@stalfh233/omc-cli 0.6.12 → 0.6.14

package/dist/lanes/runtime-data.js

@@ -10,9 +10,100 @@ import { defineTool } from "../tool-types.js";
 import { wireCall, wireRows, WireError } from "../wire.js";
 import { CHILD_TABLE_PROPERTY_TYPE, diagnoseApprovalSubmitIdentity, runtimeWriteWithAppMapping } from "../runtime-support.js";
 import { closestMatch } from "../closest-match.js";
-import { getReplayToken, searchWorkItems, wireString } from "../workflow-support.js";
+import { getReplayToken, listInstanceActivities, searchWorkItems, wireString } from "../workflow-support.js";
+import { PLATFORM_ADMIN_START_BYPASS, resolvePermissionActor } from "../identity.js";
 import { ENGINE_OWNED_KEYS, RUNTIME_DATA_LANE_CONTRACT, RUNTIME_DATA_WIRE, runtimeFormDataArg, } from "./runtime-data-contract.js";
 import { SYSTEM_FIELD_CODES } from "../field-families.js";
+/** r29b F8: keep ids/itemsPreview through governedRead's compact diet. */
+const DATA_LIST_PREVIEW_LIMIT = 20;
+function dataListItemPreview(items) {
+    const ids = [];
+    const itemsPreview = [];
+    for (const item of items) {
+        const id = typeof item.id === "string" && item.id.trim() ? item.id : typeof item.fields?.id === "string" ? String(item.fields.id) : null;
+        if (!id)
+            continue;
+        ids.push(id);
+        if (itemsPreview.length < DATA_LIST_PREVIEW_LIMIT) {
+            const nameRaw = item.fields?.name;
+            itemsPreview.push({ id, name: typeof nameRaw === "string" && nameRaw.length > 0 ? nameRaw : null });
+        }
+    }
+    return { ids, itemsPreview };
+}
+/**
+ * r29b F8：`data.list` 的大结果被外置后 `items:[]`，调用方连 id 都拿不到
+ * （3 行的模型也会这样——于是「没数据」与「被外置」看起来一样）。
+ *
+ * **只在确实要丢弃 items 时才补 `ids`/`itemsPreview`**：这段只在 governedRead
+ * 判定 `large`（>2048B）后才会被调用。早期版本把 ids/preview 无条件塞进 handler
+ * 的回执，结果 25 行的小结果因为多了这一份副本被顶过 2048B → 反而触发外置、
+ * `items` 变成空数组（composers 的 `--all` 聚齐断言直接失败）。
+ *
+ * r31b F7：外置后同信封只给一份身份面——`ids` 全量；`itemsPreview` 仅
+ * `ids.slice(0,3)` 的引用（`{id}`，不再带 name），避免「同一批行给三份」。
+ */
+function dataListCompactProjection(result) {
+    const compact = {};
+    for (const [key, value] of Object.entries(result)) {
+        if (key === "items" && Array.isArray(value)) {
+            compact.itemsCount = value.length;
+            const preview = dataListItemPreview(value);
+            compact.ids = preview.ids;
+            // Reference face only — not a second copy of the rows.
+            compact.itemsPreview = preview.ids.slice(0, 3).map((id) => ({ id }));
+            if (value.length > 0)
+                compact.listArtifactHint =
+                    "items 已外置（truncatedKeys 含 items）：完整行见 artifact（detailArtifactId / fetch）。同信封三分法：ids=本页全部 id；itemsPreview=ids 前 3 个的引用（仅 {id}，不是第二份行）；items=[] 表示正文在 artifact。";
+            continue;
+        }
+        // 这两个键由本函数按 items 现算，handler 不再重复内联。
+        if (key === "ids" || key === "itemsPreview" || key === "listArtifactHint")
+            continue;
+        compact[key] = value;
+    }
+    return compact;
+}
+/** r29c F1b: runMode is documented but unused — refuse unknown values before wire. */
+const DATA_SUBMIT_RUN_MODE_SUPPORTED = new Set([]);
+function assertSupportedRunMode(runMode) {
+    if (runMode === undefined || runMode === null)
+        return;
+    if (typeof runMode !== "string" || runMode.trim().length === 0) {
+        throw new ToolInputError({
+            status: "error",
+            blocker: "tool-input-invalid",
+            tool: "data.submit",
+            message: "runMode 必须是字符串；当前平台 REST 提交面**不支持** runMode（传任何值都会 10009 类型转换异常）。该参数不能用来撤回/终止；请省略 runMode。",
+            nextCommand: "omc describe data.submit --param runMode",
+        });
+    }
+    if (!DATA_SUBMIT_RUN_MODE_SUPPORTED.has(runMode)) {
+        throw new ToolInputError({
+            status: "error",
+            blocker: "tool-input-invalid",
+            tool: "data.submit",
+            message: `runMode="${runMode}" 不受支持：当前平台 REST 提交面没有可用的 runMode 取值（传任何值都会 10009 类型转换异常）。` +
+                "该参数**不能**用来撤回/终止实例；请省略 runMode。若要清实例，用 data.delete 删业务行（会级联终止）或 model-purge --purge-instances。",
+            acceptedValues: { runMode: [] },
+            nextCommand: "omc describe data.submit --param runMode",
+        });
+    }
+}
+/** 1.1.x batch delete is a documented fake-success; gate dry-run + execute alike. */
+function isAiPlatform11Family(session) {
+    const version = session.detectedVersion();
+    return typeof version === "string" && version.startsWith("1.1");
+}
+function batchDeleteFakeSuccessRefusal(schemaCode, ids) {
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "data-delete-batch-fake-success",
+        nextCommand: `omc call data.delete --args '${JSON.stringify({ schemaCode, bizObjectId: ids[0] })}'`,
+        message: "批量删除（bizObjectIds 多个）在 1.1.25 真机实证为假成功：回执 DELIVERED + absent:true + modelResidue.total 递减，但行仍在（data.list 不变、data.load exists:true）；同样的 id 改单条逐个删才真删掉。请用 bizObjectId（单个）逐个删，每条删完用 data.load 确认 exists:false（absent:true 不是删除成功的证明）。" +
+            `下一步：把 ${ids.length} 个 id 拆成 ${ids.length} 次单删（示例已写入 nextCommand；其余 id 替换 bizObjectId 即可）。`,
+    });
+}
 // A2（GitLab #15，2026-11-04）：单选/字典字段（RADIO/CHECKBOX/DROPDOWN_BOX/
 // DROPDOWN_MULTI_BOX）在运行面查询按**字典 key**匹配，不按显示值——按「已审核」
 // 这类显示值过滤会静默 0 条；加 `_key` 后缀的字段名则不在发布元数据里，直接拒。
@@ -681,17 +772,67 @@ export function assertRuntimeFieldValueShapes(meta, formData, childCodes, contex
         if (problems.length > 0) {
             throw new ToolRefusalError({
                 status: "refused",
-                blocker: "submit-child-rows-missing-id",
+                // r29b F7: blocker 名与工具无关（data.update / data.submit 共用）；旧名保留兼容。
+                blocker: "child-rows-missing-id",
+                blockerAliases: ["submit-child-rows-missing-id"],
                 schemaCode: context.schemaCode,
                 childTables: problems,
                 message: `更新既有记录时子表行必须带 id：${problems.join("、")}。平台对无 id 的子行按**新增插入**（不判重）——` +
                     `r17 真机：同一条记录连发 4 次带 2 行无 id 子表的 update，子行从 2 变 8，聚合 SUM 翻倍。` +
                     `改既有行：先 data.load 拿子行 id 原样带回（平台走 rowStatus=Modified）；` +
-                    `有意追加新行：显式给该行 rowStatus:"Added"。`,
+                    `有意追加新行：显式给该行 rowStatus:"Added"；删除行：只传 {id, rowStatus:"Deleted"}（少传行不会删）。` +
+                    `三合一示例见 describe data.update --example child-rows-upsert。`,
             });
         }
     }
 }
+/**
+ * r29b F6: 「少传行」被平台静默忽略。比较提交行与库内行，缺 Deleted 标记时给 warning，
+ * **绝不**自动删（语义不能猜）。
+ */
+function childRowsNotDeletedWarnings(formData, existingRecord, childCodes) {
+    if (!existingRecord)
+        return [];
+    const warnings = [];
+    for (const code of childCodes) {
+        const submitted = formData[code];
+        if (!Array.isArray(submitted))
+            continue;
+        const existing = existingRecord[code];
+        if (!Array.isArray(existing))
+            continue;
+        const existingIds = existing
+            .map((row) => (row && typeof row === "object" && !Array.isArray(row) ? String(row.id ?? "").trim() : ""))
+            .filter((id) => id.length > 0);
+        if (existingIds.length === 0)
+            continue;
+        const submittedIds = new Set(submitted
+            .map((row) => (row && typeof row === "object" && !Array.isArray(row) ? String(row.id ?? "").trim() : ""))
+            .filter((id) => id.length > 0));
+        const hasExplicitDelete = submitted.some((row) => row &&
+            typeof row === "object" &&
+            !Array.isArray(row) &&
+            typeof row.rowStatus === "string" &&
+            String(row.rowStatus).toLowerCase() === "deleted");
+        if (hasExplicitDelete)
+            continue;
+        if (submitted.length >= existingIds.length && submittedIds.size >= existingIds.length)
+            continue;
+        const omitted = existingIds.filter((id) => !submittedIds.has(id));
+        if (omitted.length === 0 && submitted.length >= existingIds.length)
+            continue;
+        const missing = omitted.length > 0 ? omitted : existingIds.slice(submitted.length);
+        if (missing.length === 0)
+            continue;
+        warnings.push({
+            code: "child-rows-not-deleted",
+            childTable: code,
+            rows: missing,
+            hint: "少传行不会删除；删除需显式 rowStatus:'Deleted'（只给 id）",
+        });
+    }
+    return warnings;
+}
 /**
  * r18 (2026-10-26 live): `errcode 40000 调用数据库发生异常` carries NO detail and
  * `omc-refusals` had nothing for it. A probe burned ~40 calls bisecting it:
@@ -776,8 +917,10 @@ export function registerRuntimeDataLane(tools) {
             filters: z.array(z.record(z.string(), z.unknown())).optional().describe("clauses combined with AND; a malformed clause is refused with blocker invalid-filter-DSL"),
             filterGroup: z.record(z.string(), z.unknown()).optional().describe('nested group { op:"and"|"or", clauses:[clause|group] }'),
             rawCondition: z.unknown().optional(),
-            displayFields: z.array(z.string().min(1)).optional(),
-            columns: z.array(z.string().min(1)).optional(),
+            displayFields: z.array(z.string().min(1)).optional().describe("列投影（平台 query/list 的 displayFields）；与 columns / fields 同义"),
+            columns: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields）"),
+            // r29b F9: data.load/save/update 都叫 fields；list 面原先只有 displayFields/columns。
+            fields: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields；与 data.load/data.save/data.update 的 fields 同语义）"),
             orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional(),
             mobile: z.boolean().optional(),
             showTotal: z.boolean().default(true),
@@ -916,7 +1059,8 @@ export function registerRuntimeDataLane(tools) {
                             nextCommand: `omc call data.load --env <env> --args '{"schemaCode":"${args.schemaCode}","bizObjectId":"<主表 bizObjectId>"}'`,
                         };
                 }
-                const requestedFields = args.displayFields ?? args.columns;
+                // r29b F9: fields 是 displayFields/columns 的同义别名（与 data.load 对齐）。
+                const requestedFields = args.displayFields ?? args.columns ?? args.fields;
                 const fields = requestedFields && requestedFields.length > 0 ? requestedFields : undefined;
                 const body = {
                     schemaCode: args.schemaCode,
@@ -992,6 +1136,7 @@ export function registerRuntimeDataLane(tools) {
                             // 元数据读失败不阻断数据返回
                         }
                     }
+                    const preview = dataListItemPreview(items);
                     return {
                         schemaCode: args.schemaCode,
                         total,
@@ -1009,6 +1154,8 @@ export function registerRuntimeDataLane(tools) {
                         // 形状常量：脚本按 result.items 取数（与内联态一致），itemsCount 与
                         // total 的差就是被截断的条数——不再只靠 size 反推。
                         itemsCount: collected.length,
+                        // r29b F8 的 ids/itemsPreview 由 compact（外置时）现算，不在这里内联——
+                        // 内联会让小结果越过 2048B 外置阈值，反而把 items 挤成 []。
                         ...(truncatedByCap
                             ? {
                                 truncated: true,
@@ -1078,11 +1225,36 @@ export function registerRuntimeDataLane(tools) {
                 // present, zero non-null business values) and say so.
                 const businessKeys = fields ?? Object.keys(items[0]?.fields ?? {}).filter((field) => !["id", "bizObjectId", "schemaCode", "sequenceStatus", "createdTime", "updatedTime", "creator", "updater", "name"].includes(field));
                 const projectionEmpty = items.length > 0 && businessKeys.length > 0 && items.every((item) => businessKeys.every((key) => item.fields[key] === null || item.fields[key] === undefined));
+                const preview = dataListItemPreview(items);
+                const requestedPage = args.page ?? 0;
+                // r31b F9: an out-of-range page can answer total:0 / totalPages:1 (platform),
+                // which scripts misread as "model empty". When the page looks empty-and-
+                // beyond, re-read page 0 for the authoritative total and mark pageOutOfRange.
+                let total = args.showTotal === false ? null : page.total;
+                let totalPages = page.totalPages;
+                let pageOutOfRange = false;
+                if (args.showTotal !== false
+                    && items.length === 0
+                    && requestedPage > 0
+                    && Number(page.total ?? 0) === 0) {
+                    const probe = await wireCall(session, {
+                        path: ENDPOINTS.runtimeQueryList,
+                        method: "POST",
+                        body: { ...body, page: 0, size: 1, showTotal: true },
+                    });
+                    const probePage = extractBizObjectPage(probe.data);
+                    total = probePage.total;
+                    totalPages = probePage.totalPages;
+                    pageOutOfRange = Number(probePage.total ?? 0) > 0 || (probePage.totalPages > 0 && requestedPage >= probePage.totalPages);
+                }
+                else if (totalPages > 0 && requestedPage >= totalPages) {
+                    pageOutOfRange = true;
+                }
                 const readback = {
                     schemaCode: args.schemaCode,
                     ...(projectionEmpty ? { projectionWarning: { reason: "business-columns-null", hint: "模型可能未配置列表视图：data.list 只投影列表列，业务列会全为 null；核对写入结果请用 data.load（或先建列表视图）" } } : {}),
                     ...(args.queryCode !== undefined ? { queryCode: args.queryCode } : {}),
-                    total: args.showTotal === false ? null : page.total,
+                    total,
                     // This branch is the non-`all` read. `excludedDraft` used to be
                     // unconditional, but r26 真机实证（2026-11-05）：**带查询条件时**草稿行
                     // 被排除（total 也只计非草稿），**不带条件时**同一个 data.save 的 DRAFT
@@ -1106,10 +1278,12 @@ export function registerRuntimeDataLane(tools) {
                                 : { draftPolicy: "unspecified", hint: "本次结果无 DRAFT 行，但本面是否过滤草稿不能据此断定；判定状态读 data.load 的 sequenceStatus" };
                         return { filter: policy };
                     })(),
-                    ...(choiceFilterFields.length > 0 && Number(page.total ?? 0) === 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}),
-                    totalPages: page.totalPages,
-                    page: page.page ?? args.page ?? 0,
+                    ...(choiceFilterFields.length > 0 && Number(total ?? 0) === 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}),
+                    totalPages,
+                    page: page.page ?? requestedPage,
                     size: page.size ?? args.size ?? 20,
+                    ...(pageOutOfRange ? { pageOutOfRange: true, emptyPage: true } : {}),
+                    // r29b F8 的 ids/itemsPreview 由 compact（外置时）现算，见 dataListCompactProjection。
                     items,
                 };
                 // A model's unconfigured default list view projects business columns as
@@ -1165,8 +1339,15 @@ export function registerRuntimeDataLane(tools) {
                     if (hint)
                         readback.projectionHint = hint;
                 }
+                // r29b F8: ids/itemsPreview 已在同信封；artifact 提示由 compact 外置后的
+                // fetch/detailArtifactId 承担。这里不改既有 projectionHint 主句（契约测试
+                // 钉死 RUNTIME_DATA_WIRE.projectionHint 原文）。
                 return readback;
-            }, { full: args.full === true, target: `data.list:${JSON.stringify({ schemaCode: args.schemaCode, queryCode: args.queryCode ?? args.schemaCode, filter: args.filter, filters: args.filters, filterGroup: args.filterGroup, rawCondition: args.rawCondition, displayFields: args.displayFields, columns: args.columns, page: args.page ?? 0, size: args.size ?? 10 })}` });
+            }, {
+                full: args.full === true,
+                compact: dataListCompactProjection,
+                target: `data.list:${JSON.stringify({ schemaCode: args.schemaCode, queryCode: args.queryCode ?? args.schemaCode, filter: args.filter, filters: args.filters, filterGroup: args.filterGroup, rawCondition: args.rawCondition, displayFields: args.displayFields ?? args.columns ?? args.fields, columns: args.columns, page: args.page ?? 0, size: args.size ?? 10 })}`,
+            });
         },
     }));
     tools.push(defineTool({
@@ -1248,7 +1429,7 @@ export function registerRuntimeDataLane(tools) {
         inputSchema: {
             schemaCode: z.string().min(1),
             sheetCode: z.string().optional(),
-            formData: runtimeFormDataArg,
+            formData: runtimeFormDataArg.describe('business-object data keyed by field code（关联/人员形状同默认描述）。mappings 仅门户回填；字典-backed 不校验取值（不存在/已停用码也会落库，要拦请配数据规则）。'),
             workflowCode: z.string().optional().describe("portal draft-save shape: create the row AND a DRAFT workflow instance + start workItem (finishStart=FALSE); submit later via data.submit with the returned workItemId. formData must NOT carry an id — in-place workflow start has no REST surface in 8.6.26"),
             submit: z.boolean().optional().describe("true=保存后立即直提（无流程模型 DRAFT→COMPLETED，触发 Create 规则）；与 workflowCode 互斥。**按业务约定正式数据优先直接 data.submit（无 id=新建并提交一调完成）——本参数是便捷别名，save 的定位是草稿/暂存**"),
             allowStaffOnSubmit: z.boolean().optional().describe("submit:true 时显式允许携带人员字段（issue#10：人员字段提交面两种形状都可能 50000，可靠链路是 save 落库后提交时省略；个别平台构建接受提交面携带，自担风险）"),
@@ -1485,7 +1666,11 @@ export function registerRuntimeDataLane(tools) {
                     message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
                 });
             }
-            const formData = (await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true })).formData;
+            const prepared = await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true });
+            const formData = prepared.formData;
+            const existingRecord = normalizeLoadedRecord(existing);
+            // r29b F6: 少传行 ≠ 删除。写前比一次，缺 Deleted 时只给 warning。
+            const omitWarnings = childRowsNotDeletedWarnings(formData, existingRecord ?? undefined, prepared.childCodes);
             let performed;
             try {
                 performed = await wireCall(session, {
@@ -1512,7 +1697,12 @@ export function registerRuntimeDataLane(tools) {
                 // Flat record contract (ticket 17): live FormLoadVO normalizes to the
                 // fake's flat field shape so `authoritative.<fieldCode>` reads work on
                 // both faces.
-                readback: { authoritative: projectReadbackRecord(updatedRecord, args), sequenceStatus, ...(updatedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(updatedEmptyFields, "data.update") } : {}) },
+                readback: {
+                    authoritative: projectReadbackRecord(updatedRecord, args),
+                    sequenceStatus,
+                    ...(updatedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(updatedEmptyFields, "data.update") } : {}),
+                    ...(omitWarnings.length > 0 ? { warnings: omitWarnings } : {}),
+                },
             };
         },
     });
@@ -1546,6 +1736,30 @@ export function registerRuntimeDataLane(tools) {
         scope: RUNTIME_TOOLS["data.delete"].scope,
         description: RUNTIME_TOOLS["data.delete"].description,
         inputSchema: { schemaCode: z.string().min(1), sheetCode: z.string().optional(), bizObjectId: z.string().min(1).optional(), bizObjectIds: z.array(z.string().min(1)).optional().describe("批量删除多个业务对象 id（等价于逐个 data.delete，但只花一次往返；返回 deleted 列表）") },
+        // r29b F10: dry-run 也必须拦 1.1.x 批量假成功，否则「计划能过、执行不能过」。
+        dryRunPayload: async (session, args) => {
+            const ids = args.bizObjectIds && args.bizObjectIds.length > 0 ? args.bizObjectIds : args.bizObjectId ? [args.bizObjectId] : [];
+            if (ids.length > 1 && isAiPlatform11Family(session)) {
+                return {
+                    wouldChange: false,
+                    blocker: "data-delete-batch-fake-success",
+                    plan: {
+                        warnings: [
+                            {
+                                code: "data-delete-batch-fake-success",
+                                message: `1.1.x（检测到 ${session.detectedVersion()}）上 bizObjectIds 批量删除是假成功；请逐个单删`,
+                            },
+                        ],
+                    },
+                    nextCommand: `omc call data.delete --args '${JSON.stringify({ schemaCode: args.schemaCode, bizObjectId: ids[0] })}'`,
+                    message: "dry-run 已拦截：批量删除（bizObjectIds 多个）在 1.1.x 真机实证为假成功。请用 bizObjectId（单个）逐个删。",
+                };
+            }
+            return {
+                wouldChange: ids.length > 0,
+                summary: ids.length > 1 ? `即将删除 ${ids.length} 条` : ids.length === 1 ? `即将删除 1 条（${ids[0]}）` : "缺少 bizObjectId/bizObjectIds",
+            };
+        },
         execute: async (session, args) => {
             const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
             const ids = args.bizObjectIds && args.bizObjectIds.length > 0 ? args.bizObjectIds : args.bizObjectId ? [args.bizObjectId] : [];
@@ -1565,23 +1779,19 @@ export function registerRuntimeDataLane(tools) {
             // DELIVERED + absent:true + a DECREASING modelResidue.total while the
             // rows are still queryable (data.list unchanged, data.load exists:true).
             // Re-issuing the same ids one at a time deleted them for real. Refuse
-            // the batch shape and teach the per-id loop until the platform path is
-            // understood; single-id deletes go through the exact same deleteOne.
+            // the batch shape on 1.1.x (and keep refusing unconditionally for the
+            // documented fake-success until an 8.6 path is proven safe).
             if (ids.length > 1)
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "data-delete-batch-fake-success",
-                    // r28b F14: point at a concrete single-id call, not the methodology page.
-                    nextCommand: `omc call data.delete --args '${JSON.stringify({ schemaCode: args.schemaCode, bizObjectId: ids[0] })}'`,
-                    message: "批量删除（bizObjectIds 多个）在 1.1.25 真机实证为假成功：回执 DELIVERED + absent:true + modelResidue.total 递减，但行仍在（data.list 不变、data.load exists:true）；同样的 id 改单条逐个删才真删掉。请用 bizObjectId（单个）逐个删，每条删完用 data.load 确认 exists:false（absent:true 不是删除成功的证明）。" +
-                        `下一步：把 ${ids.length} 个 id 拆成 ${ids.length} 次单删（示例已写入 nextCommand；其余 id 替换 bizObjectId 即可）。`,
-                });
+                batchDeleteFakeSuccessRefusal(args.schemaCode, ids);
             const deleteOne = async (bizObjectId) => {
                 // Delete is destructive: probe the authoritative object first so an
                 // absent id is an idempotent no-op, never a blind runtime delete.
                 const before = await loadExistingBizObject(session, args.schemaCode, sheetCode, bizObjectId);
+                // r31b F12: mirror model.delete — noop/deleted booleans so concurrent
+                // losers are not mistaken for successful deletes (both used to look like
+                // status:ok + DELIVERED + absent:true).
                 if (!before)
-                    return { bizObjectId, skipped: "already-absent", absent: true };
+                    return { bizObjectId, skipped: "already-absent", absent: true, noop: true, deleted: false };
                 const performed = await wireCall(session, {
                     path: ENDPOINTS.runtimeFormDelete,
                     method: "POST",
@@ -1602,13 +1812,26 @@ export function registerRuntimeDataLane(tools) {
                     else
                         throw error;
                 }
-                return { bizObjectId, errcode: performed.errcode, absent };
+                return { bizObjectId, errcode: performed.errcode, absent, deleted: absent === true, noop: false };
             };
             if (ids.length === 1) {
                 const one = await deleteOne(ids[0]);
-                if (one.skipped === "already-absent")
-                    return { performed: { skipped: "already-absent", sheetCode, resolvedFrom }, readback: { absent: true, recoveryHint: "id 不存在（already-absent≠删除成功）：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏，shell 空值兜底出来的 id 同样删不掉任何东西。若 modelResidue.total>0，用 items[].id 重删。", ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
-                return { performed: { errcode: one.errcode, sheetCode, resolvedFrom }, readback: { absent: one.absent, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+                if (one.skipped === "already-absent") {
+                    return {
+                        performed: { skipped: "already-absent", noop: true, deleted: false, sheetCode, resolvedFrom },
+                        readback: {
+                            absent: true,
+                            deleted: false,
+                            noop: true,
+                            recoveryHint: "若另一进程刚刚删除，这是正常并发结果（already-absent），不是 id 拿错。否则：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏。若 modelResidue.total>0，用 items[].id 重删。",
+                            ...(await modelResidue(session, args.schemaCode, sheetCode)),
+                        },
+                    };
+                }
+                return {
+                    performed: { errcode: one.errcode, deleted: one.deleted === true, noop: false, sheetCode, resolvedFrom },
+                    readback: { absent: one.absent, deleted: one.deleted === true, ...(await modelResidue(session, args.schemaCode, sheetCode)) },
+                };
             }
             const deleted = [];
             for (const id of ids)
@@ -1636,11 +1859,19 @@ export function registerRuntimeDataLane(tools) {
             allowChildRowAppend: z.boolean().optional().describe("默认 false：审批提交（带 workItemId/workflowInstanceId）时 formData 含子表数组会被拒——平台按追加插行，每次提交重复一份。确实要追加子行时才置 true。"),
             allowStaffOnSubmit: z.boolean().optional().describe("默认 false：提交携带人员字段会被拒（issue#10：两种形状都可能 50000；可靠链路=save 落库后提交省略人员字段）。个别平台构建接受提交面携带时置 true 自担。"),
             approval: z.record(z.string(), z.unknown()).optional(),
-            runMode: z.string().optional(),
+            runMode: z
+                .string()
+                .optional()
+                .describe("平台 REST 提交面当前**不支持** runMode（传任何值会 10009 类型转换异常）。**不能**用来撤回/终止；请省略。已支持取值：无。清实例用 data.delete 或 model-purge --purge-instances。"),
             isSimulative: z.boolean().optional(),
             ...readbackProjectionArgs,
         },
+        preflight: (args) => {
+            // r29c F1b: dry-run 与真写同门——不认识的 runMode 写前拒。
+            assertSupportedRunMode(args.runMode);
+        },
         execute: async (session, args) => {
+            assertSupportedRunMode(args.runMode);
             // r13 #5: an EMPTY STRING was forwarded verbatim, so the platform answered
             // 100002「参数为空」with no hint which parameter. Absent and blank are not
             // the same intent: refuse the blank one by name, zero wire.
@@ -2020,6 +2251,10 @@ export function registerRuntimeDataLane(tools) {
                 // response carried only the object id. Attach the pending work items for
                 // this instance while the flow is still in flight (best-effort: a lookup
                 // failure must never fail the submit).
+                // r29c F12: 驳回/通过要能从回执区分——agree:false → decision:REJECT。
+                const rejected = hasWorkItem && args.agree === false;
+                if (hasWorkItem)
+                    readback.decision = rejected ? "REJECT" : "APPROVE";
                 if (hasWorkflow && effectiveInstanceId && sequenceStatus !== "COMPLETED") {
                     try {
                         const pending = await searchWorkItems(session, { instanceId: effectiveInstanceId });
@@ -2029,18 +2264,82 @@ export function registerRuntimeDataLane(tools) {
                             activityName: wireString(item.activityName),
                             state: wireString(item.state),
                         }));
+                        // r29c F5: searchWorkItems 只回**当前登录人**待办；下一节点审批人不是
+                        // 你时 pending 为空 ≠ 没生成待办。用 listInstanceActivities 区分。
+                        let activeActivities = [];
+                        if (nextWorkItems.length === 0 && sequenceStatus === "PROCESSING") {
+                            try {
+                                const rows = await listInstanceActivities(session, effectiveInstanceId);
+                                activeActivities = rows
+                                    .filter((row) => row.status === 1 || row.status === "1")
+                                    .map((row) => {
+                                    const participants = Array.isArray(row.participantors) ? row.participantors : [];
+                                    return {
+                                        activityCode: wireString(row.activityCode),
+                                        activityName: wireString(row.activityName),
+                                        participants: participants.slice(0, 10).map((person) => ({
+                                            name: wireString(person.name) ?? wireString(person.userName) ?? null,
+                                            id: wireString(person.id) ?? wireString(person.userId) ?? null,
+                                        })),
+                                    };
+                                });
+                            }
+                            catch {
+                                // best-effort
+                            }
+                        }
                         if (nextWorkItems.length > 0) {
                             readback.nextWorkItems = nextWorkItems;
-                            // The submit RESPONSE's own workItemId is null (it names the item
-                            // just completed, not the next one). Expose the fully-formed args
-                            // for the NEXT approval so a multi-level flow advances without an
-                            // extra workitem.list round or guessing which id to use.
-                            readback.nextSubmit = {
-                                schemaCode: args.schemaCode,
-                                workItemId: nextWorkItems[0].workItemId,
-                                workflowInstanceId: effectiveInstanceId,
-                                bizObjectId: objectId,
-                                note: "下一级审批：用这些字段调 data.submit（同意传 agree:true / formData 回填）。",
+                            const nextName = nextWorkItems[0].activityName ?? nextWorkItems[0].activityCode ?? "下一节点";
+                            if (rejected) {
+                                readback.returnedTo = {
+                                    activityCode: nextWorkItems[0].activityCode,
+                                    activityName: nextWorkItems[0].activityName,
+                                };
+                                readback.nextSubmit = {
+                                    schemaCode: args.schemaCode,
+                                    workItemId: nextWorkItems[0].workItemId,
+                                    workflowInstanceId: effectiveInstanceId,
+                                    bizObjectId: objectId,
+                                    note: `已退回 ${nextName}：用这些字段调 data.submit 继续处理。`,
+                                };
+                            }
+                            else {
+                                readback.nextSubmit = {
+                                    schemaCode: args.schemaCode,
+                                    workItemId: nextWorkItems[0].workItemId,
+                                    workflowInstanceId: effectiveInstanceId,
+                                    bizObjectId: objectId,
+                                    note: "下一级审批：用这些字段调 data.submit（同意传 agree:true / formData 回填）。",
+                                };
+                            }
+                        }
+                        else if (sequenceStatus === "PROCESSING" && activeActivities.length > 0) {
+                            const first = activeActivities[0];
+                            const holderNames = first.participants
+                                .map((person) => person.name ?? person.id)
+                                .filter((value) => typeof value === "string" && value.length > 0);
+                            const holders = holderNames.length > 0 ? holderNames.join("、") : "（参与人未回显）";
+                            if (rejected) {
+                                readback.returnedTo = { activityCode: first.activityCode, activityName: first.activityName };
+                                readback.nextSubmit = {
+                                    schemaCode: args.schemaCode,
+                                    workflowInstanceId: effectiveInstanceId,
+                                    bizObjectId: objectId,
+                                    note: `已退回 ${first.activityName ?? first.activityCode ?? "上一节点"}（当前登录人看不到该待办；持有人：${holders}）。`,
+                                };
+                            }
+                            readback.flowWarning = {
+                                code: "flow-next-workitem-not-yours",
+                                message: `提交成功，下一节点已激活：${first.activityName ?? first.activityCode ?? "?"}，但待办不在当前登录人名下（持有人：${holders}）。这不是「没生成待办」。`,
+                                activityCode: first.activityCode,
+                                activityName: first.activityName,
+                                participants: first.participants,
+                                checks: [
+                                    `omc call workflow.instanceActivity --args '{"workflowInstanceId":"${effectiveInstanceId}"}'`,
+                                    `omc call workitem.list --args '{"workflowInstanceId":"${effectiveInstanceId}","participant":"<持有人 id>"}'`,
+                                    "要用该参与人账号另建环境（omc env add）再 data.submit，或临时把节点参与人改成发起人",
+                                ],
                             };
                         }
                         else if (sequenceStatus === "PROCESSING") {
@@ -2050,9 +2349,11 @@ export function registerRuntimeDataLane(tools) {
                             // create NO next work item while the submit still answers errCode 0.
                             // Without this line the caller cannot tell "flow advanced" from
                             // "flow silently stalled" — surface it instead of staying quiet.
+                            // 仅 activeCount=0 才保留 flow-no-next-workitem（勿再说「参与人解析为空」
+                            // 当其实有 active 节点——那是 F5 误报根因）。
                             readback.flowWarning = {
                                 code: "flow-no-next-workitem",
-                                message: "提交成功但该实例没有生成下一节点待办，流程停在 PROCESSING。常见原因：审批参与人解析为空（角色无成员 / 成员未挂发起人部门 / 参与人函数未注册）。",
+                                message: "提交成功但该实例没有任何激活节点（activeCount=0），流程停在 PROCESSING。常见原因：审批参与人解析失败导致未创建下一节点，或引擎异常。",
                                 checks: [
                                     `omc call workflow.instanceActivity --args '{"workflowInstanceId":"${effectiveInstanceId}"}'（看每个节点的 status 与 participants；无 status=1 即停住）`,
                                     "容器日志搜 GetParticipantInfo error / CustomParticipleMethod{...} -> []",
@@ -2066,6 +2367,49 @@ export function registerRuntimeDataLane(tools) {
                     }
                 }
             }
+            // r29c F10: 仅审批提交（有 workItemId）才输出 approvalNote；发起提交改成「已发起」。
+            const startNote = !hasWorkItem && hasWorkflow && typeof readback.workflowInstanceId === "string"
+                ? (() => {
+                    const nextName = Array.isArray(readback.nextWorkItems) && readback.nextWorkItems.length > 0
+                        ? String(readback.nextWorkItems[0].activityName ?? readback.nextWorkItems[0].activityCode ?? "下一节点")
+                        : readback.flowWarning && typeof readback.flowWarning.activityName === "string"
+                            ? String(readback.flowWarning.activityName)
+                            : null;
+                    return nextName ? `已发起，等待 ${nextName} 审批` : "已发起，等待下一节点审批";
+                })()
+                : undefined;
+            // r30d F5/F7: name the operator + whether this start succeeded only because
+            // a platform admin bypassed the start-permission whitelist. Without this,
+            // "config didn't take effect" and "admin bypass" are indistinguishable.
+            let actor = await resolvePermissionActor(session);
+            let permissionBypass;
+            const startedWorkflow = !hasWorkItem && (autoStarted || hasWorkflowCode) && typeof (readback.workflowInstanceId ?? explicitWorkflowCode) === "string";
+            if (startedWorkflow && actor.isAdmin) {
+                let onWhitelist = false;
+                const code = typeof explicitWorkflowCode === "string" && explicitWorkflowCode ? explicitWorkflowCode : null;
+                if (code) {
+                    try {
+                        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.workflowListPermission, query: { workflowCode: code } })).data);
+                        // list_permission never echoes unitId; best-effort match by name/code
+                        // against the actor, or by unitType=3 + display name.
+                        onWhitelist = rows.some((row) => {
+                            const unitType = String(row.unitType ?? "");
+                            if (unitType === "3" && actor.userId && (String(row.id ?? "") === actor.userId || String(row.code ?? "") === actor.userId))
+                                return true;
+                            if (actor.name && String(row.name ?? "") === actor.name)
+                                return true;
+                            return false;
+                        });
+                    }
+                    catch {
+                        onWhitelist = false;
+                    }
+                }
+                if (!onWhitelist) {
+                    permissionBypass = PLATFORM_ADMIN_START_BYPASS;
+                    actor = { ...actor, bypassReason: PLATFORM_ADMIN_START_BYPASS };
+                }
+            }
             return {
                 performed: {
                     errcode: performed.errcode,
@@ -2081,9 +2425,17 @@ export function registerRuntimeDataLane(tools) {
                     // saved as a bare sheet row — surfaced so the caller knows the row is
                     // now a PROCESSING workflow instance, not an orphan sheet record.
                     ...(autoStarted ? { autoStartedWorkflow: explicitWorkflowCode } : {}),
+                    ...(permissionBypass ? { permissionBypass } : {}),
                 },
                 readback: {
                     ...readback,
+                    actor,
+                    ...(permissionBypass
+                        ? {
+                            permissionBypass,
+                            permissionNote: "本次发起成功是因为平台管理员绕过了发起权限白名单（h_perm_admin ADMIN/SYS_MNG），不证明白名单对普通用户生效。要用非管理员账号另建环境验证。",
+                        }
+                        : {}),
                     // Portal-required semantics are NOT enforced by the REST submit path;
                     // say exactly what the tool checked so `ok` is never mistaken for
                     // "the portal would have accepted this" (dogfood R3). This is a
@@ -2094,11 +2446,13 @@ export function registerRuntimeDataLane(tools) {
                     // the platform (`agree: args.agree !== false`). That default is right
                     // for the portal button, but for an API caller "I forgot the flag" and
                     // "I approve" must not look identical in the receipt.
+                    // r29c F10: 只在审批提交（有 workItemId）时给 approvalNote；发起提交用 startNote。
                     ...(hasWorkItem && args.agree === undefined
                         ? {
                             approvalNote: "本次是审批提交但未传 agree——平台按**通过**处理（顶层 agree 缺省 true）。要驳回必须显式 agree:false；approval.agree 不生效。",
                         }
                         : {}),
+                    ...(startNote ? { startNote } : {}),
                     portalRulesExecuted: false,
                     portalRulesNote: "portalRulesExecuted 只指门户客户端的必填/控件校验未在 REST 提交时执行；服务端业务规则（含流程 end 规则）照常运行。",
                     requiredFields: validation.requiredFields,