@stalfh233/omc-cli 0.6.16 → 0.6.18

package/dist/lanes/runtime-data.js

@@ -14,6 +14,7 @@ import { getReplayToken, listInstanceActivities, searchWorkItems, wireString } f
 import { PLATFORM_ADMIN_START_BYPASS, resolvePermissionActor } from "../identity.js";
 import { ENGINE_OWNED_KEYS, RUNTIME_DATA_LANE_CONTRACT, RUNTIME_DATA_WIRE, runtimeFormDataArg, } from "./runtime-data-contract.js";
 import { SYSTEM_FIELD_CODES } from "../field-families.js";
+import { applicationResolutionOf, resolveApplicationScope } from "../support.js";
 /** r29b F8: keep ids/itemsPreview through governedRead's compact diet. */
 const DATA_LIST_PREVIEW_LIMIT = 20;
 function dataListItemPreview(items) {
@@ -55,6 +56,7 @@ function dataListCompactProjection(result) {
             if (value.length > 0)
                 compact.listArtifactHint =
                     "items 已外置（truncatedKeys 含 items）：完整行见 artifact（detailArtifactId / fetch）。同信封三分法：ids=本页全部 id；itemsPreview=ids 前 3 个的引用（仅 {id}，不是第二份行）；items=[] 表示正文在 artifact。";
+            compact.itemsExternalized = true;
             continue;
         }
         // 这两个键由本函数按 items 现算，handler 不再重复内联。
@@ -370,6 +372,106 @@ function readbackWarningFor(emptyFields, toolName) {
         return undefined;
     return `${toolName} 已 DELIVERED，但即时读回里这些本次提交的字段为空/缺省：${emptyFields.join("、")}。平台 form/load 在写事务后可能先回系统字段、业务字段滞后（真机 1.1.25，r14 见过只回 modifiedTime 的一笔）。**先 omc call data.load 核对，不要重写**；若 data.load 仍为空，才按投影/字段 code 排查。`;
 }
+function parseOptions(value) {
+    if (typeof value === "string") {
+        try {
+            const parsed = JSON.parse(value);
+            return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function choiceCodesFromFieldOptions(field, options) {
+    const asCodes = (value) => {
+        if (!Array.isArray(value))
+            return [];
+        return value
+            .map((entry) => {
+            if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+                const row = entry;
+                return String(row.code ?? row.value ?? row.key ?? "");
+            }
+            return String(entry ?? "");
+        })
+            .filter((code) => code.length > 0);
+    };
+    const direct = asCodes(field.choices);
+    if (direct.length > 0)
+        return direct;
+    for (const candidate of [options.choices, options.items]) {
+        const codes = asCodes(candidate);
+        if (codes.length > 0)
+            return codes;
+    }
+    const set = options.optionsSet;
+    if (!set || typeof set !== "object" || Array.isArray(set))
+        return [];
+    const optionSet = set;
+    for (const candidate of [optionSet.custom, optionSet.choices, optionSet.items, optionSet.useDictionariesData]) {
+        const codes = asCodes(candidate);
+        if (codes.length > 0)
+            return codes;
+    }
+    const dictionary = optionSet.dictionary;
+    if (dictionary && typeof dictionary === "object" && !Array.isArray(dictionary)) {
+        const codes = asCodes(dictionary.useDictionariesData);
+        if (codes.length > 0)
+            return codes;
+    }
+    return [];
+}
+/**
+ * Runtime/form/save deliberately remains permissive: the platform stores the
+ * row even when the portal would reject it.  These are advisory findings only.
+ * In particular, never manufacture a warning for a field which is absent from
+ * the published field face (the old `code/required` ghost warning did exactly
+ * that).
+ */
+async function runtimeDataWarnings(session, schemaCode, sheetCode, formData, row = 1) {
+    const warnings = [];
+    let fields = [];
+    try {
+        fields = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode, isPublish: "true" } })).data);
+    }
+    catch {
+        return warnings;
+    }
+    const byCode = new Map(fields.map((field) => [String(field.code ?? field.propertyCode ?? ""), field]));
+    let required = new Set();
+    try {
+        const sheet = ((await wireCall(session, { path: ENDPOINTS.sheetGet, query: { schemaCode, sheetCode } })).data ?? {});
+        const face = typeof sheet.publishedAttributesJson === "string" ? sheet.publishedAttributesJson : typeof sheet.draftAttributesJson === "string" ? sheet.draftAttributesJson : undefined;
+        if (face) {
+            const controls = JSON.parse(face);
+            required = new Set(Object.entries(controls).filter(([, control]) => control?.options?.required === true || typeof control?.options?.requiredFormula === "string").map(([code]) => code));
+        }
+    }
+    catch {
+        // Advisory diagnostics must never affect the write.
+    }
+    for (const [field, value] of Object.entries(formData)) {
+        const meta = byCode.get(field);
+        if (!meta)
+            continue;
+        if ((required.has(field) || parseOptions(meta.options).required === true) && (value === null || value === undefined || (typeof value === "string" && value.trim() === ""))) {
+            warnings.push({ code: "required-empty", row, fieldCode: field, message: `字段 ${field} 声明必填但本行为空；平台照存，OMC 仅提示` });
+        }
+        const options = parseOptions(meta.options);
+        const optionSet = options.optionsSet && typeof options.optionsSet === "object" ? options.optionsSet : {};
+        const choiceCodes = choiceCodesFromFieldOptions(meta, options);
+        if (choiceCodes.length > 0 && value !== null && value !== undefined && value !== "") {
+            const allowed = new Set(choiceCodes);
+            const values = Array.isArray(value) ? value : [value];
+            const invalid = values.filter((entry) => !allowed.has(String(entry)));
+            if (invalid.length > 0)
+                warnings.push({ code: "choice-out-of-range", row, fieldCode: field, value: invalid.map(String), allowed: choiceCodes, message: `字段 ${field} 含未声明选项（实际值：${invalid.map(String).join("、")}；合法集：${choiceCodes.join("、")}）；平台照存，OMC 仅提示` });
+        }
+    }
+    return warnings;
+}
 function projectApprovalReadback(record, submittedKeys) {
     if (record === null || typeof record !== "object" || Array.isArray(record))
         return {};
@@ -921,12 +1023,12 @@ export function registerRuntimeDataLane(tools) {
             columns: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields）"),
             // r29b F9: data.load/save/update 都叫 fields；list 面原先只有 displayFields/columns。
             fields: z.array(z.string().min(1)).optional().describe("列投影别名（=displayFields；与 data.load/data.save/data.update 的 fields 同语义）"),
-            orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional(),
+            orders: z.array(z.object({ field: z.string().min(1), dir: z.enum(["ASC", "DESC"]) })).optional().describe("运行面 query/list 不支持服务端排序；排序请用 listview.configure 的 sorts（视图级）或在本地对 items 排序"),
             mobile: z.boolean().optional(),
             showTotal: z.boolean().default(true),
             page: z.number().int().min(0).default(0),
             size: z.number().int().min(1).max(200).default(10),
-            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（内部按 size=200 逐页拉取，安全上限 1000 行；超过时回 truncated:true + missingCount，别当全集）——存量盘点/数据核对用，替代手动循环翻页。与 page 互斥（all 固定从第 0 页起）"),
+            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（size=200 逐页，上限 1000 行，超出 resultTruncated:true）；与 page 互斥；默认 size=10，视图 pagingSetting.pageSize 不生效"),
             full: z.boolean().optional().describe("内联完整列表结果；默认大结果只返回计数与 detailFile"),
             // r31 (2026-10-31 real machine): agents pass `query: {field: value}` as a
             // filter — zod would STRIP the unknown key silently and the server
@@ -943,6 +1045,14 @@ export function registerRuntimeDataLane(tools) {
                     tool: "data.list",
                     message: '没有 `query` 参数——过滤用 `filter: {"op":"eq","field":"<字段>","value":"<值>"}`（或 `filters` 数组=AND、`filterGroup` 嵌套）。r31 真机：`query:{...}` 被静默忽略、total 不变，极易误判为"无数据/已过滤"。',
                 });
+            if (args.orders !== undefined)
+                throw new ToolInputError({
+                    status: "error",
+                    blocker: "invalid-input",
+                    tool: "data.list",
+                    message: "运行面 query/list 不支持服务端排序；排序请用 listview.configure 的 sorts（视图级）或在本地对 items 排序。",
+                    nextCommand: `omc call listview.configure --env <env> --args '${JSON.stringify({ schemaCode: args.schemaCode, sorts: args.orders })}'`,
+                });
             let condition;
             let fromDsl = false;
             try {
@@ -970,6 +1080,8 @@ export function registerRuntimeDataLane(tools) {
                 throw error;
             }
             return governedRead(ctx, self, args, async (session) => {
+                const applicationScope = await resolveApplicationScope(session);
+                const application = { applicationCode: applicationScope.code, applicationResolution: applicationResolutionOf(applicationScope) };
                 // A2：DSL 过滤命中的单选/字典字段（total:0 时给值写法提示）
                 let choiceFilterFields = [];
                 // Published field metadata is the sole source for filter propertyType
@@ -1094,7 +1206,7 @@ export function registerRuntimeDataLane(tools) {
                     const firstPage = extractBizObjectPage(first.data);
                     const total = Number(firstPage.total ?? 0);
                     if (total === 0 || firstPage.content.length === 0)
-                        return { schemaCode: args.schemaCode, total: 0, page: "all", size: 0, pagesFetched: 0, items: [], ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
+                        return { schemaCode: args.schemaCode, ...application, total: 0, page: "all", size: 0, pagesFetched: 0, items: [], itemsCount: 0, itemsReturned: 0, resultTruncated: false, itemsExternalized: false, ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
                     const rows = [...firstPage.content];
                     const target = Math.min(total, CAP);
                     let pageIndex = 1;
@@ -1139,6 +1251,7 @@ export function registerRuntimeDataLane(tools) {
                     const preview = dataListItemPreview(items);
                     return {
                         schemaCode: args.schemaCode,
+                        ...application,
                         total,
                         page: "all",
                         size: collected.length,
@@ -1146,7 +1259,11 @@ export function registerRuntimeDataLane(tools) {
                         // 与普通读同一个口径（r28b 真机）：草稿策略必须**从结果集实际统计**，
                         // 不能按"有没有查询条件"静态声明——静态声明会与 items 自相矛盾。
                         filter: (() => {
-                            const draftRows = items.filter((item) => String(item.fields.sequenceStatus ?? "") === "DRAFT").length;
+                            const draftRows = collected.filter((row) => {
+                                const record = row;
+                                const data = record.data && typeof record.data === "object" ? record.data : record;
+                                return String(data.sequenceStatus ?? record.sequenceStatus ?? "") === "DRAFT";
+                            }).length;
                             return draftRows > 0
                                 ? { draftPolicy: "included", draftRows, hint: `本次结果含 ${draftRows} 条 DRAFT 行——total 含草稿，不要当"已提交数据量"；判定状态读 data.load 的 sequenceStatus` }
                                 : { draftPolicy: "unspecified", hint: "本次结果无 DRAFT 行；判定状态以 data.load 的 sequenceStatus 为准" };
@@ -1154,6 +1271,9 @@ export function registerRuntimeDataLane(tools) {
                         // 形状常量：脚本按 result.items 取数（与内联态一致），itemsCount 与
                         // total 的差就是被截断的条数——不再只靠 size 反推。
                         itemsCount: collected.length,
+                        itemsReturned: collected.length,
+                        resultTruncated: truncatedByCap,
+                        itemsExternalized: false,
                         // r29b F8 的 ids/itemsPreview 由 compact（外置时）现算，不在这里内联——
                         // 内联会让小结果越过 2048B 外置阈值，反而把 items 挤成 []。
                         ...(truncatedByCap
@@ -1175,7 +1295,26 @@ export function registerRuntimeDataLane(tools) {
                 }
                 catch (error) {
                     if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.emptyModelErrcode) {
-                        return { schemaCode: args.schemaCode, total: 0, totalPages: 0, page: args.page ?? 0, size: args.size ?? 10, items: [], ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
+                        return { schemaCode: args.schemaCode, ...application, total: 0, totalPages: 0, page: args.page ?? 0, size: args.size ?? 10, items: [], ...(choiceFilterFields.length > 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}) };
+                    }
+                    if (error instanceof WireError && error.kind === "business" && error.errcode === 303001) {
+                        let available = [];
+                        try {
+                            const rows = wireRows((await wireCall(session, { path: ENDPOINTS.listQueryList, query: { schemaCode: args.schemaCode, clientType: "PC" } })).data);
+                            available = rows.map((row) => ({ code: row.code ?? null, name: row.name ?? null }));
+                        }
+                        catch {
+                            available = [];
+                        }
+                        return {
+                            status: "refused",
+                            blocker: "query-view-not-found",
+                            errcode: 303001,
+                            schemaCode: args.schemaCode,
+                            queryCode: args.queryCode ?? args.schemaCode,
+                            available,
+                            message: available.length > 0 ? `列表视图不存在：${String(args.queryCode ?? args.schemaCode)}；可用视图见 available` : `列表视图不存在：${String(args.queryCode ?? args.schemaCode)}；该模型无列表视图`,
+                        };
                     }
                     // r30: a MISSING model answers this face with a generic 50000
                     // 服务异常 — indistinguishable from a real outage. One field-face
@@ -1190,9 +1329,13 @@ export function registerRuntimeDataLane(tools) {
                             if (probeError instanceof WireError && probeError.kind === "business" && probeError.errcode === 300004) {
                                 return {
                                     status: "refused",
-                                    blocker: "wire-business",
+                                    blocker: "schema-not-found",
                                     errcode: 300004,
-                                    message: `数据模型不存在（${args.schemaCode}）——运行面读取前模型必须已创建并发布字段；先 model.create / configure_model（存在性判据用 model.inspect 的 modelPresent）`,
+                                    schemaCode: args.schemaCode,
+                                    exists: false,
+                                    total: 0,
+                                    message: `数据模型不存在（${args.schemaCode}）——运行面读取前模型必须已创建并发布字段。`,
+                                    nextCommand: "omc call model.list --args '{}'",
                                 };
                             }
                         }
@@ -1250,8 +1393,13 @@ export function registerRuntimeDataLane(tools) {
                 else if (totalPages > 0 && requestedPage >= totalPages) {
                     pageOutOfRange = true;
                 }
+                const draftRows = page.content.filter((row) => {
+                    const data = row.data && typeof row.data === "object" ? row.data : row;
+                    return String(data.sequenceStatus ?? row.sequenceStatus ?? "") === "DRAFT";
+                }).length;
                 const readback = {
                     schemaCode: args.schemaCode,
+                    ...application,
                     ...(projectionEmpty ? { projectionWarning: { reason: "business-columns-null", hint: "模型可能未配置列表视图：data.list 只投影列表列，业务列会全为 null；核对写入结果请用 data.load（或先建列表视图）" } } : {}),
                     ...(args.queryCode !== undefined ? { queryCode: args.queryCode } : {}),
                     total,
@@ -1266,7 +1414,6 @@ export function registerRuntimeDataLane(tools) {
                     // 统一一个枚举键 `draftPolicy`（included | excluded | unspecified），
                     // 不再用两个不同键名表达同一件事（那要调用方写两套分支）。
                     ...(() => {
-                        const draftRows = items.filter((item) => String(item.fields.sequenceStatus ?? "") === "DRAFT").length;
                         const policy = draftRows > 0
                             ? {
                                 draftPolicy: "included",
@@ -1280,6 +1427,10 @@ export function registerRuntimeDataLane(tools) {
                     })(),
                     ...(choiceFilterFields.length > 0 && Number(total ?? 0) === 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}),
                     totalPages,
+                    itemsCount: items.length,
+                    itemsReturned: items.length,
+                    resultTruncated: false,
+                    itemsExternalized: false,
                     page: page.page ?? requestedPage,
                     size: page.size ?? args.size ?? 20,
                     ...(pageOutOfRange ? { pageOutOfRange: true, emptyPage: true } : {}),
@@ -1436,6 +1587,8 @@ export function registerRuntimeDataLane(tools) {
             ...readbackProjectionArgs,
         },
         execute: async (session, args) => {
+            const applicationScope = await resolveApplicationScope(session);
+            const application = { applicationCode: applicationScope.code, applicationResolution: applicationResolutionOf(applicationScope) };
             // F-A (self-audit): the combo used to be silently ignored (the workflow
             // draft branch returns without honoring submit). Refuse before any wire.
             if (args.submit === true && typeof args.workflowCode === "string" && args.workflowCode.trim())
@@ -1550,8 +1703,8 @@ export function registerRuntimeDataLane(tools) {
                 readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: returnedId } })).data;
                 sequenceStatus = extractSequenceStatus((readbackData ?? {}));
                 return {
-                    performed: { errcode: performed.errcode, bizObjectId: returnedId, workflowInstanceId, workItemId, workItemSource, sheetCode, resolvedFrom, formType: "save-draft-workflow" },
-                    readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
+                    performed: { errcode: performed.errcode, ...application, bizObjectId: returnedId, workflowInstanceId, workItemId, workItemSource, sheetCode, resolvedFrom, formType: "save-draft-workflow" },
+                    readback: { ...application, authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
                 };
             }
             let performed;
@@ -1579,9 +1732,12 @@ export function registerRuntimeDataLane(tools) {
             // "rule didn't fire" misdiagnosis.
             const savedRecord = normalizeLoadedRecord((readbackData ?? {}));
             const savedEmptyFields = readbackEmptyFields(formData, savedRecord);
+            const dataWarnings = await runtimeDataWarnings(session, args.schemaCode, sheetCode, formData, 1);
             const plainReadback = {
+                ...application,
                 authoritative: projectReadbackRecord(savedRecord, args),
                 ...(savedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(savedEmptyFields, "data.save") } : {}),
+                ...(dataWarnings.length > 0 ? { warnings: dataWarnings } : {}),
                 draftRuleHint: "草稿态（DRAFT）保存不触发业务规则——DRAFT 行跳过 Create/Update 分发（DomainServiceImpl.java:240-248）；要一调完成态本调用加 submit:true；已存草稿直提形状：data.submit {schemaCode, bizObjectId: 本读回的 bizObjectId, formData}（submit 自持久化）",
             };
             // r18 retro (G3): one-call COMPLETED creation — the agent goal is usually
@@ -1630,7 +1786,7 @@ export function registerRuntimeDataLane(tools) {
                 };
             }
             return {
-                performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom },
+                performed: { errcode: performed.errcode, ...application, bizObjectId, sheetCode, resolvedFrom },
                 readback: plainReadback,
             };
         },
@@ -1711,9 +1867,9 @@ export function registerRuntimeDataLane(tools) {
      * gone, not that the model is clean — a submit can leave a separate draft row
      * behind. After a delete, read the model's residue so "cleaned up" is a
      * model-level fact (`total:0`). Best-effort: a query failure never fails the
-     * delete, but it IS surfaced as `modelResidueError`.
+     * delete, but it IS surfaced under `preExistingRows.error`.
      */
-    async function modelResidue(session, schemaCode, sheetCode) {
+    async function preExistingRows(session, schemaCode, sheetCode) {
         try {
             const result = await wireCall(session, {
                 path: ENDPOINTS.runtimeQueryList,
@@ -1721,12 +1877,12 @@ export function registerRuntimeDataLane(tools) {
                 body: { schemaCode, queryCode: schemaCode, filters: [], mobile: false, page: 0, size: 1, queryVersion: 1, showTotal: true },
             });
             const page = extractBizObjectPage(result.data);
-            return { modelResidue: { total: page.total, clean: page.total === 0, sheetCode } };
+            return { preExistingRows: { total: page.total, clean: page.total === 0, sheetCode, note: "含历史既有数据，非本次创建" } };
         }
         catch (error) {
             if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.emptyModelErrcode)
-                return { modelResidue: { total: 0, clean: true, sheetCode } };
-            return { modelResidue: { total: null, clean: null, sheetCode, modelResidueError: error instanceof Error ? error.message : String(error) } };
+                return { preExistingRows: { total: 0, clean: true, sheetCode, note: "含历史既有数据，非本次创建" } };
+            return { preExistingRows: { total: null, clean: null, sheetCode, note: "含历史既有数据，非本次创建", error: error instanceof Error ? error.message : String(error) } };
         }
     }
     writeTool({
@@ -1823,14 +1979,15 @@ export function registerRuntimeDataLane(tools) {
                             absent: true,
                             deleted: false,
                             noop: true,
-                            recoveryHint: "若另一进程刚刚删除，这是正常并发结果（already-absent），不是 id 拿错。否则：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏。若 modelResidue.total>0，用 items[].id 重删。",
-                            ...(await modelResidue(session, args.schemaCode, sheetCode)),
+                            recoveryHint: "若另一进程刚刚删除，这是正常并发结果（already-absent），不是 id 拿错。否则：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏。",
+                            thisRow: { absent: true, deleted: false },
+                            ...(await preExistingRows(session, args.schemaCode, sheetCode)),
                         },
                     };
                 }
                 return {
                     performed: { errcode: one.errcode, deleted: one.deleted === true, noop: false, sheetCode, resolvedFrom },
-                    readback: { absent: one.absent, deleted: one.deleted === true, ...(await modelResidue(session, args.schemaCode, sheetCode)) },
+                    readback: { absent: one.absent, deleted: one.deleted === true, thisRow: { absent: one.absent, deleted: one.deleted === true }, ...(await preExistingRows(session, args.schemaCode, sheetCode)) },
                 };
             }
             const deleted = [];
@@ -1838,7 +1995,7 @@ export function registerRuntimeDataLane(tools) {
                 deleted.push(await deleteOne(id));
             // `deleted`/`count` ride `readback` — the write envelope surfaces only
             // performed/readback inline (extra top-level keys are artifact-only).
-            return { performed: { sheetCode, resolvedFrom }, readback: { absent: true, count: deleted.length, deleted, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+            return { performed: { sheetCode, resolvedFrom }, readback: { absent: true, count: deleted.length, deleted, ...(await preExistingRows(session, args.schemaCode, sheetCode)) } };
         },
     });
     writeTool({

package/dist/lanes/workflow-contract.js

@@ -78,6 +78,7 @@ export const WORKFLOW_WIRE = Object.freeze({
     workItemFilter: "WorkItemSearchVO.filterWorkflowInstanceId is a NOT-equal exclusion (BizWorkitemServiceImpl.toSearchWorkItemsCriterion:400-402), so exact instance filtering is client-side",
     bizObjectResolution: "GET /api/api/runtime/workflow/getBizObjectByWfInstanceId resolves bizObjectId/schemaCode; a failed lookup leaves the identity null and never drops the todo",
     mutuallyExclusiveBinding: "同一处理器绑定多条规则时它们**全部执行、无互斥**：审批通过/驳回这类互斥结果不要用两条各自 FIXED 赋值都绑 end（bench22 病灶）——通过绑 end（endEventHandler）或规则 Available，驳回绑 cancel（cancelEventHandler）或规则 Cancel，或用一条多分支图（生产 case_info_update 只在 endEventHandler 绑一条 updateData 多分支图）；workflow.bindRule 回读在 bizActions.length>1 时给 advisory",
+    participantRoleValidation: "写前参与人校验：PARTICIPANT 的 FindUserByRole(<org>,\"<roleCode>\",\"<order>\") 会与 org.role.list 的真实角色 code 比对；缺失即拒绝 workflow-participant-role-not-found，并给 activityCode/activityName/roleCode、最多 5 个 candidates 与 nextCommand。org.role.list 读取失败时 fail-open，不阻断写入。{Originator} 是发起人关键字，不按角色校验；所有 PARTICIPANT 都是 {Originator} 时给 approval-by-originator warning。",
     userSearch: "POST /api/api/organization/user/search，@RequestBody {wd (关键字，必填), page, size, filterType?} → PageVO<UserVO>{totalElements,totalPages,content[{id,name,username,userId,departmentId,corpId,status}]}（UserController.search:337-341；缺 wd 报 10005 关键字不能为空）。用于把姓名解析成真实用户，构造参与者对象 type 3=用户（type 2=角色）",
 });
 /** Workflow template object (workflow/update|publish raw body). */
@@ -117,6 +118,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         bizObjectResolution: WORKFLOW_WIRE.bizObjectResolution,
         mutuallyExclusiveBinding: WORKFLOW_WIRE.mutuallyExclusiveBinding,
         userSearch: WORKFLOW_WIRE.userSearch,
+        participantRoleValidation: WORKFLOW_WIRE.participantRoleValidation,
     }),
     wireBindings: Object.freeze({
         templateShape: Object.freeze([behaviorBinding("test/ticket-112-workflow-template-merge.test.ts#workflow.update merges onto the draft", assertWorkflowContract)]),
@@ -135,6 +137,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         bizObjectResolution: Object.freeze([emitterBinding("workflow-support.resolveBizObjectIdByInstance", assertWorkflowContract)]),
         mutuallyExclusiveBinding: Object.freeze([behaviorBinding("test/issue-14-workflow-bind-rule.test.ts#workflow.bindRule merges endEventHandler", assertWorkflowContract)]),
         userSearch: Object.freeze([behaviorBinding("test/round4-org-user-search.test.ts#org.user.search resolves a user by name into participant fields", assertWorkflowContract)]),
+        participantRoleValidation: Object.freeze([behaviorBinding("test/workflow-participant-role.test.ts#workflow.update refuses an unknown FindUserByRole role before the wire", assertWorkflowContract)]),
     }),
     evidence: Object.freeze([
         ".scratch/omc-approval-workflow/acceptance/s29-probe-20260910012330184.md",
@@ -160,7 +163,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "workflow.update": Object.freeze({
             scope: WORKFLOW_SCOPE,
-            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**连线三种写法选一**：`routes`（recipe 写法）/ `edges`（同义）/ `rules`（平台 DTO 字段名，`get_draft` 读回原样）——同传两种会被拒（`workflow-routes-ambiguous`）；merge 是并集（草稿边 + 你的边），**绝不删边**，若结果会比草稿少边则拒绝（`workflow-merge-would-drop-routes`，回 routesBefore/After + 缺失连线），dry-run 也会给出 `routesBefore/routesAfter/routesAdded/routesDropped`。**节点形状**：新增节点必须给 `type`/`activityType`（可选 START/PARTICIPANT/END…），`activityCode` 命中草稿既有节点时可省（类型/名称继承草稿）；**字段权限只发改动行**——`propertyPermissions` 是载荷体积的主要来源（整模板单次常到 1.0–1.4MB，超过 `--args-file` 上限 `CLI_ARGS_MAX_BYTES`=1MB 会被拒），权限编辑只需 `activities:[{activityCode, propertyPermissions:[{propertyCode,…}]}]`。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；**改名=同 code 原地生效**——工具把新名写入 `name_i18n`（zh/zh_TW/en），activityName 平台侧保持首建值，读回以 `renamedInPlace.displayName` 为准；只有**类型变更**才铸新码并弃旧码），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。用 `npm run test:live-permission`（非管理员参与者）验收，管理员会被后端强制 `e:true` 掩盖。",
+            description: "写入工作流模板草稿（`/api/api/workflow/update`，raw template JSON body）。cli 以当前草稿为基线做 merge，未列出的既有节点保留：**模板缺 START 或 END 时自动按增量 merge（部分模板），给全 START..END 才整模板替换**；也可显式 `merge:true/false`。**连线三种写法选一**：`routes`（recipe 写法）/ `edges`（同义）/ `rules`（平台 DTO 字段名，`get_draft` 读回原样）——同传两种会被拒（`workflow-routes-ambiguous`）；merge 是并集（草稿边 + 你的边），**绝不删边**，若结果会比草稿少边则拒绝（`workflow-merge-would-drop-routes`，回 routesBefore/After + 缺失连线），dry-run 也会给出 `routesBefore/routesAfter/routesAdded/routesDropped`。**节点形状**：新增节点必须给 `type`/`activityType`（可选 START/PARTICIPANT/END…），`activityCode` 命中草稿既有节点时可省（类型/名称继承草稿）；**字段权限只发改动行**——`propertyPermissions` 是载荷体积的主要来源（整模板单次常到 1.0–1.4MB，超过 `--args-file` 上限 `CLI_ARGS_MAX_BYTES`=1MB 会被拒）。**节点字段权限也走这里**：不必读 `get_draft --full`——直接发 `activities:[{activityCode, propertyPermissions:[{propertyCode, visible, editable, required, summary, subPropertyPermissions}]}]`（**type 可省**：activityCode 命中草稿节点时类型/名称继承草稿，不会铸 `_2` 新码；**改名=同 code 原地生效**——工具把新名写入 `name_i18n`（zh/zh_TW/en），activityName 平台侧保持首建值，读回以 `renamedInPlace.displayName` 为准；只有**类型变更**才铸新码并弃旧码），工具按 propertyCode 合并到草稿对应节点（未列的字段权限保留；`merge:true` 也可同用）——没有单独的权限工具，别把「找不到入口」当成不支持（dogfood 实测该误判会假阻塞）。`summary` **无需配置**：工具合并时自动补 `summary:true`（平台怪癖——缺省进不了运行时 `activitySummaries`、`form/load` 读不到你的 `editable:false`；显式传 `false` 才保留）；子表字段用 `subPropertyPermissions`（同样自动补）。**参与人写前校验**：`FindUserByRole(…,\"<roleCode>\",…)` 与 org.role.list 比对，未知角色拒 `workflow-participant-role-not-found`（带候选）；全 `{Originator}` 给 `approval-by-originator` warning。**子表属性不可设 `required:true`**（接口形状接受但设计器节点字段配置不支持，存入后无法渲染——工具直接拒 `workflow-child-table-not-required`）；子表整行只配 visible/editable，字段级必填配到子表内部字段所在节点。**新增节点用语义 code**（如 `approval_finance`），不要模仿草稿的 `ActivityN` 再加 `_1/_2` 后缀。**设计器默认自动补齐**（调用方显式传值优先）：填写节点（{Originator}）自动生成子表操作按钮 `buttonPermission.childTableBtns`（每个子表 ADD/DELETE/IMPORT/EXPORT 启用、BATCH_UPDATE 禁用——API 建的流程缺这份模板，设计器里子表按钮会全部不勾）；`permittedAction` 归一为设计器默认（填写节点 showReject:false 不能驳回自己，审批节点 rejectToStart:true 驳回回发起节点）。",
         }),
         "workflow.publish": Object.freeze({
             scope: WORKFLOW_SCOPE,
@@ -241,6 +244,7 @@ export function assertWorkflowContract() {
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.role.list", ["organization/role/list", "type", "Originator"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.department.list", ["organization/department/tree", "parentId"]);
     assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "org.user.search", ["organization/user/search", "wd", "type 3"]);
+    assertDescriptionCarries(WORKFLOW_LANE_CONTRACT, "workflow.update", ["FindUserByRole", "workflow-participant-role-not-found", "approval-by-originator"]);
     for (const [key, field] of Object.entries(WORKFLOW_EVENT_HANDLER_FIELDS)) {
         if (!WORKFLOW_WIRE.bindRuleChain.includes(key))
             throw new Error(`workflow contract bind-rule chain must mention the ${key} handler key`);

package/dist/lanes/workflow.js

@@ -767,6 +767,18 @@ function participantReferenceWarnings(template) {
     }
     return warnings;
 }
+export function approvalByOriginatorWarnings(template) {
+    const activities = Array.isArray(template.activities) ? template.activities : [];
+    const participants = activities.filter((activity) => String(activity.activityType ?? "") === "PARTICIPANT");
+    if (participants.length === 0 || !participants.every((activity) => String(activity.participant ?? "").trim() === "{Originator}"))
+        return [];
+    const activityCodes = participants.map((activity) => String(activity.activityCode ?? "")).filter((code) => code.length > 0);
+    return [{
+            code: "approval-by-originator",
+            activityCodes,
+            message: `所有参与人节点（${activityCodes.join("、")}）都指向 {Originator}：该流程会由发起人自审自批；这是允许的单人流程，但请确认该行为符合业务意图。`,
+        }];
+}
 /**
  * Role participants are filtered by `ouScope ∩ originator's department chain`.
  * A role whose members all have an empty scope therefore resolves to NOBODY —
@@ -782,12 +794,15 @@ async function assertRoleParticipantScopes(session, body) {
             ? Object.values(body.activities)
             : [];
     const roles = [];
+    const functionRoles = [];
     for (const activity of rows) {
         if (String(activity.activityType ?? "") !== "PARTICIPANT")
             continue;
         const raw = activity.participant;
         if (typeof raw !== "string" || !raw.trim().startsWith("["))
             continue;
+        const activityCode = String(activity.activityCode ?? "");
+        const activityName = String(activity.activityName ?? activity.name ?? activityCode);
         for (const segment of raw.split("+")) {
             let parsed;
             try {
@@ -806,7 +821,86 @@ async function assertRoleParticipantScopes(session, body) {
                     continue;
                 const roleId = String(record.id ?? "");
                 if (roleId)
-                    roles.push({ activityCode: String(activity.activityCode ?? ""), roleId, roleName: String(record.name ?? roleId) });
+                    roles.push({ activityCode, activityName, roleId, roleName: String(record.name ?? roleId) });
+            }
+        }
+    }
+    for (const activity of rows) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const participant = typeof activity.participant === "string" ? activity.participant.trim() : "";
+        const match = /^FindUserByRole\s*\(\s*[^,]+?\s*,\s*("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')\s*,\s*("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')\s*\)\s*$/.exec(participant);
+        if (!match)
+            continue;
+        const quoted = match[1];
+        let roleCode;
+        try {
+            roleCode = quoted.startsWith('"') ? JSON.parse(quoted) : quoted.slice(1, -1).replace(/\\(['\\])/g, "$1");
+        }
+        catch {
+            continue;
+        }
+        if (roleCode.trim())
+            functionRoles.push({ activityCode: String(activity.activityCode ?? ""), activityName: String(activity.activityName ?? activity.name ?? activity.activityCode ?? ""), roleCode: roleCode.trim() });
+    }
+    if (functionRoles.length > 0) {
+        let listedRoles = [];
+        let roleListAvailable = false;
+        try {
+            const data = (await wireCall(session, { path: ENDPOINTS.organizationRoleList, query: { expandAll: "true" } })).data;
+            const flattened = flattenRoleTree(wireRows(data));
+            listedRoles = Array.isArray(flattened.roles) ? flattened.roles : [];
+            roleListAvailable = true;
+        }
+        catch {
+            // Role existence is advisory when the organization read face is unavailable.
+            // Do not turn a transient read failure into a blanket workflow write outage.
+            roleListAvailable = false;
+        }
+        if (roleListAvailable) {
+            const byCode = new Map(listedRoles
+                .map((role) => [String(role.code ?? ""), role])
+                .filter(([code]) => code.length > 0));
+            const missing = functionRoles.filter((role) => !byCode.has(role.roleCode));
+            if (missing.length > 0) {
+                const candidates = (needle) => {
+                    const lower = needle.toLowerCase();
+                    const distance = (left, right) => {
+                        const row = Array.from({ length: right.length + 1 }, (_, index) => index);
+                        for (let i = 1; i <= left.length; i++) {
+                            let diagonal = row[0];
+                            row[0] = i;
+                            for (let j = 1; j <= right.length; j++) {
+                                const prior = row[j];
+                                row[j] = left[i - 1] === right[j - 1] ? diagonal : Math.min(row[j] + 1, row[j - 1] + 1, diagonal + 1);
+                                diagonal = prior;
+                            }
+                        }
+                        return row[right.length];
+                    };
+                    return listedRoles
+                        .map((role) => {
+                        const code = String(role.code ?? "");
+                        const name = String(role.name ?? "");
+                        const haystack = `${code} ${name}`.toLowerCase();
+                        const substringRank = haystack.includes(lower) ? 0 : 1;
+                        const editRank = Math.min(distance(lower, code.toLowerCase()), distance(lower, name.toLowerCase()));
+                        return { code, name, substringRank, editRank };
+                    })
+                        .filter((role) => role.code.length > 0)
+                        .sort((left, right) => left.substringRank - right.substringRank || left.editRank - right.editRank || left.code.localeCompare(right.code))
+                        .slice(0, 5)
+                        .map(({ code, name }) => ({ code, name }));
+                };
+                const first = missing[0];
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-participant-role-not-found",
+                    roles: missing,
+                    candidates: candidates(first.roleCode),
+                    nextCommand: "omc call org.role.list --args '{}'",
+                    message: `写前拒绝：节点 ${first.activityCode}（${first.activityName}）引用了不存在的角色 ${first.roleCode}。放行会导致待办静默回退给发起人（r9/r10/r15 真机）。请先用 org.role.list 确认真实 role code。`,
+                });
             }
         }
     }
@@ -2359,12 +2453,14 @@ export function registerWorkflowLane(tools) {
                 return { schemaCode: args.schemaCode, exists: false, note: "该模型没有流程可校验" };
             const template = (args.template ?? {});
             const body = await mergedTemplateBody(session, args.schemaCode ?? "", workflowCode, template, activitiesLackBoundaries(template));
+            await assertRoleParticipantScopes(session, body);
             const result = await wireCall(session, { path: ENDPOINTS.workflowValidate, method: "POST", body });
             const messages = Array.isArray(result.data) ? result.data : [];
             const errors = messages.filter((message) => message.errorLevel === "ERROR");
             const warnings = messages.filter((message) => message.errorLevel !== "ERROR");
             // r31c F23: local reachability / else-coverage — warning only, never flips valid.
             const reachability = workflowReachabilityWarnings(body);
+            const originatorWarnings = approvalByOriginatorWarnings(body);
             const allWarnings = [
                 ...warnings,
                 ...reachability.map((entry) => ({
@@ -2375,6 +2471,7 @@ export function registerWorkflowLane(tools) {
                     name: entry.name,
                     problem: entry.problem,
                 })),
+                ...originatorWarnings.map((entry) => ({ errorLevel: "WARNING", errCode: entry.code, errContent: entry.message, activityCodes: entry.activityCodes })),
             ];
             return {
                 workflowCode,
@@ -2384,6 +2481,7 @@ export function registerWorkflowLane(tools) {
                 errors,
                 warnings: allWarnings,
                 ...(reachability.length > 0 ? { reachabilityWarnings: reachability } : {}),
+                ...(originatorWarnings.length > 0 ? { approvalWarnings: originatorWarnings } : {}),
             };
         }, { target: `workflow.validate:${args.workflowCode ?? args.schemaCode}` }),
     }));
@@ -2486,6 +2584,7 @@ export function registerWorkflowLane(tools) {
             // Evaluate on `body` (post-backfill): the readback may drop the handler
             // keys, and the backfilled permittedAction is exactly what will run.
             const rejectWarnings = rejectToStartCancelWarnings(body);
+            const originatorWarnings = approvalByOriginatorWarnings(body);
             const renamedActivities = renamedActivityPairs(template, data);
             const renamedInPlace = inPlaceRenames(data);
             // Caller sent no routes at all: the draft's edges (branches included) are
@@ -2503,7 +2602,7 @@ export function registerWorkflowLane(tools) {
             const activityNames = Object.fromEntries(rawActivityRows
                 .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
                 .filter(([code]) => code !== ""));
-            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length || originatorWarnings.length ? { workflowWarnings: [...rejectWarnings, ...originatorWarnings] } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
         },
         preflight: (args) => {
             // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
@@ -2592,6 +2691,7 @@ export function registerWorkflowLane(tools) {
             const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
             await backfillDesignerDefaults(session, args.schemaCode, body, template);
             assertFirstActivityIsOriginator(template, "workflow.publish", body);
+            await assertRoleParticipantScopes(session, body);
             const unregistered = unregisteredParticipantFunctions(body);
             if (unregistered.length > 0)
                 throw new ToolRefusalError({
@@ -2629,7 +2729,8 @@ export function registerWorkflowLane(tools) {
             validateWorkflowRender(data, "workflow.publish readback");
             const participantWarnings = participantReferenceWarnings(data);
             const rejectWarnings = rejectToStartCancelWarnings(data);
-            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+            const originatorWarnings = approvalByOriginatorWarnings(data);
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length || originatorWarnings.length ? { workflowWarnings: [...rejectWarnings, ...originatorWarnings] } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
         },
         preflight: (args) => {
             assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");