@stalfh233/omc-cli 0.6.16 → 0.6.17

package/dist/batch-call.js

@@ -19,6 +19,8 @@
  * per-tool preflight apply exactly as they do for a single call.
  */
 import { refusalText } from "./cli-contract.js";
+import { createArtifact } from "./artifacts.js";
+import { artifactFetchHint, artifactRoot } from "./command-transport.js";
 import { runScript } from "./script.js";
 function inputBusinessKey(args) {
     const keys = ["code", "name", "bizObjectId", "id"];
@@ -153,6 +155,12 @@ export async function runBatchCall(options) {
         };
     });
     const entriesInline = entriesSummary.slice(0, ENTRIES_INLINE_LIMIT);
+    const warnings = batchWarnings(options.argsList);
+    const warningsInline = warnings.slice(0, ENTRIES_INLINE_LIMIT);
+    const detailOmitted = entriesSummary.length > entriesInline.length || warnings.length > warningsInline.length;
+    const detailArtifact = detailOmitted
+        ? createArtifact(artifactRoot(), JSON.stringify({ entries: entriesSummary, warnings }, null, 2) + "\n")
+        : undefined;
     return {
         exitCode: failed > 0 ? 1 : 0,
         result: {
@@ -166,10 +174,17 @@ export async function runBatchCall(options) {
             // 每条一行摘要（index/ok/bizObjectId）——不是完整信封，但足以回答
             // 「第 3 条建成了吗、它的 id 是什么」。失败项另有 failures 带完整原因。
             entries: entriesInline,
-            ...(batchWarnings(options.argsList).length > 0 ? { warnings: batchWarnings(options.argsList) } : {}),
-            ...(entries.length > entriesInline.length
-                ? { entriesOmitted: entries.length - entriesInline.length, entriesHint: `条目超过 ${ENTRIES_INLINE_LIMIT} 条，只内联前 ${ENTRIES_INLINE_LIMIT} 条摘要；完整结果走 detailArtifactId / omc artifact get` }
-                : {}),
+            ...(warnings.length > 0 ? {
+                warnings: warningsInline,
+                ...(warnings.length > warningsInline.length ? { warningsOmitted: warnings.length - warningsInline.length } : {}),
+            } : {}),
+            ...(entriesSummary.length > entriesInline.length ? { entriesOmitted: entriesSummary.length - entriesInline.length } : {}),
+            ...(detailArtifact !== undefined ? {
+                detailArtifactId: detailArtifact.artifactId,
+                sha256: detailArtifact.sha256,
+                fetch: artifactFetchHint(detailArtifact.artifactId),
+                entriesHint: `条目或预检警告超过 ${ENTRIES_INLINE_LIMIT} 条，只内联前 ${ENTRIES_INLINE_LIMIT} 条；完整结果见 detailArtifactId`,
+            } : {}),
             // Only failures carry full per-entry detail: echoing 8 full success
             // envelopes would rebuild exactly the wall of text this command exists
             // to remove.

package/dist/capability-overview.js

@@ -123,7 +123,7 @@ const SURFACES = [
     },
     {
         id: "workflow",
-        title: "流程模板",
+        title: "流程模板 + 组织与权限",
         lane: LANES.workflow,
         description: "流程模板生命周期：get_draft/get_published、create、update、publish、bindRule、delete、workitem.list。**含组织/部门/角色/权限范围（org.* 工具）**：部门树、角色组/角色、用户搜索、成员与管理范围（userScope）——流程参与人/可见性的候选来源。",
         operations: ["create", "update", "publish", "bindRule", "delete"],
@@ -193,7 +193,7 @@ const CAPABILITY_ALIASES = Object.freeze({
     businessrule: ["business-rules", "B1-businessrule"],
     "rule-lifecycle": ["rule-lifecycles", "S25-rule-lifecycle"],
     // r28h F1/F7: org.* lives under workflow; aliases let "我要管部门/组织" hit it.
-    workflow: ["workflows", "W7-S29-greenfield", "org", "organization", "organisation", "组织", "组织架构"],
+    workflow: ["workflows", "W7-S29-greenfield", "org", "organization", "permission", "role", "权限", "角色", "组织"],
     onlinejs: ["online-js"],
     programming: ["backend-online-coding", "programming-online-dev", "在线开发", "在线编码"],
     bizservice: ["bizservices", "B2-registration"],

package/dist/cli.js

@@ -1670,7 +1670,10 @@ function cmdGraphReferences(kind, code, transport, requestedEnvironment) {
 function cmdGraphStatus(transport) {
     try {
         const status = readGraphStatus();
-        return emitResult({ status: "ok", index: status.index, dbBytes: status.dbBytes, gaps: status.gaps }, transport);
+        // r31a-F16：这里是**第四个**白名单式重建（前三次：compact() 投影、references
+        // 覆盖声明、mcp-graph 的 explore）。白名单每漏一个键就等于没修，且不会被任何
+        // 单测发现——所以改成展开，新增字段自动透传。
+        return emitResult({ status: "ok", ...status }, transport);
     }
     catch (error) {
         if (error instanceof GraphIndexAbsentError)

package/dist/compute.js

@@ -189,7 +189,7 @@ export async function cmdCompute(args) {
     let result;
     let exitCode;
     try {
-        ({ result, exitCode } = await runToolCall("datarule.create", { args: createArgs, requestId: request, environment }));
+        ({ result, exitCode } = await runToolCall("datarule.create", { args: createArgs, requestId: request, environment, print: () => undefined }));
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/dist/field-families.js

@@ -64,7 +64,7 @@ export function relationDisplayFieldCode(type, options) {
     const displayField = options.displayField;
     return typeof displayField === "string" && displayField.trim() ? displayField.trim() : undefined;
 }
-export const choicesArg = z.array(z.string()).optional().describe('allowed values for text-choice families (RADIO / CHECKBOX / DROPDOWN_BOX / DROPDOWN_MULTI_BOX), e.g. ["正常","异常","待复检"]。注意：SELECTION(5) 是人员/部门混合选择器，不接受 choices，文本单选请用 DROPDOWN_BOX/RADIO');
+export const choicesArg = z.array(z.string()).optional().describe('allowed values for text-choice families, e.g. ["正常","异常","待复检"]。注意：SELECTION(5) 是人员/部门混合选择器，不接受 choices；文本单选族随版本不同，拒绝信息会列当前 live 集');
 function jsonString() {
     return z.string().refine((value) => {
         if (value === "")
@@ -830,6 +830,43 @@ export function assertFieldFamilyAllowed(args) {
     // works if the preflight gate is the same gate the write uses.
     assertNumericalScale(normalized, options);
 }
+/**
+ * Reject the platform's accept-then-drop org-selector+choices shapes before write.
+ *
+ * 三个组织选择器族同语义（SELECTION 混合 / STAFF_SELECTOR 人员 / DEPARTMENT_SELECTOR
+ * 部门）：choices 都会被平台静默丢弃，字段建成后写任何 choices 值都 50000 无明细。
+ * r37（2026-11-07）之前 SELECTION 走的是 execute 路径的 capability-out-of-coverage
+ * （citation.reason 才说不接受 choices），STAFF/DEPARTMENT 走 live 集拒绝——同一语义
+ * 三个族两种 blocker。统一收敛到这里：同语义 = 同 blocker（含 options.choices 形态，
+ * 那是 F14 真机撞出来的：字段落库、field.list 还回显 choices、运行面才炸）。
+ */
+const ORG_SELECTOR_TYPES = new Set([
+    FIELD_PROPERTY_TYPES.SELECTION,
+    FIELD_PROPERTY_TYPES.STAFF_SELECTOR,
+    FIELD_PROPERTY_TYPES.DEPARTMENT_SELECTOR,
+]);
+export function assertSelectionChoicesAllowed(args) {
+    const options = args.options;
+    const hasTopLevelChoices = args.choices !== undefined;
+    const hasOptionsChoices = options !== null && typeof options === "object" && !Array.isArray(options)
+        && Object.prototype.hasOwnProperty.call(options, "choices");
+    if (!hasTopLevelChoices && !hasOptionsChoices)
+        return;
+    const raw = args.propertyType;
+    const type = typeof raw === "number" && Number.isInteger(raw)
+        ? raw
+        : typeof raw === "string" && raw in FIELD_PROPERTY_TYPES
+            ? FIELD_PROPERTY_TYPES[raw]
+            : undefined;
+    if (type === undefined || !ORG_SELECTOR_TYPES.has(type))
+        return;
+    const family = typeof raw === "string" ? raw : String(type);
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "field-choices-family-mismatch",
+        message: `${family} 是组织选择器（人员/部门），choices 会被平台静默丢弃；字段虽会建成，但写入任何 choices 值都会返回 50000 且无明细。选人/部门请使用不带 choices 的本族字段（值走引用）；文本单选族随版本不同，请先看 omc describe field.create --param propertyType，拒绝信息会列当前 live 集。`,
+    });
+}
 function refuseFieldOptions(reason, message) {
     const citation = {
         code: "capability-out-of-coverage",

package/dist/graph.js

@@ -46,10 +46,18 @@ function nodeSqlite() {
  *   staleness is handled by reporting pulledAt + identity, refreshed by an
  *   explicit re-pull (no incremental watermarks, no write-back hooks).
  */
-const GRAPH_SCHEMA_VERSION = "4";
+const GRAPH_SCHEMA_VERSION = "5";
 const STALE_LOCK_MS = 15 * 60 * 1000;
 export const DEFAULT_PULL_CONCURRENCY = 16;
 export const MAX_PULL_CONCURRENCY = 32;
+/** 索引超过这个天数就提示刷新（配置类查询，1 天足够新）。 */
+export const STALE_INDEX_DAYS = 1;
+export function indexAgeDays(pulledAtIso, now = Date.now()) {
+    const pulled = Date.parse(pulledAtIso);
+    if (Number.isNaN(pulled))
+        return 0;
+    return Math.max(0, Math.floor((now - pulled) / 86_400_000));
+}
 export class GraphIndexAbsentError extends Error {
     constructor(message) {
         super(message);
@@ -179,13 +187,39 @@ export async function pullRuleGraph(session, concurrency = DEFAULT_PULL_CONCURRE
     // zero-guard) wedge the scheduler.
     const scope = await resolveApplicationScope(session, undefined).catch(() => undefined);
     const applicationCode = scope?.code ?? "";
-    const schemaCodes = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data))
-        .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== "")
-        .map((row) => String(row.code))
-        .sort();
+    const gaps = [];
+    const treeRows = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+    const modelEntities = treeRows.filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== "").map((row) => ({ schemaCode: String(row.code), name: String(row.name ?? row.code) })).sort((a, b) => a.schemaCode.localeCompare(b.schemaCode));
+    const schemaCodes = modelEntities.map((row) => row.schemaCode);
+    const fields = [];
+    const services = [];
+    await Promise.all(schemaCodes.map(async (schemaCode) => {
+        try {
+            const rows = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+            for (const row of rows) {
+                const code = String(row.code ?? row.propertyCode ?? "");
+                if (code)
+                    fields.push({ schemaCode, code, name: String(row.name ?? row.propertyName ?? code) });
+            }
+        }
+        catch (error) {
+            gaps.push({ kind: "field-list", ref: schemaCode, note: error instanceof Error ? error.message : String(error) });
+        }
+    }));
+    try {
+        await wireCall(session, { path: ENDPOINTS.bizServiceCategoryList });
+        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.bizServiceListByCategoryId, query: { categoryId: "" } })).data);
+        for (const row of rows) {
+            const code = String(row.code ?? "");
+            if (code)
+                services.push({ code, name: String(row.name ?? code) });
+        }
+    }
+    catch (error) {
+        gaps.push({ kind: "service-list", ref: "all", note: error instanceof Error ? error.message : String(error) });
+    }
     const rules = [];
     const edges = [];
-    const gaps = [];
     let parseFailures = 0;
     let dataruleCount = 0;
     let viewCount = 0;
@@ -375,6 +409,9 @@ export async function pullRuleGraph(session, concurrency = DEFAULT_PULL_CONCURRE
         },
         rules,
         edges,
+        models: modelEntities,
+        fields: fields.sort((a, b) => `${a.schemaCode}/${a.code}`.localeCompare(`${b.schemaCode}/${b.code}`)),
+        services: services.sort((a, b) => a.code.localeCompare(b.code)),
         gaps,
         scanned: { models: schemaCodes.length, rules: rules.length, datarules: dataruleCount, views: viewCount, parseFailures },
         timings: { listMs, readMs, totalMs: Date.now() - totalStart },
@@ -489,7 +526,10 @@ export async function publishGraphPull(session, concurrency = DEFAULT_PULL_CONCU
           via TEXT NOT NULL
         );
         CREATE INDEX edges_lookup ON edges(kind, code);
-        CREATE TABLE gaps (kind TEXT NOT NULL, ref TEXT NOT NULL, note TEXT);
+         CREATE TABLE gaps (kind TEXT NOT NULL, ref TEXT NOT NULL, note TEXT);
+         CREATE TABLE models (schema_code TEXT PRIMARY KEY, name TEXT NOT NULL);
+         CREATE TABLE fields (schema_code TEXT NOT NULL, code TEXT NOT NULL, name TEXT NOT NULL);
+         CREATE TABLE services (code TEXT PRIMARY KEY, name TEXT NOT NULL);
       `);
                 const insertMeta = db.prepare("INSERT INTO meta (key, value) VALUES (?, ?)");
                 // `applicationResolution` is an object; String(value) would persist
@@ -506,12 +546,21 @@ export async function publishGraphPull(session, concurrency = DEFAULT_PULL_CONCU
                 const insertGap = db.prepare("INSERT INTO gaps (kind, ref, note) VALUES (?, ?, ?)");
                 for (const gap of data.gaps)
                     insertGap.run(gap.kind, gap.ref, gap.note ?? null);
+                const insertModel = db.prepare("INSERT INTO models (schema_code, name) VALUES (?, ?)");
+                for (const row of data.models)
+                    insertModel.run(row.schemaCode, row.name);
+                const insertField = db.prepare("INSERT INTO fields (schema_code, code, name) VALUES (?, ?, ?)");
+                for (const row of data.fields)
+                    insertField.run(row.schemaCode, row.code, row.name);
+                const insertService = db.prepare("INSERT INTO services (code, name) VALUES (?, ?)");
+                for (const row of data.services)
+                    insertService.run(row.code, row.name);
                 // FTS5 mirrors rules (code+name) for `graph search`; one rebuild after
                 // the bulk insert is cheaper than per-row triggers on a wholesale rebuild.
                 db.exec(`
-        CREATE VIRTUAL TABLE rules_fts USING fts5(rule_code, name, content='rules', content_rowid='rowid');
-        INSERT INTO rules_fts(rules_fts) VALUES('rebuild');
-      `);
+         CREATE VIRTUAL TABLE rules_fts USING fts5(rule_code, name, content='rules', content_rowid='rowid');
+          INSERT INTO rules_fts(rules_fts) VALUES('rebuild');
+        `);
                 db.exec("COMMIT;");
             }
             finally {
@@ -544,6 +593,11 @@ function openGraphIndex() {
             throw new GraphIndexAbsentError(`索引 schema 版本不匹配（${meta.schemaVersion} ≠ ${GRAPH_SCHEMA_VERSION}）；重跑 omc graph pull`);
         const ruleCount = db.prepare("SELECT COUNT(*) AS n FROM rules").get().n;
         const modelCount = db.prepare("SELECT COUNT(DISTINCT schema_code) AS n FROM rules").get().n;
+        const entityCounts = {
+            models: db.prepare("SELECT COUNT(*) AS n FROM models").get().n,
+            fields: db.prepare("SELECT COUNT(*) AS n FROM fields").get().n,
+            services: db.prepare("SELECT COUNT(*) AS n FROM services").get().n,
+        };
         const edgeRows = db.prepare("SELECT kind, COUNT(*) AS n FROM edges GROUP BY kind").all();
         const edges = {};
         for (const row of edgeRows)
@@ -555,6 +609,8 @@ function openGraphIndex() {
             byKind[row.kind] = row.n;
             gapCount += row.n;
         }
+        const pulledAtIso = meta.pulledAtIso ?? "";
+        const ageDays = indexAgeDays(pulledAtIso);
         return {
             db,
             summary: {
@@ -564,10 +620,17 @@ function openGraphIndex() {
                 // such key, so this stays optional rather than failing the read.
                 ...(meta.applicationResolution ? { applicationResolution: parseApplicationResolution(meta.applicationResolution) } : {}),
                 identityFingerprint: meta.identityFingerprint ?? "",
-                pulledAtIso: meta.pulledAtIso ?? "",
+                pulledAtIso,
                 freshness: gapCount === 0 ? "complete" : "partial",
+                ageDays,
+                // r31a-F16：旧索引 + complete 标签 = 静默错答。给可直接照抄的刷新命令，
+                // 并明确「complete 只指扫描无缺口」。
+                ...(ageDays >= STALE_INDEX_DAYS
+                    ? { staleWarning: `索引是 ${ageDays} 天前的快照（pulledAt ${pulledAtIso}）；freshness:"complete" 只表示扫描无缺口、不表示最新。先 \`omc graph pull --env ${meta.environmentName ?? "<env>"}\` 再查，或给结论加时效限定` }
+                    : {}),
                 models: modelCount,
                 rules: ruleCount,
+                entities: entityCounts,
                 edges,
                 gaps: { count: gapCount, byKind },
             },
@@ -578,6 +641,17 @@ function openGraphIndex() {
         throw error instanceof GraphIndexAbsentError ? error : new GraphIndexAbsentError(`索引不可读（schema 不匹配或文件损坏）：${error instanceof Error ? error.message : String(error)}；重跑 omc graph pull`);
     }
 }
+/**
+ * r35a-F4 / r35a-F4b（真机 2026-11-06）：探针拿 `matches:[]` 差点把一个**被表单引用**
+ * 的字段判成「可安全删除」，紧接着发现 `graph impact` 的 `totals` 全 0 也有同样误读风险。
+ * 三个面（CLI references / CLI impact / MCP explore）必须共用同一份声明——
+ * 分散定义就会被漏掉一处（MCP 面第一版就漏了）。
+ */
+export const GRAPH_COVERAGE = Object.freeze({
+    scanned: Object.freeze(["businessrule", "datarule", "listview"]),
+    notScanned: Object.freeze(["form", "workflow.permissions", "workflow.bindings", "onlinejs", "rule.conditions"]),
+    note: "零命中/全零 totals 只代表 scanned 面没有命中；notScanned 面（尤其 form 与 workflow.permissions）未扫描，不可据此判定可安全删除或无影响",
+});
 /**
  * Zero-hit disambiguation (2026-10-31 capability-test friction, hit twice in
  * one session): querying `impact field mcc_supplier` returns an empty result
@@ -611,11 +685,7 @@ export function queryGraphReferences(kind, code) {
         // 字段判成「可安全删除」——note 只说了「不含规则条件叶子/流程绑定」，从没
         // 明说表单与流程权限表不在扫描范围。散文字段不承担安全契约：这里给结构化
         // coverage，让「没人引用」与「这一面没扫」在机器可读层面可分。
-        const coverage = {
-            scanned: ["businessrule", "datarule", "listview"],
-            notScanned: ["form", "workflow.permissions", "workflow.bindings", "onlinejs", "rule.conditions"],
-            note: "matches:[] 只代表 scanned 面零命中；notScanned 面（尤其 form 与 workflow.permissions）未扫描，不可据此判定可安全删除",
-        };
+        const coverage = GRAPH_COVERAGE;
         return {
             kind,
             code,
@@ -643,7 +713,14 @@ export function readGraphStatus() {
     const { db, summary } = openGraphIndex();
     try {
         const gaps = db.prepare("SELECT kind, ref, note FROM gaps ORDER BY kind, ref LIMIT 50").all();
-        return { index: summary, dbBytes: statSync(graphDbPath()).size, gaps };
+        const dbPath = graphDbPath();
+        return {
+            index: summary,
+            dbBytes: statSync(dbPath).size,
+            dbPath,
+            dbId: sha256(dbPath).slice(0, 12),
+            gaps,
+        };
     }
     finally {
         db.close();
@@ -661,6 +738,11 @@ export function searchGraphRules(term, limit = 20) {
     try {
         const tokens = term.trim().split(/\s+/).filter((token) => token !== "");
         let matches = [];
+        const entityMatches = {
+            model: { count: 0, total: 0, items: [] },
+            field: { count: 0, total: 0, items: [] },
+            service: { count: 0, total: 0, items: [] },
+        };
         if (tokens.length > 0) {
             const quoted = tokens.map((token, index) => `"${token.replaceAll('"', '""')}"${index === tokens.length - 1 ? "*" : ""}`).join(" ");
             const rows = db
@@ -683,13 +765,24 @@ export function searchGraphRules(term, limit = 20) {
                     refs,
                 };
             });
+            const searchEntity = (countSql, rowsSql, params, map) => {
+                const total = Number(db.prepare(countSql).get(...params).n);
+                const rows = db.prepare(rowsSql).all(...params, limit);
+                return { count: rows.length, total, items: rows.map(map), ...(rows.length < total ? { truncated: true } : {}) };
+            };
+            entityMatches.model = searchEntity("SELECT COUNT(*) AS n FROM models WHERE instr(name, ?) > 0 OR instr(schema_code, ?) > 0", "SELECT schema_code, name FROM models WHERE instr(name, ?) > 0 OR instr(schema_code, ?) > 0 ORDER BY schema_code LIMIT ?", [term.trim(), term.trim()], (row) => ({ schemaCode: row.schema_code, name: row.name }));
+            entityMatches.field = searchEntity("SELECT COUNT(*) AS n FROM fields WHERE instr(name, ?) > 0 OR instr(code, ?) > 0", "SELECT schema_code, code, name FROM fields WHERE instr(name, ?) > 0 OR instr(code, ?) > 0 ORDER BY schema_code, code LIMIT ?", [term.trim(), term.trim()], (row) => ({ schemaCode: row.schema_code, code: row.code, name: row.name }));
+            entityMatches.service = searchEntity("SELECT COUNT(*) AS n FROM services WHERE instr(name, ?) > 0 OR instr(code, ?) > 0", "SELECT code, name FROM services WHERE instr(name, ?) > 0 OR instr(code, ?) > 0 ORDER BY code LIMIT ?", [term.trim(), term.trim()], (row) => ({ code: row.code, name: row.name }));
         }
         const gapped = summary.gaps.count > 0;
         return {
             term,
             rules: matches,
+            matches: entityMatches,
             index: summary,
-            ...(matches.length === 0
+            coverage: { scanned: ["rule.code", "rule.name", "model.code", "model.name", "field.code", "field.name", "service.code", "service.name"], notScanned: ["rule.body", "form", "workflow.permissions"], note: "检索覆盖规则与实体的 code/name；规则体、表单与流程权限未扫描" },
+            ...(term.trim() !== "" && !/^[A-Za-z][A-Za-z0-9_.-]*$/.test(term.trim()) ? { note: "疑似业务词；本工具同时检索实体 name/code 与规则 code/name，引用明细请使用匹配到的 code 再查 references/impact" } : {}),
+            ...(matches.length === 0 && entityMatches.model.total === 0 && entityMatches.field.total === 0 && entityMatches.service.total === 0
                 ? {
                     note: tokens.length === 0
                         ? "检索词为空"
@@ -767,11 +860,12 @@ export function impactGraph(kind, code) {
             listviews: listViewHits.slice(0, 20).map((hit) => ({ schemaCode: hit.schema_code, viewCode: hit.view_code ?? "", via: hit.via })),
             totals: { rules: hop1.length, datarules: dataruleHits.length, listviews: listViewHits.length, touchedServices: services.size, touchedModels: models.size, touchedFields: fields.size },
             index: summary,
+            coverage: GRAPH_COVERAGE,
             ...(hop1.length === 0 && dataruleHits.length === 0 && listViewHits.length === 0
                 ? {
                     note: (gapped
                         ? "零命中，但索引存在扫描缺口——不可作为「无影响」证明；先 omc graph pull 重建再查"
-                        : "零命中=索引覆盖范围内没有引用它（规则面+数据规则面+视图列/排序/条件面；流程绑定暂不在索引内）") +
+                        : "零命中=仅 scanned 面（规则/数据规则/视图）没有影响；form（表单控件）与 workflow.permissions 未扫描，见 coverage.notScanned——不可据此判定「删除无影响」") +
                         (zeroHitKindHint(db, kind, code, "impact") ?? ""),
                 }
                 : {}),

package/dist/lanes/field.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
 import { fieldChangeWireBody, fieldUpdateWireBody, prepareFieldChange, prepareFieldUpdate } from "../field-change.js";
-import { aggregationSelfSchemaMessage, aggregationTargetsOwnSchema, choicesArg, childColumnsOf, FIELD_PROPERTY_TYPES, fieldOptionsArg, fieldTypeLabel, numericalScaleWarning, propertyTypeArg, relativeCodeArg, stripAggregationPrefix, subFieldArg, SYSTEM_FIELD_CODES, } from "../field-families.js";
+import { aggregationSelfSchemaMessage, aggregationTargetsOwnSchema, choicesArg, childColumnsOf, FIELD_PROPERTY_TYPES, fieldOptionsArg, fieldTypeLabel, numericalScaleWarning, propertyTypeArg, relativeCodeArg, stripAggregationPrefix, subFieldArg, SYSTEM_FIELD_CODES, assertFieldFamilyAllowed, assertSelectionChoicesAllowed, } from "../field-families.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead } from "../read.js";
 import { writeTool } from "../write.js";
@@ -442,6 +442,10 @@ export function registerFieldLane(tools) {
                 },
             };
         },
+        preflight: (args) => {
+            assertSelectionChoicesAllowed(args);
+            assertFieldFamilyAllowed(args);
+        },
         rollback: fieldRollbackSpec("field.create"),
     });
     writeTool({

package/dist/lanes/model.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
-import { assertFieldFamilyAllowed, choicesArg, fieldOptionsArg, nameI18nJson, propertyTypeArg, relationTargetOf, relativeCodeArg, SYSTEM_FIELD_CODES, subFieldArg, } from "../field-families.js";
+import { assertFieldFamilyAllowed, assertSelectionChoicesAllowed, choicesArg, fieldOptionsArg, nameI18nJson, propertyTypeArg, relationTargetOf, relativeCodeArg, SYSTEM_FIELD_CODES, subFieldArg, } from "../field-families.js";
 import { fieldChangeWireBody, prepareFieldChange, sameFieldChange } from "../field-change.js";
 import { executeFormDraftWrite, executeFormPublishWrite } from "../form-support.js";
 import { mapBounded } from "../support.js";
@@ -1317,6 +1317,8 @@ export function registerModelLane(tools) {
             ];
             if (violations.length > 0)
                 throw new ToolRefusalError({ status: "refused", blocker: "business-code-invalid", message: "code 未过出门前校验；按 validation 修正（长度/风格/保留字）", validation: violations });
+            for (const entry of entries)
+                assertSelectionChoicesAllowed(entry);
             for (const entry of entries)
                 prepareFieldChange(fieldChangeInputOf(args.code, entry));
         },
@@ -1513,8 +1515,10 @@ function fieldEntriesOf(args) {
     if (Array.isArray(args.fields) && args.fields.length > 0) {
         if (args.fieldCode !== undefined || args.fieldName !== undefined || args.propertyType !== undefined)
             throw new ToolRefusalError({ status: "refused", blocker: "configure-model-fields-exclusive", message: "fields[] 与单字段参数（fieldCode/fieldName/propertyType）互斥；多字段用 fields[]，单字段用旧三元组" });
-        for (const entry of args.fields)
+        for (const entry of args.fields) {
+            assertSelectionChoicesAllowed(entry);
             assertFieldFamilyAllowed({ ...entry });
+        }
         return args.fields.map((entry) => ({ code: entry.code, name: entry.name, propertyType: entry.propertyType, ...withLegacy(entry) }));
     }
     if (typeof args.fieldCode !== "string" || typeof args.fieldName !== "string" || typeof args.propertyType !== "string")
@@ -1524,6 +1528,7 @@ function fieldEntriesOf(args) {
             message: "configure_model 需要 fields[]（多字段）或 fieldCode+fieldName+propertyType（单字段）",
         });
     const legacy = { code: args.fieldCode, name: args.fieldName, propertyType: args.propertyType, ...withLegacy(args) };
+    assertSelectionChoicesAllowed(legacy);
     assertFieldFamilyAllowed(legacy);
     return [legacy];
 }

package/dist/lanes/organization.js

@@ -531,10 +531,17 @@ export function registerOrganizationLane(tools) {
             remarks: z.string().optional(),
             corpId: z.string().min(1).optional().describe("组织 corpId，默认当前登录企业；传 \"other\" 表示非组织分组角色"),
         },
-        execute: async (session, args) => {
+        preflight: (args) => {
             if (!args.roleGroupCode && !args.roleGroupId) {
-                throw new ToolInputError({ message: "必须给 roleGroupCode（推荐）或 roleGroupId；先 org.role.list 取 groups 码表" });
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "role-group-required",
+                    nextCommand: "omc call org.role.list --args '{}'",
+                    message: "必须给 roleGroupCode（推荐）或 roleGroupId；先 org.role.list 取 groups 码表",
+                });
             }
+        },
+        execute: async (session, args) => {
             const { groups } = await readRoleTree(session);
             if (groups.length === 0) {
                 throw new ToolRefusalError({ status: "refused", blocker: "wire-shape", message: "org.role.list 未解析出任何角色组；先确认组织树可读，不要盲建角色" });

package/dist/lanes/runtime-data.js

@@ -55,6 +55,7 @@ function dataListCompactProjection(result) {
             if (value.length > 0)
                 compact.listArtifactHint =
                     "items 已外置（truncatedKeys 含 items）：完整行见 artifact（detailArtifactId / fetch）。同信封三分法：ids=本页全部 id；itemsPreview=ids 前 3 个的引用（仅 {id}，不是第二份行）；items=[] 表示正文在 artifact。";
+            compact.itemsExternalized = true;
             continue;
         }
         // 这两个键由本函数按 items 现算，handler 不再重复内联。
@@ -921,12 +922,12 @@ export function registerRuntimeDataLane(tools) {
             columns: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields）"),
             // r29b F9: data.load/save/update 都叫 fields；list 面原先只有 displayFields/columns。
             fields: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields；与 data.load/data.save/data.update 的 fields 同语义）"),
-            orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional(),
+            orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional().describe("运行面 query/list 不支持服务端排序；排序请用 listview.configure 的 sorts（视图级）或在本地对 items 排序"),
             mobile: z.boolean().optional(),
             showTotal: z.boolean().default(true),
             page: z.number().int().min(0).default(0),
             size: z.number().int().min(1).max(200).default(10),
-            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（内部按 size=200 逐页拉取，安全上限 1000 行；超过时回 truncated:true + missingCount，别当全集）——存量盘点/数据核对用，替代手动循环翻页。与 page 互斥（all 固定从第 0 页起）"),
+            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（size=200 逐页，上限 1000 行，超出 resultTruncated:true）；与 page 互斥；默认 size=10，视图 pagingSetting.pageSize 不生效"),
             full: z.boolean().optional().describe("内联完整列表结果；默认大结果只返回计数与 detailFile"),
             // r31 (2026-10-31 real machine): agents pass `query: {field: value}` as a
             // filter — zod would STRIP the unknown key silently and the server
@@ -943,6 +944,14 @@ export function registerRuntimeDataLane(tools) {
                     tool: "data.list",
                     message: '没有 `query` 参数——过滤用 `filter: {"op":"eq","field":"<字段>","value":"<值>"}`（或 `filters` 数组=AND、`filterGroup` 嵌套）。r31 真机：`query:{...}` 被静默忽略、total 不变，极易误判为"无数据/已过滤"。',
                 });
+            if (args.orders !== undefined)
+                throw new ToolInputError({
+                    status: "error",
+                    blocker: "invalid-input",
+                    tool: "data.list",
+                    message: "运行面 query/list 不支持服务端排序；排序请用 listview.configure 的 sorts（视图级）或在本地对 items 排序。",
+                    nextCommand: `omc call listview.configure --env <env> --args '${JSON.stringify({ schemaCode: args.schemaCode, sorts: args.orders })}'`,
+                });
             let condition;
             let fromDsl = false;
             try {
@@ -1094,7 +1103,7 @@ export function registerRuntimeDataLane(tools) {
                     const firstPage = extractBizObjectPage(first.data);
                     const total = Number(firstPage.total ?? 0);
                     if (total === 0 || firstPage.content.length === 0)
-                        return { schemaCode: args.schemaCode, total: 0, page: "all", size: 0, pagesFetched: 0, items: [], ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
+                        return { schemaCode: args.schemaCode, total: 0, page: "all", size: 0, pagesFetched: 0, items: [], itemsCount: 0, itemsReturned: 0, resultTruncated: false, itemsExternalized: false, ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
                     const rows = [...firstPage.content];
                     const target = Math.min(total, CAP);
                     let pageIndex = 1;
@@ -1154,6 +1163,9 @@ export function registerRuntimeDataLane(tools) {
                         // 形状常量：脚本按 result.items 取数（与内联态一致），itemsCount 与
                         // total 的差就是被截断的条数——不再只靠 size 反推。
                         itemsCount: collected.length,
+                        itemsReturned: collected.length,
+                        resultTruncated: truncatedByCap,
+                        itemsExternalized: false,
                         // r29b F8 的 ids/itemsPreview 由 compact（外置时）现算，不在这里内联——
                         // 内联会让小结果越过 2048B 外置阈值，反而把 items 挤成 []。
                         ...(truncatedByCap
@@ -1190,9 +1202,13 @@ export function registerRuntimeDataLane(tools) {
                             if (probeError instanceof WireError && probeError.kind === "business" && probeError.errcode === 300004) {
                                 return {
                                     status: "refused",
-                                    blocker: "wire-business",
+                                    blocker: "schema-not-found",
                                     errcode: 300004,
-                                    message: `数据模型不存在（${args.schemaCode}）——运行面读取前模型必须已创建并发布字段；先 model.create / configure_model（存在性判据用 model.inspect 的 modelPresent）`,
+                                    schemaCode: args.schemaCode,
+                                    exists: false,
+                                    total: 0,
+                                    message: `数据模型不存在（${args.schemaCode}）——运行面读取前模型必须已创建并发布字段。`,
+                                    nextCommand: "omc call model.list --args '{}'",
                                 };
                             }
                         }
@@ -1280,6 +1296,10 @@ export function registerRuntimeDataLane(tools) {
                     })(),
                     ...(choiceFilterFields.length > 0 && Number(total ?? 0) === 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}),
                     totalPages,
+                    itemsCount: items.length,
+                    itemsReturned: items.length,
+                    resultTruncated: false,
+                    itemsExternalized: false,
                     page: page.page ?? requestedPage,
                     size: page.size ?? args.size ?? 20,
                     ...(pageOutOfRange ? { pageOutOfRange: true, emptyPage: true } : {}),

package/dist/lanes/workflow-contract.js

@@ -78,6 +78,7 @@ export const WORKFLOW_WIRE = Object.freeze({
     workItemFilter: "WorkItemSearchVO.filterWorkflowInstanceId is a NOT-equal exclusion (BizWorkitemServiceImpl.toSearchWorkItemsCriterion:400-402), so exact instance filtering is client-side",
     bizObjectResolution: "GET /api/api/runtime/workflow/getBizObjectByWfInstanceId resolves bizObjectId/schemaCode; a failed lookup leaves the identity null and never drops the todo",
     mutuallyExclusiveBinding: "同一处理器绑定多条规则时它们**全部执行、无互斥**：审批通过/驳回这类互斥结果不要用两条各自 FIXED 赋值都绑 end（bench22 病灶）——通过绑 end（endEventHandler）或规则 Available，驳回绑 cancel（cancelEventHandler）或规则 Cancel，或用一条多分支图（生产 case_info_update 只在 endEventHandler 绑一条 updateData 多分支图）；workflow.bindRule 回读在 bizActions.length>1 时给 advisory",
+    participantRoleValidation: "写前参与人校验：PARTICIPANT 的 FindUserByRole(<org>,\"<roleCode>\",\"<order>\") 会与 org.role.list 的真实角色 code 比对；缺失即拒绝 workflow-participant-role-not-found，并给 activityCode/activityName/roleCode、最多 5 个 candidates 与 nextCommand。org.role.list 读取失败时 fail-open，不阻断写入。{Originator} 是发起人关键字，不按角色校验；所有 PARTICIPANT 都是 {Originator} 时给 approval-by-originator warning。",
     userSearch: "POST /api/api/organization/user/search，@RequestBody {wd (关键字，必填), page, size, filterType?} → PageVO<UserVO>{totalElements,totalPages,content[{id,name,username,userId,departmentId,corpId,status}]}（UserController.search:337-341；缺 wd 报 10005 关键字不能为空）。用于把姓名解析成真实用户，构造参与者对象 type 3=用户（type 2=角色）",
 });
 /** Workflow template object (workflow/update|publish raw body). */
@@ -117,6 +118,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         bizObjectResolution: WORKFLOW_WIRE.bizObjectResolution,
         mutuallyExclusiveBinding: WORKFLOW_WIRE.mutuallyExclusiveBinding,
         userSearch: WORKFLOW_WIRE.userSearch,
+        participantRoleValidation: WORKFLOW_WIRE.participantRoleValidation,
     }),
     wireBindings: Object.freeze({
         templateShape: Object.freeze([behaviorBinding("test/ticket-112-workflow-template-merge.test.ts#workflow.update merges onto the draft", assertWorkflowContract)]),
@@ -135,6 +137,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         bizObjectResolution: Object.freeze([emitterBinding("workflow-support.resolveBizObjectIdByInstance", assertWorkflowContract)]),
         mutuallyExclusiveBinding: Object.freeze([behaviorBinding("test/issue-14-workflow-bind-rule.test.ts#workflow.bindRule merges endEventHandler", assertWorkflowContract)]),
         userSearch: Object.freeze([behaviorBinding("test/round4-org-user-search.test.ts#org.user.search resolves a user by name into participant fields", assertWorkflowContract)]),
+        participantRoleValidation: Object.freeze([behaviorBinding("test/workflow-participant-role.test.ts#workflow.update refuses an unknown FindUserByRole role before the wire", assertWorkflowContract)]),
     }),
     evidence: Object.freeze([
         ".scratch/omc-approval-workflow/acceptance/s29-probe-20260910012330184.md",
@@ -160,7 +163,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "workflow.update": Object.freeze({
             scope: WORKFLOW_SCOPE,
-            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**连线三种写法选一**：`routes`（recipe 写法）/ `edges`（同义）/ `rules`（平台 DTO 字段名，`get_draft` 读回原样）——同传两种会被拒（`workflow-routes-ambiguous`）；merge 是并集（草稿边 + 你的边），**绝不删边**，若结果会比草稿少边则拒绝（`workflow-merge-would-drop-routes`，回 routesBefore/After + 缺失连线），dry-run 也会给出 `routesBefore/routesAfter/routesAdded/routesDropped`。**节点形状**：新增节点必须给 `type`/`activityType`（可选 START/PARTICIPANT/END…），`activityCode` 命中草稿既有节点时可省（类型/名称继承草稿）；**字段权限只发改动行**——`propertyPermissions` 是载荷体积的主要来源（整模板单次常到 1.0–1.4MB，超过 `--args-file` 上限 `CLI_ARGS_MAX_BYTES`=1MB 会被拒），权限编辑只需 `activities:[{activityCode, propertyPermissions:[{propertyCode,…}]}]`。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；**改名=同 code 原地生效**——工具把新名写入 `name_i18n`（zh/zh_TW/en），activityName 平台侧保持首建值，读回以 `renamedInPlace.displayName` 为准；只有**类型变更**才铸新码并弃旧码），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。用 `npm run test:live-permission`（非管理员参与者）验收，管理员会被后端强制 `e:true` 掩盖。",
+            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**连线三种写法选一**：`routes`（recipe 写法）/ `edges`（同义）/ `rules`（平台 DTO 字段名，`get_draft` 读回原样）——同传两种会被拒（`workflow-routes-ambiguous`）；merge 是并集（草稿边 + 你的边），**绝不删边**，若结果会比草稿少边则拒绝（`workflow-merge-would-drop-routes`，回 routesBefore/After + 缺失连线），dry-run 也会给出 `routesBefore/routesAfter/routesAdded/routesDropped`。**节点形状**：新增节点必须给 `type`/`activityType`（可选 START/PARTICIPANT/END…），`activityCode` 命中草稿既有节点时可省（类型/名称继承草稿）；**字段权限只发改动行**——`propertyPermissions` 是载荷体积的主要来源（整模板单次常到 1.0–1.4MB，超过 `--args-file` 上限 `CLI_ARGS_MAX_BYTES`=1MB 会被拒）。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；**改名=同 code 原地生效**——工具把新名写入 `name_i18n`（zh/zh_TW/en），activityName 平台侧保持首建值，读回以 `renamedInPlace.displayName` 为准；只有**类型变更**才铸新码并弃旧码），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**参与人写前校验**：`FindUserByRole(…,\"<roleCode>\",…)` 与 org.role.list 比对，未知角色拒 `workflow-participant-role-not-found`（带候选）；全 `{Originator}` 给 `approval-by-originator` warning。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。",
         }),
         "workflow.publish": Object.freeze({
             scope: WORKFLOW_SCOPE,
@@ -241,6 +244,7 @@ export function assertWorkflowContract() {
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.role.list", ["organization/role/list", "type", "Originator"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.department.list", ["organization/department/tree", "parentId"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.user.search", ["organization/user/search", "wd", "type 3"]);
+    assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.update", ["FindUserByRole", "workflow-participant-role-not-found", "approval-by-originator"]);
     for (const [key, field] of Object.entries(WORKFLOW_EVENT_HANDLER_FIELDS)) {
         if (!WORKFLOW_WIRE.bindRuleChain.includes(key))
             throw new Error(`workflow contract bind-rule chain must mention the ${key} handler key`);

package/dist/lanes/workflow.js

@@ -767,6 +767,18 @@ function participantReferenceWarnings(template) {
     }
     return warnings;
 }
+export function approvalByOriginatorWarnings(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const participants = activities.filter((activity) => String(activity.activityType ?? "") === "PARTICIPANT");
+    if (participants.length === 0 || !participants.every((activity) => String(activity.participant ?? "").trim() === "{Originator}"))
+        return [];
+    const activityCodes = participants.map((activity) => String(activity.activityCode ?? "")).filter((code) => code.length > 0);
+    return [{
+            code: "approval-by-originator",
+            activityCodes,
+            message: `所有参与人节点（${activityCodes.join("、")}）都指向 {Originator}：该流程会由发起人自审自批；这是允许的单人流程，但请确认该行为符合业务意图。`,
+        }];
+}
 /**
  * Role participants are filtered by `ouScope ∩ originator's department chain`.
  * A role whose members all have an empty scope therefore resolves to NOBODY —
@@ -782,12 +794,15 @@ async function assertRoleParticipantScopes(session, body) {
             ? Object.values(body.activities)
             : [];
     const roles = [];
+    const functionRoles = [];
     for (const activity of rows) {
         if (String(activity.activityType ?? "") !== "PARTICIPANT")
             continue;
         const raw = activity.participant;
         if (typeof raw !== "string" || !raw.trim().startsWith("["))
             continue;
+        const activityCode = String(activity.activityCode ?? "");
+        const activityName = String(activity.activityName ?? activity.name ?? activityCode);
         for (const segment of raw.split("+")) {
             let parsed;
             try {
@@ -806,7 +821,86 @@ async function assertRoleParticipantScopes(session, body) {
                     continue;
                 const roleId = String(record.id ?? "");
                 if (roleId)
-                    roles.push({ activityCode: String(activity.activityCode ?? ""), roleId, roleName: String(record.name ?? roleId) });
+                    roles.push({ activityCode, activityName, roleId, roleName: String(record.name ?? roleId) });
+            }
+        }
+    }
+    for (const activity of rows) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const participant = typeof activity.participant === "string" ? activity.participant.trim() : "";
+        const match = /^FindUserByRole\s*\(\s*[^,]+?\s*,\s*("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')\s*,\s*("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')\s*\)\s*$/.exec(participant);
+        if (!match)
+            continue;
+        const quoted = match[1];
+        let roleCode;
+        try {
+            roleCode = quoted.startsWith('"') ? JSON.parse(quoted) : quoted.slice(1, -1).replace(/\\(['\\])/g, "$1");
+        }
+        catch {
+            continue;
+        }
+        if (roleCode.trim())
+            functionRoles.push({ activityCode: String(activity.activityCode ?? ""), activityName: String(activity.activityName ?? activity.name ?? activity.activityCode ?? ""), roleCode: roleCode.trim() });
+    }
+    if (functionRoles.length > 0) {
+        let listedRoles = [];
+        let roleListAvailable = false;
+        try {
+            const data = (await wireCall(session, { path: ENDPOINTS.organizationRoleList, query: { expandAll: "true" } })).data;
+            const flattened = flattenRoleTree(wireRows(data));
+            listedRoles = Array.isArray(flattened.roles) ? flattened.roles : [];
+            roleListAvailable = true;
+        }
+        catch {
+            // Role existence is advisory when the organization read face is unavailable.
+            // Do not turn a transient read failure into a blanket workflow write outage.
+            roleListAvailable = false;
+        }
+        if (roleListAvailable) {
+            const byCode = new Map(listedRoles
+                .map((role) => [String(role.code ?? ""), role])
+                .filter(([code]) => code.length > 0));
+            const missing = functionRoles.filter((role) => !byCode.has(role.roleCode));
+            if (missing.length > 0) {
+                const candidates = (needle) => {
+                    const lower = needle.toLowerCase();
+                    const distance = (left, right) => {
+                        const row = Array.from({ length: right.length + 1 }, (_, index) => index);
+                        for (let i = 1; i <= left.length; i++) {
+                            let diagonal = row[0];
+                            row[0] = i;
+                            for (let j = 1; j <= right.length; j++) {
+                                const prior = row[j];
+                                row[j] = left[i - 1] === right[j - 1] ? diagonal : Math.min(row[j] + 1, row[j - 1] + 1, diagonal + 1);
+                                diagonal = prior;
+                            }
+                        }
+                        return row[right.length];
+                    };
+                    return listedRoles
+                        .map((role) => {
+                        const code = String(role.code ?? "");
+                        const name = String(role.name ?? "");
+                        const haystack = `${code} ${name}`.toLowerCase();
+                        const substringRank = haystack.includes(lower) ? 0 : 1;
+                        const editRank = Math.min(distance(lower, code.toLowerCase()), distance(lower, name.toLowerCase()));
+                        return { code, name, substringRank, editRank };
+                    })
+                        .filter((role) => role.code.length > 0)
+                        .sort((left, right) => left.substringRank - right.substringRank || left.editRank - right.editRank || left.code.localeCompare(right.code))
+                        .slice(0, 5)
+                        .map(({ code, name }) => ({ code, name }));
+                };
+                const first = missing[0];
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-participant-role-not-found",
+                    roles: missing,
+                    candidates: candidates(first.roleCode),
+                    nextCommand: "omc call org.role.list --args '{}'",
+                    message: `写前拒绝：节点 ${first.activityCode}（${first.activityName}）引用了不存在的角色 ${first.roleCode}。放行会导致待办静默回退给发起人（r9/r10/r15 真机）。请先用 org.role.list 确认真实 role code。`,
+                });
             }
         }
     }
@@ -2359,12 +2453,14 @@ export function registerWorkflowLane(tools) {
                 return { schemaCode: args.schemaCode, exists: false, note: "该模型没有流程可校验" };
             const template = (args.template ?? {});
             const body = await mergedTemplateBody(session, args.schemaCode ?? "", workflowCode, template, activitiesLackBoundaries(template));
+            await assertRoleParticipantScopes(session, body);
             const result = await wireCall(session, { path: ENDPOINTS.workflowValidate, method: "POST", body });
             const messages = Array.isArray(result.data) ? result.data : [];
             const errors = messages.filter((message) => message.errorLevel === "ERROR");
             const warnings = messages.filter((message) => message.errorLevel !== "ERROR");
             // r31c F23: local reachability / else-coverage — warning only, never flips valid.
             const reachability = workflowReachabilityWarnings(body);
+            const originatorWarnings = approvalByOriginatorWarnings(body);
             const allWarnings = [
                 ...warnings,
                 ...reachability.map((entry) => ({
@@ -2375,6 +2471,7 @@ export function registerWorkflowLane(tools) {
                     name: entry.name,
                     problem: entry.problem,
                 })),
+                ...originatorWarnings.map((entry) => ({ errorLevel: "WARNING", errCode: entry.code, errContent: entry.message, activityCodes: entry.activityCodes })),
             ];
             return {
                 workflowCode,
@@ -2384,6 +2481,7 @@ export function registerWorkflowLane(tools) {
                 errors,
                 warnings: allWarnings,
                 ...(reachability.length > 0 ? { reachabilityWarnings: reachability } : {}),
+                ...(originatorWarnings.length > 0 ? { approvalWarnings: originatorWarnings } : {}),
             };
         }, { target: `workflow.validate:${args.workflowCode ?? args.schemaCode}` }),
     }));
@@ -2486,6 +2584,7 @@ export function registerWorkflowLane(tools) {
             // Evaluate on `body` (post-backfill): the readback may drop the handler
             // keys, and the backfilled permittedAction is exactly what will run.
             const rejectWarnings = rejectToStartCancelWarnings(body);
+            const originatorWarnings = approvalByOriginatorWarnings(body);
             const renamedActivities = renamedActivityPairs(template, data);
             const renamedInPlace = inPlaceRenames(data);
             // Caller sent no routes at all: the draft's edges (branches included) are
@@ -2503,7 +2602,7 @@ export function registerWorkflowLane(tools) {
             const activityNames = Object.fromEntries(rawActivityRows
                 .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
                 .filter(([code]) => code !== ""));
-            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length || originatorWarnings.length ? { workflowWarnings: [...rejectWarnings, ...originatorWarnings] } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
         },
         preflight: (args) => {
             // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
@@ -2592,6 +2691,7 @@ export function registerWorkflowLane(tools) {
             const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
             await backfillDesignerDefaults(session, args.schemaCode, body, template);
             assertFirstActivityIsOriginator(template, "workflow.publish", body);
+            await assertRoleParticipantScopes(session, body);
             const unregistered = unregisteredParticipantFunctions(body);
             if (unregistered.length > 0)
                 throw new ToolRefusalError({
@@ -2629,7 +2729,8 @@ export function registerWorkflowLane(tools) {
             validateWorkflowRender(data, "workflow.publish readback");
             const participantWarnings = participantReferenceWarnings(data);
             const rejectWarnings = rejectToStartCancelWarnings(data);
-            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+            const originatorWarnings = approvalByOriginatorWarnings(data);
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length || originatorWarnings.length ? { workflowWarnings: [...rejectWarnings, ...originatorWarnings] } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
         },
         preflight: (args) => {
             assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");

package/dist/mcp-graph.js

@@ -59,7 +59,7 @@ const EXPLORE_TOOL = {
     description: [
         "一次查全一个目标的引用与影响面（本地索引，毫秒级）。",
         "输入 query=字段/模型/服务的 code（或规则检索词）；kind 可选 field|model|service，不给则三种都查。",
-        "返回 {index(freshness), references:{kind:[{schemaCode,ruleCode,nodeCode,nodeType,via}]}, impact:{kind:totals}, search:{rules}}。",
+        "返回 {index(freshness), references:{kind:[{schemaCode,ruleCode,nodeCode,nodeType,via}]}, impact:{kind:totals}, search:{matches:{model,field,service},rules}}。",
         "改/删/重命名任何字段、模型、服务之前必查；找\"关于 X 的规则\"拿 code 也走这里。",
         "索引不含规则条件叶子与流程绑定；freshness=partial 时命中可能不完整（答案里有 gapWarning）。",
     ].join(" "),
@@ -116,7 +116,15 @@ export async function executeGraphTool(name, rawArgs) {
             for (const one of kinds) {
                 const ref = queryGraphReferences(one, query);
                 const capped = cap(ref.matches);
-                references[one] = { count: ref.matches.length, ...capped, ...(ref.gapWarning ? { gapWarning: ref.gapWarning } : {}) };
+                // r35a-F4c（真机 2026-11-06）：**MCP 面是第三个消费者**——CLI 的 references
+                // 与 impact 都带 coverage 了，这里若不显式透传，MCP 用户看到的仍是
+                // 「matches:[] + 一句旧 note」，照样会把「表单没扫」误读成「没人引用」。
+                references[one] = {
+                    count: ref.matches.length,
+                    ...capped,
+                    ...(ref.coverage ? { coverage: ref.coverage } : {}),
+                    ...(ref.gapWarning ? { gapWarning: ref.gapWarning } : {}),
+                };
                 if (ref.matches.length > 0 || kind !== undefined) {
                     const imp = impactGraph(one, query);
                     impact[one] = {
@@ -124,6 +132,7 @@ export async function executeGraphTool(name, rawArgs) {
                         rules: cap(imp.rules),
                         datarules: cap(imp.datarules),
                         listviews: cap(imp.listviews),
+                        ...(imp.coverage ? { coverage: imp.coverage } : {}),
                     };
                 }
             }
@@ -135,9 +144,11 @@ export async function executeGraphTool(name, rawArgs) {
                 index,
                 references,
                 impact,
-                search: { count: search.rules.length, rules: search.rules },
+                search: { count: search.rules.length, rules: search.rules, matches: search.matches, coverage: search.coverage },
                 ...(search.note ? { searchNote: search.note } : {}),
-                note: "索引不含规则条件叶子与流程绑定；改这些面仍需平台侧核查",
+                // 旧句「索引不含规则条件叶子与流程绑定」漏了表单与流程权限（r35a-F4 实证
+                // 探针据此差点误删被表单引用的字段）。改为指向结构化 coverage，不再靠散文。
+                note: "零命中只代表 references[].coverage.scanned 面没有命中；notScanned 面（尤其 form 与 workflow.permissions）未扫描，不可据此判定可安全删除或无影响",
             });
         }
         return toolError(`未知工具：${name}`);

package/dist/rule-when.js

@@ -11,7 +11,8 @@
  * 编译目标只用**设计器验证过**的形状（前台生效约束，2026-10-16 用户裁决：后端
  * 接口大量不拦截，save/publish 通过≠门户生效）：
  * - 预置触发行 Create/Update（设计器原生行，非自定义）
- * - 单 UPDATE 节点：filterCondition（查找满足条件的主表数据）+ dataActions（赋值）
+ * - 单 UPDATE 节点：dataCondition（输入数据满足条件时执行）+
+ *   filterCondition（默认按当前输入行定位）+ dataActions（赋值）
  * - FIXED 字面量 / DYNAMIC 字段引用 / EXPRESSION 公式（含 DATEDIF 语法，均真机验证）
  * - 布局/路由交给 prepareRuleGraph 注入（points 画布兼容，Ticket 109）
  *
@@ -23,6 +24,16 @@ import { envelope, requestId, classifyResult, CLI_EXIT_CODES } from "./cli-contr
 import { writeEnvelope } from "./cli-output.js";
 import { argvValue } from "./args.js";
 const WHEN_OPS = { "=": "EQ", "==": "EQ", "!=": "NEQ", ">": "GT", "<": "LT", ">=": "GTEQ", "<=": "LTEQ", "~=": "CT", "!~": "NCT" };
+function parseWhen(raw) {
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)\s*(>=|<=|~=|!~|==|!=|=|>|<)\s*([\s\S]+)$/.exec(raw.trim());
+    if (!match)
+        throw new Error(`--when "${raw}" 解析失败：形如 字段=值 / 字段!=值 / 字段>=数字 / 字段~=文本（包含）`);
+    const [, field, op, rawValue] = match;
+    if (rawValue.startsWith("="))
+        throw new Error(`--when "${raw}" 疑似操作符手误（值以 = 开头）：检查是否多打了等号`);
+    const value = /^-?\d+(\.\d+)?$/.test(rawValue.trim()) ? Number(rawValue.trim()) : rawValue.trim();
+    return { field, op, value };
+}
 /** 编译 --when/--then DSL 为设计器验证形状的规则图（导出供测试断言）。 */
 export function composeRuleWhenGraph(options) {
     if (options.when.length === 0)
@@ -33,17 +44,14 @@ export function composeRuleWhenGraph(options) {
     for (const raw of options.when) {
         // 最长操作符优先：>= <= ~= !~ == != > <（操作符两侧允许空格——r34 探针
         // 实测 `dr_price > 1000` 因空格被拒，属于自然书写）
-        const match = /^([A-Za-z_][A-Za-z0-9_]*)\s*(>=|<=|~=|!~|==|!=|=|>|<)\s*([\s\S]+)$/.exec(raw.trim());
-        if (!match)
-            throw new Error(`--when "${raw}" 解析失败：形如 字段=值 / 字段!=值 / 字段>=数字 / 字段~=文本（包含）`);
-        const [, field, op, rawValue] = match;
-        if (rawValue.startsWith("="))
-            throw new Error(`--when "${raw}" 疑似操作符手误（值以 = 开头）：检查是否多打了等号`);
+        const { field, op, value } = parseWhen(raw);
         const opCode = WHEN_OPS[op];
         if (!opCode)
             throw new Error(`--when 操作符 "${op}" 不受支持`);
-        const value = /^-?\d+(\.\d+)?$/.test(rawValue.trim()) ? Number(rawValue.trim()) : rawValue.trim();
-        leaves.push({ targetSchemaDataItem: field, ruleConditionType: opCode, ruleValueType: "FIXED", value });
+        // DataCondition uses DataFilterCondition, not TableCondition:
+        // currentSchemaDataItem is the input field and the operator wire key is
+        // ruleDataConditionType (ruleConditionType is @JsonIgnore here).
+        leaves.push({ currentSchemaDataItem: field, ruleDataConditionType: opCode, ruleValueType: "FIXED", value });
     }
     const actions = [];
     for (const raw of options.then) {
@@ -70,7 +78,11 @@ export function composeRuleWhenGraph(options) {
             nodes: [
                 { nodeCode: "Start", nodeType: "START" },
                 { nodeCode: "UpdateData1", nodeType: "UPDATE", targetObjectCode: options.schema, inputParam: "_input",
-                    filterCondition: { mainConditions: [leaves], sheetConditions: [] },
+                    // UPDATE.filterCondition selects rows; it is not an execution gate.
+                    // Keep the trigger row as the default target and put --when on the
+                    // platform's real execution-gate field (dataCondition).
+                    dataCondition: { conditionGroup: [leaves] },
+                    filterCondition: { mainConditions: [[{ targetSchemaDataItem: "id", ruleConditionType: "EQ", ruleValueType: "DYNAMIC", currentSchemaDataItem: "id" }]], sheetConditions: [] },
                     dataActions: actions },
                 { nodeCode: "End", nodeType: "END" },
             ],
@@ -130,9 +142,27 @@ export async function cmdRuleWhen(args) {
     catch (error) {
         return invalid(error instanceof Error ? error.message : String(error));
     }
-    const { result, exitCode } = await runToolCall("rule.save", { args: createArgs, requestId: request, environment });
+    const rowScope = {
+        mode: "current-row",
+        matchedRows: null,
+        sampleIds: [],
+        note: "当前行由运行时 _input.id 确定；保存面没有具体行 id，无法预先 count，按 fail-open 继续保存",
+    };
+    // print: () => undefined —— stdout 必须恰好一个 JSON 信封（repo 契约）。默认 print 是
+    // console.log，会把工具进度行打到信封前面：任何按行解析 stdout 的管道（agent、
+    // 重放脚本）第一行就 json.loads 失败（0.6.17 重放 R8 真机撞上）。approval-flow
+    // 等 composer 都覆写了，这里漏了；compute.ts 同病同修。
+    const { result, exitCode } = await runToolCall("rule.save", { args: createArgs, requestId: request, environment, print: () => undefined });
+    // `rule.save` owns the wire write; enrich this high-level command's receipt
+    // with the impact face it can prove from the compiled graph. The generated
+    // id=id locator is current-row scope, so no count query is needed and the
+    // answer is fail-open rather than inventing a table-wide count.
+    const scopedResult = {
+        ...result,
+        rowScope,
+    };
     const classified = classifyResult(result);
-    writeEnvelope(envelope(classified.status, result, request, classified.error));
+    writeEnvelope(envelope(classified.status, scopedResult, request, classified.error));
     if (apply && classified.status === "ok")
         process.stderr.write("[omc] 前台生效验证清单（后端通过≠门户生效）：1) omc call rule.enable 启用；2) 造一条命中 --when 的测试数据提交；3) 门户打开该记录核对 --then 字段已变更；4) 再造一条不命中的数据确认不误改；5) 设计器打开本规则确认节点/条件显示正常。\n");
     return exitCode;

package/dist/skills.js

@@ -109,7 +109,7 @@ const SYNTHETIC_SKILLS = Object.freeze({
             "# 批量写",
             "",
             "通用批量入口是 `omc call <tool> --args-list '<json数组>'`，逐条执行且默认不中断。",
-            "先做零写入形状校验：`omc call data.save --args-list '<file|stdin>' --preflight`；回执 `shapeOnly:true`，只校验 JSON 形状与 schema 必填键，不做业务语义校验；业务校验要真写一次才知道。",
+            "先做零写入形状校验：`omc call data.save --args-list '<json数组>' --preflight`；回执 `shapeOnly:true`，只校验 JSON 形状与 schema 必填键，不做业务语义校验；业务校验要真写一次才知道。大数组请用 shell 变量传入（`--args-list` 暂不读取文件或 stdin）。",
             "支持 `data.save`、`data.delete`、`field.create` 等同一工具逐条批量调用；没有专用 `data.import`，导入数据就是逐条 `data.save`。",
             "失败项回 `row`（1 基）、`index`（0 基）和尽力推断的字段/原因；成功项回输入中的 `code` 等业务标识。",
             "",

package/dist/workflow-support.js

@@ -173,13 +173,14 @@ export function diagnoseInstanceActivity(input) {
     const originator = input.originator ?? null;
     const fallbackSuspect = originator !== null &&
         active.some((activity) => activity.participantCount > 0 && activity.participants.every((person) => person.id === originator));
+    const unresolved = active.filter((activity) => activity.activityType === "PARTICIPANT" && activity.participantCount === 0).map((activity) => activity.activityCode ?? "?");
     return {
         code: "has-active-activity",
         message: `当前激活节点：${active.map((activity) => `${activity.activityCode}(${activity.activityName ?? ""})`).join("、")}`,
         checks: fallbackSuspect
             ? ["若这些节点本应流转给角色或他人，现在却落在发起人身上：参与人解析为空时平台会退回发起人（1.1.25 实测），流程看似推进实为错派。核对参与人写法（参与者对象数组 / FindUserByRole(org, roleCode[, order])）与角色成员。"]
             : [],
-        warnings: fallbackSuspect ? ["participant-fallback-to-originator"] : [],
+        warnings: [...(fallbackSuspect ? ["participant-fallback-to-originator"] : []), ...unresolved.map((activityCode) => `participant-unresolved:${activityCode}`)],
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.6.16",
+  "version": "0.6.17",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -55,7 +55,7 @@
   },
   "dependencies": {
     "commander": "14.0.3",
-    "omc-core": "0.6.16",
+    "omc-core": "0.6.17",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",
@@ -73,6 +73,6 @@
     "directory": "packages/omc-cli"
   },
   "optionalDependencies": {
-    "@stalfh233/omc-fake-platform": "0.6.16"
+    "@stalfh233/omc-fake-platform": "0.6.17"
   }
 }