@stalfh233/omc-cli 0.6.7 → 0.6.10

package/dist/lanes/workflow.js

@@ -2226,386 +2226,425 @@ export function registerWorkflowLane(tools) {
             return { workflowCode, valid: errors.length === 0, errorCount: errors.length, warningCount: warnings.length, errors, warnings };
         }, { target: `workflow.validate:${args.workflowCode ?? args.schemaCode}` }),
     }));
-    writeTool(tools, "workflow.create", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.create"].scope, WORKFLOW_TOOLS["workflow.create"].description, {
-        schemaCode: z.string().min(1),
-        // 2026-10-27 用户需求：流程名默认与表单名一致。省略时的解析链见
-        // resolveWorkflowName——表单名 → 模型名 → 拒绝（不拿 schemaCode 冒充）。
-        name: z.string().min(1).optional().describe("流程名称；省略时默认 = 该模型默认表单的名字（无表单草稿时用模型名），与设计器行为一致"),
-        code: z.string().min(1),
-    }, async (session, args) => {
-        // Ticket 76 idempotent retry: get_header FIRST — a post-timeout
-        // re-create of the same code short-circuits with the existing header
-        // and ZERO create wires. On the happy path this read REPLACES the
-        // post-create header read (same wire count), because a successful
-        // create implies the header.
-        const existingHeader = await getWorkflowHeaderOrNull(session, args.code);
-        if (existingHeader != null) {
-            return { performed: { skipped: "already-present" }, readback: { alreadyPresent: true, header: existingHeader } };
-        }
-        const { name: workflowName, resolvedFrom } = await resolveWorkflowName(session, args.name, args.schemaCode);
-        let performed;
-        try {
-            performed = await wireCall(session, {
-                path: ENDPOINTS.workflowCreate,
-                method: "POST",
-                body: { workflowCode: args.code, workflowName, schemaCode: args.schemaCode, icon: "h-icon-all-logic" },
-            });
-        }
-        catch (error) {
-            // Ticket 76 live: the platform answers an envelope with NO numeric
-            // errcode when the SCHEMA already has a workflow (a second, differently
-            // coded one is refused). Decode it as a duplicate-create — same-code
-            // presence was already excluded by the pre-check, so this is the
-            // different-code case — instead of surfacing a malformed-envelope
-            // transport-looking failure on a business duplicate.
-            if (error instanceof WireError && error.kind === "malformed-envelope") {
-                const has = await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode: args.schemaCode } });
-                if (has.data === true) {
-                    throw new ToolRefusalError({
-                        status: "refused",
-                        blocker: "workflow-already-exists",
-                        schemaCode: args.schemaCode,
-                        workflowCode: args.code,
-                        message: `模型 ${args.schemaCode} 已有流程（平台对重复创建返回非数字 errcode 的 envelope）——一个模型只能有一个流程。要改现有流程用 workflow.update/workflow.publish（先 workflow.get_draft 取当前模板），不要另建新 code`,
-                    });
+    writeTool({
+        tools,
+        name: "workflow.create",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.create"].scope,
+        description: WORKFLOW_TOOLS["workflow.create"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            // 2026-10-27 用户需求：流程名默认与表单名一致。省略时的解析链见
+            // resolveWorkflowName——表单名 → 模型名 → 拒绝（不拿 schemaCode 冒充）。
+            name: z.string().min(1).optional().describe("流程名称；省略时默认 = 该模型默认表单的名字（无表单草稿时用模型名），与设计器行为一致"),
+            code: z.string().min(1),
+        },
+        execute: async (session, args) => {
+            // Ticket 76 idempotent retry: get_header FIRST — a post-timeout
+            // re-create of the same code short-circuits with the existing header
+            // and ZERO create wires. On the happy path this read REPLACES the
+            // post-create header read (same wire count), because a successful
+            // create implies the header.
+            const existingHeader = await getWorkflowHeaderOrNull(session, args.code);
+            if (existingHeader != null) {
+                return { performed: { skipped: "already-present" }, readback: { alreadyPresent: true, header: existingHeader } };
+            }
+            const { name: workflowName, resolvedFrom } = await resolveWorkflowName(session, args.name, args.schemaCode);
+            let performed;
+            try {
+                performed = await wireCall(session, {
+                    path: ENDPOINTS.workflowCreate,
+                    method: "POST",
+                    body: { workflowCode: args.code, workflowName, schemaCode: args.schemaCode, icon: "h-icon-all-logic" },
+                });
+            }
+            catch (error) {
+                // Ticket 76 live: the platform answers an envelope with NO numeric
+                // errcode when the SCHEMA already has a workflow (a second, differently
+                // coded one is refused). Decode it as a duplicate-create — same-code
+                // presence was already excluded by the pre-check, so this is the
+                // different-code case — instead of surfacing a malformed-envelope
+                // transport-looking failure on a business duplicate.
+                if (error instanceof WireError && error.kind === "malformed-envelope") {
+                    const has = await wireCall(session, { path: ENDPOINTS.workflowIsWorkflow, query: { schemaCode: args.schemaCode } });
+                    if (has.data === true) {
+                        throw new ToolRefusalError({
+                            status: "refused",
+                            blocker: "workflow-already-exists",
+                            schemaCode: args.schemaCode,
+                            workflowCode: args.code,
+                            message: `模型 ${args.schemaCode} 已有流程（平台对重复创建返回非数字 errcode 的 envelope）——一个模型只能有一个流程。要改现有流程用 workflow.update/workflow.publish（先 workflow.get_draft 取当前模板），不要另建新 code`,
+                        });
+                    }
                 }
+                throw error;
             }
-            throw error;
-        }
-        const draft = await getWorkflowDraftOrNull(session, args.code);
-        return {
-            performed: { errcode: performed.errcode },
-            readback: { workflowCode: args.code, name: workflowName, nameResolvedFrom: resolvedFrom, headerPresent: true, draftPresent: draft != null, templateId: draft?.id ?? null },
-        };
-    }, undefined, undefined, workflowRollbackSpec("workflow.create"));
-    writeTool(tools, "workflow.update", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.update"].scope, WORKFLOW_TOOLS["workflow.update"].description, { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code，传 workflowCode 会被 schema 拒绝"), template: workflowTemplateArg, merge: z.boolean().optional().describe("增量：只发改动/新增的活动与路由，工具按 activityCode 合并到草稿（草稿为基；新增节点自动接链），不必先读回整模板再重发。默认自动：模板缺 START 或 END 时按增量 merge（部分模板），给了完整 START..END 才整模板替换；显式 true 强制增量、false 强制替换。merge 是并集、绝不删边：结果比草稿少边会被拒（workflow-merge-would-drop-routes）；--dry-run 会返回 routesBefore/routesAfter/routesAdded/routesDropped") }, async (session, args) => {
-        const template = args.template ?? {};
-        validateCallerActivities(template, "workflow.update");
-        validateWorkflowRouteConditions(template, "workflow.update");
-        assertTemplateNotMinimal(template, "workflow.update");
-        lintWorkflowTemplate(template, "workflow.update");
-        await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.update");
-        // Ticket 112: merge onto the full draft row — a verbatim minimal post
-        // leaves converter holes and answers errcode 50000 on the platform.
-        // Delta semantics: explicit `true` forces merge, explicit `false` forces
-        // replace, and the default auto-detects a partial template (missing
-        // START/END) as a delta — see activitiesLackBoundaries.
-        const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
-        const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
-        await backfillDesignerDefaults(session, args.schemaCode, body, template);
-        assertFirstActivityIsOriginator(template, "workflow.update", body);
-        validateWorkflowRender(body, "workflow.update");
-        await assertRoleParticipantScopes(session, body);
-        // Live: workflow/update does NOT run the template validator — it stores a
-        // refused participant silently and only /publish answers the
-        // ValidateMessage[]. So the guard belongs on publish/bindRule, not here.
-        const performed = await wireCall(session, { path: ENDPOINTS.workflowUpdate, method: "POST", body });
-        const draft = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.code } });
-        const data = (draft.data ?? null);
-        if (!data)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
-        validateWorkflowRender(data, "workflow.update readback");
-        const participantWarnings = participantReferenceWarnings(data);
-        // Evaluate on `body` (post-backfill): the readback may drop the handler
-        // keys, and the backfilled permittedAction is exactly what will run.
-        const rejectWarnings = rejectToStartCancelWarnings(body);
-        const renamedActivities = renamedActivityPairs(template, data);
-        const renamedInPlace = inPlaceRenames(data);
-        // Caller sent no routes at all: the draft's edges (branches included) are
-        // what rides the wire. Say so, and name the branch edges, because the only
-        // other trace is a missing edge in a later getPublished readback.
-        const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
-        const branchEdges = callerSentRoutes ? [] : inheritedBranchEdges(data);
-        // 改名验收的权威读数：每个节点的当前显示名（platform may keep
-        // activityName or sync it; effectiveActivityName resolves both shapes).
-        const rawActivityRows = Array.isArray(data.activities)
-            ? data.activities
-            : data.activities && typeof data.activities === "object"
-                ? Object.values(data.activities)
+            const draft = await getWorkflowDraftOrNull(session, args.code);
+            return {
+                performed: { errcode: performed.errcode },
+                readback: { workflowCode: args.code, name: workflowName, nameResolvedFrom: resolvedFrom, headerPresent: true, draftPresent: draft != null, templateId: draft?.id ?? null },
+            };
+        },
+        rollback: workflowRollbackSpec("workflow.create"),
+    });
+    writeTool({
+        tools,
+        name: "workflow.update",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.update"].scope,
+        description: WORKFLOW_TOOLS["workflow.update"].description,
+        inputSchema: { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code，传 workflowCode 会被 schema 拒绝"), template: workflowTemplateArg, merge: z.boolean().optional().describe("增量：只发改动/新增的活动与路由，工具按 activityCode 合并到草稿（草稿为基；新增节点自动接链），不必先读回整模板再重发。默认自动：模板缺 START 或 END 时按增量 merge（部分模板），给了完整 START..END 才整模板替换；显式 true 强制增量、false 强制替换。merge 是并集、绝不删边：结果比草稿少边会被拒（workflow-merge-would-drop-routes）；--dry-run 会返回 routesBefore/routesAfter/routesAdded/routesDropped") },
+        execute: async (session, args) => {
+            const template = args.template ?? {};
+            validateCallerActivities(template, "workflow.update");
+            validateWorkflowRouteConditions(template, "workflow.update");
+            assertTemplateNotMinimal(template, "workflow.update");
+            lintWorkflowTemplate(template, "workflow.update");
+            await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.update");
+            // Ticket 112: merge onto the full draft row — a verbatim minimal post
+            // leaves converter holes and answers errcode 50000 on the platform.
+            // Delta semantics: explicit `true` forces merge, explicit `false` forces
+            // replace, and the default auto-detects a partial template (missing
+            // START/END) as a delta — see activitiesLackBoundaries.
+            const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
+            const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
+            await backfillDesignerDefaults(session, args.schemaCode, body, template);
+            assertFirstActivityIsOriginator(template, "workflow.update", body);
+            validateWorkflowRender(body, "workflow.update");
+            await assertRoleParticipantScopes(session, body);
+            // Live: workflow/update does NOT run the template validator — it stores a
+            // refused participant silently and only /publish answers the
+            // ValidateMessage[]. So the guard belongs on publish/bindRule, not here.
+            const performed = await wireCall(session, { path: ENDPOINTS.workflowUpdate, method: "POST", body });
+            const draft = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.code } });
+            const data = (draft.data ?? null);
+            if (!data)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.update returned no draft" });
+            validateWorkflowRender(data, "workflow.update readback");
+            const participantWarnings = participantReferenceWarnings(data);
+            // Evaluate on `body` (post-backfill): the readback may drop the handler
+            // keys, and the backfilled permittedAction is exactly what will run.
+            const rejectWarnings = rejectToStartCancelWarnings(body);
+            const renamedActivities = renamedActivityPairs(template, data);
+            const renamedInPlace = inPlaceRenames(data);
+            // Caller sent no routes at all: the draft's edges (branches included) are
+            // what rides the wire. Say so, and name the branch edges, because the only
+            // other trace is a missing edge in a later getPublished readback.
+            const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
+            const branchEdges = callerSentRoutes ? [] : inheritedBranchEdges(data);
+            // 改名验收的权威读数：每个节点的当前显示名（platform may keep
+            // activityName or sync it; effectiveActivityName resolves both shapes).
+            const rawActivityRows = Array.isArray(data.activities)
+                ? data.activities
+                : data.activities && typeof data.activities === "object"
+                    ? Object.values(data.activities)
+                    : [];
+            const activityNames = Object.fromEntries(rawActivityRows
+                .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
+                .filter(([code]) => code !== ""));
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        },
+        preflight: (args) => {
+            // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
+            // governed pipeline — including the rollback before-capture read.
+            assertTemplateNotMinimal(args.template ?? {}, "workflow.update");
+        },
+        dryRunPayload: // Dry-run must actually look at the merge result: shape-only previews said
+        // "wouldChange" while the write silently dropped 15 of 46 edges (issue
+        // 2026-10-22 §1.2). The payload runs the SAME merge as the write (reads
+        // only) and reports the edge delta; the contraction refusal fires here too.
+        async (session, args) => {
+            const template = args.template ?? {};
+            const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
+            const draft = await getWorkflowDraftOrNull(session, args.code);
+            if (draft === null)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-not-found",
+                    workflowCode: args.code,
+                    message: `流程 ${args.code} 不存在（get_draft 401001 缺席）——先 workflow.create 再 update/publish`,
+                });
+            const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
+            validateWorkflowRender(body, "workflow.update");
+            const edgeKeys = (rules) => (Array.isArray(rules) ? rules : []).map((rule) => `${String(rule.preActivityCode ?? "")}->${String(rule.postActivityCode ?? "")}`);
+            const beforeEdges = edgeKeys(draft.rules);
+            const afterEdges = edgeKeys(body.rules);
+            // Multiset difference: two conditional lines can share one node pair, so a
+            // Set would hide a real drop.
+            const remaining = [...afterEdges];
+            const routesDropped = [];
+            for (const edge of beforeEdges) {
+                const index = remaining.indexOf(edge);
+                if (index >= 0)
+                    remaining.splice(index, 1);
+                else
+                    routesDropped.push(edge);
+            }
+            const beforeLeft = [...beforeEdges];
+            const routesAdded = [];
+            for (const edge of afterEdges) {
+                const index = beforeLeft.indexOf(edge);
+                if (index >= 0)
+                    beforeLeft.splice(index, 1);
+                else
+                    routesAdded.push(edge);
+            }
+            const activityCodes = (rows) => {
+                const list = Array.isArray(rows) ? rows : rows && typeof rows === "object" ? Object.values(rows) : [];
+                return list.map((row) => String(row?.activityCode ?? "")).filter((code) => code !== "");
+            };
+            const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
+            return {
+                merge,
+                callerSentRoutes,
+                activitiesBefore: activityCodes(draft.activities).length,
+                activitiesAfter: activityCodes(body.activities).length,
+                routesBefore: beforeEdges.length,
+                routesAfter: afterEdges.length,
+                routesAdded,
+                routesDropped,
+                hint: callerSentRoutes
+                    ? "本次显式给了连线：merge 是并集（草稿边 + 你的边），不会删边"
+                    : "本次未给 routes/edges/rules：草稿连线原样沿用（新增节点才会自动接链）",
+            };
+        },
+        rollback: workflowRollbackSpec("workflow.update"),
+    });
+    writeTool({
+        tools,
+        name: "workflow.publish",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.publish"].scope,
+        description: WORKFLOW_TOOLS["workflow.publish"].description,
+        inputSchema: { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code，传 workflowCode 会被 schema 拒绝"), template: workflowTemplateArg.optional() },
+        execute: async (session, args) => {
+            // An absent template publishes the stored draft as-is — the platform's own
+            // path. The schema is optional so the contract no longer contradicts it.
+            const template = args.template ?? {};
+            validateCallerActivities(template, "workflow.publish");
+            validateWorkflowRouteConditions(template, "workflow.publish");
+            assertTemplateNotMinimal(template, "workflow.publish");
+            await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.publish");
+            lintWorkflowTemplate(template, "workflow.publish");
+            // Ticket 112: same merge-before-write as update. A template without both
+            // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
+            const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
+            await backfillDesignerDefaults(session, args.schemaCode, body, template);
+            assertFirstActivityIsOriginator(template, "workflow.publish", body);
+            const unregistered = unregisteredParticipantFunctions(body);
+            if (unregistered.length > 0)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-participant-function-unregistered",
+                    workflowCode: args.code,
+                    activities: unregistered,
+                    message: `流程发布被拒：参与人函数 ${[...new Set(unregistered.map((entry) => entry.functionName + "()"))].join("、")} 在 AI-Platform v1.1.25 未注册（节点 ${unregistered.map((entry) => entry.activityCode).join("、")}）。` +
+                        `发布能过，但运行期 ParticipantActivityRuntime 抛 FunctionNotFoundException：实例卡 PROCESSING、不生成待办，而 data.submit 仍回 errCode 0（r4-training 真机）。` +
+                        `内置函数只有 FindUserByRole({Originator.OU},"<roleCode>","random")；跨部门/全局角色改用参与者对象数组（角色 id）。` +
+                        `这两个名字常见于 workflow.get_published 读回与种子流程，不要回抄。`,
+                });
+            validateWorkflowRender(body, "workflow.publish");
+            const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
+            // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
+            assertWorkflowWriteAccepted(performed, "workflow.publish", args.code);
+            const published = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.code } });
+            const data = (published.data ?? null);
+            // Ticket 77: publish evidence is the published-face MARKER, not data
+            // presence (the endpoint answers the draft shape when unpublished).
+            const isPublished = data !== null && (data.templateType === "PUBLISH" || data.published === true);
+            if (!data)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.publish returned no published template" });
+            const warnings = workflowValidationWarnings(performed.data);
+            // The platform accepted the write (no ERROR) yet the published face still
+            // shows the draft marker: surface that honestly instead of implying the
+            // flow went live.
+            if (!isPublished)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-publish-not-applied",
+                    workflowCode: args.code,
+                    message: `workflow.publish: 平台接受写入（errcode 0）但读回仍是草稿形态（templateType=${String(data.templateType ?? "null")}, published=${String(data.published ?? "null")}）——流程未生效。先 workflow.validate 复核模板，修正后重试`,
+                });
+            validateWorkflowRender(data, "workflow.publish readback");
+            const participantWarnings = participantReferenceWarnings(data);
+            const rejectWarnings = rejectToStartCancelWarnings(data);
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
+        },
+        preflight: (args) => {
+            assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");
+        },
+        rollback: workflowRollbackSpec("workflow.publish"),
+    });
+    writeTool({
+        tools,
+        name: "workflow.bindRule",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.bindRule"].scope,
+        description: WORKFLOW_TOOLS["workflow.bindRule"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            workflowCode: z.string().min(1),
+            ruleCode: z.string().min(1).optional().describe("single-rule form: the rule to bind (mutually exclusive with ruleCodes)"),
+            ruleCodes: z.array(z.string().min(1)).min(1).optional().describe("batch form: several rules bound in ONE update + publish; MERGE semantics — the handler's existing bizActions are preserved and the listed rules appended (deduplicated)"),
+            handler: z
+                .string()
+                .optional()
+                .describe("FLOW-level event handler to bind: start | cancel | activate | end (default end). 与 activityCode+nodeEvent 互斥"),
+            activityCode: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("NODE-level target activity (草稿里的 activityCode，如 Activity2). 必须与 nodeEvent 同时给；节点不存在时报 workflow-activity-not-found 并列出可用 code"),
+            nodeEvent: z
+                .enum(["beforeActivate", "afterActivate", "endActivity", "cancelActivity", "activityApproved", "activityRejected", "jobSubmitted", "jobRejected"])
+                .optional()
+                .describe("NODE-level event on activityCode: beforeActivate|afterActivate|endActivity|cancelActivity|activityApproved|activityRejected|jobSubmitted|jobRejected（如填写节点 endActivity = 申请人提交离开该节点时）. 与 handler 互斥"),
+            publish: z.boolean().optional(),
+        },
+        execute: async (session, args) => {
+            const target = resolveBindTarget(args.handler, args.nodeEvent, args.activityCode);
+            const codes = (args.ruleCodes ?? [args.ruleCode]).map(String);
+            // Only CUSTOM rules are bindable to workflow events — the designer's picker
+            // does not offer preset trigger rows (bench59 bound `Create` to `end`).
+            const bindableByCode = await assertBindableWorkflowRules(session, args.schemaCode, codes);
+            // A bound workflow rule MUST be enabled (else 失效/未启用). Enable any
+            // disabled bound custom rule before writing the binding.
+            const { enabledRuleCodes, alreadyEnabledRuleCodes } = await ensureWorkflowRulesEnabled(session, args.schemaCode, codes, bindableByCode);
+            const shouldPublish = args.publish !== false;
+            const draft = (await getWorkflowDraftOrNull(session, args.workflowCode)) ?? {};
+            if (Object.keys(draft).length === 0) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-not-found",
+                    workflowCode: args.workflowCode,
+                    message: `流程 ${args.workflowCode} 不存在（get_draft 401001 缺席）——先 workflow.create，再 bindRule`,
+                });
+            }
+            // Node-level: fail closed BEFORE the wire when the activity code is not in
+            // the draft, and name the codes that ARE (the designer's own codes like
+            // Activity2 are the common miss).
+            if (target.scope === "activity" && !findTemplateActivity(draft, target.activityCode)) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "workflow-activity-not-found",
+                    workflowCode: args.workflowCode,
+                    activityCode: target.activityCode,
+                    activities: templateActivityCodes(draft),
+                    message: `流程 ${args.workflowCode} 的草稿里没有活动 ${target.activityCode}——节点级事件必须指向已存在的活动。可用活动：${templateActivityCodes(draft).join("、") || "（无）"}（先用 workflow.get_draft 看 code，别用节点名）`,
+                });
+            }
+            const handlerOf = (template) => {
+                if (target.scope === "workflow")
+                    return (template?.[target.field] ?? {}) ?? {};
+                return (findTemplateActivity(template, target.activityCode)?.[target.field] ?? {}) ?? {};
+            };
+            const existing = handlerOf(draft);
+            const priorActions = Array.isArray(existing.bizActions)
+                ? existing.bizActions.filter((value) => typeof value === "string")
                 : [];
-        const activityNames = Object.fromEntries(rawActivityRows
-            .map((row) => [String(row.activityCode ?? ""), effectiveActivityName(row)])
-            .filter(([code]) => code !== ""));
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, activities: Array.isArray(data.activities) ? data.activities.length : rawActivityRows.length, templateType: data.templateType ?? null, activityNames, rollbackHint: `本次改动的 before 快照已记录：omc rollback plan --target workflow:${args.schemaCode}/${args.code} 查看可回退项，omc rollback apply --target … --step <n> 执行（草稿回退后仍需 workflow.publish 才生效）`, ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), ...(branchEdges.length ? { routesInherited: { edges: branchEdges, hint: "本次未传 routes/edges：以上分支边沿用草稿（含 else 兜底）。要改连线请显式回传完整 routes" } } : {}), ...(renamedInPlace.length ? { renamedInPlace, renamedInPlaceHint: "改名已同 code 原地生效（载体 name_i18n，displayName 才是当前名；activityName 是首建值，平台不再变更）" } : {}), ...(renamedActivities.length ? { renamedActivities, renamedHint: "类型变更铸了新码（上表 from→to）且旧码已失效——后续读写一律用 to；再用旧码 from 会被当作新节点追加" } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
-    }, (args) => {
-        // Zero-wire refusal (ticket 77): fires in semanticGate BEFORE the
-        // governed pipeline — including the rollback before-capture read.
-        assertTemplateNotMinimal(args.template ?? {}, "workflow.update");
-    }, 
-    // Dry-run must actually look at the merge result: shape-only previews said
-    // "wouldChange" while the write silently dropped 15 of 46 edges (issue
-    // 2026-10-22 §1.2). The payload runs the SAME merge as the write (reads
-    // only) and reports the edge delta; the contraction refusal fires here too.
-    async (session, args) => {
-        const template = args.template ?? {};
-        const merge = args.merge === true || (args.merge !== false && activitiesLackBoundaries(template));
-        const draft = await getWorkflowDraftOrNull(session, args.code);
-        if (draft === null)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-not-found",
-                workflowCode: args.code,
-                message: `流程 ${args.code} 不存在（get_draft 401001 缺席）——先 workflow.create 再 update/publish`,
-            });
-        const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, merge);
-        validateWorkflowRender(body, "workflow.update");
-        const edgeKeys = (rules) => (Array.isArray(rules) ? rules : []).map((rule) => `${String(rule.preActivityCode ?? "")}->${String(rule.postActivityCode ?? "")}`);
-        const beforeEdges = edgeKeys(draft.rules);
-        const afterEdges = edgeKeys(body.rules);
-        // Multiset difference: two conditional lines can share one node pair, so a
-        // Set would hide a real drop.
-        const remaining = [...afterEdges];
-        const routesDropped = [];
-        for (const edge of beforeEdges) {
-            const index = remaining.indexOf(edge);
-            if (index >= 0)
-                remaining.splice(index, 1);
-            else
-                routesDropped.push(edge);
-        }
-        const beforeLeft = [...beforeEdges];
-        const routesAdded = [];
-        for (const edge of afterEdges) {
-            const index = beforeLeft.indexOf(edge);
-            if (index >= 0)
-                beforeLeft.splice(index, 1);
-            else
-                routesAdded.push(edge);
-        }
-        const activityCodes = (rows) => {
-            const list = Array.isArray(rows) ? rows : rows && typeof rows === "object" ? Object.values(rows) : [];
-            return list.map((row) => String(row?.activityCode ?? "")).filter((code) => code !== "");
-        };
-        const callerSentRoutes = template.routes !== undefined || template.edges !== undefined || template.rules !== undefined;
-        return {
-            merge,
-            callerSentRoutes,
-            activitiesBefore: activityCodes(draft.activities).length,
-            activitiesAfter: activityCodes(body.activities).length,
-            routesBefore: beforeEdges.length,
-            routesAfter: afterEdges.length,
-            routesAdded,
-            routesDropped,
-            hint: callerSentRoutes
-                ? "本次显式给了连线：merge 是并集（草稿边 + 你的边），不会删边"
-                : "本次未给 routes/edges/rules：草稿连线原样沿用（新增节点才会自动接链）",
-        };
-    }, workflowRollbackSpec("workflow.update"));
-    writeTool(tools, "workflow.publish", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.publish"].scope, WORKFLOW_TOOLS["workflow.publish"].description, { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code，传 workflowCode 会被 schema 拒绝"), template: workflowTemplateArg.optional() }, async (session, args) => {
-        // An absent template publishes the stored draft as-is — the platform's own
-        // path. The schema is optional so the contract no longer contradicts it.
-        const template = args.template ?? {};
-        validateCallerActivities(template, "workflow.publish");
-        validateWorkflowRouteConditions(template, "workflow.publish");
-        assertTemplateNotMinimal(template, "workflow.publish");
-        await refuseRequiredOnChildTableFields(session, args.schemaCode, template, "workflow.publish");
-        lintWorkflowTemplate(template, "workflow.publish");
-        // Ticket 112: same merge-before-write as update. A template without both
-        // boundaries is a partial edit → delta merge (see activitiesLackBoundaries).
-        const body = await mergedTemplateBody(session, args.schemaCode, args.code, template, activitiesLackBoundaries(template));
-        await backfillDesignerDefaults(session, args.schemaCode, body, template);
-        assertFirstActivityIsOriginator(template, "workflow.publish", body);
-        const unregistered = unregisteredParticipantFunctions(body);
-        if (unregistered.length > 0)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-participant-function-unregistered",
-                workflowCode: args.code,
-                activities: unregistered,
-                message: `流程发布被拒：参与人函数 ${[...new Set(unregistered.map((entry) => entry.functionName + "()"))].join("、")} 在 AI-Platform v1.1.25 未注册（节点 ${unregistered.map((entry) => entry.activityCode).join("、")}）。` +
-                    `发布能过，但运行期 ParticipantActivityRuntime 抛 FunctionNotFoundException：实例卡 PROCESSING、不生成待办，而 data.submit 仍回 errCode 0（r4-training 真机）。` +
-                    `内置函数只有 FindUserByRole({Originator.OU},"<roleCode>","random")；跨部门/全局角色改用参与者对象数组（角色 id）。` +
-                    `这两个名字常见于 workflow.get_published 读回与种子流程，不要回抄。`,
-            });
-        validateWorkflowRender(body, "workflow.publish");
-        const performed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
-        // A refused publish answers errcode 0 — the ValidateMessage[] is the truth.
-        assertWorkflowWriteAccepted(performed, "workflow.publish", args.code);
-        const published = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.code } });
-        const data = (published.data ?? null);
-        // Ticket 77: publish evidence is the published-face MARKER, not data
-        // presence (the endpoint answers the draft shape when unpublished).
-        const isPublished = data !== null && (data.templateType === "PUBLISH" || data.published === true);
-        if (!data)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.publish returned no published template" });
-        const warnings = workflowValidationWarnings(performed.data);
-        // The platform accepted the write (no ERROR) yet the published face still
-        // shows the draft marker: surface that honestly instead of implying the
-        // flow went live.
-        if (!isPublished)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-publish-not-applied",
-                workflowCode: args.code,
-                message: `workflow.publish: 平台接受写入（errcode 0）但读回仍是草稿形态（templateType=${String(data.templateType ?? "null")}, published=${String(data.published ?? "null")}）——流程未生效。先 workflow.validate 复核模板，修正后重试`,
-            });
-        validateWorkflowRender(data, "workflow.publish readback");
-        const participantWarnings = participantReferenceWarnings(data);
-        const rejectWarnings = rejectToStartCancelWarnings(data);
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, published: isPublished, workflowVersion: data.workflowVersion ?? null, ...(warnings.length ? { warnings } : {}), ...(participantWarnings.length ? { participantWarnings } : {}), ...(rejectWarnings.length ? { workflowWarnings: rejectWarnings } : {}), workflowRenderCompat: workflowRenderCompat(data) } };
-    }, (args) => {
-        assertTemplateNotMinimal(args.template ?? {}, "workflow.publish");
-    }, undefined, workflowRollbackSpec("workflow.publish"));
-    writeTool(tools, "workflow.bindRule", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.bindRule"].scope, WORKFLOW_TOOLS["workflow.bindRule"].description, {
-        schemaCode: z.string().min(1),
-        workflowCode: z.string().min(1),
-        ruleCode: z.string().min(1).optional().describe("single-rule form: the rule to bind (mutually exclusive with ruleCodes)"),
-        ruleCodes: z.array(z.string().min(1)).min(1).optional().describe("batch form: several rules bound in ONE update + publish; MERGE semantics — the handler's existing bizActions are preserved and the listed rules appended (deduplicated)"),
-        handler: z
-            .string()
-            .optional()
-            .describe("FLOW-level event handler to bind: start | cancel | activate | end (default end). 与 activityCode+nodeEvent 互斥"),
-        activityCode: z
-            .string()
-            .min(1)
-            .optional()
-            .describe("NODE-level target activity (草稿里的 activityCode，如 Activity2). 必须与 nodeEvent 同时给；节点不存在时报 workflow-activity-not-found 并列出可用 code"),
-        nodeEvent: z
-            .enum(["beforeActivate", "afterActivate", "endActivity", "cancelActivity", "activityApproved", "activityRejected", "jobSubmitted", "jobRejected"])
-            .optional()
-            .describe("NODE-level event on activityCode: beforeActivate|afterActivate|endActivity|cancelActivity|activityApproved|activityRejected|jobSubmitted|jobRejected（如填写节点 endActivity = 申请人提交离开该节点时）. 与 handler 互斥"),
-        publish: z.boolean().optional(),
-    }, async (session, args) => {
-        const target = resolveBindTarget(args.handler, args.nodeEvent, args.activityCode);
-        const codes = (args.ruleCodes ?? [args.ruleCode]).map(String);
-        // Only CUSTOM rules are bindable to workflow events — the designer's picker
-        // does not offer preset trigger rows (bench59 bound `Create` to `end`).
-        const bindableByCode = await assertBindableWorkflowRules(session, args.schemaCode, codes);
-        // A bound workflow rule MUST be enabled (else 失效/未启用). Enable any
-        // disabled bound custom rule before writing the binding.
-        const { enabledRuleCodes, alreadyEnabledRuleCodes } = await ensureWorkflowRulesEnabled(session, args.schemaCode, codes, bindableByCode);
-        const shouldPublish = args.publish !== false;
-        const draft = (await getWorkflowDraftOrNull(session, args.workflowCode)) ?? {};
-        if (Object.keys(draft).length === 0) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-not-found",
-                workflowCode: args.workflowCode,
-                message: `流程 ${args.workflowCode} 不存在（get_draft 401001 缺席）——先 workflow.create，再 bindRule`,
-            });
-        }
-        // Node-level: fail closed BEFORE the wire when the activity code is not in
-        // the draft, and name the codes that ARE (the designer's own codes like
-        // Activity2 are the common miss).
-        if (target.scope === "activity" && !findTemplateActivity(draft, target.activityCode)) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-activity-not-found",
-                workflowCode: args.workflowCode,
-                activityCode: target.activityCode,
-                activities: templateActivityCodes(draft),
-                message: `流程 ${args.workflowCode} 的草稿里没有活动 ${target.activityCode}——节点级事件必须指向已存在的活动。可用活动：${templateActivityCodes(draft).join("、") || "（无）"}（先用 workflow.get_draft 看 code，别用节点名）`,
-            });
-        }
-        const handlerOf = (template) => {
-            if (target.scope === "workflow")
-                return (template?.[target.field] ?? {}) ?? {};
-            return (findTemplateActivity(template, target.activityCode)?.[target.field] ?? {}) ?? {};
-        };
-        const existing = handlerOf(draft);
-        const priorActions = Array.isArray(existing.bizActions)
-            ? existing.bizActions.filter((value) => typeof value === "string")
-            : [];
-        // MERGE: existing bizActions are preserved; the listed rules are
-        // appended in order, deduplicated (same semantics the single-rule form
-        // has always had — replace is NOT the contract).
-        const nextActions = [...priorActions];
-        for (const code of codes)
-            if (!nextActions.includes(code))
-                nextActions.push(code);
-        const mergedHandler = {
-            ...(typeof existing === "object" && existing ? existing : {}),
-            bizActions: nextActions,
-            bizActionType: "BIZ_RULE",
-        };
-        let nextTemplate;
-        if (target.scope === "workflow") {
-            nextTemplate = { ...draft, [target.field]: mergedHandler, workflowCode: args.workflowCode, schemaCode: args.schemaCode };
-        }
-        else {
-            // Keep the draft's activities container shape (array or index-keyed
-            // object) — only the selected row's handler field changes.
-            nextTemplate = mapTemplateActivity(draft, target.activityCode, (row) => ({ ...row, [target.field]: mergedHandler })).template;
-            nextTemplate = { ...nextTemplate, workflowCode: args.workflowCode, schemaCode: args.schemaCode };
-        }
-        validateWorkflowRender(nextTemplate, "workflow.bindRule");
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.workflowUpdate,
-            method: "POST",
-            body: nextTemplate,
-        });
-        let publishedReadback = null;
-        let publishMarked = false;
-        if (shouldPublish) {
-            const publishPerformed = await wireCall(session, {
-                path: ENDPOINTS.workflowPublish,
+            // MERGE: existing bizActions are preserved; the listed rules are
+            // appended in order, deduplicated (same semantics the single-rule form
+            // has always had — replace is NOT the contract).
+            const nextActions = [...priorActions];
+            for (const code of codes)
+                if (!nextActions.includes(code))
+                    nextActions.push(code);
+            const mergedHandler = {
+                ...(typeof existing === "object" && existing ? existing : {}),
+                bizActions: nextActions,
+                bizActionType: "BIZ_RULE",
+            };
+            let nextTemplate;
+            if (target.scope === "workflow") {
+                nextTemplate = { ...draft, [target.field]: mergedHandler, workflowCode: args.workflowCode, schemaCode: args.schemaCode };
+            }
+            else {
+                // Keep the draft's activities container shape (array or index-keyed
+                // object) — only the selected row's handler field changes.
+                nextTemplate = mapTemplateActivity(draft, target.activityCode, (row) => ({ ...row, [target.field]: mergedHandler })).template;
+                nextTemplate = { ...nextTemplate, workflowCode: args.workflowCode, schemaCode: args.schemaCode };
+            }
+            validateWorkflowRender(nextTemplate, "workflow.bindRule");
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.workflowUpdate,
                 method: "POST",
                 body: nextTemplate,
             });
-            // A refused publish answers errcode 0 with the truth in ValidateMessage[].
-            assertWorkflowWriteAccepted(publishPerformed, "workflow.bindRule", args.workflowCode);
-            const pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.workflowCode } });
-            publishedReadback = (pub.data ?? null);
-            // Authoritative marker, not the request echo (ticket 77 semantics).
-            publishMarked = publishedReadback !== null && (publishedReadback.templateType === "PUBLISH" || publishedReadback.published === true);
-        }
-        const draftReadback = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.workflowCode } });
-        const data = (draftReadback.data ?? null);
-        if (!data)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.bindRule returned no draft" });
-        validateWorkflowRender(data, "workflow.bindRule readback");
-        const handler = handlerOf(data);
-        const bizActions = Array.isArray(handler?.bizActions) ? handler.bizActions.filter((value) => typeof value === "string") : [];
-        const publishedHandler = publishedReadback ? handlerOf(publishedReadback) : undefined;
-        const publishedBizActions = Array.isArray(publishedHandler?.bizActions)
-            ? publishedHandler.bizActions.filter((value) => typeof value === "string")
-            : [];
-        const targetShape = target.scope === "workflow"
-            ? { handler: target.key, handlerField: target.field }
-            : { activityCode: target.activityCode, nodeEvent: target.key, nodeEventField: target.field };
-        return {
-            performed: { errcode: performed.errcode, scope: target.scope, ...targetShape, addedRuleCodes: codes, bizActions, publishRequested: shouldPublish },
-            readback: {
-                workflowCode: args.workflowCode,
-                scope: target.scope,
-                ...targetShape,
-                semantics: "merge",
-                bound: codes.every((code) => bizActions.includes(code)),
-                bizActions,
-                // Workflow-bound rules must be enabled; report the enable delta.
-                enabledRuleCodes,
-                alreadyEnabledRuleCodes,
-                bizActionType: typeof handler?.bizActionType === "string" ? handler.bizActionType : null,
-                templateFieldsPreserved: target.scope === "workflow"
-                    ? Object.keys(draft).every((key) => key === target.field || data[key] !== undefined)
-                    : Object.keys(draft).every((key) => data[key] !== undefined),
-                // Authoritative published-face marker, NOT the request echo: a
-                // refused publish keeps errcode 0 and the draft marker (live 8.6.26).
-                published: publishMarked,
-                publishedBound: codes.every((code) => publishedBizActions.includes(code)),
-                publishedBizActions,
-                publishedBizActionType: typeof publishedHandler?.bizActionType === "string" ? publishedHandler.bizActionType : null,
-                ...(participantReferenceWarnings(data).length ? { participantWarnings: participantReferenceWarnings(data) } : {}),
-                ...(bizActions.length > 1
-                    ? { advisory: `同一事件处理器绑定了 ${bizActions.length} 条规则，它们会**全部执行**（没有互斥）：审批通过/驳回这类互斥结果不要用两条各自 FIXED 赋值的规则——两次都会写、后者覆盖前者（bench22 病灶：通过→已通过、驳回→已驳回 两条各自 FIXED 赋值都绑 endEventHandler）。正确做法二选一：① **绑定到不同处理器/触发**——通过绑流程结束处理器 \`end\`（endEventHandler）或流程生效规则 \`Available\`，驳回绑流程作废处理器 \`cancel\`（cancelEventHandler）或规则 \`Cancel\`；② **一条规则内部按条件分支**（规则图用 BRANCH/filterCondition/dataCondition 读审批结果，多分支各写各的）。真实生产（2026-09-23，case_info_update）只在 endEventHandler 绑一条多分支图（updateData），由该图内部分支完成回写。` }
-                    : {}),
-                workflowRenderCompat: workflowRenderCompat(data),
-            },
-        };
-    }, (args) => {
-        resolveBindTarget(args.handler, args.nodeEvent, args.activityCode);
-        const hasSingle = typeof args.ruleCode === "string" && args.ruleCode.length > 0;
-        const hasMany = Array.isArray(args.ruleCodes);
-        if (hasSingle && hasMany)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-exclusive", message: "ruleCode 与 ruleCodes 互斥：单规则用 ruleCode，多规则用 ruleCodes[]" });
-        if (!hasSingle && !hasMany)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "需要 ruleCode（单个）或 ruleCodes（数组）之一" });
-        if (hasMany) {
-            const codes = args.ruleCodes;
-            if (codes.length === 0 || new Set(codes.map(String)).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0))
-                throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "ruleCodes 必须是非空、去重的规则 code 数组" });
-        }
-    }, undefined, workflowRollbackSpec("workflow.bindRule"));
+            let publishedReadback = null;
+            let publishMarked = false;
+            if (shouldPublish) {
+                const publishPerformed = await wireCall(session, {
+                    path: ENDPOINTS.workflowPublish,
+                    method: "POST",
+                    body: nextTemplate,
+                });
+                // A refused publish answers errcode 0 with the truth in ValidateMessage[].
+                assertWorkflowWriteAccepted(publishPerformed, "workflow.bindRule", args.workflowCode);
+                const pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.workflowCode } });
+                publishedReadback = (pub.data ?? null);
+                // Authoritative marker, not the request echo (ticket 77 semantics).
+                publishMarked = publishedReadback !== null && (publishedReadback.templateType === "PUBLISH" || publishedReadback.published === true);
+            }
+            const draftReadback = await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.workflowCode } });
+            const data = (draftReadback.data ?? null);
+            if (!data)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-render-readback-invalid", message: "workflow.bindRule returned no draft" });
+            validateWorkflowRender(data, "workflow.bindRule readback");
+            const handler = handlerOf(data);
+            const bizActions = Array.isArray(handler?.bizActions) ? handler.bizActions.filter((value) => typeof value === "string") : [];
+            const publishedHandler = publishedReadback ? handlerOf(publishedReadback) : undefined;
+            const publishedBizActions = Array.isArray(publishedHandler?.bizActions)
+                ? publishedHandler.bizActions.filter((value) => typeof value === "string")
+                : [];
+            const targetShape = target.scope === "workflow"
+                ? { handler: target.key, handlerField: target.field }
+                : { activityCode: target.activityCode, nodeEvent: target.key, nodeEventField: target.field };
+            return {
+                performed: { errcode: performed.errcode, scope: target.scope, ...targetShape, addedRuleCodes: codes, bizActions, publishRequested: shouldPublish },
+                readback: {
+                    workflowCode: args.workflowCode,
+                    scope: target.scope,
+                    ...targetShape,
+                    semantics: "merge",
+                    bound: codes.every((code) => bizActions.includes(code)),
+                    bizActions,
+                    // Workflow-bound rules must be enabled; report the enable delta.
+                    enabledRuleCodes,
+                    alreadyEnabledRuleCodes,
+                    bizActionType: typeof handler?.bizActionType === "string" ? handler.bizActionType : null,
+                    templateFieldsPreserved: target.scope === "workflow"
+                        ? Object.keys(draft).every((key) => key === target.field || data[key] !== undefined)
+                        : Object.keys(draft).every((key) => data[key] !== undefined),
+                    // Authoritative published-face marker, NOT the request echo: a
+                    // refused publish keeps errcode 0 and the draft marker (live 8.6.26).
+                    published: publishMarked,
+                    publishedBound: codes.every((code) => publishedBizActions.includes(code)),
+                    publishedBizActions,
+                    publishedBizActionType: typeof publishedHandler?.bizActionType === "string" ? publishedHandler.bizActionType : null,
+                    ...(participantReferenceWarnings(data).length ? { participantWarnings: participantReferenceWarnings(data) } : {}),
+                    ...(bizActions.length > 1
+                        ? { advisory: `同一事件处理器绑定了 ${bizActions.length} 条规则，它们会**全部执行**（没有互斥）：审批通过/驳回这类互斥结果不要用两条各自 FIXED 赋值的规则——两次都会写、后者覆盖前者（bench22 病灶：通过→已通过、驳回→已驳回 两条各自 FIXED 赋值都绑 endEventHandler）。正确做法二选一：① **绑定到不同处理器/触发**——通过绑流程结束处理器 \`end\`（endEventHandler）或流程生效规则 \`Available\`，驳回绑流程作废处理器 \`cancel\`（cancelEventHandler）或规则 \`Cancel\`；② **一条规则内部按条件分支**（规则图用 BRANCH/filterCondition/dataCondition 读审批结果，多分支各写各的）。真实生产（2026-09-23，case_info_update）只在 endEventHandler 绑一条多分支图（updateData），由该图内部分支完成回写。` }
+                        : {}),
+                    workflowRenderCompat: workflowRenderCompat(data),
+                },
+            };
+        },
+        preflight: (args) => {
+            resolveBindTarget(args.handler, args.nodeEvent, args.activityCode);
+            const hasSingle = typeof args.ruleCode === "string" && args.ruleCode.length > 0;
+            const hasMany = Array.isArray(args.ruleCodes);
+            if (hasSingle && hasMany)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-exclusive", message: "ruleCode 与 ruleCodes 互斥：单规则用 ruleCode，多规则用 ruleCodes[]" });
+            if (!hasSingle && !hasMany)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "需要 ruleCode（单个）或 ruleCodes（数组）之一" });
+            if (hasMany) {
+                const codes = args.ruleCodes;
+                if (codes.length === 0 || new Set(codes.map(String)).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0))
+                    throw new ToolRefusalError({ status: "refused", blocker: "workflow-bindrule-codes-invalid", message: "ruleCodes 必须是非空、去重的规则 code 数组" });
+            }
+        },
+        rollback: workflowRollbackSpec("workflow.bindRule"),
+    });
     /**
      * Friendly writer for the designer's 「表单操作」 checkboxes: each PARTICIPANT
      * activity carries `buttonPermission.customBtns[]` = the form-toolbar buttons
@@ -2616,148 +2655,166 @@ export function registerWorkflowLane(tools) {
      * childTableBtns, which is exactly how a caller drops the child-table
      * defaults — this tool merges per node.
      */
-    writeTool(tools, "workflow.setButtons", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.setButtons"].scope, WORKFLOW_TOOLS["workflow.setButtons"].description, {
-        schemaCode: z.string().min(1),
-        workflowCode: z.string().min(1),
-        nodes: z
-            .array(z.object({
-            activityCode: z.string().min(1).describe("活动 code（workflow.get_draft 的 activities[].code）"),
-            buttonCodes: z.array(z.string().min(1)).describe("该节点要**启用**的表单按钮 code（按 form.get 的 formButtonCodes）；未列出的置为 enabled:false，不删除子表按钮配置"),
-        }))
-            .min(1),
-        publish: z.boolean().optional().describe("默认 true：写草稿后发布，表单页立即生效；false 只写草稿"),
-    }, async (session, args) => {
-        const draft = (await getWorkflowDraftOrNull(session, args.workflowCode)) ?? {};
-        if (Object.keys(draft).length === 0)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "workflow-not-found",
-                workflowCode: args.workflowCode,
-                message: `流程 ${args.workflowCode} 不存在（get_draft 401001 缺席）`,
-            });
-        const available = await readSchemaFormButtons(session, args.schemaCode);
-        const availableCodes = Object.keys(available);
-        const draftCodes = templateActivityCodes(draft);
-        const patches = [];
-        const names = {};
-        for (const node of args.nodes) {
-            const row = findTemplateActivity(draft, node.activityCode);
-            if (!row) {
+    writeTool({
+        tools,
+        name: "workflow.setButtons",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.setButtons"].scope,
+        description: WORKFLOW_TOOLS["workflow.setButtons"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            workflowCode: z.string().min(1),
+            nodes: z
+                .array(z.object({
+                activityCode: z.string().min(1).describe("活动 code（workflow.get_draft 的 activities[].code）"),
+                buttonCodes: z.array(z.string().min(1)).describe("该节点要**启用**的表单按钮 code（按 form.get 的 formButtonCodes）；未列出的置为 enabled:false，不删除子表按钮配置"),
+            }))
+                .min(1),
+            publish: z.boolean().optional().describe("默认 true：写草稿后发布，表单页立即生效；false 只写草稿"),
+        },
+        execute: async (session, args) => {
+            const draft = (await getWorkflowDraftOrNull(session, args.workflowCode)) ?? {};
+            if (Object.keys(draft).length === 0)
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "workflow-activity-not-found",
+                    blocker: "workflow-not-found",
                     workflowCode: args.workflowCode,
-                    activityCode: node.activityCode,
-                    activities: draftCodes,
-                    message: `流程 ${args.workflowCode} 没有活动 ${node.activityCode}；可用：${draftCodes.join("、") || "（无）"}`,
+                    message: `流程 ${args.workflowCode} 不存在（get_draft 401001 缺席）`,
                 });
-            }
-            const unknown = node.buttonCodes.filter((code) => available[code] === undefined);
-            if (unknown.length > 0) {
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "form-button-absent",
-                    schemaCode: args.schemaCode,
+            const available = await readSchemaFormButtons(session, args.schemaCode);
+            const availableCodes = Object.keys(available);
+            const draftCodes = templateActivityCodes(draft);
+            const patches = [];
+            const names = {};
+            for (const node of args.nodes) {
+                const row = findTemplateActivity(draft, node.activityCode);
+                if (!row) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-activity-not-found",
+                        workflowCode: args.workflowCode,
+                        activityCode: node.activityCode,
+                        activities: draftCodes,
+                        message: `流程 ${args.workflowCode} 没有活动 ${node.activityCode}；可用：${draftCodes.join("、") || "（无）"}`,
+                    });
+                }
+                const unknown = node.buttonCodes.filter((code) => available[code] === undefined);
+                if (unknown.length > 0) {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "form-button-absent",
+                        schemaCode: args.schemaCode,
+                        activityCode: node.activityCode,
+                        buttonCodes: unknown,
+                        available: availableCodes,
+                        message: `按钮 ${unknown.join("、")} 不在模型 ${args.schemaCode} 的表单按钮里；先 form.publish {buttons:[…]} 生成。可用：${availableCodes.join("、") || "（无）"}`,
+                    });
+                }
+                const existing = (row.buttonPermission ?? {});
+                const existingBtns = Array.isArray(existing.customBtns) ? existing.customBtns : [];
+                const wanted = new Set(node.buttonCodes);
+                const merged = [];
+                for (const button of existingBtns) {
+                    const code = String(button.code ?? "");
+                    if (code === "")
+                        continue;
+                    merged.push({ ...button, enabled: wanted.has(code) });
+                    wanted.delete(code);
+                }
+                for (const code of wanted) {
+                    const source = available[code];
+                    names[code] = String(source.name ?? code);
+                    merged.push({ code, name: String(source.name ?? code), name_i18n: source.name_i18n ?? null, enabled: true, type: "form" });
+                }
+                patches.push({
                     activityCode: node.activityCode,
-                    buttonCodes: unknown,
-                    available: availableCodes,
-                    message: `按钮 ${unknown.join("、")} 不在模型 ${args.schemaCode} 的表单按钮里；先 form.publish {buttons:[…]} 生成。可用：${availableCodes.join("、") || "（无）"}`,
+                    buttonPermission: {
+                        ...existing,
+                        containerCode: existing.containerCode ?? args.schemaCode,
+                        customBtns: merged,
+                        childTableBtns: existing.childTableBtns ?? [],
+                    },
                 });
             }
-            const existing = (row.buttonPermission ?? {});
-            const existingBtns = Array.isArray(existing.customBtns) ? existing.customBtns : [];
-            const wanted = new Set(node.buttonCodes);
-            const merged = [];
-            for (const button of existingBtns) {
-                const code = String(button.code ?? "");
-                if (code === "")
-                    continue;
-                merged.push({ ...button, enabled: wanted.has(code) });
-                wanted.delete(code);
-            }
-            for (const code of wanted) {
-                const source = available[code];
-                names[code] = String(source.name ?? code);
-                merged.push({ code, name: String(source.name ?? code), name_i18n: source.name_i18n ?? null, enabled: true, type: "form" });
+            const body = await mergedTemplateBody(session, args.schemaCode, args.workflowCode, { activities: patches }, true);
+            validateWorkflowRender(body, "workflow.setButtons");
+            const performed = await wireCall(session, { path: ENDPOINTS.workflowUpdate, method: "POST", body });
+            const shouldPublish = args.publish !== false;
+            let publishMarked = false;
+            if (shouldPublish) {
+                const publishPerformed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
+                assertWorkflowWriteAccepted(publishPerformed, "workflow.setButtons", args.workflowCode);
+                const pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.workflowCode } });
+                const published = (pub.data ?? null);
+                publishMarked = published !== null && (published.templateType === "PUBLISH" || published.published === true);
             }
-            patches.push({
-                activityCode: node.activityCode,
-                buttonPermission: {
-                    ...existing,
-                    containerCode: existing.containerCode ?? args.schemaCode,
-                    customBtns: merged,
-                    childTableBtns: existing.childTableBtns ?? [],
-                },
+            const readback = (await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.workflowCode } })).data;
+            const nodeButtons = (readback ? readback.activities : draft.activities);
+            const rows = Array.isArray(nodeButtons)
+                ? nodeButtons
+                : nodeButtons && typeof nodeButtons === "object"
+                    ? Object.values(nodeButtons)
+                    : [];
+            const state = args.nodes.map((node) => {
+                const row = rows.find((entry) => String(entry.activityCode ?? "") === node.activityCode) ?? {};
+                const bp = (row.buttonPermission ?? {});
+                const btns = Array.isArray(bp.customBtns) ? bp.customBtns : [];
+                return {
+                    activityCode: node.activityCode,
+                    enabled: btns.filter((button) => button.enabled === true).map((button) => String(button.code ?? "")),
+                    disabled: btns.filter((button) => button.enabled !== true).map((button) => String(button.code ?? "")),
+                };
             });
-        }
-        const body = await mergedTemplateBody(session, args.schemaCode, args.workflowCode, { activities: patches }, true);
-        validateWorkflowRender(body, "workflow.setButtons");
-        const performed = await wireCall(session, { path: ENDPOINTS.workflowUpdate, method: "POST", body });
-        const shouldPublish = args.publish !== false;
-        let publishMarked = false;
-        if (shouldPublish) {
-            const publishPerformed = await wireCall(session, { path: ENDPOINTS.workflowPublish, method: "POST", body });
-            assertWorkflowWriteAccepted(publishPerformed, "workflow.setButtons", args.workflowCode);
-            const pub = await wireCall(session, { path: ENDPOINTS.workflowGetPublished, query: { workflowCode: args.workflowCode } });
-            const published = (pub.data ?? null);
-            publishMarked = published !== null && (published.templateType === "PUBLISH" || published.published === true);
-        }
-        const readback = (await wireCall(session, { path: ENDPOINTS.workflowGetDraft, query: { workflowCode: args.workflowCode } })).data;
-        const nodeButtons = (readback ? readback.activities : draft.activities);
-        const rows = Array.isArray(nodeButtons)
-            ? nodeButtons
-            : nodeButtons && typeof nodeButtons === "object"
-                ? Object.values(nodeButtons)
-                : [];
-        const state = args.nodes.map((node) => {
-            const row = rows.find((entry) => String(entry.activityCode ?? "") === node.activityCode) ?? {};
-            const bp = (row.buttonPermission ?? {});
-            const btns = Array.isArray(bp.customBtns) ? bp.customBtns : [];
             return {
-                activityCode: node.activityCode,
-                enabled: btns.filter((button) => button.enabled === true).map((button) => String(button.code ?? "")),
-                disabled: btns.filter((button) => button.enabled !== true).map((button) => String(button.code ?? "")),
+                performed: { errcode: performed.errcode, publishRequested: shouldPublish, nodes: args.nodes.map((node) => node.activityCode) },
+                readback: {
+                    workflowCode: args.workflowCode,
+                    nodes: state,
+                    published: publishMarked,
+                    buttonNames: names,
+                    note: "节点未列出的按钮被置为 enabled:false（不删除子表按钮配置）；表单页只在 enabled:true 的节点显示该按钮",
+                },
             };
-        });
-        return {
-            performed: { errcode: performed.errcode, publishRequested: shouldPublish, nodes: args.nodes.map((node) => node.activityCode) },
-            readback: {
-                workflowCode: args.workflowCode,
-                nodes: state,
-                published: publishMarked,
-                buttonNames: names,
-                note: "节点未列出的按钮被置为 enabled:false（不删除子表按钮配置）；表单页只在 enabled:true 的节点显示该按钮",
-            },
-        };
-    }, undefined, undefined, workflowRollbackSpec("workflow.update"));
-    writeTool(tools, "workflow.delete", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.delete"].scope, WORKFLOW_TOOLS["workflow.delete"].description, { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code") }, async (session, args) => {
-        let performed;
-        try {
-            performed = await wireCall(session, { path: ENDPOINTS.workflowDelete, method: "POST", query: { workflowCode: args.code } });
-        }
-        catch (error) {
-            // 402508 流程实例已存在 — the platform refuses on purpose. Previously it
-            // arrived as a bare wire code, so the caller's next move was to delete the
-            // MODEL instead (which cascades the template away and leaves orphan todos
-            // pointing at nothing — r14's 8× 50000). Name the order.
-            if (error instanceof WireError && error.kind === "business" && error.errcode === 402508) {
-                const pending = await countPendingWorkItems(session, args.code);
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "workflow-has-instances",
-                    workflowCode: args.code,
-                    ...(pending > 0 ? { pendingWorkItems: pending } : {}),
-                    nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowCode: args.code })}'`,
-                    message: `流程 ${args.code} 还有流程实例，平台拒绝删除（402508）。**不要改用 model.delete 绕过**——那会把流程模板级联删掉，` +
-                        `留下指向空模板的待办，而平台全局待办搜索会给每条待办解析模板，**一条缺失就整页 NPE（50000），所有用户的待办列表一起坏掉**（r14 实测 8 连击，需维护者清库）。` +
-                        `正确顺序：① 先完结/清理实例的待办（workitem.list --workflowCode ${args.code} 看还有哪些在办）；② 再 workflow.delete；③ 最后才 model.delete。`,
-                });
+        },
+        rollback: workflowRollbackSpec("workflow.update"),
+    });
+    writeTool({
+        tools,
+        name: "workflow.delete",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.delete"].scope,
+        description: WORKFLOW_TOOLS["workflow.delete"].description,
+        inputSchema: { schemaCode: z.string().min(1), code: z.string().min(1).describe("流程编码——本参数名是 code") },
+        execute: async (session, args) => {
+            let performed;
+            try {
+                performed = await wireCall(session, { path: ENDPOINTS.workflowDelete, method: "POST", query: { workflowCode: args.code } });
             }
-            throw error;
-        }
-        const header = await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: args.code } }).catch(() => ({ data: null }));
-        return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, absent: header.data === null || header.data === undefined } };
-    }, undefined, undefined, workflowRollbackSpec("workflow.delete"));
+            catch (error) {
+                // 402508 流程实例已存在 — the platform refuses on purpose. Previously it
+                // arrived as a bare wire code, so the caller's next move was to delete the
+                // MODEL instead (which cascades the template away and leaves orphan todos
+                // pointing at nothing — r14's 8× 50000). Name the order.
+                if (error instanceof WireError && error.kind === "business" && error.errcode === 402508) {
+                    const pending = await countPendingWorkItems(session, args.code);
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-has-instances",
+                        workflowCode: args.code,
+                        ...(pending > 0 ? { pendingWorkItems: pending } : {}),
+                        nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowCode: args.code })}'`,
+                        message: `流程 ${args.code} 还有流程实例，平台拒绝删除（402508）。**不要改用 model.delete 绕过**——那会把流程模板级联删掉，` +
+                            `留下指向空模板的待办，而平台全局待办搜索会给每条待办解析模板，**一条缺失就整页 NPE（50000），所有用户的待办列表一起坏掉**（r14 实测 8 连击，需维护者清库）。` +
+                            `正确顺序：① 先完结/清理实例的待办（workitem.list --workflowCode ${args.code} 看还有哪些在办）；② 再 workflow.delete；③ 最后才 model.delete。`,
+                    });
+                }
+                throw error;
+            }
+            const header = await wireCall(session, { path: ENDPOINTS.workflowGetHeader, query: { workflowCode: args.code } }).catch(() => ({ data: null }));
+            return { performed: { errcode: performed.errcode }, readback: { workflowCode: args.code, absent: header.data === null || header.data === undefined } };
+        },
+        rollback: workflowRollbackSpec("workflow.delete"),
+    });
     // ---- high-level greenfield orchestration (round 10 ergonomics) --------
     // The survey's write-face gap: a first workflow took create → update →
     // publish (+ bindRule for rules), 3–4 separate CLI calls. configure_workflow
@@ -3101,103 +3158,119 @@ export function registerWorkflowLane(tools) {
             };
         }),
     }));
-    writeTool(tools, "workflow.addPermission", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.addPermission"].scope, WORKFLOW_TOOLS["workflow.addPermission"].description, {
-        workflowCode: z.string().optional().describe("流程 code；省略则用 schemaCode 解析"),
-        schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型的流程"),
-        unitId: z.string().min(1).describe("部门 id / 角色 id / 用户 id（看 unitType）"),
-        unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).describe("1=部门 2=角色 3=用户；也接受 DEPARTMENT/ROLE/USER"),
-        corpId: z.string().optional().describe("企业 id；省略则用当前会话企业"),
-    }, async (session, args) => {
-        const workflowCode = await resolveWorkflowArg(session, args);
-        if (!workflowCode)
-            throw new ToolRefusalError({ status: "refused", blocker: "workflow-not-found", message: `模型 ${String(args.schemaCode ?? "")} 没有流程；先 workflow.create` });
-        const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
-        // Idempotent retry: the platform answers 402003 WORKFLOW_PERMISSION_EXIST
-        // for a duplicate unitId, which would read as a failure. `list_permission`
-        // does NOT echo unitId (only id/name/unitType/fullName/code), so identity
-        // is decided by the platform's own refusal rather than a guessed pre-read.
-        const before = await permissionRows(session, workflowCode);
-        try {
-            // Send the unit's own name/code too: `list_permission` reads them back
-            // (it echoes `name`/`code`), which is the only way `workflow.permissions`
-            // can describe a row by more than its opaque permission id.
-            const identity = await unitIdentity(session, unitType, args.unitId);
-            await wireCall(session, {
-                path: ENDPOINTS.workflowCreatePermission,
-                method: "POST",
-                body: {
-                    workflowCode,
-                    unitId: args.unitId,
-                    unitType,
-                    corpId: args.corpId ?? session.enterpriseId(),
-                    ...(identity.name ? { name: identity.name } : {}),
-                    ...(identity.code ? { code: identity.code } : {}),
-                },
-            });
-        }
-        catch (error) {
-            const errcode = error.details?.errcode ?? error.errcode;
-            if (String(errcode ?? "") !== "402003")
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "workflow-permission-write-failed",
-                    workflowCode,
-                    unitId: args.unitId,
-                    unitType,
-                    message: `create_permission 被平台拒绝（err=${String(errcode ?? "n/a")}）。核对 unitId 是否真实存在（部门用 org.department.list、角色用 org.role.list、用户用 org.user.search），以及发起权限是否被企业策略禁用。原始错误：${error instanceof Error ? error.message : String(error)}`,
-                });
-            return {
-                performed: { skipped: "already-present" },
-                readback: { workflowCode, alreadyPresent: true, unitId: args.unitId, unitType, count: before.length, note: "该主体已有发起权限（平台 402003），未重复写入" },
-            };
-        }
-        const after = await permissionRows(session, workflowCode);
-        const created = after.find((row) => !before.some((old) => String(old.id ?? "") === String(row.id ?? ""))) ?? after[after.length - 1];
-        return {
-            performed: { errcode: 0 },
-            readback: {
-                workflowCode,
-                count: after.length,
-                permissionId: created?.id ?? null,
-                unitType: created?.unitType ?? unitType,
-                name: created?.name ?? null,
-                note: "发起权限已授予。若之前 data.submit 回 40009，现在应可发起；仍失败先 workflow.permissions 确认行存在，并核对发起人所属部门/角色。",
-            },
-        };
-    });
-    writeTool(tools, "workflow.removePermission", WORKFLOW_LANE, WORKFLOW_TOOLS["workflow.removePermission"].scope, WORKFLOW_TOOLS["workflow.removePermission"].description, {
-        permissionId: z.string().min(1).optional().describe("首选：workflow.permissions 返回的 id（唯一确定）"),
-        workflowCode: z.string().optional().describe("配合 unitId+unitType 使用（平台的 list_permission 不回 unitId，需按显示名解析）"),
-        unitId: z.string().min(1).optional().describe("部门/角色/用户 id；按 unitType 解析显示名后匹配权限行"),
-        unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).optional().describe("unitId 的类型：1=部门 2=角色 3=用户"),
-        schemaCode: z.string().optional(),
-    }, async (session, args) => {
-        let permissionId = args.permissionId;
-        if (!permissionId) {
-            const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode });
-            if (!workflowCode || !args.unitId || args.unitType === undefined)
-                throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "workflow.removePermission", message: "需要 permissionId（推荐），或 workflowCode（/schemaCode）+ unitId + unitType" });
+    writeTool({
+        tools,
+        name: "workflow.addPermission",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.addPermission"].scope,
+        description: WORKFLOW_TOOLS["workflow.addPermission"].description,
+        inputSchema: {
+            workflowCode: z.string().optional().describe("流程 code；省略则用 schemaCode 解析"),
+            schemaCode: z.string().optional().describe("模型 code：省略 workflowCode 时用它解析该模型的流程"),
+            unitId: z.string().min(1).describe("部门 id / 角色 id / 用户 id（看 unitType）"),
+            unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).describe("1=部门 2=角色 3=用户；也接受 DEPARTMENT/ROLE/USER"),
+            corpId: z.string().optional().describe("企业 id；省略则用当前会话企业"),
+        },
+        execute: async (session, args) => {
+            const workflowCode = await resolveWorkflowArg(session, args);
+            if (!workflowCode)
+                throw new ToolRefusalError({ status: "refused", blocker: "workflow-not-found", message: `模型 ${String(args.schemaCode ?? "")} 没有流程；先 workflow.create` });
             const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
-            const identity = await unitIdentity(session, unitType, args.unitId);
-            const rows = await permissionRows(session, workflowCode);
-            const wantedType = String(unitType);
-            const hit = rows.find((row) => String(row.unitType ?? "") === wantedType && (String(row.id ?? "") === args.unitId ||
-                (identity.name !== null && String(row.name ?? "") === identity.name) ||
-                (identity.code !== null && String(row.code ?? "") === identity.code)));
-            if (!hit)
-                return {
-                    performed: { skipped: "absent" },
-                    readback: {
+            // Idempotent retry: the platform answers 402003 WORKFLOW_PERMISSION_EXIST
+            // for a duplicate unitId, which would read as a failure. `list_permission`
+            // does NOT echo unitId (only id/name/unitType/fullName/code), so identity
+            // is decided by the platform's own refusal rather than a guessed pre-read.
+            const before = await permissionRows(session, workflowCode);
+            try {
+                // Send the unit's own name/code too: `list_permission` reads them back
+                // (it echoes `name`/`code`), which is the only way `workflow.permissions`
+                // can describe a row by more than its opaque permission id.
+                const identity = await unitIdentity(session, unitType, args.unitId);
+                await wireCall(session, {
+                    path: ENDPOINTS.workflowCreatePermission,
+                    method: "POST",
+                    body: {
                         workflowCode,
-                        removed: false,
-                        note: `没有匹配该主体的权限行（幂等）。注意 list_permission 不回 unitId，匹配靠解析出的显示名「${identity.name ?? "?"}」；不确定时用 workflow.permissions 拿 id 再按 permissionId 删。`,
-                        permissions: rows.map((row) => ({ id: row.id ?? null, name: row.name ?? null, unitType: row.unitType ?? null })),
+                        unitId: args.unitId,
+                        unitType,
+                        corpId: args.corpId ?? session.enterpriseId(),
+                        ...(identity.name ? { name: identity.name } : {}),
+                        ...(identity.code ? { code: identity.code } : {}),
                     },
+                });
+            }
+            catch (error) {
+                const errcode = error.details?.errcode ?? error.errcode;
+                if (String(errcode ?? "") !== "402003")
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "workflow-permission-write-failed",
+                        workflowCode,
+                        unitId: args.unitId,
+                        unitType,
+                        message: `create_permission 被平台拒绝（err=${String(errcode ?? "n/a")}）。核对 unitId 是否真实存在（部门用 org.department.list、角色用 org.role.list、用户用 org.user.search），以及发起权限是否被企业策略禁用。原始错误：${error instanceof Error ? error.message : String(error)}`,
+                    });
+                return {
+                    performed: { skipped: "already-present" },
+                    readback: { workflowCode, alreadyPresent: true, unitId: args.unitId, unitType, count: before.length, note: "该主体已有发起权限（平台 402003），未重复写入" },
                 };
-            permissionId = String(hit.id ?? "");
-        }
-        await wireCall(session, { path: ENDPOINTS.workflowDeletePermission, method: "POST", query: { permissionId } });
-        return { performed: { errcode: 0 }, readback: { permissionId, removed: true } };
+            }
+            const after = await permissionRows(session, workflowCode);
+            const created = after.find((row) => !before.some((old) => String(old.id ?? "") === String(row.id ?? ""))) ?? after[after.length - 1];
+            return {
+                performed: { errcode: 0 },
+                readback: {
+                    workflowCode,
+                    count: after.length,
+                    permissionId: created?.id ?? null,
+                    unitType: created?.unitType ?? unitType,
+                    name: created?.name ?? null,
+                    note: "发起权限已授予。若之前 data.submit 回 40009，现在应可发起；仍失败先 workflow.permissions 确认行存在，并核对发起人所属部门/角色。",
+                },
+            };
+        },
+    });
+    writeTool({
+        tools,
+        name: "workflow.removePermission",
+        lane: WORKFLOW_LANE,
+        scope: WORKFLOW_TOOLS["workflow.removePermission"].scope,
+        description: WORKFLOW_TOOLS["workflow.removePermission"].description,
+        inputSchema: {
+            permissionId: z.string().min(1).optional().describe("首选：workflow.permissions 返回的 id（唯一确定）"),
+            workflowCode: z.string().optional().describe("配合 unitId+unitType 使用（平台的 list_permission 不回 unitId，需按显示名解析）"),
+            unitId: z.string().min(1).optional().describe("部门/角色/用户 id；按 unitType 解析显示名后匹配权限行"),
+            unitType: z.union([z.literal(1), z.literal(2), z.literal(3), z.literal("DEPARTMENT"), z.literal("ROLE"), z.literal("USER")]).optional().describe("unitId 的类型：1=部门 2=角色 3=用户"),
+            schemaCode: z.string().optional(),
+        },
+        execute: async (session, args) => {
+            let permissionId = args.permissionId;
+            if (!permissionId) {
+                const workflowCode = await resolveWorkflowArg(session, { workflowCode: args.workflowCode, schemaCode: args.schemaCode });
+                if (!workflowCode || !args.unitId || args.unitType === undefined)
+                    throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "workflow.removePermission", message: "需要 permissionId（推荐），或 workflowCode（/schemaCode）+ unitId + unitType" });
+                const unitType = args.unitType === 1 || args.unitType === "DEPARTMENT" ? 1 : args.unitType === 2 || args.unitType === "ROLE" ? 2 : 3;
+                const identity = await unitIdentity(session, unitType, args.unitId);
+                const rows = await permissionRows(session, workflowCode);
+                const wantedType = String(unitType);
+                const hit = rows.find((row) => String(row.unitType ?? "") === wantedType && (String(row.id ?? "") === args.unitId ||
+                    (identity.name !== null && String(row.name ?? "") === identity.name) ||
+                    (identity.code !== null && String(row.code ?? "") === identity.code)));
+                if (!hit)
+                    return {
+                        performed: { skipped: "absent" },
+                        readback: {
+                            workflowCode,
+                            removed: false,
+                            note: `没有匹配该主体的权限行（幂等）。注意 list_permission 不回 unitId，匹配靠解析出的显示名「${identity.name ?? "?"}」；不确定时用 workflow.permissions 拿 id 再按 permissionId 删。`,
+                            permissions: rows.map((row) => ({ id: row.id ?? null, name: row.name ?? null, unitType: row.unitType ?? null })),
+                        },
+                    };
+                permissionId = String(hit.id ?? "");
+            }
+            await wireCall(session, { path: ENDPOINTS.workflowDeletePermission, method: "POST", query: { permissionId } });
+            return { performed: { errcode: 0 }, readback: { permissionId, removed: true } };
+        },
     });
     tools.push(defineTool({
         name: "org.role.list",
@@ -3261,6 +3334,23 @@ export function registerWorkflowLane(tools) {
                 parentId: dept.parentId ?? null,
             }));
             return { count: departments.length, departments };
+        }, {
+            // r28h F2: default CODE_NAME_LIST_KEYS collapses departments to
+            // `id｜name` and drops parentId — the one field this tool exists for.
+            // Keep a dedicated slim shape that preserves hierarchy.
+            compact: (result) => {
+                const rows = Array.isArray(result.departments) ? result.departments : [];
+                return {
+                    count: result.count ?? rows.length,
+                    departments: rows.map((row) => ({
+                        id: row.id ?? null,
+                        name: row.name ?? null,
+                        code: row.code ?? null,
+                        parentId: row.parentId ?? null,
+                    })),
+                    departmentsCount: rows.length,
+                };
+            },
         }),
     }));
     tools.push(defineTool({
@@ -3290,6 +3380,29 @@ export function registerWorkflowLane(tools) {
             // `wd` = 0..9 to discover users — 11 calls, ~16 KB, to learn a roster the
             // platform can already answer. Omitted keyword now aggregates
             // `department/list_user` over the department tree (one tool call).
+            // r28h F4: ≤50 users inline as {id,name,username,departmentId}; larger
+            // rosters fall back to count + artifact. Default summarizeValue was folding
+            // a 12-person roster into `{count,sha256,omitted:true}`.
+            const userSearchCompact = (result) => {
+                const rows = Array.isArray(result.users) ? result.users : [];
+                const slim = rows.map((row) => ({
+                    id: row.id ?? null,
+                    name: row.name ?? null,
+                    username: row.username ?? null,
+                    departmentId: row.departmentId ?? null,
+                }));
+                return {
+                    keyword: result.keyword ?? null,
+                    count: result.count ?? rows.length,
+                    total: result.total ?? rows.length,
+                    ...(result.departmentsScanned !== undefined ? { departmentsScanned: result.departmentsScanned } : {}),
+                    ...(result.truncated === true ? { truncated: true } : {}),
+                    ...(typeof result.note === "string" ? { note: result.note } : {}),
+                    ...(typeof result.hint === "string" ? { hint: result.hint } : {}),
+                    users: slim.length <= 50 ? slim : { count: slim.length, omitted: true },
+                    ...(slim.length > 50 ? { usersCount: slim.length } : {}),
+                };
+            };
             if (!keyword) {
                 return governedRead(ctx, self, args, async (session) => {
                     const orgQuery = { corpId: session.enterpriseId() };
@@ -3325,7 +3438,7 @@ export function registerWorkflowLane(tools) {
                         users,
                         hint: "无关键字=列全员（按部门树聚合）。平台 user/search 的 wd 不支持空串（10005），所以这条路径走 department/list_user；只要某部门的人用 org.department.users。",
                     };
-                });
+                }, { compact: userSearchCompact });
             }
             return governedRead(ctx, self, { ...args, wd: keyword }, async (session) => {
                 const body = { wd: keyword, page: args.page ?? 0, size: args.size ?? 100 };
@@ -3344,7 +3457,7 @@ export function registerWorkflowLane(tools) {
                     status: user.status ?? null,
                 }));
                 return { keyword, count: users.length, total: data?.totalElements ?? users.length, users };
-            });
+            }, { compact: userSearchCompact });
         },
     }));
 }
@@ -3380,25 +3493,30 @@ function isRoleGroup(row) {
 export function flattenRoleTree(rows) {
     const roles = [];
     const groups = [];
-    const walk = (nodes, containerPath) => {
+    const walk = (nodes, containers) => {
         for (const node of nodes) {
             if (!isRoleGroup(node)) {
-                roles.push(roleOf(node, containerPath.length > 0 ? containerPath[containerPath.length - 1] : null));
+                const parent = containers.length > 0 ? containers[containers.length - 1] : null;
+                roles.push(roleOf(node, parent));
                 continue;
             }
             const name = String(node.name ?? "");
-            const path = [...containerPath, name];
+            const id = String(node.id ?? "");
+            const code = node.code == null || node.code === "" ? null : String(node.code);
+            const path = [...containers.map((container) => container.name), name].filter((part) => part.length > 0).join(" / ");
             const children = roleChildren(node);
+            const parent = containers.length > 0 ? containers[containers.length - 1] : null;
             groups.push({
                 id: node.id ?? null,
                 name: node.name ?? null,
                 code: node.code ?? null,
                 corpId: node.corpId ?? null,
-                path: path.join(" / "),
+                parentId: parent?.id ?? null,
+                path,
                 childCount: children.length,
             });
             if (children.length > 0)
-                walk(children, path);
+                walk(children, [...containers, { id, code, name }]);
         }
     };
     walk(rows, []);
@@ -3418,13 +3536,22 @@ export function flattenRoleTree(rows) {
     };
 }
 function roleOf(row, group) {
+    // r28h F6: roles used to carry only `group:<name>` — write faces need the
+    // group id/code. Keep `group` (name) for back-compat and add explicit FKs.
     return {
         id: row.id ?? null,
         name: row.name ?? null,
         code: row.code ?? null,
         roleType: row.roleType ?? null,
         corpId: row.corpId ?? null,
-        ...(group !== null ? { group } : {}),
+        ...(group !== null
+            ? {
+                group: group.name,
+                groupId: group.id || null,
+                groupCode: group.code,
+                groupName: group.name,
+            }
+            : {}),
     };
 }
 //# sourceMappingURL=workflow.js.map