@stalfh233/omc-cli 0.6.7 → 0.6.10

package/dist/lanes/runtime-data.js

@@ -9,6 +9,7 @@ import { writeTool } from "../write.js";
 import { defineTool } from "../tool-types.js";
 import { wireCall, wireRows, WireError } from "../wire.js";
 import { CHILD_TABLE_PROPERTY_TYPE, diagnoseApprovalSubmitIdentity, runtimeWriteWithAppMapping } from "../runtime-support.js";
+import { closestMatch } from "../closest-match.js";
 import { getReplayToken, searchWorkItems, wireString } from "../workflow-support.js";
 import { ENGINE_OWNED_KEYS, RUNTIME_DATA_LANE_CONTRACT, RUNTIME_DATA_WIRE, runtimeFormDataArg, } from "./runtime-data-contract.js";
 import { SYSTEM_FIELD_CODES } from "../field-families.js";
@@ -771,7 +772,7 @@ export function registerRuntimeDataLane(tools) {
             // `Expected object, received array`). An array is the caller's AND-list,
             // so accept it and treat it as `filters` rather than costing a retry
             // (dogfood R1 round17).
-            filter: z.union([z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).optional().describe('one clause { op, field, value? } (or an array of clauses = AND); op 取值见过滤语义：eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull（camelCase 别名 equally valid: equals/notEquals/contains/isNull/isNotNull）。**like/contains 是子串包含（String.includes），不是前缀匹配，`%` / `_` 是字面量而非通配符**；按前缀分片请用 gte/lt 区间或更长的前缀+本地去重，别假设 like:"0%" 只命中 0 开头（GitLab #18 P1-3 实测 4 个"前缀分片"互相重叠 2258 条）'),
+            filter: z.union([z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).optional().describe('one clause { op, field, value? } (or an array of clauses = AND); op 取值见过滤语义：eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull（camelCase 别名 equally valid: equals/notEquals/contains/isNull/isNotNull）。**like/contains 是子串包含（String.includes），不是前缀匹配，`%` / `_` 是字面量而非通配符**；按前缀分片请用 gte/lt 区间或更长的前缀+本地去重，别假设 like:"0%" 只命中 0 开头（GitLab #18 P1-3 实测 4 个"前缀分片"互相重叠 2258 条）。field 须是**已发布**字段 code——写错时拒绝信封直接带 publishedFields/didYouMean，无需再查 field.list'),
             filters: z.array(z.record(z.string(), z.unknown())).optional().describe("clauses combined with AND; a malformed clause is refused with blocker invalid-filter-DSL"),
             filterGroup: z.record(z.string(), z.unknown()).optional().describe('nested group { op:"and"|"or", clauses:[clause|group] }'),
             rawCondition: z.unknown().optional(),
@@ -834,11 +835,29 @@ export function registerRuntimeDataLane(tools) {
                 // an explicit projection came back all-null, so a normal read that
                 // yields values performs zero metadata requests.
                 let publishedTypes = null;
+                // 运行面 filter 的「未知字段」此前只报字段名，调用方还得再发一跳 field.list
+                // （HANDOFF §三.1-2）。把已发布字段目录随拒绝一起带出：前 20 个 code(+名称)、
+                // 全量总数、拼写 did-you-mean；目录复用上面这次元数据读取，零新增 wire。
+                const FILTER_FIELD_SAMPLE_LIMIT = 20;
+                let publishedCatalog = null;
+                const publishedFields = async () => {
+                    if (publishedCatalog)
+                        return publishedCatalog;
+                    const meta = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } })).data);
+                    publishedCatalog = meta
+                        .map((row) => {
+                        const code = String(row.code ?? row.propertyCode ?? "");
+                        const rawName = row.name ?? row.propertyName;
+                        const name = typeof rawName === "string" && rawName.length > 0 && rawName !== code ? rawName : undefined;
+                        return { code, ...(name !== undefined ? { name } : {}), type: Number(row.propertyType ?? row.type) };
+                    })
+                        .filter((row) => row.code.length > 0);
+                    return publishedCatalog;
+                };
                 const publishedTypeByCode = async () => {
                     if (publishedTypes)
                         return publishedTypes;
-                    const meta = wireRows((await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: args.schemaCode, isPublish: "true" } })).data);
-                    publishedTypes = new Map(meta.map((row) => [String(row.code ?? row.propertyCode), Number(row.propertyType ?? row.type)]));
+                    publishedTypes = new Map((await publishedFields()).map((row) => [row.code, row.type]));
                     return publishedTypes;
                 };
                 if (fromDsl) {
@@ -847,13 +866,36 @@ export function registerRuntimeDataLane(tools) {
                         const type = typeByCode.get(code);
                         return Number.isInteger(type) ? type : undefined;
                     });
-                    if (!injected.ok)
+                    if (!injected.ok) {
+                        const catalog = await publishedFields();
+                        const codes = catalog.map((row) => row.code);
+                        const sample = catalog.slice(0, FILTER_FIELD_SAMPLE_LIMIT);
+                        const didYouMean = Object.fromEntries(injected.missing
+                            .map((code) => [code, closestMatch(code, codes)])
+                            .filter((entry) => entry[1] !== undefined));
+                        const didYouMeanHint = Object.entries(didYouMean).map(([from, to]) => `；${from} 是否想写 ${to}`).join("");
+                        // r26b 读回体积审计（2026-11-05）：目录此前在**同一个信封里被写三遍**
+                        // ——`publishedFields`（结构化，~930 B）+ `message` 里逐条再列一遍
+                        // （~810 B）+ `error.message` 是 result.message 的镜像（又 ~810 B）。
+                        // 一条「字段名拼错」回执因此 3.2 KB，而回答只需要 missing + didYouMean。
+                        // message 改为只给判据与指针，目录只留结构化那一份。
+                        const catalogHint = catalog.length === 0
+                            ? "；该模型当前没有已发布字段（先 field.create + field.publish 再过滤）"
+                            : `；已发布字段共 ${catalog.length} 个，code/名称见 publishedFields${catalog.length > sample.length ? `（仅列前 ${sample.length} 个，其余用 field.list 查）` : ""}`;
                         return {
                             status: "refused",
                             blocker: "unknown-filter-field",
                             missing: injected.missing,
-                            message: `filter fields not found in published field metadata: ${injected.missing.join(", ")}; the runtime query requires each leaf's propertyType from field metadata (no guessing); system/foreign fields may use rawCondition` + choiceKeySuffixHint(injected.missing, typeByCode),
+                            publishedFields: sample.map((row) => ({ code: row.code, ...(row.name !== undefined ? { name: row.name } : {}) })),
+                            publishedFieldsTotal: catalog.length,
+                            ...(Object.keys(didYouMean).length > 0 ? { didYouMean } : {}),
+                            // acceptedValues 是「合法取值全集」：截断时故意不给，避免把第 21 个
+                            // 之后真实存在的字段误判成非法。
+                            ...(catalog.length > 0 && catalog.length <= FILTER_FIELD_SAMPLE_LIMIT ? { acceptedValues: { "filter.field": codes } } : {}),
+                            message: `filter 字段不在已发布元数据里：${injected.missing.join("、")}（运行面过滤要用每个叶子的 propertyType，不做猜测；系统/外部字段改用 rawCondition）` + choiceKeySuffixHint(injected.missing, typeByCode) + didYouMeanHint + catalogHint,
+                            ...(catalog.length > 0 ? { nextCommand: `omc call field.list --env <env> --args '{"schemaCode":"${args.schemaCode}","published":true}'` } : {}),
                         };
+                    }
                     condition = injected.condition;
                     // A2（GitLab #15）：单选/字典字段按显示值过滤会静默 0 条（平台查询按
                     // 字典 key 匹配）。带出这些字段，total:0 时给写法提示，防"查不到数据"
@@ -956,6 +998,14 @@ export function registerRuntimeDataLane(tools) {
                         page: "all",
                         size: collected.length,
                         pagesFetched: pageIndex,
+                        // 与普通读同一个口径（r28b 真机）：草稿策略必须**从结果集实际统计**，
+                        // 不能按"有没有查询条件"静态声明——静态声明会与 items 自相矛盾。
+                        filter: (() => {
+                            const draftRows = items.filter((item) => String(item.fields.sequenceStatus ?? "") === "DRAFT").length;
+                            return draftRows > 0
+                                ? { draftPolicy: "included", draftRows, hint: `本次结果含 ${draftRows} 条 DRAFT 行——total 含草稿，不要当"已提交数据量"；判定状态读 data.load 的 sequenceStatus` }
+                                : { draftPolicy: "unspecified", hint: "本次结果无 DRAFT 行；判定状态以 data.load 的 sequenceStatus 为准" };
+                        })(),
                         // 形状常量：脚本按 result.items 取数（与内联态一致），itemsCount 与
                         // total 的差就是被截断的条数——不再只靠 size 反推。
                         itemsCount: collected.length,
@@ -1033,11 +1083,29 @@ export function registerRuntimeDataLane(tools) {
                     ...(projectionEmpty ? { projectionWarning: { reason: "business-columns-null", hint: "模型可能未配置列表视图：data.list 只投影列表列，业务列会全为 null；核对写入结果请用 data.load（或先建列表视图）" } } : {}),
                     ...(args.queryCode !== undefined ? { queryCode: args.queryCode } : {}),
                     total: args.showTotal === false ? null : page.total,
-                    // This branch is the non-`all` read: the platform's default filter
-                    // hides DRAFTs and the total excludes them too — say so explicitly
-                    // (live 2026-10-18: total:0 was read as "no residue" while 9 drafts
-                    // existed).
-                    filter: { excludedDraft: true, hint: "默认不含 DRAFT（total 亦仅计非草稿）；核对/清理残留请加 all:true" },
+                    // This branch is the non-`all` read. `excludedDraft` used to be
+                    // unconditional, but r26 真机实证（2026-11-05）：**带查询条件时**草稿行
+                    // 被排除（total 也只计非草稿），**不带条件时**同一个 data.save 的 DRAFT
+                    // r28b 真机（2026-11-05）：上一版按「有无查询条件」**静态声明**草稿策略，
+                    // 探针抓到自相矛盾——回执写 `excludedDraft:true`，返回的 items 里却是
+                    // DRAFT 行。静态 hint 永远可能和真实结果打架，`total:0` 被读成「写失败」
+                    // 就是这么来的。
+                    // 现在**从结果集实际统计**得出：items 里出现 DRAFT 就如实说 included。
+                    // 统一一个枚举键 `draftPolicy`（included | excluded | unspecified），
+                    // 不再用两个不同键名表达同一件事（那要调用方写两套分支）。
+                    ...(() => {
+                        const draftRows = items.filter((item) => String(item.fields.sequenceStatus ?? "") === "DRAFT").length;
+                        const policy = draftRows > 0
+                            ? {
+                                draftPolicy: "included",
+                                draftRows,
+                                hint: `本次结果含 ${draftRows} 条 DRAFT 行（total 也计入）——**不要**把 total 当"已提交数据量"，判定状态读 data.load 的 sequenceStatus`,
+                            }
+                            : condition !== undefined
+                                ? { draftPolicy: "excluded", hint: "本次结果无 DRAFT 行；判定状态仍以 data.load 的 sequenceStatus 为准" }
+                                : { draftPolicy: "unspecified", hint: "本次结果无 DRAFT 行，但本面是否过滤草稿不能据此断定；判定状态读 data.load 的 sequenceStatus" };
+                        return { filter: policy };
+                    })(),
                     ...(choiceFilterFields.length > 0 && Number(page.total ?? 0) === 0 ? { filterValueHint: choiceFilterValueHint(choiceFilterFields) } : {}),
                     totalPages: page.totalPages,
                     page: page.page ?? args.page ?? 0,
@@ -1171,266 +1239,282 @@ export function registerRuntimeDataLane(tools) {
             }, { full: args.full === true, target: `data.load:${args.schemaCode}:${args.bizObjectId}` });
         },
     }));
-    writeTool(tools, "data.save", RUNTIME_LANE, RUNTIME_TOOLS["data.save"].scope, RUNTIME_TOOLS["data.save"].description, {
-        schemaCode: z.string().min(1),
-        sheetCode: z.string().optional(),
-        formData: runtimeFormDataArg,
-        workflowCode: z.string().optional().describe("portal draft-save shape: create the row AND a DRAFT workflow instance + start workItem (finishStart=FALSE); submit later via data.submit with the returned workItemId. formData must NOT carry an id — in-place workflow start has no REST surface in 8.6.26"),
-        submit: z.boolean().optional().describe("true=保存后立即直提（无流程模型 DRAFT→COMPLETED，触发 Create 规则）；与 workflowCode 互斥。**按业务约定正式数据优先直接 data.submit（无 id=新建并提交一调完成）——本参数是便捷别名，save 的定位是草稿/暂存**"),
-        allowStaffOnSubmit: z.boolean().optional().describe("submit:true 时显式允许携带人员字段（issue#10：人员字段提交面两种形状都可能 50000，可靠链路是 save 落库后提交时省略；个别平台构建接受提交面携带，自担风险）"),
-        ...readbackProjectionArgs,
-    }, async (session, args) => {
-        // F-A (self-audit): the combo used to be silently ignored (the workflow
-        // draft branch returns without honoring submit). Refuse before any wire.
-        if (args.submit === true && typeof args.workflowCode === "string" && args.workflowCode.trim())
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "submit-workflow-code-conflict",
-                schemaCode: args.schemaCode,
-                message: "submit:true 与 workflowCode 互斥——workflowCode 是流程草稿两段式的第一段（返回 workItemId 后用 data.submit 提交）；无流程模型的一调完成态用 submit:true 且不带 workflowCode",
-            });
-        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const rawSaveData = args.formData;
-        const saveIsUpdate = typeof rawSaveData.id === "string" && rawSaveData.id.trim().length > 0;
-        const formData = (await prepareRuntimeFormData(session, args.schemaCode, rawSaveData, { isUpdate: saveIsUpdate })).formData;
-        // issue#9 C1 + issue#10 勘误：提交面（submit:true / data.submit）的人员字段
-        // 两种已知形状都不安全——对象数组有历史 50000 证据（UserBizField.fillClientContent，
-        // 本闸拦截），字符串 id 数组在 8.6.41 实测同样 50000（#10 D）。可靠链路只有一条：
-        // data.save 人员字段用对象数组 [{id,type,name}] 落库 → 提交时**省略人员字段**（值已持久化）。
-        if (args.submit === true && args.allowStaffOnSubmit !== true) {
-            const staffOnSubmit = await staffFieldsPresent(session, args.schemaCode, formData).catch(() => []);
-            if (staffOnSubmit.length > 0)
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "submit-person-field-shape",
-                    schemaCode: args.schemaCode,
-                    fields: staffOnSubmit,
-                    message: `提交携带了人员字段：${staffOnSubmit.map((entry) => `${entry.code}(${entry.got})`).join("、")}。提交面的两种形状都不安全（对象数组触发 UserBizField.fillClientContent 50000；字符串 id 在 8.6.41 实测同样 50000——issue#10 复现矩阵）。` +
-                        `可靠链路：data.save 时人员字段用对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门）落库，提交（submit:true / data.submit）时**省略人员字段**——值已持久化，提交只推进流程。` +
-                        `确要在提交携带人员字段（个别平台构建接受），显式带 allowStaffOnSubmit:true 自担。`,
-                });
-        }
-        // issue#10 A：save 面的字符串 id 才是错误形状（对象数组才是正解 B）——
-        // 裸字符串/字符串数组在 save 面直落平台换一个无诊断的 50000，fail-closed。
-        if (args.submit !== true) {
-            const staffStringSave = await staffStringShapeViolations(session, args.schemaCode, formData).catch(() => []);
-            if (staffStringSave.length > 0)
+    writeTool({
+        tools,
+        name: "data.save",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.save"].scope,
+        description: RUNTIME_TOOLS["data.save"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            sheetCode: z.string().optional(),
+            formData: runtimeFormDataArg,
+            workflowCode: z.string().optional().describe("portal draft-save shape: create the row AND a DRAFT workflow instance + start workItem (finishStart=FALSE); submit later via data.submit with the returned workItemId. formData must NOT carry an id — in-place workflow start has no REST surface in 8.6.26"),
+            submit: z.boolean().optional().describe("true=保存后立即直提（无流程模型 DRAFT→COMPLETED，触发 Create 规则）；与 workflowCode 互斥。**按业务约定正式数据优先直接 data.submit（无 id=新建并提交一调完成）——本参数是便捷别名，save 的定位是草稿/暂存**"),
+            allowStaffOnSubmit: z.boolean().optional().describe("submit:true 时显式允许携带人员字段（issue#10：人员字段提交面两种形状都可能 50000，可靠链路是 save 落库后提交时省略；个别平台构建接受提交面携带，自担风险）"),
+            ...readbackProjectionArgs,
+        },
+        execute: async (session, args) => {
+            // F-A (self-audit): the combo used to be silently ignored (the workflow
+            // draft branch returns without honoring submit). Refuse before any wire.
+            if (args.submit === true && typeof args.workflowCode === "string" && args.workflowCode.trim())
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "save-person-field-shape",
+                    blocker: "submit-workflow-code-conflict",
                     schemaCode: args.schemaCode,
-                    fields: staffStringSave,
-                    message: `data.save 的人员字段用了字符串 id：${staffStringSave.map((entry) => `${entry.code}(${entry.got})`).join("、")}——save 面的正确形状是对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门；issue#10 实测矩阵：字符串 id 50000、对象数组成功）。读回值 [{id,type,name,…}] 可直接回写。`,
+                    message: "submit:true 与 workflowCode 互斥——workflowCode 是流程草稿两段式的第一段（返回 workItemId 后用 data.submit 提交）；无流程模型的一调完成态用 submit:true 且不带 workflowCode",
                 });
-        }
-        if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
-            // Portal draft-save shape. The row id travels in data.id (the portal
-            // form SDK receives a pre-generated id from form/load and echoes it);
-            // BizObjectModel.getId() reads data["id"], so a client-chosen id is
-            // echoed back as FormSaveVO.objectId. An id that already exists in
-            // the store would hit the create-path INSERT duplicate (40000), so an
-            // existing id is refused up front.
-            const suppliedId = typeof formData.id === "string" ? formData.id.trim() : "";
-            if (suppliedId) {
-                const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, suppliedId);
-                if (existing) {
+            const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+            const rawSaveData = args.formData;
+            const saveIsUpdate = typeof rawSaveData.id === "string" && rawSaveData.id.trim().length > 0;
+            const formData = (await prepareRuntimeFormData(session, args.schemaCode, rawSaveData, { isUpdate: saveIsUpdate })).formData;
+            // issue#9 C1 + issue#10 勘误：提交面（submit:true / data.submit）的人员字段
+            // 两种已知形状都不安全——对象数组有历史 50000 证据（UserBizField.fillClientContent，
+            // 本闸拦截），字符串 id 数组在 8.6.41 实测同样 50000（#10 D）。可靠链路只有一条：
+            // data.save 人员字段用对象数组 [{id,type,name}] 落库 → 提交时**省略人员字段**（值已持久化）。
+            if (args.submit === true && args.allowStaffOnSubmit !== true) {
+                const staffOnSubmit = await staffFieldsPresent(session, args.schemaCode, formData).catch(() => []);
+                if (staffOnSubmit.length > 0)
                     throw new ToolRefusalError({
                         status: "refused",
-                        blocker: "save-workflow-draft-with-id-unsupported",
+                        blocker: "submit-person-field-shape",
                         schemaCode: args.schemaCode,
-                        bizObjectId: suppliedId,
+                        fields: staffOnSubmit,
+                        message: `提交携带了人员字段：${staffOnSubmit.map((entry) => `${entry.code}(${entry.got})`).join("、")}。提交面的两种形状都不安全（对象数组触发 UserBizField.fillClientContent 50000；字符串 id 在 8.6.41 实测同样 50000——issue#10 复现矩阵）。` +
+                            `可靠链路：data.save 时人员字段用对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门）落库，提交（submit:true / data.submit）时**省略人员字段**——值已持久化，提交只推进流程。` +
+                            `确要在提交携带人员字段（个别平台构建接受），显式带 allowStaffOnSubmit:true 自担。`,
+                    });
+            }
+            // issue#10 A：save 面的字符串 id 才是错误形状（对象数组才是正解 B）——
+            // 裸字符串/字符串数组在 save 面直落平台换一个无诊断的 50000，fail-closed。
+            if (args.submit !== true) {
+                const staffStringSave = await staffStringShapeViolations(session, args.schemaCode, formData).catch(() => []);
+                if (staffStringSave.length > 0)
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "save-person-field-shape",
+                        schemaCode: args.schemaCode,
+                        fields: staffStringSave,
+                        message: `data.save 的人员字段用了字符串 id：${staffStringSave.map((entry) => `${entry.code}(${entry.got})`).join("、")}——save 面的正确形状是对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门；issue#10 实测矩阵：字符串 id 50000、对象数组成功）。读回值 [{id,type,name,…}] 可直接回写。`,
+                    });
+            }
+            if (typeof args.workflowCode === "string" && args.workflowCode.trim()) {
+                // Portal draft-save shape. The row id travels in data.id (the portal
+                // form SDK receives a pre-generated id from form/load and echoes it);
+                // BizObjectModel.getId() reads data["id"], so a client-chosen id is
+                // echoed back as FormSaveVO.objectId. An id that already exists in
+                // the store would hit the create-path INSERT duplicate (40000), so an
+                // existing id is refused up front.
+                const suppliedId = typeof formData.id === "string" ? formData.id.trim() : "";
+                if (suppliedId) {
+                    const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, suppliedId);
+                    if (existing) {
+                        throw new ToolRefusalError({
+                            status: "refused",
+                            blocker: "save-workflow-draft-with-id-unsupported",
+                            schemaCode: args.schemaCode,
+                            bizObjectId: suppliedId,
+                            workflowCode: args.workflowCode,
+                            message: "workflow draft-save always INSERTs in 8.6.26 (no REST in-place start for an existing row); use a fresh id or no id, or submit an existing workflow draft via data.submit with its workItemId",
+                        });
+                    }
+                }
+                const objectId = suppliedId || randomUUID().replaceAll("-", "");
+                // isStartWf branch runs verifyReplay; the instance is DRAFT only when
+                // data carries sequenceStatus DRAFT (an empty default builds PROCESSING).
+                const replayToken = await getReplayToken(session);
+                let performed;
+                try {
+                    performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
+                        path: ENDPOINTS.runtimeFormSave,
+                        method: "POST",
+                        body: {
+                            workflowCode: args.workflowCode,
+                            ...(replayToken ? { replayToken } : {}),
+                            bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
+                        },
+                    }), formData, args.workflowCode);
+                }
+                catch (error) {
+                    await diagnoseDbException(session, args.schemaCode, error);
+                    throw error;
+                }
+                const vo = (performed.data ?? {});
+                const returnedId = typeof vo.objectId === "string" && vo.objectId ? vo.objectId : typeof vo.bizObjectId === "string" && vo.bizObjectId ? vo.bizObjectId : objectId;
+                const workflowInstanceId = typeof vo.workflowInstanceId === "string" ? vo.workflowInstanceId : null;
+                // saveWorkflow resolves the start workItem via getWorkItem INSIDE the
+                // still-uncommitted request transaction (autoCommit:false), so the live
+                // FormSaveVO usually omits workItem. The committed row is visible to a
+                // follow-up search_workitems read; resolve the pending start todo by
+                // exact instanceId (the server filter is a NOT-equal exclusion).
+                let workItem = vo.workItem;
+                let workItemId = workItem && typeof workItem.id === "string" ? workItem.id : null;
+                let workItemSource = workItemId ? "form-save" : null;
+                if (!workItemId && workflowInstanceId) {
+                    // search_workitems via the shared workflow seam (ticket 21): exact
+                    // instanceId match is client-side (the server filter is a NOT-equal
+                    // exclusion); the seam's default size 200 is the unified scan width.
+                    const found = await searchWorkItems(session, {
                         workflowCode: args.workflowCode,
-                        message: "workflow draft-save always INSERTs in 8.6.26 (no REST in-place start for an existing row); use a fresh id or no id, or submit an existing workflow draft via data.submit with its workItemId",
+                        instanceId: workflowInstanceId,
                     });
+                    const matchId = found.items.length > 0 ? wireString(found.items[0].id) : null;
+                    if (matchId) {
+                        workItemId = matchId;
+                        workItemSource = "workitem-search";
+                    }
                 }
+                let readbackData = null;
+                let sequenceStatus = null;
+                readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: returnedId } })).data;
+                sequenceStatus = extractSequenceStatus((readbackData ?? {}));
+                return {
+                    performed: { errcode: performed.errcode, bizObjectId: returnedId, workflowInstanceId, workItemId, workItemSource, sheetCode, resolvedFrom, formType: "save-draft-workflow" },
+                    readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
+                };
             }
-            const objectId = suppliedId || randomUUID().replaceAll("-", "");
-            // isStartWf branch runs verifyReplay; the instance is DRAFT only when
-            // data carries sequenceStatus DRAFT (an empty default builds PROCESSING).
-            const replayToken = await getReplayToken(session);
             let performed;
             try {
                 performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
                     path: ENDPOINTS.runtimeFormSave,
                     method: "POST",
-                    body: {
-                        workflowCode: args.workflowCode,
-                        ...(replayToken ? { replayToken } : {}),
-                        bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: objectId, sequenceStatus: "DRAFT" } },
-                    },
-                }), formData, args.workflowCode);
+                    body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
+                }), formData);
             }
             catch (error) {
                 await diagnoseDbException(session, args.schemaCode, error);
                 throw error;
             }
-            const vo = (performed.data ?? {});
-            const returnedId = typeof vo.objectId === "string" && vo.objectId ? vo.objectId : typeof vo.bizObjectId === "string" && vo.bizObjectId ? vo.bizObjectId : objectId;
-            const workflowInstanceId = typeof vo.workflowInstanceId === "string" ? vo.workflowInstanceId : null;
-            // saveWorkflow resolves the start workItem via getWorkItem INSIDE the
-            // still-uncommitted request transaction (autoCommit:false), so the live
-            // FormSaveVO usually omits workItem. The committed row is visible to a
-            // follow-up search_workitems read; resolve the pending start todo by
-            // exact instanceId (the server filter is a NOT-equal exclusion).
-            let workItem = vo.workItem;
-            let workItemId = workItem && typeof workItem.id === "string" ? workItem.id : null;
-            let workItemSource = workItemId ? "form-save" : null;
-            if (!workItemId && workflowInstanceId) {
-                // search_workitems via the shared workflow seam (ticket 21): exact
-                // instanceId match is client-side (the server filter is a NOT-equal
-                // exclusion); the seam's default size 200 is the unified scan width.
-                const found = await searchWorkItems(session, {
-                    workflowCode: args.workflowCode,
-                    instanceId: workflowInstanceId,
-                });
-                const matchId = found.items.length > 0 ? wireString(found.items[0].id) : null;
-                if (matchId) {
-                    workItemId = matchId;
-                    workItemSource = "workitem-search";
-                }
-            }
+            const bizObjectId = performed.data?.bizObjectId ?? performed.data?.objectId ?? performed.data;
             let readbackData = null;
-            let sequenceStatus = null;
-            readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: returnedId } })).data;
-            sequenceStatus = extractSequenceStatus((readbackData ?? {}));
-            return {
-                performed: { errcode: performed.errcode, bizObjectId: returnedId, workflowInstanceId, workItemId, workItemSource, sheetCode, resolvedFrom, formType: "save-draft-workflow" },
-                readback: { authoritative: projectReadbackRecord(normalizeLoadedRecord((readbackData ?? {})), args), sequenceStatus, expectedSequenceStatus: "DRAFT" },
+            if (typeof bizObjectId === "string" && bizObjectId) {
+                readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } })).data;
+            }
+            // Ticket 111: a plain save lands as sequenceStatus DRAFT, and DRAFT
+            // rows SKIP the Create/Update rule dispatch entirely
+            // (DomainServiceImpl.java:240-248 buckets drafts before the rule
+            // branch) — business rules only run once data.submit advances the
+            // row. Saying so on every plain-save readback prevents the
+            // "rule didn't fire" misdiagnosis.
+            const savedRecord = normalizeLoadedRecord((readbackData ?? {}));
+            const savedEmptyFields = readbackEmptyFields(formData, savedRecord);
+            const plainReadback = {
+                authoritative: projectReadbackRecord(savedRecord, args),
+                ...(savedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(savedEmptyFields, "data.save") } : {}),
+                draftRuleHint: "草稿态（DRAFT）保存不触发业务规则——DRAFT 行跳过 Create/Update 分发（DomainServiceImpl.java:240-248）；要一调完成态本调用加 submit:true；已存草稿直提形状：data.submit {schemaCode, bizObjectId: 本读回的 bizObjectId, formData}（submit 自持久化）",
             };
-        }
-        let performed;
-        try {
-            performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.save 运行时写稳定失败（50000）", () => wireCall(session, {
-                path: ENDPOINTS.runtimeFormSave,
-                method: "POST",
-                body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: formData } },
-            }), formData);
-        }
-        catch (error) {
-            await diagnoseDbException(session, args.schemaCode, error);
-            throw error;
-        }
-        const bizObjectId = performed.data?.bizObjectId ?? performed.data?.objectId ?? performed.data;
-        let readbackData = null;
-        if (typeof bizObjectId === "string" && bizObjectId) {
-            readbackData = (await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } })).data;
-        }
-        // Ticket 111: a plain save lands as sequenceStatus DRAFT, and DRAFT
-        // rows SKIP the Create/Update rule dispatch entirely
-        // (DomainServiceImpl.java:240-248 buckets drafts before the rule
-        // branch) — business rules only run once data.submit advances the
-        // row. Saying so on every plain-save readback prevents the
-        // "rule didn't fire" misdiagnosis.
-        const savedRecord = normalizeLoadedRecord((readbackData ?? {}));
-        const savedEmptyFields = readbackEmptyFields(formData, savedRecord);
-        const plainReadback = {
-            authoritative: projectReadbackRecord(savedRecord, args),
-            ...(savedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(savedEmptyFields, "data.save") } : {}),
-            draftRuleHint: "草稿态（DRAFT）保存不触发业务规则——DRAFT 行跳过 Create/Update 分发（DomainServiceImpl.java:240-248）；要一调完成态本调用加 submit:true；已存草稿直提形状：data.submit {schemaCode, bizObjectId: 本读回的 bizObjectId, formData}（submit 自持久化）",
-        };
-        // r18 retro (G3): one-call COMPLETED creation — the agent goal is usually
-        // "record AND rule effect", not "a draft". Chain the no-flow submit in
-        // the same governed write (the same sibling execute apply_changes uses).
-        if (args.submit === true) {
-            // F-B (self-audit): data.submit AUTO-STARTS a published workflow
-            // (resolvePublishedWorkflowCode → formType 1 → PROCESSING, not
-            // COMPLETED) — the one-call chain's ruleHint would lie. Workflow-
-            // backed models keep the two-phase chain.
-            const publishedWorkflow = await resolvePublishedWorkflowCode(session, args.schemaCode);
-            if (publishedWorkflow) {
+            // r18 retro (G3): one-call COMPLETED creation — the agent goal is usually
+            // "record AND rule effect", not "a draft". Chain the no-flow submit in
+            // the same governed write (the same sibling execute apply_changes uses).
+            if (args.submit === true) {
+                // F-B (self-audit): data.submit AUTO-STARTS a published workflow
+                // (resolvePublishedWorkflowCode → formType 1 → PROCESSING, not
+                // COMPLETED) — the one-call chain's ruleHint would lie. Workflow-
+                // backed models keep the two-phase chain.
+                const publishedWorkflow = await resolvePublishedWorkflowCode(session, args.schemaCode);
+                if (publishedWorkflow) {
+                    return {
+                        performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: false },
+                        readback: {
+                            ...plainReadback,
+                            submitRefused: {
+                                blocker: "submit-model-has-workflow",
+                                workflowCode: publishedWorkflow,
+                                message: `本模型有已发布流程 ${publishedWorkflow}：submit:true 的直提只适用无流程模型（流程模型会自动起流程得到 PROCESSING 而非完成态，Create 规则语义也不同）。草稿已保存；正确链路 = data.save {workflowCode} 建流程草稿（返回 workItemId）→ data.submit {bizObjectId, workflowInstanceId, workItemId}（见 describe data.submit --example workflow-backed-data-submit）`,
+                            },
+                        },
+                    };
+                }
+                const submitTool = tools.find((entry) => entry.name === "data.submit");
+                const submitOutcome = submitTool?.writeExecute
+                    ? await submitTool.writeExecute(session, { schemaCode: args.schemaCode, bizObjectId, formData: args.formData })
+                    : { status: "error", message: "data.submit 工具不可用" };
+                if ("status" in submitOutcome && typeof submitOutcome.status === "string" && submitOutcome.status !== "ok") {
+                    // The save itself DELIVERED — report it honestly with the submit
+                    // refusal attached, never as a plain refusal.
+                    const envelope = "envelope" in submitOutcome ? submitOutcome.envelope : submitOutcome;
+                    return {
+                        performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: false },
+                        readback: { ...plainReadback, submitRefused: envelope },
+                    };
+                }
+                const okOutcome = submitOutcome;
                 return {
-                    performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: false },
+                    performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: true },
                     readback: {
-                        ...plainReadback,
-                        submitRefused: {
-                            blocker: "submit-model-has-workflow",
-                            workflowCode: publishedWorkflow,
-                            message: `本模型有已发布流程 ${publishedWorkflow}：submit:true 的直提只适用无流程模型（流程模型会自动起流程得到 PROCESSING 而非完成态，Create 规则语义也不同）。草稿已保存；正确链路 = data.save {workflowCode} 建流程草稿（返回 workItemId）→ data.submit {bizObjectId, workflowInstanceId, workItemId}（见 describe data.submit --example workflow-backed-data-submit）`,
-                        },
+                        ...okOutcome.readback,
+                        submitted: true,
+                        ruleHint: "已直提 COMPLETED——Create 业务规则本次已分发；规则效果以本读回字段值为准",
                     },
                 };
             }
-            const submitTool = tools.find((entry) => entry.name === "data.submit");
-            const submitOutcome = submitTool?.writeExecute
-                ? await submitTool.writeExecute(session, { schemaCode: args.schemaCode, bizObjectId, formData: args.formData })
-                : { status: "error", message: "data.submit 工具不可用" };
-            if ("status" in submitOutcome && typeof submitOutcome.status === "string" && submitOutcome.status !== "ok") {
-                // The save itself DELIVERED — report it honestly with the submit
-                // refusal attached, never as a plain refusal.
-                const envelope = "envelope" in submitOutcome ? submitOutcome.envelope : submitOutcome;
-                return {
-                    performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: false },
-                    readback: { ...plainReadback, submitRefused: envelope },
-                };
-            }
-            const okOutcome = submitOutcome;
             return {
-                performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom, submitted: true },
-                readback: {
-                    ...okOutcome.readback,
-                    submitted: true,
-                    ruleHint: "已直提 COMPLETED——Create 业务规则本次已分发；规则效果以本读回字段值为准",
-                },
+                performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom },
+                readback: plainReadback,
             };
-        }
-        return {
-            performed: { errcode: performed.errcode, bizObjectId, sheetCode, resolvedFrom },
-            readback: plainReadback,
-        };
+        },
     });
-    writeTool(tools, "data.update", RUNTIME_LANE, RUNTIME_TOOLS["data.update"].scope, RUNTIME_TOOLS["data.update"].description, {
-        schemaCode: z.string().min(1),
-        sheetCode: z.string().optional(),
-        bizObjectId: z.string().min(1).describe("id of the EXISTING record to edit; the tool refuses when it is absent (never silently inserts)"),
-        formData: runtimeFormDataArg.describe("fields to change, keyed by field code; the platform merges them onto the stored record, so omitted fields keep their value (patch semantics)"),
-        ...readbackProjectionArgs,
-    }, async (session, args) => {
-        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, args.bizObjectId);
-        if (!existing) {
-            // The platform's save-with-id path silently inserts when the id is
-            // unknown (BizObjectFacadeImpl.createBizObject). Refuse instead of
-            // turning an edit into an accidental create.
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "update-target-absent",
-                errcode: RUNTIME_DATA_WIRE.absenceErrcode,
-                schemaCode: args.schemaCode,
-                bizObjectId: args.bizObjectId,
-                sheetCode,
-                nextCommand: `omc call data.list --args '${JSON.stringify({ schemaCode: args.schemaCode })}'`,
-                message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
-            });
-        }
-        const formData = (await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true })).formData;
-        let performed;
-        try {
-            performed = await wireCall(session, {
-                path: ENDPOINTS.runtimeFormSave,
-                method: "POST",
-                // Live-proven shape: BizObjectModel.getId() reads data["id"], so the
-                // target id MUST travel inside `data`; a top-level bizObject.id is
-                // ignored and the platform silently creates a new row.
-                body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: args.bizObjectId } } },
-            });
-        }
-        catch (error) {
-            await diagnoseDbException(session, args.schemaCode, error);
-            throw error;
-        }
-        const performedData = (performed.data ?? {});
-        const returnedId = typeof performedData.objectId === "string" ? performedData.objectId : typeof performedData.bizObjectId === "string" ? performedData.bizObjectId : args.bizObjectId;
-        const readbackData = await loadExistingBizObject(session, args.schemaCode, sheetCode, returnedId);
-        const sequenceStatus = extractSequenceStatus(readbackData);
-        const updatedRecord = normalizeLoadedRecord(readbackData);
-        const updatedEmptyFields = readbackEmptyFields(formData, updatedRecord);
-        return {
-            performed: { errcode: performed.errcode, bizObjectId: returnedId, sheetCode, resolvedFrom },
-            // Flat record contract (ticket 17): live FormLoadVO normalizes to the
-            // fake's flat field shape so `authoritative.<fieldCode>` reads work on
-            // both faces.
-            readback: { authoritative: projectReadbackRecord(updatedRecord, args), sequenceStatus, ...(updatedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(updatedEmptyFields, "data.update") } : {}) },
-        };
+    writeTool({
+        tools,
+        name: "data.update",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.update"].scope,
+        description: RUNTIME_TOOLS["data.update"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            sheetCode: z.string().optional(),
+            bizObjectId: z.string().min(1).describe("id of the EXISTING record to edit; the tool refuses when it is absent (never silently inserts)"),
+            formData: runtimeFormDataArg.describe("fields to change, keyed by field code; the platform merges them onto the stored record, so omitted fields keep their value (patch semantics)"),
+            ...readbackProjectionArgs,
+        },
+        execute: async (session, args) => {
+            const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+            const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, args.bizObjectId);
+            if (!existing) {
+                // The platform's save-with-id path silently inserts when the id is
+                // unknown (BizObjectFacadeImpl.createBizObject). Refuse instead of
+                // turning an edit into an accidental create.
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "update-target-absent",
+                    errcode: RUNTIME_DATA_WIRE.absenceErrcode,
+                    schemaCode: args.schemaCode,
+                    bizObjectId: args.bizObjectId,
+                    sheetCode,
+                    nextCommand: `omc call data.list --args '${JSON.stringify({ schemaCode: args.schemaCode })}'`,
+                    message: "no live business object with this id; refusing to update (the platform would otherwise insert a new row)",
+                });
+            }
+            const formData = (await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: true })).formData;
+            let performed;
+            try {
+                performed = await wireCall(session, {
+                    path: ENDPOINTS.runtimeFormSave,
+                    method: "POST",
+                    // Live-proven shape: BizObjectModel.getId() reads data["id"], so the
+                    // target id MUST travel inside `data`; a top-level bizObject.id is
+                    // ignored and the platform silently creates a new row.
+                    body: { bizObject: { schemaCode: args.schemaCode, sheetCode, data: { ...formData, id: args.bizObjectId } } },
+                });
+            }
+            catch (error) {
+                await diagnoseDbException(session, args.schemaCode, error);
+                throw error;
+            }
+            const performedData = (performed.data ?? {});
+            const returnedId = typeof performedData.objectId === "string" ? performedData.objectId : typeof performedData.bizObjectId === "string" ? performedData.bizObjectId : args.bizObjectId;
+            const readbackData = await loadExistingBizObject(session, args.schemaCode, sheetCode, returnedId);
+            const sequenceStatus = extractSequenceStatus(readbackData);
+            const updatedRecord = normalizeLoadedRecord(readbackData);
+            const updatedEmptyFields = readbackEmptyFields(formData, updatedRecord);
+            return {
+                performed: { errcode: performed.errcode, bizObjectId: returnedId, sheetCode, resolvedFrom },
+                // Flat record contract (ticket 17): live FormLoadVO normalizes to the
+                // fake's flat field shape so `authoritative.<fieldCode>` reads work on
+                // both faces.
+                readback: { authoritative: projectReadbackRecord(updatedRecord, args), sequenceStatus, ...(updatedEmptyFields.length > 0 ? { readbackWarning: readbackWarningFor(updatedEmptyFields, "data.update") } : {}) },
+            };
+        },
     });
     /**
      * Round 16b (dogfood R1-R3): `data.delete`'s `absent:true` only proves THAT id is
@@ -1455,549 +1539,589 @@ export function registerRuntimeDataLane(tools) {
             return { modelResidue: { total: null, clean: null, sheetCode, modelResidueError: error instanceof Error ? error.message : String(error) } };
         }
     }
-    writeTool(tools, "data.delete", RUNTIME_LANE, RUNTIME_TOOLS["data.delete"].scope, RUNTIME_TOOLS["data.delete"].description, { schemaCode: z.string().min(1), sheetCode: z.string().optional(), bizObjectId: z.string().min(1).optional(), bizObjectIds: z.array(z.string().min(1)).optional().describe("批量删除多个业务对象 id（等价于逐个 data.delete，但只花一次往返；返回 deleted 列表）") }, async (session, args) => {
-        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const ids = args.bizObjectIds && args.bizObjectIds.length > 0 ? args.bizObjectIds : args.bizObjectId ? [args.bizObjectId] : [];
-        if (ids.length === 0)
-            throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "data.delete", message: "需要 bizObjectId（单个）或 bizObjectIds（数组，批量）" });
-        // r30 (2026-10-31, 1.1.25 real machine): the batch form fake-succeeds —
-        // DELIVERED + absent:true + a DECREASING modelResidue.total while the
-        // rows are still queryable (data.list unchanged, data.load exists:true).
-        // Re-issuing the same ids one at a time deleted them for real. Refuse
-        // the batch shape and teach the per-id loop until the platform path is
-        // understood; single-id deletes go through the exact same deleteOne.
-        if (ids.length > 1)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "data-delete-batch-fake-success",
-                message: "批量删除（bizObjectIds 多个）在 1.1.25 真机实证为假成功：回执 DELIVERED + absent:true + modelResidue.total 递减，但行仍在（data.list 不变、data.load exists:true）；同样的 id 改单条逐个删才真删掉。请用 bizObjectId（单个）逐个删，每条删完用 data.load 确认 exists:false（absent:true 不是删除成功的证明）。",
-            });
-        const deleteOne = async (bizObjectId) => {
-            // Delete is destructive: probe the authoritative object first so an
-            // absent id is an idempotent no-op, never a blind runtime delete.
-            const before = await loadExistingBizObject(session, args.schemaCode, sheetCode, bizObjectId);
-            if (!before)
-                return { bizObjectId, skipped: "already-absent", absent: true };
-            const performed = await wireCall(session, {
-                path: ENDPOINTS.runtimeFormDelete,
-                method: "POST",
-                query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId },
-            });
-            // The absence readback: a missing object surfaces either as an empty
-            // payload or as a business error (304001 业务对象不存在) from form/load.
-            // Both are authoritative absence, not a delete failure.
-            let absent = false;
-            try {
-                const readback = await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } });
-                const value = readback.data;
-                absent = value == null || value === false;
-            }
-            catch (error) {
-                if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.absenceErrcode)
-                    absent = true;
-                else
-                    throw error;
-            }
-            return { bizObjectId, errcode: performed.errcode, absent };
-        };
-        if (ids.length === 1) {
-            const one = await deleteOne(ids[0]);
-            if (one.skipped === "already-absent")
-                return { performed: { skipped: "already-absent", sheetCode, resolvedFrom }, readback: { absent: true, recoveryHint: "id 不存在（already-absent≠删除成功）：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏，shell 空值兜底出来的 id 同样删不掉任何东西。若 modelResidue.total>0，用 items[].id 重删。", ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
-            return { performed: { errcode: one.errcode, sheetCode, resolvedFrom }, readback: { absent: one.absent, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
-        }
-        const deleted = [];
-        for (const id of ids)
-            deleted.push(await deleteOne(id));
-        // `deleted`/`count` ride `readback` — the write envelope surfaces only
-        // performed/readback inline (extra top-level keys are artifact-only).
-        return { performed: { sheetCode, resolvedFrom }, readback: { absent: true, count: deleted.length, deleted, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
-    });
-    writeTool(tools, "data.submit", RUNTIME_LANE, RUNTIME_TOOLS["data.submit"].scope, RUNTIME_TOOLS["data.submit"].description, {
-        schemaCode: z.string().min(1),
-        sheetCode: z.string().optional(),
-        formData: runtimeFormDataArg,
-        workflowCode: z.string().optional(),
-        workflowInstanceId: z.string().optional(),
-        workItemId: z.string().optional(),
-        bizObjectId: z.string().optional().describe("existing record id; REQUIRED for workItem approval submits (formType=1 + workItemId) — the submit's bizObject must reference the in-flight record or the engine NPEs (DataChangeHandlerImpl.changeBizObject)"),
-        agree: z.boolean().optional(),
-        allowChildRowAppend: z.boolean().optional().describe("默认 false：审批提交（带 workItemId/workflowInstanceId）时 formData 含子表数组会被拒——平台按追加插行，每次提交重复一份。确实要追加子行时才置 true。"),
-        allowStaffOnSubmit: z.boolean().optional().describe("默认 false：提交携带人员字段会被拒（issue#10：两种形状都可能 50000；可靠链路=save 落库后提交省略人员字段）。个别平台构建接受提交面携带时置 true 自担。"),
-        approval: z.record(z.string(), z.unknown()).optional(),
-        runMode: z.string().optional(),
-        isSimulative: z.boolean().optional(),
-        ...readbackProjectionArgs,
-    }, async (session, args) => {
-        // r13 #5: an EMPTY STRING was forwarded verbatim, so the platform answered
-        // 100002「参数为空」with no hint which parameter. Absent and blank are not
-        // the same intent: refuse the blank one by name, zero wire.
-        const blank = ["workItemId", "workflowInstanceId", "workflowCode"].filter((key) => typeof args[key] === "string" && args[key].trim().length === 0 && args[key].length > 0);
-        if (blank.length > 0)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "submit-blank-parameter",
-                schemaCode: args.schemaCode,
-                parameters: blank,
-                message: `这些参数传了空白字符串：${blank.join("、")}。平台会把这个空白当"参数为空"回 100002（SYS_PARAMETER_EMPTY），` +
-                    `而错误里不会说是哪一个。要么给出真实 id，要么整个省略该键（省略 ≠ 传空串）。`,
-            });
-        const hasWorkItem = typeof args.workItemId === "string" && args.workItemId.trim().length > 0;
-        // r18b: pure shape check — run before any read/wire so a wrong-result
-        // payload never costs a round trip.
-        if (args.approval && typeof args.approval === "object") {
-            const misplaced = args.approval;
-            if (misplaced.agree !== undefined)
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "submit-approval-agree-misplaced",
-                    schemaCode: args.schemaCode,
-                    message: `approval.agree 不生效：平台只读**顶层** agree（true=通过 / false=驳回）。approval 对象里放 agree 会被**静默忽略并按通过处理**` +
-                        `（r18b 真机：approval:{agree:false} 仍写入 result=APPROVE 并把流程走完）。改成顶层参数 {"agree":false,...}。`,
+    writeTool({
+        tools,
+        name: "data.delete",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.delete"].scope,
+        description: RUNTIME_TOOLS["data.delete"].description,
+        inputSchema: { schemaCode: z.string().min(1), sheetCode: z.string().optional(), bizObjectId: z.string().min(1).optional(), bizObjectIds: z.array(z.string().min(1)).optional().describe("批量删除多个业务对象 id（等价于逐个 data.delete，但只花一次往返；返回 deleted 列表）") },
+        execute: async (session, args) => {
+            const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+            const ids = args.bizObjectIds && args.bizObjectIds.length > 0 ? args.bizObjectIds : args.bizObjectId ? [args.bizObjectId] : [];
+            if (ids.length === 0)
+                throw new ToolInputError({
+                    status: "error",
+                    blocker: "tool-input-invalid",
+                    tool: "data.delete",
+                    // r28b F10: describe is not the next action — the caller already
+                    // described. Point at list→id then a pasteable single-id delete.
+                    nextCommand: `omc call data.list --args '${JSON.stringify({ schemaCode: args.schemaCode, all: true })}'`,
+                    message: "需要 bizObjectId（单个）或 bizObjectIds（数组，批量）。先 data.list 取 items[].id，再：{\"schemaCode\":\"" +
+                        args.schemaCode +
+                        "\",\"bizObjectId\":\"<items[].id>\"}（1.1.25 上多个 id 的 bizObjectIds 会被拒——请逐个单删）。",
                 });
-            if (misplaced.opinion !== undefined)
+            // r30 (2026-10-31, 1.1.25 real machine): the batch form fake-succeeds —
+            // DELIVERED + absent:true + a DECREASING modelResidue.total while the
+            // rows are still queryable (data.list unchanged, data.load exists:true).
+            // Re-issuing the same ids one at a time deleted them for real. Refuse
+            // the batch shape and teach the per-id loop until the platform path is
+            // understood; single-id deletes go through the exact same deleteOne.
+            if (ids.length > 1)
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "submit-approval-opinion-misplaced",
-                    schemaCode: args.schemaCode,
-                    message: `approval.opinion 不是平台键，会被静默丢弃（r18b 真机：意见不进 h_biz_comment，content 为 NULL）。` +
-                        `审批意见（BizCommentModel）用 **approval.content**；附件 approval.resources；下一步审批人 approval.relUsers。`,
+                    blocker: "data-delete-batch-fake-success",
+                    // r28b F14: point at a concrete single-id call, not the methodology page.
+                    nextCommand: `omc call data.delete --args '${JSON.stringify({ schemaCode: args.schemaCode, bizObjectId: ids[0] })}'`,
+                    message: "批量删除（bizObjectIds 多个）在 1.1.25 真机实证为假成功：回执 DELIVERED + absent:true + modelResidue.total 递减，但行仍在（data.list 不变、data.load exists:true）；同样的 id 改单条逐个删才真删掉。请用 bizObjectId（单个）逐个删，每条删完用 data.load 确认 exists:false（absent:true 不是删除成功的证明）。" +
+                        `下一步：把 ${ids.length} 个 id 拆成 ${ids.length} 次单删（示例已写入 nextCommand；其余 id 替换 bizObjectId 即可）。`,
                 });
-        }
-        const hasInstance = typeof args.workflowInstanceId === "string" && args.workflowInstanceId.trim().length > 0;
-        const targetObjectId = typeof args.bizObjectId === "string" && args.bizObjectId.trim() ? args.bizObjectId.trim() : null;
-        if ((hasWorkItem || hasInstance) && !targetObjectId) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "submit-biz-object-id-required",
-                schemaCode: args.schemaCode,
-                workItemId: args.workItemId,
-                workflowInstanceId: args.workflowInstanceId,
-                message: "workItemId or workflowInstanceId submit requires bizObjectId; refusing before runtime/form/submit",
-            });
-        }
-        const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
-        const stampedSubmit = await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: targetObjectId !== null });
-        const formData = stampedSubmit.formData;
-        // r5-asset 2026-10-20: the platform APPENDS child rows carried in an
-        // approval submit's formData (no upsert by row id, no error). Live: an
-        // approval that echoed the whole form twice turned 2 detail rows into 6
-        // and 30000 into 90000 while every call answered errcode 0 — node-level
-        // `editable:false` does not stop it server-side. Refuse before the wire.
-        if ((hasWorkItem || hasInstance) && args.allowChildRowAppend !== true) {
-            // Scan at ANY depth: callers wrap the form as {data:{...}} or
-            // {bizObject:{data:{...}}}, and a top-level-only check let those through
-            // (the platform appends whatever it finds). The child codes come from the
-            // model's own field list.
-            const carried = collectChildArrayPaths(args.formData, new Set(stampedSubmit.childCodes));
-            if (carried.length > 0)
+            const deleteOne = async (bizObjectId) => {
+                // Delete is destructive: probe the authoritative object first so an
+                // absent id is an idempotent no-op, never a blind runtime delete.
+                const before = await loadExistingBizObject(session, args.schemaCode, sheetCode, bizObjectId);
+                if (!before)
+                    return { bizObjectId, skipped: "already-absent", absent: true };
+                const performed = await wireCall(session, {
+                    path: ENDPOINTS.runtimeFormDelete,
+                    method: "POST",
+                    query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId },
+                });
+                // The absence readback: a missing object surfaces either as an empty
+                // payload or as a business error (304001 业务对象不存在) from form/load.
+                // Both are authoritative absence, not a delete failure.
+                let absent = false;
+                try {
+                    const readback = await wireCall(session, { path: ENDPOINTS.runtimeFormLoad, query: { schemaCode: args.schemaCode, sheetCode, objectId: bizObjectId } });
+                    const value = readback.data;
+                    absent = value == null || value === false;
+                }
+                catch (error) {
+                    if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.absenceErrcode)
+                        absent = true;
+                    else
+                        throw error;
+                }
+                return { bizObjectId, errcode: performed.errcode, absent };
+            };
+            if (ids.length === 1) {
+                const one = await deleteOne(ids[0]);
+                if (one.skipped === "already-absent")
+                    return { performed: { skipped: "already-absent", sheetCode, resolvedFrom }, readback: { absent: true, recoveryHint: "id 不存在（already-absent≠删除成功）：真实 id 必须取自 data.list 的 items[].id；工作流中心/门户页面回显的 id 会脱敏，shell 空值兜底出来的 id 同样删不掉任何东西。若 modelResidue.total>0，用 items[].id 重删。", ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+                return { performed: { errcode: one.errcode, sheetCode, resolvedFrom }, readback: { absent: one.absent, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+            }
+            const deleted = [];
+            for (const id of ids)
+                deleted.push(await deleteOne(id));
+            // `deleted`/`count` ride `readback` — the write envelope surfaces only
+            // performed/readback inline (extra top-level keys are artifact-only).
+            return { performed: { sheetCode, resolvedFrom }, readback: { absent: true, count: deleted.length, deleted, ...(await modelResidue(session, args.schemaCode, sheetCode)) } };
+        },
+    });
+    writeTool({
+        tools,
+        name: "data.submit",
+        lane: RUNTIME_LANE,
+        scope: RUNTIME_TOOLS["data.submit"].scope,
+        description: RUNTIME_TOOLS["data.submit"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            sheetCode: z.string().optional(),
+            formData: runtimeFormDataArg,
+            workflowCode: z.string().optional(),
+            workflowInstanceId: z.string().optional(),
+            workItemId: z.string().optional(),
+            bizObjectId: z.string().optional().describe("existing record id; REQUIRED for workItem approval submits (formType=1 + workItemId) — the submit's bizObject must reference the in-flight record or the engine NPEs (DataChangeHandlerImpl.changeBizObject)"),
+            agree: z.boolean().optional(),
+            allowChildRowAppend: z.boolean().optional().describe("默认 false：审批提交（带 workItemId/workflowInstanceId）时 formData 含子表数组会被拒——平台按追加插行，每次提交重复一份。确实要追加子行时才置 true。"),
+            allowStaffOnSubmit: z.boolean().optional().describe("默认 false：提交携带人员字段会被拒（issue#10：两种形状都可能 50000；可靠链路=save 落库后提交省略人员字段）。个别平台构建接受提交面携带时置 true 自担。"),
+            approval: z.record(z.string(), z.unknown()).optional(),
+            runMode: z.string().optional(),
+            isSimulative: z.boolean().optional(),
+            ...readbackProjectionArgs,
+        },
+        execute: async (session, args) => {
+            // r13 #5: an EMPTY STRING was forwarded verbatim, so the platform answered
+            // 100002「参数为空」with no hint which parameter. Absent and blank are not
+            // the same intent: refuse the blank one by name, zero wire.
+            const blank = ["workItemId", "workflowInstanceId", "workflowCode"].filter((key) => typeof args[key] === "string" && args[key].trim().length === 0 && args[key].length > 0);
+            if (blank.length > 0)
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "submit-approval-child-rows",
+                    blocker: "submit-blank-parameter",
                     schemaCode: args.schemaCode,
-                    childTables: carried,
-                    message: `审批提交（workItemId/workflowInstanceId）的 formData 不要带子表数组：${carried.join("、")}。平台按「追加行」处理——每提交一次就再插一份（真机：2 行 → 6 行，30000 → 90000），且不报错、审批节点的 editable:false 也拦不住。只传主表字段；确实要在审批中追加子行时显式传 allowChildRowAppend:true。`,
+                    parameters: blank,
+                    message: `这些参数传了空白字符串：${blank.join("、")}。平台会把这个空白当"参数为空"回 100002（SYS_PARAMETER_EMPTY），` +
+                        `而错误里不会说是哪一个。要么给出真实 id，要么整个省略该键（省略 ≠ 传空串）。`,
                 });
-        }
-        // Portal required-field semantics: the REST submit does NOT enforce them,
-        // so a missing required value must be REPORTED, not silently accepted as a
-        // portal-valid submit (dogfood R3). Best-effort read; a failure never
-        // blocks the submit.
-        // r16 P5:人员字段读回来是对象数组 `[{id,type,name,…}]`，写回去必须是**字符串 id**
-        // ——写成对象会让 UserBizField.fillClientContent 断言失败，平台只回 50000。
-        // 读写不对称且 schema 无法表达（formData 是 additionalProperties），所以在
-        // 写前按已发布字段类型做一次浅校验，把这类形状错误变成一条指名道姓的拒绝。
-        // issue#10（8.6.41 复现矩阵 + 本仓 1.1.25 复验）：旧提示方向反了——
-        // "写入只接受字符串 id"会让调用者按提示改成字符串数组，然后平台 50000
-        // （submit 面 D）。提交面两种已知形状都不安全，可靠链路只有：save 时用
-        // 对象数组落库 → 提交时省略人员字段（值已持久化）。
-        if (args.allowStaffOnSubmit !== true) {
-            const staffShaped = await staffFieldsPresent(session, args.schemaCode, formData).catch(() => []);
-            if (staffShaped.length > 0)
+            const hasWorkItem = typeof args.workItemId === "string" && args.workItemId.trim().length > 0;
+            // r18b: pure shape check — run before any read/wire so a wrong-result
+            // payload never costs a round trip.
+            if (args.approval && typeof args.approval === "object") {
+                const misplaced = args.approval;
+                if (misplaced.agree !== undefined)
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-approval-agree-misplaced",
+                        schemaCode: args.schemaCode,
+                        message: `approval.agree 不生效：平台只读**顶层** agree（true=通过 / false=驳回）。approval 对象里放 agree 会被**静默忽略并按通过处理**` +
+                            `（r18b 真机：approval:{agree:false} 仍写入 result=APPROVE 并把流程走完）。改成顶层参数 {"agree":false,...}。`,
+                    });
+                if (misplaced.opinion !== undefined)
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-approval-opinion-misplaced",
+                        schemaCode: args.schemaCode,
+                        message: `approval.opinion 不是平台键，会被静默丢弃（r18b 真机：意见不进 h_biz_comment，content 为 NULL）。` +
+                            `审批意见（BizCommentModel）用 **approval.content**；附件 approval.resources；下一步审批人 approval.relUsers。`,
+                    });
+            }
+            const hasInstance = typeof args.workflowInstanceId === "string" && args.workflowInstanceId.trim().length > 0;
+            const targetObjectId = typeof args.bizObjectId === "string" && args.bizObjectId.trim() ? args.bizObjectId.trim() : null;
+            if ((hasWorkItem || hasInstance) && !targetObjectId) {
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "submit-person-field-shape",
+                    blocker: "submit-biz-object-id-required",
                     schemaCode: args.schemaCode,
-                    fields: staffShaped,
-                    message: `提交携带了人员字段：${staffShaped.map((entry) => `${entry.code}(${entry.got})`).join("、")}。提交面的两种形状都可能 50000（对象数组触发 UserBizField.fillClientContent 断言；字符串 id 数组在 8.6.41/1.1.25 均实测 50000——issue#10 复现矩阵）。` +
-                        `可靠链路：data.save 时人员字段用对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门）落库，提交时**省略人员字段**——值已持久化，提交只推进流程。` +
-                        `确要在提交携带人员字段（个别平台构建接受），显式带 allowStaffOnSubmit:true 自担。`,
+                    workItemId: args.workItemId,
+                    workflowInstanceId: args.workflowInstanceId,
+                    message: "workItemId or workflowInstanceId submit requires bizObjectId; refusing before runtime/form/submit",
                 });
-        }
-        const validation = await portalRequiredViolations(session, args.schemaCode, sheetCode, args.formData).catch(() => ({ requiredFields: [], missingRequired: [] }));
-        // Directive: a workflow-backed model's submit must START the workflow, not
-        // merely save a sheet row. When the caller names no workflow params, detect
-        // the model's workflow and start it (formType=1 + workflowCode); a model
-        // with no workflow stays a direct sheet submit (formType=2 -> COMPLETED).
-        let explicitWorkflowCode = typeof args.workflowCode === "string" && args.workflowCode.trim().length > 0 ? args.workflowCode.trim() : "";
-        let autoStarted = false;
-        // r16 P4: a second submit on the same work item answers 100005
-        // SYS_REPLAY_ERROR「频繁重复提交！」(ErrorCode.java:68 — the SAME numeric code
-        // as TEST_CONNECTION_FAIL, so the text is the only discriminator). The
-        // platform rate-limits per work item, not per request body, so retrying
-        // with a different payload changes nothing; the caller needs to know
-        // whether the FIRST submit actually landed. Diagnose before the wire.
-        if (hasWorkItem) {
-            try {
-                const activity = (await wireCall(session, {
-                    path: ENDPOINTS.workflowListInstanceActivity,
-                    query: { workflowInstanceId: String(args.workflowInstanceId ?? "") },
-                })).data;
-                const rows = Array.isArray(activity?.activities) ? activity.activities : wireRows(activity);
-                const mine = rows.filter((row) => String(row.workItemId ?? "") === args.workItemId);
-                const finished = mine.length > 0 && mine.every((row) => /FINISHED|COMPLETED/i.test(String(row.state ?? row.status ?? "")));
-                if (finished)
+            }
+            const { sheetCode, resolvedFrom } = await resolveFormSheetCode(session, { schemaCode: args.schemaCode, sheetCode: args.sheetCode });
+            const stampedSubmit = await prepareRuntimeFormData(session, args.schemaCode, args.formData, { isUpdate: targetObjectId !== null });
+            const formData = stampedSubmit.formData;
+            // r5-asset 2026-10-20: the platform APPENDS child rows carried in an
+            // approval submit's formData (no upsert by row id, no error). Live: an
+            // approval that echoed the whole form twice turned 2 detail rows into 6
+            // and 30000 into 90000 while every call answered errcode 0 — node-level
+            // `editable:false` does not stop it server-side. Refuse before the wire.
+            if ((hasWorkItem || hasInstance) && args.allowChildRowAppend !== true) {
+                // Scan at ANY depth: callers wrap the form as {data:{...}} or
+                // {bizObject:{data:{...}}}, and a top-level-only check let those through
+                // (the platform appends whatever it finds). The child codes come from the
+                // model's own field list.
+                const carried = collectChildArrayPaths(args.formData, new Set(stampedSubmit.childCodes));
+                if (carried.length > 0)
                     throw new ToolRefusalError({
                         status: "refused",
-                        blocker: "submit-workitem-already-finished",
+                        blocker: "submit-approval-child-rows",
                         schemaCode: args.schemaCode,
-                        workItemId: args.workItemId,
-                        nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowInstanceId: String(args.workflowInstanceId ?? "") })}'`,
-                        message: `待办 ${String(args.workItemId)} 已经是完成状态——本次提交**没有发生**，平台会回 100005「频繁重复提交！」（SYS_REPLAY_ERROR，按 workItem 维度限流，换载荷/等待都无效）。` +
-                            `这不是失败，是"已经提交过了"。用 workitem.list 看下一级待办，或 data.load 看当前 sequenceStatus，不要重复提交。`,
+                        childTables: carried,
+                        message: `审批提交（workItemId/workflowInstanceId）的 formData 不要带子表数组：${carried.join("、")}。平台按「追加行」处理——每提交一次就再插一份（真机：2 行 → 6 行，30000 → 90000），且不报错、审批节点的 editable:false 也拦不住。只传主表字段；确实要在审批中追加子行时显式传 allowChildRowAppend:true。`,
                     });
             }
-            catch (error) {
-                if (error instanceof ToolRefusalError)
-                    throw error;
-                // A read failure must not block the submit (fail open).
+            // Portal required-field semantics: the REST submit does NOT enforce them,
+            // so a missing required value must be REPORTED, not silently accepted as a
+            // portal-valid submit (dogfood R3). Best-effort read; a failure never
+            // blocks the submit.
+            // r16 P5:人员字段读回来是对象数组 `[{id,type,name,…}]`，写回去必须是**字符串 id**
+            // ——写成对象会让 UserBizField.fillClientContent 断言失败，平台只回 50000。
+            // 读写不对称且 schema 无法表达（formData 是 additionalProperties），所以在
+            // 写前按已发布字段类型做一次浅校验，把这类形状错误变成一条指名道姓的拒绝。
+            // issue#10（8.6.41 复现矩阵 + 本仓 1.1.25 复验）：旧提示方向反了——
+            // "写入只接受字符串 id"会让调用者按提示改成字符串数组，然后平台 50000
+            // （submit 面 D）。提交面两种已知形状都不安全，可靠链路只有：save 时用
+            // 对象数组落库 → 提交时省略人员字段（值已持久化）。
+            if (args.allowStaffOnSubmit !== true) {
+                const staffShaped = await staffFieldsPresent(session, args.schemaCode, formData).catch(() => []);
+                if (staffShaped.length > 0)
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-person-field-shape",
+                        schemaCode: args.schemaCode,
+                        fields: staffShaped,
+                        message: `提交携带了人员字段：${staffShaped.map((entry) => `${entry.code}(${entry.got})`).join("、")}。提交面的两种形状都可能 50000（对象数组触发 UserBizField.fillClientContent 断言；字符串 id 数组在 8.6.41/1.1.25 均实测 50000——issue#10 复现矩阵）。` +
+                            `可靠链路：data.save 时人员字段用对象数组 [{"id":"<userId>","type":3,"name":"<名>"}]（type:3=用户/1=部门）落库，提交时**省略人员字段**——值已持久化，提交只推进流程。` +
+                            `确要在提交携带人员字段（个别平台构建接受），显式带 allowStaffOnSubmit:true 自担。`,
+                    });
             }
-        }
-        if (!explicitWorkflowCode && !hasWorkItem && !hasInstance) {
-            const resolved = await resolvePublishedWorkflowCode(session, args.schemaCode);
-            if (resolved) {
-                explicitWorkflowCode = resolved;
-                autoStarted = true;
+            const validation = await portalRequiredViolations(session, args.schemaCode, sheetCode, args.formData).catch(() => ({ requiredFields: [], missingRequired: [] }));
+            // Directive: a workflow-backed model's submit must START the workflow, not
+            // merely save a sheet row. When the caller names no workflow params, detect
+            // the model's workflow and start it (formType=1 + workflowCode); a model
+            // with no workflow stays a direct sheet submit (formType=2 -> COMPLETED).
+            let explicitWorkflowCode = typeof args.workflowCode === "string" && args.workflowCode.trim().length > 0 ? args.workflowCode.trim() : "";
+            let autoStarted = false;
+            // r16 P4: a second submit on the same work item answers 100005
+            // SYS_REPLAY_ERROR「频繁重复提交！」(ErrorCode.java:68 — the SAME numeric code
+            // as TEST_CONNECTION_FAIL, so the text is the only discriminator). The
+            // platform rate-limits per work item, not per request body, so retrying
+            // with a different payload changes nothing; the caller needs to know
+            // whether the FIRST submit actually landed. Diagnose before the wire.
+            if (hasWorkItem) {
+                try {
+                    const activity = (await wireCall(session, {
+                        path: ENDPOINTS.workflowListInstanceActivity,
+                        query: { workflowInstanceId: String(args.workflowInstanceId ?? "") },
+                    })).data;
+                    const rows = Array.isArray(activity?.activities) ? activity.activities : wireRows(activity);
+                    const mine = rows.filter((row) => String(row.workItemId ?? "") === args.workItemId);
+                    const finished = mine.length > 0 && mine.every((row) => /FINISHED|COMPLETED/i.test(String(row.state ?? row.status ?? "")));
+                    if (finished)
+                        throw new ToolRefusalError({
+                            status: "refused",
+                            blocker: "submit-workitem-already-finished",
+                            schemaCode: args.schemaCode,
+                            workItemId: args.workItemId,
+                            nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowInstanceId: String(args.workflowInstanceId ?? "") })}'`,
+                            message: `待办 ${String(args.workItemId)} 已经是完成状态——本次提交**没有发生**，平台会回 100005「频繁重复提交！」（SYS_REPLAY_ERROR，按 workItem 维度限流，换载荷/等待都无效）。` +
+                                `这不是失败，是"已经提交过了"。用 workitem.list 看下一级待办，或 data.load 看当前 sequenceStatus，不要重复提交。`,
+                        });
+                }
+                catch (error) {
+                    if (error instanceof ToolRefusalError)
+                        throw error;
+                    // A read failure must not block the submit (fail open).
+                }
             }
-        }
-        const hasWorkflowCode = explicitWorkflowCode.length > 0;
-        const hasWorkflow = hasWorkflowCode || hasWorkItem || hasInstance;
-        const formType = hasWorkflow ? "1" : "2";
-        const payload = {
-            formType,
-            bizObject: {
-                schemaCode: args.schemaCode,
-                sheetCode,
-                data: args.formData,
-            },
-            agree: args.agree !== false,
-        };
-        let draftObjectId = null;
-        if (targetObjectId && hasWorkflowCode && !hasWorkItem && !hasInstance) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "submit-existing-workflow-unsupported",
-                schemaCode: args.schemaCode,
-                bizObjectId: targetObjectId,
-                workflowCode: explicitWorkflowCode,
-                nextCommand: "omc describe data.submit --example workflow-backed-data-submit",
-                message: "8.6.26 has no REST in-place workflow start for an existing no-instance row (submitWorkflowByWorkflowCode -> createAndGetBizObject INSERTs -> 40000 duplicate primary key; the load+update starter is facade-only). Supported shape: create workflow drafts via data.save with workflowCode (returns same-id row + DRAFT instance + start workItemId), then data.submit with that workItemId + workflowInstanceId + bizObjectId",
-            });
-        }
-        let preSubmitExisting = null;
-        if (targetObjectId) {
-            const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, targetObjectId);
-            preSubmitExisting = existing;
-            if (!existing) {
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "submit-target-absent",
-                    errcode: RUNTIME_DATA_WIRE.absenceErrcode,
+            if (!explicitWorkflowCode && !hasWorkItem && !hasInstance) {
+                const resolved = await resolvePublishedWorkflowCode(session, args.schemaCode);
+                if (resolved) {
+                    explicitWorkflowCode = resolved;
+                    autoStarted = true;
+                }
+            }
+            const hasWorkflowCode = explicitWorkflowCode.length > 0;
+            const hasWorkflow = hasWorkflowCode || hasWorkItem || hasInstance;
+            const formType = hasWorkflow ? "1" : "2";
+            const payload = {
+                formType,
+                bizObject: {
                     schemaCode: args.schemaCode,
-                    bizObjectId: targetObjectId,
                     sheetCode,
-                    nextCommand: `omc call data.list --args '${JSON.stringify({ schemaCode: args.schemaCode })}'`,
-                    message: "no live business object with this id; refusing to submit (the platform would otherwise create a new row)",
-                });
-            }
-            // Direct-submit chain (ticket 18): form/submit persists bizObject.data
-            // itself — formType=2 submitBizSheet -> saveBizObject (sets COMPLETED,
-            // merges via updateBizObject.mergeObject); formType=1 workItem ->
-            // SubmitDataChangeHandlerImpl.updateBizObject — so the historical
-            // pre-submit form/save + form/load round-trip is redundant wire. The
-            // submit bizObject is synthesized from the authoritative pre-check
-            // load overlaid with the caller's formData.
-            const flat = normalizeLoadedRecord(existing) ?? {};
-            payload.bizObject = {
-                id: targetObjectId,
-                schemaCode: args.schemaCode,
-                sheetCode,
-                ownerId: typeof flat.ownerId === "string" ? flat.ownerId : undefined,
-                // Engine-owned keys must never be echoed back: the loaded row's
-                // `sequenceStatus: DRAFT` would be persisted verbatim and pin the
-                // row to DRAFT across submits (the portal client never resubmits
-                // the status column; live TID 10e6bc65 evidence, ticket 17).
-                data: stripEngineOwnedKeys({ ...flat, ...formData }),
-            };
-            if (formType === "2")
-                payload.actionCode = "submit";
-            draftObjectId = targetObjectId;
-        }
-        else if (formType === "2") {
-            // Live 1.1.25 (r7-vehicle 2026-10-21): the previous chain did
-            // form/save (creating a DRAFT row) and then submitted with that id —
-            // the platform INSERTED A SECOND ROW instead of completing the first,
-            // leaving one COMPLETED + one orphan DRAFT per submit (verified in
-            // ia38g_veh_vehicle: same plateNo, same second, statuses COMPLETED and
-            // DRAFT). form/submit persists bizObject.data itself (ticket 18), so
-            // skip the pre-save and let the platform create+complete in one call.
-            payload.bizObject = {
-                schemaCode: args.schemaCode,
-                sheetCode,
-                data: stripEngineOwnedKeys(formData),
+                    data: args.formData,
+                },
+                agree: args.agree !== false,
             };
-            payload.actionCode = "submit";
-        }
-        let replayToken;
-        if (hasWorkflowCode && !hasWorkItem && !hasInstance) {
-            // Starting a workflow (formType=1 + workflowCode, no workItem) requires
-            // a replayToken pre-registered in Redis via GET /runtime/form/getReplayToken
-            // (AbstractFormRuntimeController.verifyReplay -> SYS_REPLAY_ERROR 100005).
-            replayToken = await getReplayToken(session);
-        }
-        if (hasWorkflowCode)
-            payload.workflowCode = explicitWorkflowCode;
-        if (replayToken)
-            payload.replayToken = replayToken;
-        if (typeof args.workflowInstanceId === "string")
-            payload.workflowInstanceId = args.workflowInstanceId;
-        if (typeof args.workItemId === "string")
-            payload.workItemId = args.workItemId;
-        if (args.approval && typeof args.approval === "object")
-            payload.approval = args.approval;
-        if (typeof args.runMode === "string")
-            payload.runMode = args.runMode;
-        if (typeof args.isSimulative === "boolean")
-            payload.isSimulative = args.isSimulative;
-        // Approval submits are resolved against the LOGGED-IN user (r13: six
-        // blind 40005s). Name the boundary before the write instead of letting the
-        // platform answer "权限不足", which reads like a misconfiguration.
-        if (hasWorkItem)
-            await diagnoseApprovalSubmitIdentity(session, { workflowInstanceId: args.workflowInstanceId, workItemId: args.workItemId });
-        let performed;
-        try {
-            performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.submit 运行时提交稳定失败（50000）", () => wireCall(session, {
-                path: ENDPOINTS.runtimeFormSubmit,
-                method: "POST",
-                body: payload,
-            }), undefined, hasWorkflowCode ? explicitWorkflowCode : undefined);
-        }
-        catch (error) {
-            await diagnoseDbException(session, args.schemaCode, error);
-            // r16 P4: 100005 is SYS_REPLAY_ERROR「频繁重复提交！」(ErrorCode.java:68 —
-            // the same numeric code as TEST_CONNECTION_FAIL, so only the text
-            // separates them). The platform rate-limits per WORK ITEM, so a different
-            // payload or a longer wait changes nothing. The actionable question is
-            // "did the earlier submit land?", which the todo list answers.
-            if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.replayTokenErrcode) {
-                const stillMine = await workItemStillOpen(session, args.workflowInstanceId, args.workItemId).catch(() => null);
+            let draftObjectId = null;
+            if (targetObjectId && hasWorkflowCode && !hasWorkItem && !hasInstance) {
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: stillMine === false ? "submit-workitem-already-finished" : "submit-rate-limited",
+                    blocker: "submit-existing-workflow-unsupported",
                     schemaCode: args.schemaCode,
-                    workItemId: args.workItemId ?? null,
-                    workflowInstanceId: args.workflowInstanceId ?? null,
-                    nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowInstanceId: String(args.workflowInstanceId ?? "") })}'`,
-                    message: stillMine === false
-                        ? `100005「频繁重复提交！」在这里的真实含义：待办 ${String(args.workItemId ?? "(未提供)")} **已经提交过了**。限流按 workItem 维度，换载荷、等待、换 requestId 都无效——这不是失败。用 workitem.list 看下一级待办，或 data.load 看 sequenceStatus，不要重试本次提交。`
-                        : `100005 = 平台 SYS_REPLAY_ERROR「频繁重复提交！」（ErrorCode.java:68，与"测试连接不通过"共用该数值码，只能靠文案区分）。` +
-                            `两种成因：① 该待办已经提交过；② startWorkflow 路径的 replayToken 未刷新。` +
-                            `${stillMine === null ? "（待办状态读取失败，无法判定）" : stillMine ? "该待办仍在——多半是限流窗口未过。" : ""}` +
-                            `先 workitem.list 核对当前待办，确认没提交成功再等一会儿重试；改 payload 不会绕过它。`,
+                    bizObjectId: targetObjectId,
+                    workflowCode: explicitWorkflowCode,
+                    nextCommand: "omc describe data.submit --example workflow-backed-data-submit",
+                    message: "8.6.26 has no REST in-place workflow start for an existing no-instance row (submitWorkflowByWorkflowCode -> createAndGetBizObject INSERTs -> 40000 duplicate primary key; the load+update starter is facade-only). Supported shape: create workflow drafts via data.save with workflowCode (returns same-id row + DRAFT instance + start workItemId), then data.submit with that workItemId + workflowInstanceId + bizObjectId",
                 });
             }
-            throw error;
-        }
-        const performedData = (performed.data ?? {});
-        let readback = { formType };
-        if (formType === "2") {
-            const objectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
-            if (!objectId) {
-                // Source contract: submitBizSheet ALWAYS returns objectId.
-                // Absence is a transport / protocol deviation — never paper over
-                // it with a fabricated sequenceStatus:COMPLETED.
-                return {
-                    performed: { errcode: performed.errcode, sheetCode, resolvedFrom, formType, draftObjectId },
-                    readback: { formType, sequenceStatus: null, missingObjectId: true },
+            let preSubmitExisting = null;
+            if (targetObjectId) {
+                const existing = await loadExistingBizObject(session, args.schemaCode, sheetCode, targetObjectId);
+                preSubmitExisting = existing;
+                if (!existing) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-target-absent",
+                        errcode: RUNTIME_DATA_WIRE.absenceErrcode,
+                        schemaCode: args.schemaCode,
+                        bizObjectId: targetObjectId,
+                        sheetCode,
+                        nextCommand: `omc call data.list --args '${JSON.stringify({ schemaCode: args.schemaCode })}'`,
+                        message: "no live business object with this id; refusing to submit (the platform would otherwise create a new row)",
+                    });
+                }
+                // Direct-submit chain (ticket 18): form/submit persists bizObject.data
+                // itself — formType=2 submitBizSheet -> saveBizObject (sets COMPLETED,
+                // merges via updateBizObject.mergeObject); formType=1 workItem ->
+                // SubmitDataChangeHandlerImpl.updateBizObject — so the historical
+                // pre-submit form/save + form/load round-trip is redundant wire. The
+                // submit bizObject is synthesized from the authoritative pre-check
+                // load overlaid with the caller's formData.
+                const flat = normalizeLoadedRecord(existing) ?? {};
+                payload.bizObject = {
+                    id: targetObjectId,
+                    schemaCode: args.schemaCode,
+                    sheetCode,
+                    ownerId: typeof flat.ownerId === "string" ? flat.ownerId : undefined,
+                    // Engine-owned keys must never be echoed back: the loaded row's
+                    // `sequenceStatus: DRAFT` would be persisted verbatim and pin the
+                    // row to DRAFT across submits (the portal client never resubmits
+                    // the status column; live TID 10e6bc65 evidence, ticket 17).
+                    data: stripEngineOwnedKeys({ ...flat, ...formData }),
                 };
+                if (formType === "2")
+                    payload.actionCode = "submit";
+                draftObjectId = targetObjectId;
             }
-            if (targetObjectId && objectId !== targetObjectId) {
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "submit-target-id-changed",
-                    expectedBizObjectId: targetObjectId,
-                    actualBizObjectId: objectId,
-                    message: "runtime/form/submit returned a different object id; refusing to accept a new row",
-                });
+            else if (formType === "2") {
+                // Live 1.1.25 (r7-vehicle 2026-10-21): the previous chain did
+                // form/save (creating a DRAFT row) and then submitted with that id —
+                // the platform INSERTED A SECOND ROW instead of completing the first,
+                // leaving one COMPLETED + one orphan DRAFT per submit (verified in
+                // ia38g_veh_vehicle: same plateNo, same second, statuses COMPLETED and
+                // DRAFT). form/submit persists bizObject.data itself (ticket 18), so
+                // skip the pre-save and let the platform create+complete in one call.
+                payload.bizObject = {
+                    schemaCode: args.schemaCode,
+                    sheetCode,
+                    data: stripEngineOwnedKeys(formData),
+                };
+                payload.actionCode = "submit";
             }
-            const load = await wireCall(session, {
-                path: ENDPOINTS.runtimeFormLoad,
-                query: { schemaCode: args.schemaCode, sheetCode, objectId },
-            });
-            const loaded = (load.data ?? {});
-            const record = normalizeLoadedRecord(loaded) ?? {};
-            const sequenceStatus = extractSequenceStatus(record);
-            readback = {
-                ...readback,
-                objectId,
-                schemaCode: typeof performedData.schemaCode === "string" ? performedData.schemaCode : args.schemaCode,
-                formCode: typeof performedData.formCode === "string" ? performedData.formCode : sheetCode,
-                sequenceStatus,
-                ...(sequenceStatus === null ? { missingSequenceStatus: true } : {}),
-                submittedData: projectReadbackRecord(record, args),
-            };
-        }
-        else {
-            const returnedObjectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
-            if (targetObjectId && returnedObjectId !== targetObjectId) {
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "submit-target-id-changed",
-                    expectedBizObjectId: targetObjectId,
-                    actualBizObjectId: returnedObjectId,
-                    message: "runtime/form/submit returned a different object id; refusing to accept a new row",
-                });
+            let replayToken;
+            if (hasWorkflowCode && !hasWorkItem && !hasInstance) {
+                // Starting a workflow (formType=1 + workflowCode, no workItem) requires
+                // a replayToken pre-registered in Redis via GET /runtime/form/getReplayToken
+                // (AbstractFormRuntimeController.verifyReplay -> SYS_REPLAY_ERROR 100005).
+                replayToken = await getReplayToken(session);
             }
-            const workflowInstanceId = typeof performedData.workflowInstanceId === "string" ? performedData.workflowInstanceId : null;
-            const objectId = returnedObjectId ?? targetObjectId;
-            // Workflow engine status writes can lag the submit response
-            // (autoCommit): an immediate authoritative form/load may still show
-            // the pre-submit status. Poll briefly when a workflow submit reads
-            // back unchanged — a genuinely unchanged mid-flow status costs one
-            // short bounded wait, a lagged boundary transition resolves.
-            const preSubmitStatus = preSubmitExisting ? extractSequenceStatus(preSubmitExisting) : null;
-            let loaded = objectId ? await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId) : null;
-            let sequenceStatus = extractSequenceStatus(loaded);
-            for (let attempt = 0; objectId && sequenceStatus !== null && sequenceStatus === preSubmitStatus && attempt < 3; attempt += 1) {
-                await new Promise((resolve) => setTimeout(resolve, 400));
-                loaded = await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId);
-                sequenceStatus = extractSequenceStatus(loaded);
+            if (hasWorkflowCode)
+                payload.workflowCode = explicitWorkflowCode;
+            if (replayToken)
+                payload.replayToken = replayToken;
+            if (typeof args.workflowInstanceId === "string")
+                payload.workflowInstanceId = args.workflowInstanceId;
+            if (typeof args.workItemId === "string")
+                payload.workItemId = args.workItemId;
+            if (args.approval && typeof args.approval === "object")
+                payload.approval = args.approval;
+            if (typeof args.runMode === "string")
+                payload.runMode = args.runMode;
+            if (typeof args.isSimulative === "boolean")
+                payload.isSimulative = args.isSimulative;
+            // Approval submits are resolved against the LOGGED-IN user (r13: six
+            // blind 40005s). Name the boundary before the write instead of letting the
+            // platform answer "权限不足", which reads like a misconfiguration.
+            if (hasWorkItem)
+                await diagnoseApprovalSubmitIdentity(session, { workflowInstanceId: args.workflowInstanceId, workItemId: args.workItemId });
+            let performed;
+            try {
+                performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.submit 运行时提交稳定失败（50000）", () => wireCall(session, {
+                    path: ENDPOINTS.runtimeFormSubmit,
+                    method: "POST",
+                    body: payload,
+                }), undefined, hasWorkflowCode ? explicitWorkflowCode : undefined);
             }
-            const loadedRecord = normalizeLoadedRecord(loaded);
-            // The platform's submit response often omits workflowInstanceId (the fake
-            // start path returns only {result, objectId}); the authoritative loaded
-            // row carries it. Prefer the response, then the row.
-            const effectiveInstanceId = workflowInstanceId ?? extractWorkflowInstanceId(loaded) ?? (loadedRecord && typeof loadedRecord.workflowInstanceId === "string" && loadedRecord.workflowInstanceId ? loadedRecord.workflowInstanceId : null);
-            // An approval submit returns the status + the fields the caller submitted,
-            // not the whole row: r12's 25 approvals were the largest read face at
-            // 55.6 KB. Explicit summary/fields/full keep their contract.
-            // Pure-instance submits (workflowInstanceId without workItemId) go
-            // through the same engine path and deserve the same delta (item 11).
-            const approvalDelta = (hasWorkItem || hasInstance) && args.summary !== true && args.full !== true && !(Array.isArray(args.fields) && args.fields.length > 0);
-            readback = {
-                ...readback,
-                workflowInstanceId: effectiveInstanceId,
-                objectId,
-                workItemId: typeof performedData.workItemId === "string" ? performedData.workItemId : null,
-                sequenceStatus,
-                submittedData: approvalDelta ? projectApprovalReadback(loadedRecord, Object.keys(formData ?? {})) : projectReadbackRecord(loadedRecord, args),
-                ...(approvalDelta
-                    ? { readbackShape: "approval-delta", readbackHint: "审批提交默认只回 sequenceStatus + 本次提交的字段；要整条记录（含子表/系统字段）加 full:true，要指定字段加 fields:[...]" }
-                    : {}),
-            };
-            // Multi-level approval: after a submit advances the flow, the caller
-            // almost always needs the NEXT pending todo — bench52/53 paid an extra
-            // `workitem.list` wire call at every approval level because the submit
-            // response carried only the object id. Attach the pending work items for
-            // this instance while the flow is still in flight (best-effort: a lookup
-            // failure must never fail the submit).
-            if (hasWorkflow && effectiveInstanceId && sequenceStatus !== "COMPLETED") {
-                try {
-                    const pending = await searchWorkItems(session, { instanceId: effectiveInstanceId });
-                    const nextWorkItems = pending.items.slice(0, 5).map((item) => ({
-                        workItemId: wireString(item.id),
-                        activityCode: wireString(item.activityCode),
-                        activityName: wireString(item.activityName),
-                        state: wireString(item.state),
-                    }));
-                    if (nextWorkItems.length > 0) {
-                        readback.nextWorkItems = nextWorkItems;
-                        // The submit RESPONSE's own workItemId is null (it names the item
-                        // just completed, not the next one). Expose the fully-formed args
-                        // for the NEXT approval so a multi-level flow advances without an
-                        // extra workitem.list round or guessing which id to use.
-                        readback.nextSubmit = {
-                            schemaCode: args.schemaCode,
-                            workItemId: nextWorkItems[0].workItemId,
-                            workflowInstanceId: effectiveInstanceId,
-                            bizObjectId: objectId,
-                            note: "下一级审批：用这些字段调 data.submit（同意传 agree:true / formData 回填）。",
-                        };
-                    }
-                    else if (sequenceStatus === "PROCESSING") {
-                        // r4-training 2026-10-20: an unresolvable participant (role with no
-                        // members, member not attached to the originator's department, or a
-                        // participant function that is not registered) makes the engine
-                        // create NO next work item while the submit still answers errCode 0.
-                        // Without this line the caller cannot tell "flow advanced" from
-                        // "flow silently stalled" — surface it instead of staying quiet.
-                        readback.flowWarning = {
-                            code: "flow-no-next-workitem",
-                            message: "提交成功但该实例没有生成下一节点待办，流程停在 PROCESSING。常见原因：审批参与人解析为空（角色无成员 / 成员未挂发起人部门 / 参与人函数未注册）。",
-                            checks: [
-                                `omc call workflow.instanceActivity --args '{"workflowInstanceId":"${effectiveInstanceId}"}'（看每个节点的 status 与 participants；无 status=1 即停住）`,
-                                "容器日志搜 GetParticipantInfo error / CustomParticipleMethod{...} -> []",
-                                "参与人优先用参与者对象数组（角色 id）；内置函数只认 FindUserByRole(org, roleCode[, order])",
-                            ],
-                        };
-                    }
+            catch (error) {
+                await diagnoseDbException(session, args.schemaCode, error);
+                // r16 P4: 100005 is SYS_REPLAY_ERROR「频繁重复提交！」(ErrorCode.java:68 —
+                // the same numeric code as TEST_CONNECTION_FAIL, so only the text
+                // separates them). The platform rate-limits per WORK ITEM, so a different
+                // payload or a longer wait changes nothing. The actionable question is
+                // "did the earlier submit land?", which the todo list answers.
+                if (error instanceof WireError && error.kind === "business" && error.errcode === RUNTIME_DATA_WIRE.replayTokenErrcode) {
+                    const stillMine = await workItemStillOpen(session, args.workflowInstanceId, args.workItemId).catch(() => null);
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: stillMine === false ? "submit-workitem-already-finished" : "submit-rate-limited",
+                        schemaCode: args.schemaCode,
+                        workItemId: args.workItemId ?? null,
+                        workflowInstanceId: args.workflowInstanceId ?? null,
+                        nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowInstanceId: String(args.workflowInstanceId ?? "") })}'`,
+                        message: stillMine === false
+                            ? `100005「频繁重复提交！」在这里的真实含义：待办 ${String(args.workItemId ?? "(未提供)")} **已经提交过了**。限流按 workItem 维度，换载荷、等待、换 requestId 都无效——这不是失败。用 workitem.list 看下一级待办，或 data.load 看 sequenceStatus，不要重试本次提交。`
+                            : `100005 = 平台 SYS_REPLAY_ERROR「频繁重复提交！」（ErrorCode.java:68，与"测试连接不通过"共用该数值码，只能靠文案区分）。` +
+                                `两种成因：① 该待办已经提交过；② startWorkflow 路径的 replayToken 未刷新。` +
+                                `${stillMine === null ? "（待办状态读取失败，无法判定）" : stillMine ? "该待办仍在——多半是限流窗口未过。" : ""}` +
+                                `先 workitem.list 核对当前待办，确认没提交成功再等一会儿重试；改 payload 不会绕过它。`,
+                    });
                 }
-                catch {
-                    // best-effort
+                throw error;
+            }
+            const performedData = (performed.data ?? {});
+            let readback = { formType };
+            if (formType === "2") {
+                const objectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
+                if (!objectId) {
+                    // Source contract: submitBizSheet ALWAYS returns objectId.
+                    // Absence is a transport / protocol deviation — never paper over
+                    // it with a fabricated sequenceStatus:COMPLETED.
+                    return {
+                        performed: { errcode: performed.errcode, sheetCode, resolvedFrom, formType, draftObjectId },
+                        readback: { formType, sequenceStatus: null, missingObjectId: true },
+                    };
                 }
+                if (targetObjectId && objectId !== targetObjectId) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-target-id-changed",
+                        expectedBizObjectId: targetObjectId,
+                        actualBizObjectId: objectId,
+                        message: "runtime/form/submit returned a different object id; refusing to accept a new row",
+                    });
+                }
+                const load = await wireCall(session, {
+                    path: ENDPOINTS.runtimeFormLoad,
+                    query: { schemaCode: args.schemaCode, sheetCode, objectId },
+                });
+                const loaded = (load.data ?? {});
+                const record = normalizeLoadedRecord(loaded) ?? {};
+                const sequenceStatus = extractSequenceStatus(record);
+                readback = {
+                    ...readback,
+                    objectId,
+                    schemaCode: typeof performedData.schemaCode === "string" ? performedData.schemaCode : args.schemaCode,
+                    formCode: typeof performedData.formCode === "string" ? performedData.formCode : sheetCode,
+                    sequenceStatus,
+                    ...(sequenceStatus === null ? { missingSequenceStatus: true } : {}),
+                    // r28b F2（真机 2026-11-05 复现）：模型没配业务流水号时，平台把
+                    // `sequenceNo` 直接回填成 objectId 本身——32 位 hex 长得像单号，
+                    // 读回却没法区分「真的生成了单号」和「回填了行 id」。
+                    // 相等即标注，不等时不加（不猜）。
+                    ...(typeof record.sequenceNo === "string" && String(record.sequenceNo) === objectId
+                        ? { sequenceNoSource: "object-id", sequenceNoNote: "本模型未配置业务流水号：sequenceNo 回填的是 objectId 本身（不是生成的单号）。要单号请在模型上配序列号字段。" }
+                        : {}),
+                    submittedData: projectReadbackRecord(record, args),
+                };
             }
-        }
-        return {
-            performed: {
-                errcode: performed.errcode,
-                sheetCode,
-                resolvedFrom,
-                formType,
-                ...(draftObjectId ? { draftObjectId } : {}),
-                // The workflow was auto-detected and started (formType=1) rather than
-                // saved as a bare sheet row — surfaced so the caller knows the row is
-                // now a PROCESSING workflow instance, not an orphan sheet record.
-                ...(autoStarted ? { autoStartedWorkflow: explicitWorkflowCode } : {}),
-            },
-            readback: {
-                ...readback,
-                // Portal-required semantics are NOT enforced by the REST submit path;
-                // say exactly what the tool checked so `ok` is never mistaken for
-                // "the portal would have accepted this" (dogfood R3). This is a
-                // SEPARATE concern from server-side business rules (which DO run on
-                // submit) — name that so `portalRulesExecuted:false` is not misread as
-                // "no rule ran" (dogfood R2).
-                // r18b: an approval submit that omits `agree` is treated as APPROVE by
-                // the platform (`agree: args.agree !== false`). That default is right
-                // for the portal button, but for an API caller "I forgot the flag" and
-                // "I approve" must not look identical in the receipt.
-                ...(hasWorkItem && args.agree === undefined
-                    ? {
-                        approvalNote: "本次是审批提交但未传 agree——平台按**通过**处理（顶层 agree 缺省 true）。要驳回必须显式 agree:false；approval.agree 不生效。",
+            else {
+                const returnedObjectId = typeof performedData.objectId === "string" ? performedData.objectId : null;
+                if (targetObjectId && returnedObjectId !== targetObjectId) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "submit-target-id-changed",
+                        expectedBizObjectId: targetObjectId,
+                        actualBizObjectId: returnedObjectId,
+                        message: "runtime/form/submit returned a different object id; refusing to accept a new row",
+                    });
+                }
+                const workflowInstanceId = typeof performedData.workflowInstanceId === "string" ? performedData.workflowInstanceId : null;
+                const objectId = returnedObjectId ?? targetObjectId;
+                // Workflow engine status writes can lag the submit response
+                // (autoCommit): an immediate authoritative form/load may still show
+                // the pre-submit status. Poll briefly when a workflow submit reads
+                // back unchanged — a genuinely unchanged mid-flow status costs one
+                // short bounded wait, a lagged boundary transition resolves.
+                const preSubmitStatus = preSubmitExisting ? extractSequenceStatus(preSubmitExisting) : null;
+                let loaded = objectId ? await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId) : null;
+                let sequenceStatus = extractSequenceStatus(loaded);
+                for (let attempt = 0; objectId && sequenceStatus !== null && sequenceStatus === preSubmitStatus && attempt < 3; attempt += 1) {
+                    await new Promise((resolve) => setTimeout(resolve, 400));
+                    loaded = await loadExistingBizObject(session, args.schemaCode, sheetCode, objectId);
+                    sequenceStatus = extractSequenceStatus(loaded);
+                }
+                const loadedRecord = normalizeLoadedRecord(loaded);
+                // The platform's submit response often omits workflowInstanceId (the fake
+                // start path returns only {result, objectId}); the authoritative loaded
+                // row carries it. Prefer the response, then the row.
+                const effectiveInstanceId = workflowInstanceId ?? extractWorkflowInstanceId(loaded) ?? (loadedRecord && typeof loadedRecord.workflowInstanceId === "string" && loadedRecord.workflowInstanceId ? loadedRecord.workflowInstanceId : null);
+                // An approval submit returns the status + the fields the caller submitted,
+                // not the whole row: r12's 25 approvals were the largest read face at
+                // 55.6 KB. Explicit summary/fields/full keep their contract.
+                // Pure-instance submits (workflowInstanceId without workItemId) go
+                // through the same engine path and deserve the same delta (item 11).
+                const approvalDelta = (hasWorkItem || hasInstance) && args.summary !== true && args.full !== true && !(Array.isArray(args.fields) && args.fields.length > 0);
+                readback = {
+                    ...readback,
+                    workflowInstanceId: effectiveInstanceId,
+                    objectId,
+                    workItemId: typeof performedData.workItemId === "string" ? performedData.workItemId : null,
+                    sequenceStatus,
+                    submittedData: approvalDelta ? projectApprovalReadback(loadedRecord, Object.keys(formData ?? {})) : projectReadbackRecord(loadedRecord, args),
+                    ...(approvalDelta
+                        ? { readbackShape: "approval-delta", readbackHint: "审批提交默认只回 sequenceStatus + 本次提交的字段；要整条记录（含子表/系统字段）加 full:true，要指定字段加 fields:[...]" }
+                        : {}),
+                };
+                // Multi-level approval: after a submit advances the flow, the caller
+                // almost always needs the NEXT pending todo — bench52/53 paid an extra
+                // `workitem.list` wire call at every approval level because the submit
+                // response carried only the object id. Attach the pending work items for
+                // this instance while the flow is still in flight (best-effort: a lookup
+                // failure must never fail the submit).
+                if (hasWorkflow && effectiveInstanceId && sequenceStatus !== "COMPLETED") {
+                    try {
+                        const pending = await searchWorkItems(session, { instanceId: effectiveInstanceId });
+                        const nextWorkItems = pending.items.slice(0, 5).map((item) => ({
+                            workItemId: wireString(item.id),
+                            activityCode: wireString(item.activityCode),
+                            activityName: wireString(item.activityName),
+                            state: wireString(item.state),
+                        }));
+                        if (nextWorkItems.length > 0) {
+                            readback.nextWorkItems = nextWorkItems;
+                            // The submit RESPONSE's own workItemId is null (it names the item
+                            // just completed, not the next one). Expose the fully-formed args
+                            // for the NEXT approval so a multi-level flow advances without an
+                            // extra workitem.list round or guessing which id to use.
+                            readback.nextSubmit = {
+                                schemaCode: args.schemaCode,
+                                workItemId: nextWorkItems[0].workItemId,
+                                workflowInstanceId: effectiveInstanceId,
+                                bizObjectId: objectId,
+                                note: "下一级审批：用这些字段调 data.submit（同意传 agree:true / formData 回填）。",
+                            };
+                        }
+                        else if (sequenceStatus === "PROCESSING") {
+                            // r4-training 2026-10-20: an unresolvable participant (role with no
+                            // members, member not attached to the originator's department, or a
+                            // participant function that is not registered) makes the engine
+                            // create NO next work item while the submit still answers errCode 0.
+                            // Without this line the caller cannot tell "flow advanced" from
+                            // "flow silently stalled" — surface it instead of staying quiet.
+                            readback.flowWarning = {
+                                code: "flow-no-next-workitem",
+                                message: "提交成功但该实例没有生成下一节点待办，流程停在 PROCESSING。常见原因：审批参与人解析为空（角色无成员 / 成员未挂发起人部门 / 参与人函数未注册）。",
+                                checks: [
+                                    `omc call workflow.instanceActivity --args '{"workflowInstanceId":"${effectiveInstanceId}"}'（看每个节点的 status 与 participants；无 status=1 即停住）`,
+                                    "容器日志搜 GetParticipantInfo error / CustomParticipleMethod{...} -> []",
+                                    "参与人优先用参与者对象数组（角色 id）；内置函数只认 FindUserByRole(org, roleCode[, order])",
+                                ],
+                            };
+                        }
                     }
-                    : {}),
-                portalRulesExecuted: false,
-                portalRulesNote: "portalRulesExecuted 只指门户客户端的必填/控件校验未在 REST 提交时执行；服务端业务规则（含流程 end 规则）照常运行。",
-                requiredFields: validation.requiredFields,
-                missingRequired: validation.missingRequired,
-                ...(validation.missingRequired.length > 0
-                    ? {
-                        portalValidationWarning: `已提交但**未执行门户必填校验**：${validation.missingRequired.join("、")} 在发布表单里是必填，本次 formData 为空/缺省。REST runtime/form/submit 不跑门户客户端校验；如需真正阻断，请在提交前自行校验，或在服务端规则里加必填约束。`,
+                    catch {
+                        // best-effort
                     }
-                    : {}),
-                // Round 16b (dogfood R1-R3): a submit can leave BOTH a draft row and a
-                // committed row, and deleting only the committed id leaves the draft
-                // behind (data.list still counts it). Name both ids so cleanup does not
-                // silently miss one. Round 17 (dogfood R2): when there is only ONE row
-                // (a workflow submit advances the same row), say so explicitly — the
-                // absence of a hint was itself read as an evidence gap.
-                ...(typeof readback.objectId === "string"
-                    ? draftObjectId && readback.objectId !== draftObjectId
-                        ? { cleanupHint: `本次提交产生 draft(${draftObjectId}) 与 committed(${String(readback.objectId)}) 两条记录；验收后两条都要 data.delete，直到 data.list total=0。` }
-                        : { cleanupHint: `本次提交只有一条记录（${String(readback.objectId)}）；验收后 data.delete 该 id，直到 data.list total=0。` }
-                    : {}),
-            },
-        };
+                }
+            }
+            return {
+                performed: {
+                    errcode: performed.errcode,
+                    sheetCode,
+                    resolvedFrom,
+                    formType,
+                    // r28b F2 追问（真机 2026-11-05）：这里只有 `draftObjectId`，而**参数名**、
+                    // data.save/data.delete/data.update 的读回、以及 data.load 全叫 `bizObjectId`。
+                    // 同一个 id 换三个名字，调用方要把 submit 的回执接到下一步（读回/删除）
+                    // 时得先知道这个别名。两个键都给（draftObjectId 保留不破既有脚本）。
+                    ...(draftObjectId ? { bizObjectId: draftObjectId, draftObjectId } : {}),
+                    // The workflow was auto-detected and started (formType=1) rather than
+                    // saved as a bare sheet row — surfaced so the caller knows the row is
+                    // now a PROCESSING workflow instance, not an orphan sheet record.
+                    ...(autoStarted ? { autoStartedWorkflow: explicitWorkflowCode } : {}),
+                },
+                readback: {
+                    ...readback,
+                    // Portal-required semantics are NOT enforced by the REST submit path;
+                    // say exactly what the tool checked so `ok` is never mistaken for
+                    // "the portal would have accepted this" (dogfood R3). This is a
+                    // SEPARATE concern from server-side business rules (which DO run on
+                    // submit) — name that so `portalRulesExecuted:false` is not misread as
+                    // "no rule ran" (dogfood R2).
+                    // r18b: an approval submit that omits `agree` is treated as APPROVE by
+                    // the platform (`agree: args.agree !== false`). That default is right
+                    // for the portal button, but for an API caller "I forgot the flag" and
+                    // "I approve" must not look identical in the receipt.
+                    ...(hasWorkItem && args.agree === undefined
+                        ? {
+                            approvalNote: "本次是审批提交但未传 agree——平台按**通过**处理（顶层 agree 缺省 true）。要驳回必须显式 agree:false；approval.agree 不生效。",
+                        }
+                        : {}),
+                    portalRulesExecuted: false,
+                    portalRulesNote: "portalRulesExecuted 只指门户客户端的必填/控件校验未在 REST 提交时执行；服务端业务规则（含流程 end 规则）照常运行。",
+                    requiredFields: validation.requiredFields,
+                    missingRequired: validation.missingRequired,
+                    ...(validation.missingRequired.length > 0
+                        ? {
+                            portalValidationWarning: `已提交但**未执行门户必填校验**：${validation.missingRequired.join("、")} 在发布表单里是必填，本次 formData 为空/缺省。REST runtime/form/submit 不跑门户客户端校验；如需真正阻断，请在提交前自行校验，或在服务端规则里加必填约束。`,
+                        }
+                        : {}),
+                    // Round 16b (dogfood R1-R3): a submit can leave BOTH a draft row and a
+                    // committed row, and deleting only the committed id leaves the draft
+                    // behind (data.list still counts it). Name both ids so cleanup does not
+                    // silently miss one. Round 17 (dogfood R2): when there is only ONE row
+                    // (a workflow submit advances the same row), say so explicitly — the
+                    // absence of a hint was itself read as an evidence gap.
+                    ...(typeof readback.objectId === "string"
+                        ? draftObjectId && readback.objectId !== draftObjectId
+                            ? { cleanupHint: `本次提交产生 draft(${draftObjectId}) 与 committed(${String(readback.objectId)}) 两条记录；验收后两条都要 data.delete，直到 data.list total=0。` }
+                            : { cleanupHint: `本次提交只有一条记录（${String(readback.objectId)}）；验收后 data.delete 该 id，直到 data.list total=0。` }
+                        : {}),
+                },
+            };
+        },
     });
 }
 //# sourceMappingURL=runtime-data.js.map