP
@@ -98,5 +159,56 @@ export function buildToolRegistry() {
     }
     return tools;
 }
+/** Local-only requestId readback (r30a F4) — exposes findCompleted's store. */
+function registerRequestStatusTool(tools) {
+    tools.push(defineTool({
+        name: "request.status",
+        layer: "meta",
+        kind: "read",
+        description: "按 requestId 查本机写产物；uncertain 后确认，不查远端。",
+        inputSchema: {
+            environment: environmentArg,
+            requestId: z.string().min(1),
+            tool: z.string().optional(),
+        },
+        handler: async (ctx, args) => {
+            const requestId = String(args.requestId);
+            const environment = typeof args.environment === "string" && args.environment.length > 0 ? args.environment : undefined;
+            const tool = typeof args.tool === "string" && args.tool.length > 0 ? args.tool : undefined;
+            const hits = listRequestArtifacts(ctx.artifactsDir, requestId, { ...(tool ? { tool } : {}), ...(environment ? { environment } : {}) });
+            if (hits.length === 0) {
+                return {
+                    status: "ok",
+                    found: false,
+                    requestId,
+                    ...(environment ? { environment } : {}),
+                    hint: "本机无此 requestId；可按业务键 data.list/model.list 再确认",
+                };
+            }
+            const latest = hits[hits.length - 1];
+            const artifact = latest.artifact;
+            const performed = (artifact.performed ?? {});
+            return {
+                status: "ok",
+                found: true,
+                requestId,
+                tool: artifact.tool,
+                environment: artifact.environment,
+                deliveryState: artifact.deliveryState,
+                completedAt: artifact.recordedAt,
+                requestFingerprint: artifact.requestFingerprint,
+                result: {
+                    ...(typeof performed.bizObjectId === "string" ? { bizObjectId: performed.bizObjectId } : {}),
+                    ...(performed.skipped !== undefined ? { skipped: performed.skipped } : {}),
+                    ...(artifact.readback !== undefined ? { readback: artifact.readback } : {}),
+                    performed,
+                },
+                artifactFile: latest.file,
+                matches: hits.length,
+                ...(hits.length > 1 ? { hint: `同 id ${hits.length} 条；以上为最后一条` } : {}),
+            };
+        },
+    }));
+}
 export { loadCoverageManifest };
 //# sourceMappingURL=tools.js.map

package/dist/wire.js

@@ -235,7 +235,19 @@ export async function wireCall(session, call) {
         data: envelope.data ?? null,
         readbackFingerprint: "",
     };
-    if (state)
+    // 2026-11-05（ticket-110 回归）：**否定读不缓存**。
+    //
+    // `sheetGet` 对「还没有表单」的模型回 errcode 0 + data:null——这不是错误，
+    // 是被缓存的合法响应。于是同一会话里一旦有人读过「表单不存在」（例如
+    // `field.publish` 的 formBinding 咨询），后面 60s 内的所有 sheetGet 都命中
+    // 这份**空**缓存：设计器刚建好的表单 / 测试直接种进去的布局都读不到，
+    // `onlinejs.compose` 于是把既有 toolbar/template 当不存在，重建空骨架，
+    // 设计器写的控件属性（className 等）被永久覆盖。
+    //
+    // 负面结果（data 为 null / 空数组）恰恰是最容易在下一秒被写操作推翻的状态，
+    // 缓存它省不了往返，只会制造陈旧读。
+    const cacheableResult = result.data !== null && !(Array.isArray(result.data) && result.data.length === 0);
+    if (state && cacheableResult)
         state.entries.set(key, { result: structuredClone(result), query: call.query ?? {}, storedAt: clock() });
     return result;
 }

package/dist/write-lock.js

@@ -11,16 +11,72 @@ function lockTarget(environment) {
 function ownerFile(environment) {
     return `${lockTarget(environment)}.lock.owner.json`;
 }
+/** Extract `data.save` from `… cli.js call data.save …`, or a top-level verb. */
+export function reduceLockCommand(commandLine) {
+    const tokens = commandLine.trim().split(/\s+/).filter(Boolean);
+    const callAt = tokens.lastIndexOf("call");
+    if (callAt >= 0 && tokens[callAt + 1] && !tokens[callAt + 1].startsWith("-")) {
+        const tool = tokens[callAt + 1];
+        return { command: tool, tool };
+    }
+    const intentAt = tokens.lastIndexOf("intent");
+    if (intentAt >= 0 && tokens[intentAt + 1] && !tokens[intentAt + 1].startsWith("-")) {
+        return { command: `intent ${tokens[intentAt + 1]}` };
+    }
+    // Fall back to the last non-flag token that looks like a CLI verb / tool.
+    for (let i = tokens.length - 1; i >= 0; i -= 1) {
+        const token = tokens[i];
+        if (token.startsWith("-"))
+            continue;
+        if (token.includes("/") || token.endsWith(".js") || token === "node")
+            continue;
+        return { command: token };
+    }
+    return { command: commandLine };
+}
+function normalizeOwner(raw) {
+    if (!raw || typeof raw.pid !== "number")
+        return null;
+    const startedAt = typeof raw.startedAt === "string" ? raw.startedAt : "";
+    const legacyCommand = typeof raw.command === "string" ? raw.command : "";
+    const commandLine = typeof raw.commandLine === "string" && raw.commandLine.length > 0
+        ? raw.commandLine
+        : legacyCommand;
+    const reduced = typeof raw.tool === "string" && raw.tool.length > 0
+        ? { command: raw.tool, tool: raw.tool }
+        : reduceLockCommand(commandLine || legacyCommand);
+    // Prefer an already-reduced `command` when it is short (new writers); otherwise
+    // re-reduce from the command line so old ~110-char owners still shrink.
+    const command = typeof raw.command === "string" && raw.command.length > 0 && raw.command.length <= 64 && !raw.command.includes("/")
+        ? raw.command
+        : reduced.command;
+    return {
+        pid: raw.pid,
+        startedAt,
+        command,
+        commandLine: commandLine || command,
+        ...(reduced.tool !== undefined ? { tool: reduced.tool } : typeof raw.tool === "string" ? { tool: raw.tool } : {}),
+    };
+}
 function readOwner(environment) {
     try {
-        return JSON.parse(readFileSync(ownerFile(environment), "utf8"));
+        return normalizeOwner(JSON.parse(readFileSync(ownerFile(environment), "utf8")));
     }
     catch {
         return null;
     }
 }
 function writeOwner(environment) {
-    const owner = { pid: process.pid, startedAt: new Date().toISOString(), command: process.argv.slice(0, 4).join(" ") };
+    // Persist the full argv so forensics keep the path; reduce for the `command` face.
+    const commandLine = process.argv.join(" ");
+    const reduced = reduceLockCommand(commandLine);
+    const owner = {
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        command: reduced.command,
+        commandLine,
+        ...(reduced.tool !== undefined ? { tool: reduced.tool } : {}),
+    };
     try {
         writeFileSync(ownerFile(environment), JSON.stringify(owner, null, 2) + "\n", { mode: 0o600 });
     }
@@ -78,17 +134,23 @@ async function tryAcquire(environment) {
         }
         const lockDir = `${lockTarget(environment)}.lock`;
         const ownerDead = owner !== null && Number.isInteger(owner.pid) && !pidAlive(owner.pid);
+        const ownerLabel = owner
+            ? `owner pid=${owner.pid} started=${owner.startedAt} command=${owner.command}`
+            : "owner metadata missing (the holder predates lock metadata or crashed while acquiring)";
         return {
             held: false,
             reason: "conflict",
             owner,
             recovery: [
                 `another process holds the write lock for environment ${environment}`,
-                owner ? `owner pid=${owner.pid} started=${owner.startedAt} command=${owner.command}` : "owner metadata missing (the holder predates lock metadata or crashed while acquiring)",
+                ownerLabel,
                 `lock path: ${lockDir}`,
                 ...(ownerDead
                     ? ["owner pid is NOT alive → this is a STALE lock; re-running the same command now recovers automatically (or delete the lock path above)"]
-                    : ["the holder is alive → wait for it to finish, then retry (retryable:true); do NOT delete the lock path while the holder runs"]),
+                    : [
+                        "the holder is alive → wait for it to finish, then retry (retryable:true); do NOT delete the lock path while the holder runs",
+                        "不要写 shell 重试循环；用 --wait <ms> 让 CLI 内部排队（例：omc call <tool> --wait 30000）",
+                    ]),
                 `to force recovery when the owner is dead: rm -rf "${lockDir}" then retry`,
             ],
         };
@@ -106,4 +168,30 @@ export function staleLockPresent(environment) {
     const owner = readOwner(environment);
     return owner !== null && Number.isInteger(owner.pid) && !pidAlive(owner.pid);
 }
+/** Structured face for a write-lock-held refusal (r31b F2). */
+export function writeLockHeldFace(options) {
+    const wait = Math.max(1_000, options.waitMs && options.waitMs > 0 ? options.waitMs : 30_000);
+    const tool = options.refusedTool && options.refusedTool.length > 0 ? options.refusedTool : "<tool>";
+    const lockOwnerFace = options.owner
+        ? {
+            tool: options.owner.tool ?? options.owner.command,
+            pid: options.owner.pid,
+            startedAt: options.owner.startedAt,
+            command: options.owner.command,
+            commandLine: options.owner.commandLine,
+        }
+        : null;
+    return {
+        status: "refused",
+        blocker: "write-lock-held",
+        environment: options.environment,
+        retryable: true,
+        owner: options.owner,
+        lockOwner: lockOwnerFace,
+        nextCommand: `omc call ${tool} --env ${options.environment} --wait ${wait}`,
+        note: "不要写 shell 重试循环；用 --wait 排队",
+        message: `another process holds the write lock for environment ${options.environment}（retryable:true；用 --wait 排队，不要写 shell 重试循环）`,
+        recovery: options.recovery,
+    };
+}
 //# sourceMappingURL=write-lock.js.map

package/dist/write.js

@@ -50,7 +50,9 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload, readOnlyEs
         // A face may supply a session-aware dry-run projection (e.g. model.delete's
         // reference scan) so the preview carries facts that only live reads can
         // establish — never a second write path.
-        dryRunResult: dryRunPayload ? (plan, session) => dryRunPayload(session, args).then((payload) => ({ status: "dry-run", wouldChange: true, plan, idempotency: idempotencyDeclaration(tool.name), ...payload, ...(args.requestId ? { requestId: args.requestId } : {}) })) : (plan) => ({ status: "dry-run", wouldChange: true, plan, idempotency: idempotencyDeclaration(tool.name), ...(args.requestId ? { requestId: args.requestId } : {}) }),
+        // First-write / dry-run receipts use replay:"none" — the duplicate tag only
+        // appears on a true same-fingerprint replay (r30a F1).
+        dryRunResult: dryRunPayload ? (plan, session) => dryRunPayload(session, args).then((payload) => ({ status: "dry-run", wouldChange: true, plan, idempotency: idempotencyDeclaration(tool.name, "none"), ...payload, ...(args.requestId ? { requestId: args.requestId } : {}) })) : (plan) => ({ status: "dry-run", wouldChange: true, plan, idempotency: idempotencyDeclaration(tool.name, "none"), ...(args.requestId ? { requestId: args.requestId } : {}) }),
         replay: (plan) => (requestFingerprint ? findCompleted(ctx.artifactsDir, args.requestId, tool.name, plan.environment, requestFingerprint) : undefined),
     });
     if (outcome.kind === "settled")
@@ -105,6 +107,18 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload, readOnlyEs
                         message: `${error.message}——这是平台 ORM 的对象状态错误（Serializer.update/delete 要求实体先被装载），不是入参或规则图的形状问题。` +
                             "同一份入参再保存一次通常即恢复。持续复现就换行：rule.delete 后重建（rule.save 会铸新记录），或用 rule.get 读回完整行再 rule.node.update 改一处——不要继续重试同一份 payload。",
                     };
+                // r30a F10：errcode 40000「调用数据库发生异常」是平台侧故障，不是入参形状问题。
+                // 标 platform-fault，避免脚本把原样透出的业务码当成「改参数再试」。
+                if (error.errcode === 40000 || /调用数据库发生异常/.test(error.message))
+                    return {
+                        status: "refused",
+                        blocker: `wire-${error.kind}`,
+                        errcode: error.errcode,
+                        "platform-fault": true,
+                        message: `${error.message}——这是平台侧异常（errcode ${error.errcode}），不是入参形状问题；勿改参数硬重试，稍后重试或查平台日志。`,
+                        nextAction: "稍后重试同一请求；持续复现请查平台 DB/ORM 日志，不要把 40000 当参数错误",
+                        ...(error.diagnostic ? { diagnostic: error.diagnostic } : {}),
+                    };
                 return { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message, ...(error.diagnostic ? { diagnostic: error.diagnostic } : {}) };
             }
             throw error;
@@ -129,7 +143,7 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload, readOnlyEs
             const artifactRef = writeArtifact(ctx, `${tool.name}-${randomUUID().slice(0, 8)}.json`, artifact);
             return { status: executed.status, steps: executed.steps, failedStep: executed.failedStep, ...executed.envelope, ...(args.requestId ? { requestId: args.requestId } : {}), artifactFingerprint: artifactRef.detailSha256 };
         }
-        const { performed, readback, steps, halfSuccess } = executed;
+        const { performed, readback, steps, halfSuccess, irreversible } = executed;
         // Readback gate (live 2026-10-17): a tool that reports `readback.present:false`
         // has NOT proven its own write — the platform accepted the request but the
         // object is absent from the authoritative face. "Called without error" must
@@ -165,8 +179,13 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload, readOnlyEs
         const artifactRef = writeArtifact(ctx, `${tool.name}-${randomUUID().slice(0, 8)}.json`, artifact);
         // Journal AFTER the artifact is durable: one append-only line per
         // delivered governed config write, feeding `omc rollback list/plan/apply`.
+        // r30a F22: already-absent / noop writes must NOT pollute the rollback
+        // timeline (reverting a no-op delete would try to "restore" something that
+        // never existed in this session).
+        const skipped = typeof performed.skipped === "string" ? performed.skipped : undefined;
+        const isNoopWrite = performed.noop === true || skipped === "already-absent" || skipped === "stale-record-cache";
         let rollbackRef;
-        if (tool.rollback) {
+        if (tool.rollback && !isNoopWrite) {
             const entry = appendJournalEntry(ctx.artifactsDir, {
                 v: 1,
                 environment: session.environmentName,
@@ -182,7 +201,25 @@ async function governedWrite(ctx, tool, args, execute, dryRunPayload, readOnlyEs
             });
             rollbackRef = { seq: entry.seq, hint: `omc rollback plan ${entry.seq}（--env ${entry.environment}）` };
         }
-        return { status: "ok", deliveryState, ...(readOnlyEscapeNote !== undefined ? { readOnlyEscape: readOnlyEscapeNote } : {}), performed, readback, ...(readbackWarning ? { readbackWarning } : {}), ...(steps !== undefined ? { steps } : {}), ...(halfSuccess !== undefined ? { halfSuccess } : {}), ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name) } : {}), ...(productionConfirmed ? { productionConfirmed: true } : {}), ...(rollbackRef ? { rollback: rollbackRef } : {}), summary: writeSummary(tool.name, args, { performed, readback }, "done"), detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256, artifactFingerprint: artifactRef.detailSha256 };
+        return {
+            status: "ok",
+            deliveryState,
+            ...(readOnlyEscapeNote !== undefined ? { readOnlyEscape: readOnlyEscapeNote } : {}),
+            performed,
+            readback,
+            ...(readbackWarning ? { readbackWarning } : {}),
+            ...(steps !== undefined ? { steps } : {}),
+            ...(halfSuccess !== undefined ? { halfSuccess } : {}),
+            ...(typeof irreversible === "string" ? { irreversible } : {}),
+            // r30a F1: first write → replay:"none"; duplicate only on true replay.
+            ...(args.requestId ? { requestId: args.requestId, idempotency: idempotencyDeclaration(tool.name, "none") } : {}),
+            ...(productionConfirmed ? { productionConfirmed: true } : {}),
+            ...(rollbackRef ? { rollback: rollbackRef } : {}),
+            summary: writeSummary(tool.name, args, { performed, readback }, "done"),
+            detailFile: artifactRef.detailFile,
+            detailSha256: artifactRef.detailSha256,
+            artifactFingerprint: artifactRef.detailSha256,
+        };
     });
 }
 /**
@@ -200,29 +237,105 @@ export function deliveryStateFor(readback) {
         }
         : { deliveryState: "DELIVERED" };
 }
-function idempotencyDeclaration(tool) {
+/**
+ * Single source of truth for requestId replay enum strings (r30a F1).
+ * Help / skills must quote these constants — do not invent parallel spellings.
+ */
+export const IDEMPOTENCY_REPLAY = Object.freeze({
+    none: "none",
+    alreadyCompleted: "already-completed",
+});
+export const IDEMPOTENCY_DUPLICATE = Object.freeze({
+    sameRequestReplayNoOp: "same-request-replay-no-op",
+    alreadyAbsentNoOp: "already-absent-no-op",
+    alreadyPublishedNoOp: "already-published-no-op",
+});
+function idempotencyDeclaration(tool, replay) {
+    if (replay === IDEMPOTENCY_REPLAY.none)
+        return { key: "requestId", replay: IDEMPOTENCY_REPLAY.none };
     if (tool.includes("delete"))
-        return { key: "requestId", replay: "completed", duplicate: "already-absent-no-op" };
+        return { key: "requestId", replay: IDEMPOTENCY_REPLAY.alreadyCompleted, duplicate: IDEMPOTENCY_DUPLICATE.alreadyAbsentNoOp };
     if (tool.includes("publish"))
-        return { key: "requestId", replay: "completed", duplicate: "already-published-no-op" };
-    if (tool.includes("import"))
-        return { key: "requestId", replay: "completed", duplicate: "same-request-replay-no-op" };
-    return { key: "requestId", replay: "completed", duplicate: "same-request-replay-no-op" };
+        return { key: "requestId", replay: IDEMPOTENCY_REPLAY.alreadyCompleted, duplicate: IDEMPOTENCY_DUPLICATE.alreadyPublishedNoOp };
+    return { key: "requestId", replay: IDEMPOTENCY_REPLAY.alreadyCompleted, duplicate: IDEMPOTENCY_DUPLICATE.sameRequestReplayNoOp };
 }
-function findCompleted(root, requestId, tool, environment, requestFingerprint) {
+/** Walk local write artifacts for a requestId (optionally tool/env scoped). */
+export function listRequestArtifacts(root, requestId, options = {}) {
     if (!existsSync(root))
-        return undefined;
+        return [];
+    const hits = [];
     for (const name of readdirSync(root)) {
         if (!name.endsWith(".json"))
             continue;
         try {
             const artifact = JSON.parse(readFileSync(join(root, name), "utf8"));
-            if (artifact.deliveryState === "DELIVERED" && artifact.requestId === requestId && artifact.tool === tool && artifact.environment === environment && artifact.requestFingerprint === requestFingerprint)
-                return { status: "ok", deliveryState: "DELIVERED", replay: "already-completed", requestId, idempotency: idempotencyDeclaration(tool), performed: artifact.performed, readback: artifact.readback };
+            if (artifact.requestId !== requestId)
+                continue;
+            if (options.tool !== undefined && artifact.tool !== options.tool)
+                continue;
+            if (options.environment !== undefined && artifact.environment !== options.environment)
+                continue;
+            hits.push({ file: name, artifact });
         }
-        catch { }
+        catch { /* torn/corrupt artifact: skip */ }
+    }
+    return hits;
+}
+/**
+ * Idempotent replay lookup (r30a F1/F2):
+ * - same requestId + same fingerprint → already-completed (true no-op replay)
+ * - same requestId + different fingerprint → refuse request-id-args-mismatch
+ * - no prior hit → undefined (proceed with first write)
+ */
+function findCompleted(root, requestId, tool, environment, requestFingerprint) {
+    const hits = listRequestArtifacts(root, requestId, { tool, environment });
+    const exact = hits.find((hit) => hit.artifact.deliveryState === "DELIVERED" && hit.artifact.requestFingerprint === requestFingerprint);
+    if (exact) {
+        const artifact = exact.artifact;
+        return {
+            status: "ok",
+            deliveryState: "DELIVERED",
+            replay: IDEMPOTENCY_REPLAY.alreadyCompleted,
+            requestId,
+            idempotency: idempotencyDeclaration(tool, IDEMPOTENCY_REPLAY.alreadyCompleted),
+            performed: artifact.performed,
+            readback: artifact.readback,
+        };
     }
-    return undefined;
+    const prior = hits.find((hit) => hit.artifact.deliveryState === "DELIVERED" || hit.artifact.deliveryState === "WRITE_UNVERIFIED" || hit.artifact.deliveryState === "STOPPED");
+    if (!prior)
+        return undefined;
+    const priorArtifact = prior.artifact;
+    const performed = (priorArtifact.performed ?? {});
+    const existingBizObjectId = typeof performed.bizObjectId === "string"
+        ? performed.bizObjectId
+        : typeof priorArtifact.readback?.bizObjectId === "string"
+            ? String(priorArtifact.readback.bizObjectId)
+            : undefined;
+    const envFlag = `--env ${environment}`;
+    return {
+        status: "refused",
+        blocker: "request-id-args-mismatch",
+        requestId,
+        argsDigestChanged: true,
+        existingRequestFingerprint: priorArtifact.requestFingerprint ?? null,
+        ...(existingBizObjectId !== undefined ? { existingBizObjectId } : {}),
+        prior: {
+            tool: priorArtifact.tool,
+            environment: priorArtifact.environment,
+            deliveryState: priorArtifact.deliveryState,
+            recordedAt: priorArtifact.recordedAt,
+            artifactFile: prior.file,
+        },
+        message: `同一个 requestId「${requestId}」已经用过不同参数写过（argsDigestChanged:true）。` +
+            `requestId 是 (id, 参数指纹) 组合键——换参数必须换 requestId，否则拒绝，避免悄悄写出第二条。`,
+        nextCommand: `omc call request.status ${envFlag} --args '{"requestId":"${requestId}"}'`,
+        recovery: {
+            whatWentWrong: "request-id-args-mismatch",
+            fixFirst: `换一个未用过的 --request-id 再发；或先 omc call request.status ${envFlag} --args '{"requestId":"${requestId}"}' 查已有结果`,
+            doNot: "不要用同一 requestId 换参数期望覆盖/重放——那会拒绝，不会更新原写",
+        },
+    };
 }
 /** Low-level write registration factory: shared by every lane adapter. */
 export function writeTool(definition) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -54,9 +54,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.6.11",
     "commander": "14.0.3",
-    "omc-core": "0.6.11",
+    "omc-core": "0.6.13",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",
@@ -72,5 +71,8 @@
     "type": "git",
     "url": "https://gitlab.h3yun.com/fuwenbin/oh-my-cpagents.git",
     "directory": "packages/omc-cli"
+  },
+  "optionalDependencies": {
+    "@stalfh233/omc-fake-platform": "0.6.13"
   }
 }

package/skills/omc-business-configuration.md

@@ -152,7 +152,7 @@ rules:
 
 - **两条路**：模型+表单+流程一揽子交付走**意图**（`intent` 的 `workflow` 能力，声明式一次 apply）；只动流程或想逐步控制走**低层链** `workflow.create → workflow.update（权限/节点）→ workflow.publish`，标准链配方见 `omc describe workflow.update`（含多级审批/participant 三形态/自动回填说明）。流程权限细节见下节。
 - 一个模型只能有一个流程；已有流程的模型直接 `workflow.update`，不要另建。
-- **清理测试数据用批量删除**：`data.delete --args '{"schemaCode":"<code>","bizObjectIds":["id1","id2"]}'` 一次往返删多条（真机 r6：207 次逐条 `data.delete` 占 13.5% 调用）。
+- **清理测试数据用逐条删除**：1.1.x 上 `bizObjectIds:[多个]` 是假成功（`data-delete-batch-fake-success`）。用 `--args-list` 一次跑多条单删：`omc call data.delete --args-list '[{"schemaCode":"<code>","bizObjectId":"id1"},{"schemaCode":"<code>","bizObjectId":"id2"}]'`，再逐条 `data.load` 确认 `exists:false`（见 `describe data.delete --example sweep-all-readback`）。
 - **「聚合计算」是字段能力，不是规则节点**：FORMULA(计算公式)字段的 `options.formulaConfig.formulaType="AGGREGATION"` 就是 UI 里的「配置方式 → 聚合计算」。**只能汇总另一个模型**（跨模型），**同模型/自己的子表会 305003**（`field.publish` 时 `publishFormula` 把相对码改写成子表父模型 = 本模型，`checkCycleOfAggregation:1032` 判成环；工具已写前拒绝 `aggregation-self-schema-cycle`）。可直接抄 `omc describe field.create --example formula-aggregation-cross-model`。形状：
   `options = {persistent:true, formulaConfig: JSON字符串({resultType:2, formulaType:"AGGREGATION", aggregation: JSON字符串({schemaCode:"<来源模型>", dataItemCode:"<来源列>", calculateType:"SUM", formula:"SUM({<来源模型>.<列>})", queryConditions:[[{propertyCode:"<来源模型字段>", currentPropertyCode:"<目标模型字段>", operatorType:1, valueType:"DYNAMIC"}]]})})}`。
   - **`queryConditions` 不能为空**：它是反向过滤器的唯一输入，空数组时回算日志照打但目标字段恒 0（r17 实测）。

package/skills/omc-capabilities.md

@@ -67,9 +67,9 @@ only the section for the capability you need —
 ## 数据字典 `dictionary`
 
 - **能做哪些事**：字典与字典记录全生命周期（键值型/树型、启停）；作为选择字段的选项来源；字典分类。
-- **工具**：`dictionary.list`、`dictionary.type`、`dictionary.names`、`dictionary.get`、`dictionary.records`、`dictionary.save`、`dictionary.status`、`dictionary.usage`、`dictionary.parent`、`dictionary.classes`、`dictionary.class.save`、`dictionary.class.delete`
+- **工具**：`dictionary.list`、`dictionary.type`、`dictionary.names`、`dictionary.get`、`dictionary.records`、`dictionary.save`、`dictionary.status`、`dictionary.usage`、`dictionary.references`、`dictionary.parent`、`dictionary.classes`、`dictionary.class.save`、`dictionary.class.delete`
 - **recipe**：`omc describe dictionary.save --example dictionary-key-value`
-- **边界 / 陷阱**：选择字段有三种选项来源——`custom` / `dictionary` / `businessModel`；关联单选/多选支持 `searchFormula` 与 `conditions` JSON 筛选。**字典没有删除**——平台只有停用/启用（`dictionary.status`，target= dictionary|record）；不要找 dictionary.delete（分类有 `class.delete`，字典本体没有），清理测试残留用停用即可。
+- **边界 / 陷阱**：选项来源 `custom`/`dictionary`/`businessModel`；关联可用 `searchFormula`/`conditions`。**无字典删除**——只能 `dictionary.status` 停用。`dictionary.usage`=写 initialUsed（非引用查询）；引用扫描用 `dictionary.references`。
 
 ## 业务模型 `model`
 
@@ -152,8 +152,8 @@ only the section for the capability you need —
 
 - **能做哪些事**：流程模板 get_draft/get_published、create、update、publish、bindRule（事件处理器规则绑定）、delete、workitem.list、workflow.instanceActivity（实例节点状态诊断）；参与人用组织对象。
 - **工具**：`workflow.get_draft`、`workflow.setButtons`（节点「表单操作」按钮勾选）、`workflow.get_published`、`workflow.validate`、`workflow.create`、`workflow.update`、`workflow.publish`、`workflow.bindRule`、`workflow.delete`、`workflow.permissions`、`workflow.addPermission`、`workflow.removePermission`（发起权限：发布流程不会自动建这一行，缺它一律 40009）、`configure_workflow`、`workitem.list`、`workflow.instanceActivity`、`org.role.list`、`org.department.list`、`org.user.search`、`org.role.users`、`org.role.userScope`、`org.roleGroup.create`、`org.role.create`、`org.role.update`、`org.role.addUsers`、`org.role.removeUsers`、`org.role.setUserScope`、`org.department.create`、`org.department.update`、`org.department.delete`、`org.department.users`、`org.user.create`、`org.user.update`、`org.user.delete`、`org.user.info`、`org.user.departments`、`org.role.delete`、`org.roleGroup.delete`、`org.user.transferDepartment`
-- **recipe**：`omc describe workflow.bindRule --example workflow-handler-binding`
-- **边界 / 陷阱**：greenfield 首版；`publish`/`bindRule` 不得在 `ValidateMessage[]` 拒绝时报告成功。运行时 workitem（提交/审批）走 `data.submit`；想知道实例停在哪/是否错派，用 `workflow.instanceActivity`（无 status=1=真停，参与人全是发起人=解析为空退回）。
+- **recipe**：`omc describe workflow.bindRule --example workflow-handler-binding`；条件两级/一级：`omc describe workflow.update --example workflow-conditional-two-level-approval`
+- **边界 / 陷阱**：greenfield 首版；`publish`/`bindRule` 不得在 `ValidateMessage[]` 拒绝时报告成功。运行时 workitem（提交/审批）走 `data.submit`；想知道实例停在哪/是否错派，用 `workflow.instanceActivity`（无 status=1=真停，参与人全是发起人=解析为空退回）。**发起权限**（`workflow.permissions` / `addPermission`）只有部门/角色/用户三种白名单，**没有「全员」选项**——缺权限行时非管理员通常不能发起（40009），想放开只能授一个够宽的部门/角色，不是「不建行=全员」。**行级数据权限 / 可见范围 / 申请人只看自己的单据不在工具覆盖内**（没有按登录人动态过滤的读面/写面）；`org.role.setUserScope` 是角色成员的部门管理范围，不是单据行级可见范围。
 
 ## 表单在线 JS `onlinejs`
 
@@ -207,6 +207,7 @@ only the section for the capability you need —
 | 面 | 状态 | 说明 |
 | --- | --- | --- |
 | 权限 / 授权矩阵 | blocked | 授权矩阵不在配置面 |
+| **行级数据权限 / 可见范围 / 本人单据** | unsupported | 没有按登录人动态过滤的读面/写面；`workflow.permissions` 只管谁能**发起**；`org.role.setUserScope` 是角色成员部门管理范围。搜「数据权限」「可见范围」「行级权限」「本人」应命中本行——不是词写错，是能力缺口 |
 | 嵌套子表（子表套子表） | 平台不存在 | 平台本身就是一级子表：主表可多子表，子表不能再套子表；不是 CLI 缺口，不要按此设计 |
 | OCR / 电子签章 / 发票识别 | unsupported | 不在平台配置覆盖内 |
 | 应用发布 / 环境上线 / 生产发布 | unsupported | CLI 只做配置，不做环境发布 |

package/skills/omc-playbook.md

@@ -0,0 +1,41 @@
+---
+name: omc-playbook
+description: 一页纸业务场景步骤清单（采购申请 / 请假审批 / 基础档案）。多面需求先看这里，再按步执行。
+---
+
+# Playbook（业务场景一页纸）
+
+多面需求不要靠自己拼 3–4 个 1KB+ 方法论节。这里每步一条命令。
+
+入口：`omc next "<目标>"`（多面 → `mode:whole-package`）→ 本页 → 逐步执行。
+
+## 采购申请（主子表 + 合计 + 条件审批 + 列表 + 按钮）
+
+1. `omc next "从零做采购申请：主子表、合计、条件审批、列表、按钮"`
+2. `omc intent schema`（或直接按下方拼装器链）
+3. `omc model-scaffold --app <app> --code <code> --name 采购申请 --fields '[{"code":"title","name":"标题","propertyType":"SHORT_TEXT"},{"code":"amount","name":"合计","propertyType":"NUMERICAL","options":{"scale":2}},{"code":"details","name":"明细","propertyType":"CHILD_TABLE","subFields":[{"code":"item","name":"品名","propertyType":"SHORT_TEXT"},{"code":"qty","name":"数量","propertyType":"NUMERICAL","options":{"scale":0}},{"code":"price","name":"单价","propertyType":"NUMERICAL","options":{"scale":2}},{"code":"lineAmount","name":"金额","propertyType":"NUMERICAL","options":{"scale":2}}]}]' --apply`
+4. `omc compute --schema <code> --target amount --formula 'SUM({details.lineAmount})' --apply`（⚠️ 只在门户算，REST 不回填）
+5. 条件审批（金额>50000 两级）：**不要** `approval-flow --condition`（无此参数）。线性先：`omc approval-flow --schema <code> --steps '经理@role:<mgr>' --steps '总监@role:<dir>' --apply`；条件分流改 `omc describe workflow.update --example workflow-conditional-branch` 后 `workflow.update`。
+6. 发起权限：`omc call workflow.addPermission --args '{"workflowCode":"<code>_wf","unitId":"<deptOrRoleId>","unitType":1}'`（这是**谁能发起**，不是行级可见范围）
+7. 列表：`omc call listview.configure --args '{"schemaCode":"<code>","fieldCodes":["title","amount"]}'`
+8. 表单按钮：`omc call listview.configure --args '{"schemaCode":"<code>","buttons":[{"name":"提交审批","useLocation":"FORM","bindAction":"FLOW"}]}'`（形状以 describe 为准）
+9. ⚠️ **行级「申请人只看自己」当前工具面不支持**（`workflow.permissions` / `org.role.setUserScope` 都不是行级数据权限）
+
+## 请假审批（线性流）
+
+1. `omc model-scaffold --code leave --name 请假 --fields '[{"code":"days","name":"天数","propertyType":"NUMERICAL","options":{"scale":1}},{"code":"reason","name":"事由","propertyType":"LONG_TEXT"}]' --apply`
+2. `omc approval-flow --schema leave --steps '主管@role:<code>' --apply`
+3. `omc call workflow.addPermission --args '{"workflowCode":"leave_wf","unitId":"<id>","unitType":2}'`
+4. 造单验：`omc describe data.submit --example workflow-backed-data-submit`
+
+## 基础档案（无流程）
+
+1. `omc model-scaffold --code vendor --name 供应商 --fields '[{"code":"name","name":"名称","propertyType":"SHORT_TEXT"},{"code":"code","name":"编码","propertyType":"SHORT_TEXT"}]' --apply`
+2. `omc call listview.configure --args '{"schemaCode":"vendor","fieldCodes":["name","code"]}'`
+3. 造数：`omc describe data.submit --example plain-data-submit`
+
+## 读法
+
+- 默认索引：`omc help omc-playbook`（看节摘要）
+- 按节：`omc help omc-playbook --section "采购申请"`
+- 下次可按节读：`omc help <topic> --section <标题>`