@stalfh233/omc-cli 0.6.7 → 0.6.11

package/dist/lanes/model.js

@@ -16,6 +16,7 @@ import { defineTool, ToolInputError, ToolRefusalError } from "../tool-types.js";
 import { wireCall, wireRows, WireError } from "../wire.js";
 import { readModelRecord } from "../model-record.js";
 import { MODEL_CREATE_BODY_DEFAULTS, MODEL_LANE_CONTRACT } from "./model-contract.js";
+import { flattenFolders } from "./folder.js";
 const MODEL_LANE = MODEL_LANE_CONTRACT.lane;
 const MODEL_TOOLS = MODEL_LANE_CONTRACT.tools;
 /**
@@ -413,97 +414,132 @@ export function registerModelLane(tools) {
             },
         }),
     }));
-    writeTool(tools, "model.create", MODEL_LANE, MODEL_TOOLS["model.create"].scope, MODEL_TOOLS["model.create"].description, { name: z.string().min(1), code: z.string().min(1), folderId: z.string().optional(), applicationCode: z.string().optional(), modelType: z.enum(["LIST", "TREE"]).default("LIST") }, async (session, args) => {
-        const applicationCode = await resolveApplicationCode(session, args.applicationCode);
-        const existing = await resolveModelTreeNode(session, args.code, args.applicationCode);
-        if (existing.node) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-create-duplicate",
-                schemaCode: args.code,
-                applicationCode: existing.applicationCode,
-                message: `模型 ${args.code} 已存在于应用 ${existing.applicationCode} 的应用树中；create 拒绝重复 POST，不能把既有模型证明为本次创建结果`,
-            });
-        }
-        // A tree-miss does NOT prove absence: an orphan mount (row exists in
-        // h_biz_schema but its h_app_function.parentId is invalid) is invisible to
-        // the tree scan but real on the record face. Refuse instead of creating a
-        // second row and leaving the first orphaned (live 2026-10-17).
-        try {
-            // bizmodels/get_all is keyed by the query, so a non-null object IS the
-            // model (an absent one answers a business errcode — wireCall throws and
-            // we fall through to create).
-            const record = await readModelRecord(session, args.code);
-            if (record !== null && typeof record === "object") {
+    writeTool({
+        tools,
+        name: "model.create",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.create"].scope,
+        description: MODEL_TOOLS["model.create"].description,
+        inputSchema: {
+            name: z.string().min(1),
+            code: z.string().min(1),
+            folderId: z
+                .string()
+                .optional()
+                .describe("目标目录 id（必须是 folder.tree 里 type=Folder 的 id；也接受该目录 code，工具归一为 id）。省略则落到应用树第一个目录（常为平台默认分组）。不要传目录名。"),
+            applicationCode: z
+                .string()
+                .optional()
+                .describe("模型所属应用 code（应用包，不是目录）。省略用配置默认应用；folder.* 的 appCode 别名本工具不认，请用 applicationCode。"),
+            modelType: z.enum(["LIST", "TREE"]).default("LIST"),
+        },
+        execute: async (session, args) => {
+            const applicationCode = await resolveApplicationCode(session, args.applicationCode);
+            const existing = await resolveModelTreeNode(session, args.code, args.applicationCode);
+            if (existing.node) {
                 throw new ToolRefusalError({
                     status: "refused",
-                    blocker: "model-create-duplicate-orphan",
+                    blocker: "model-create-duplicate",
                     schemaCode: args.code,
-                    applicationCode: args.applicationCode ?? null,
-                    nextCommand: `omc call model.delete --env <env> --args '{"schemaCode":"${args.code}"}'`,
-                    message: `模型 ${args.code} 在册（bizmodels/get_all 可读）但不在应用树中。**先跑一次 model.delete**——它现在会把两种成因分开：` +
-                        `① 读缓存滞后（记录其实已删）→ 回 already-absent/stale-record-cache，随后可直接 create；` +
-                        `② 真孤儿（删除级联中断留下的残骸）→ 回 model-orphaned-record 并给平台侧出路（回收站物理删除 / 换 code），因为 8.6 平台无法删除没有 AppFunction 行的业务模型。` +
-                        `不要重复 create（会再造一条孤儿），也不要只信这一条拒绝信息。`,
+                    applicationCode: existing.applicationCode,
+                    message: `模型 ${args.code} 已存在于应用 ${existing.applicationCode} 的应用树中；create 拒绝重复 POST，不能把既有模型证明为本次创建结果`,
                 });
             }
-        }
-        catch (error) {
-            if (error instanceof ToolRefusalError)
-                throw error;
-            // A record-face read failure must not be read as absence; let create
-            // proceed and rely on the platform's unique key.
-        }
-        // Cross-face key trap (live 2026-10-17, AI-Platform 1.1.7): apppackage/list
-        // projects a Folder node's h_app_function.CODE, while apppackage/trees rows
-        // carry the function ID. Passing the former straight through as
-        // bizmodels/create.parentId writes an orphan row that the tree assembler
-        // drops — the model reads fine on schema faces but vanishes from the menu,
-        // model.list(tree) and duplicate checks. Resolve BOTH keys and always send
-        // the tree row id.
-        const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
-        let folderId = args.folderId;
-        let resolvedFrom = args.folderId ? "explicit" : undefined;
-        if (folderId) {
-            const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string" && (String(row.id) === folderId || String(row.code ?? "") === folderId));
-            if (!folder) {
-                const candidates = tree.filter((row) => row.type !== "BizModel" && typeof row.id === "string").map((row) => `${String(row.id)}|${String(row.code ?? "")}|${String(row.name ?? "")}`);
-                throw new ToolRefusalError({
-                    status: "refused",
-                    blocker: "model-create-folder-unresolved",
-                    message: `folderId ${folderId} 未命中应用 ${applicationCode} 树中任何目录（id/code 双口径）——不要把 apppackage/list 的目录 code 当 id 传；候选（id|code|name）：${candidates.join("；") || "（无目录）"}`,
-                    applicationCode,
-                });
+            // A tree-miss does NOT prove absence: an orphan mount (row exists in
+            // h_biz_schema but its h_app_function.parentId is invalid) is invisible to
+            // the tree scan but real on the record face. Refuse instead of creating a
+            // second row and leaving the first orphaned (live 2026-10-17).
+            try {
+                // bizmodels/get_all is keyed by the query, so a non-null object IS the
+                // model (an absent one answers a business errcode — wireCall throws and
+                // we fall through to create).
+                const record = await readModelRecord(session, args.code);
+                if (record !== null && typeof record === "object") {
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "model-create-duplicate-orphan",
+                        schemaCode: args.code,
+                        applicationCode: args.applicationCode ?? null,
+                        nextCommand: `omc call model.delete --env <env> --args '{"schemaCode":"${args.code}"}'`,
+                        message: `模型 ${args.code} 在册（bizmodels/get_all 可读）但不在应用树中。**先跑一次 model.delete**——它现在会把两种成因分开：` +
+                            `① 读缓存滞后（记录其实已删）→ 回 already-absent/stale-record-cache，随后可直接 create；` +
+                            `② 真孤儿（删除级联中断留下的残骸）→ 回 model-orphaned-record 并给平台侧出路（回收站物理删除 / 换 code），因为 8.6 平台无法删除没有 AppFunction 行的业务模型。` +
+                            `不要重复 create（会再造一条孤儿），也不要只信这一条拒绝信息。`,
+                    });
+                }
             }
-            resolvedFrom = String(folder.id) === folderId ? "explicit" : "explicit-code-resolved";
-            folderId = String(folder.id);
-        }
-        else {
-            const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
-            if (!folder)
-                throw new WireError("business", "no folder found for model creation", 302001);
-            folderId = String(folder.id);
-            resolvedFrom = "auto-default-folder";
-        }
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.modelCreate,
-            method: "POST",
-            body: {
-                appCode: applicationCode,
-                name: args.name,
-                parentId: folderId,
-                modelType: args.modelType ?? MODEL_CREATE_BODY_DEFAULTS.modelType,
-                bizSchemaCode: args.code,
-                icon: MODEL_CREATE_BODY_DEFAULTS.icon,
-                name_i18n: nameI18nJson(args.name),
-                pcAble: MODEL_CREATE_BODY_DEFAULTS.pcAble,
-                mobileAble: MODEL_CREATE_BODY_DEFAULTS.mobileAble,
-                options: MODEL_CREATE_BODY_DEFAULTS.options,
-            },
-        });
-        const present = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data)).some((row) => row.type === "BizModel" && row.code === args.code);
-        return { performed: { errcode: performed.errcode, folderId, resolvedFrom, applicationCode }, readback: { present } };
-    }, undefined, undefined, modelRollbackSpec("model.create"));
+            catch (error) {
+                if (error instanceof ToolRefusalError)
+                    throw error;
+                // A record-face read failure must not be read as absence; let create
+                // proceed and rely on the platform's unique key.
+            }
+            // Cross-face key trap (live 2026-10-17, AI-Platform 1.1.7): apppackage/list
+            // projects a Folder node's h_app_function.CODE, while apppackage/trees rows
+            // carry the function ID. Passing the former straight through as
+            // bizmodels/create.parentId writes an orphan row that the tree assembler
+            // drops — the model reads fine on schema faces but vanishes from the menu,
+            // model.list(tree) and duplicate checks. Resolve BOTH keys and always send
+            // the tree row id.
+            const tree = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+            let folderId = args.folderId;
+            let resolvedFrom = args.folderId ? "explicit" : undefined;
+            if (folderId) {
+                const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string" && (String(row.id) === folderId || String(row.code ?? "") === folderId));
+                if (!folder) {
+                    const candidates = tree.filter((row) => row.type !== "BizModel" && typeof row.id === "string").map((row) => `${String(row.id)}|${String(row.code ?? "")}|${String(row.name ?? "")}`);
+                    throw new ToolRefusalError({
+                        status: "refused",
+                        blocker: "model-create-folder-unresolved",
+                        message: `folderId ${folderId} 未命中应用 ${applicationCode} 树中任何目录（id/code 双口径）——不要把 apppackage/list 的目录 code 当 id 传；候选（id|code|name）：${candidates.join("；") || "（无目录）"}`,
+                        applicationCode,
+                    });
+                }
+                resolvedFrom = String(folder.id) === folderId ? "explicit" : "explicit-code-resolved";
+                folderId = String(folder.id);
+            }
+            else {
+                const folder = tree.find((row) => row.type !== "BizModel" && typeof row.id === "string");
+                if (!folder)
+                    throw new WireError("business", "no folder found for model creation", 302001);
+                folderId = String(folder.id);
+                resolvedFrom = "auto-default-folder";
+            }
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.modelCreate,
+                method: "POST",
+                body: {
+                    appCode: applicationCode,
+                    name: args.name,
+                    parentId: folderId,
+                    modelType: args.modelType ?? MODEL_CREATE_BODY_DEFAULTS.modelType,
+                    bizSchemaCode: args.code,
+                    icon: MODEL_CREATE_BODY_DEFAULTS.icon,
+                    name_i18n: nameI18nJson(args.name),
+                    pcAble: MODEL_CREATE_BODY_DEFAULTS.pcAble,
+                    mobileAble: MODEL_CREATE_BODY_DEFAULTS.mobileAble,
+                    options: MODEL_CREATE_BODY_DEFAULTS.options,
+                },
+            });
+            // r28d F4: prove placement with the same path face folder.create uses
+            // (flattenFolders), not a bare present:true.
+            const afterTree = flattenFolders(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data));
+            const createdNode = afterTree.find((row) => row.type === "BizModel" && row.code === args.code);
+            const present = createdNode !== undefined;
+            return {
+                performed: { errcode: performed.errcode, folderId, resolvedFrom, applicationCode },
+                readback: {
+                    present,
+                    schemaCode: args.code,
+                    folderId: createdNode ? String(createdNode.parentId ?? folderId) : folderId,
+                    path: createdNode ? String(createdNode.path ?? "") : null,
+                    ...(createdNode?.displayPath ? { displayPath: createdNode.displayPath } : {}),
+                    applicationCode,
+                },
+            };
+        },
+        rollback: modelRollbackSpec("model.create"),
+    });
     /** model.delete writeTool extra arg: a session-aware dry-run that scans inbound references (no write). */
     async function modelDeleteDryRun(session, args) {
         const record = await (async () => {
@@ -547,6 +583,9 @@ export function registerModelLane(tools) {
             referencingModels: referencing,
             treeNodeResolved: nodeResolved,
             applicationCode: resolved.applicationCode,
+            // r28g F30：plan 以前只报对外引用，不说本模型内部从属资源会被级联清掉。
+            // 计数走轻量读面；失败不挡 dry-run（仍给定性 cascadeNote）。
+            cascadeNote: "删除模型会级联清掉其字段/表单/列表视图/字段级数据规则/业务规则（含平台预置触发行）及运行数据；其它模型对本模型的关联字段不会自动拆——见 mayBeReferenced/referencingModels。预置规则在幻影 schema 上 list 会重灌，故删前勿对已删 schemaCode 再 rule.list。",
             ...(referencing.length > 0
                 ? { blocker: "model-referenced-by", nextAction: "先删引用方模型或先删其关联字段，再删本模型（依赖倒序）" }
                 : !nodeResolved
@@ -554,455 +593,514 @@ export function registerModelLane(tools) {
                     : {}),
         };
     }
-    writeTool(tools, "model.delete", MODEL_LANE, MODEL_TOOLS["model.delete"].scope, MODEL_TOOLS["model.delete"].description, { schemaCode: z.string().min(1), applicationCode: z.string().optional() }, async (session, args) => {
-        // authoritative model record (bizmodels/get_all); the app-tree node id
-        // may lag behind and is cleaned best-effort.
-        const readRecord = () => readModelRecord(session, args.schemaCode);
-        const record = await readRecord();
-        // Ticket 68: resolve the app-tree node across applications (the tree row
-        // id IS the AppFunction id physically_delete needs). Never fall back to
-        // the biz-model record id — the platform answers 601003 业务模型不存在
-        // for it (removeBizModel looks the id up as an AppFunction id).
-        const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
-        const node = resolved.node;
-        const applicationCode = resolved.applicationCode;
-        const treeRows = async () => applicationCode ? flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data)) : [];
-        if (!node) {
-            if (record === null)
-                return { performed: { skipped: "already-absent" }, readback: { absent: true } };
-            // r12 (2026-10-24): "record readable but no tree node" has TWO causes and
-            // the caller could not tell them apart — create said "go fix parentId",
-            // model.move said "there is no node", model.delete said "no node means
-            // no delete": a closed loop with no exit.
-            //
-            // Cause A: a stale read face. `bizmodels/get_all` is served through a
-            // cache, so a record already removed by a previous delete (or by an
-            // interrupted cascade) keeps answering for a while. Re-read after a
-            // short wait before declaring anything.
-            // ~7s total: long enough to clear a warm read cache, short enough that
-            // a genuine orphan is reported without a long stall. Tests can shrink it
-            // with OMC_MODEL_ORPHAN_RECHECK_MS.
-            const recheckDelay = Number(process.env.OMC_MODEL_ORPHAN_RECHECK_MS ?? 1000);
-            let stillPresent = record;
-            for (let attempt = 0; attempt < 4 && stillPresent !== null; attempt += 1) {
-                await new Promise((resolve) => setTimeout(resolve, Number.isFinite(recheckDelay) ? recheckDelay : 1000));
-                stillPresent = await readRecord();
-            }
-            if (stillPresent === null) {
-                return {
-                    performed: { skipped: "stale-record-cache" },
-                    readback: {
-                        absent: true,
-                        note: "业务模型记录读取面（bizmodels/get_all）先前仍返回该 code，复查后已消失——这是读缓存滞后的残留，模型实际已删除。若刚跑过 model.create 又被拒「已在册」，现在可以重试。",
-                    },
-                };
+    writeTool({
+        tools,
+        name: "model.delete",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.delete"].scope,
+        description: MODEL_TOOLS["model.delete"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            applicationCode: z
+                .string()
+                .optional()
+                .describe("模型所属应用 code（应用包）。省略时先查配置默认应用，再扫其它应用树定位节点；跨应用删除建议显式传入。"),
+        },
+        execute: async (session, args) => {
+            // authoritative model record (bizmodels/get_all); the app-tree node id
+            // may lag behind and is cleaned best-effort.
+            const readRecord = () => readModelRecord(session, args.schemaCode);
+            const record = await readRecord();
+            // Ticket 68: resolve the app-tree node across applications (the tree row
+            // id IS the AppFunction id physically_delete needs). Never fall back to
+            // the biz-model record id — the platform answers 601003 业务模型不存在
+            // for it (removeBizModel looks the id up as an AppFunction id).
+            const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
+            const node = resolved.node;
+            const applicationCode = resolved.applicationCode;
+            const treeRows = async () => applicationCode ? flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: applicationCode } })).data)) : [];
+            if (!node) {
+                if (record === null)
+                    return { performed: { skipped: "already-absent" }, readback: { absent: true } };
+                // r12 (2026-10-24): "record readable but no tree node" has TWO causes and
+                // the caller could not tell them apart — create said "go fix parentId",
+                // model.move said "there is no node", model.delete said "no node means
+                // no delete": a closed loop with no exit.
+                //
+                // Cause A: a stale read face. `bizmodels/get_all` is served through a
+                // cache, so a record already removed by a previous delete (or by an
+                // interrupted cascade) keeps answering for a while. Re-read after a
+                // short wait before declaring anything.
+                // ~7s total: long enough to clear a warm read cache, short enough that
+                // a genuine orphan is reported without a long stall. Tests can shrink it
+                // with OMC_MODEL_ORPHAN_RECHECK_MS.
+                const recheckDelay = Number(process.env.OMC_MODEL_ORPHAN_RECHECK_MS ?? 1000);
+                let stillPresent = record;
+                for (let attempt = 0; attempt < 4 && stillPresent !== null; attempt += 1) {
+                    await new Promise((resolve) => setTimeout(resolve, Number.isFinite(recheckDelay) ? recheckDelay : 1000));
+                    stillPresent = await readRecord();
+                }
+                if (stillPresent === null) {
+                    return {
+                        performed: { skipped: "stale-record-cache" },
+                        readback: {
+                            absent: true,
+                            note: "业务模型记录读取面（bizmodels/get_all）先前仍返回该 code，复查后已消失——这是读缓存滞后的残留，模型实际已删除。若刚跑过 model.create 又被拒「已在册」，现在可以重试。",
+                        },
+                    };
+                }
+                // Cause B: a genuine orphan. The platform has no path: physically_delete
+                // resolves the id through AppFunction and `removeBizModel` throws
+                // APP_FUNCTION_MODEL_NOTEXIST when the row is gone
+                // (AppIntegrationFacadeImpl:1905-1910), so no id can satisfy it.
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-orphaned-record",
+                    schemaCode: args.schemaCode,
+                    retryable: false,
+                    platformLimitation: "removeBizModel(AppIntegrationFacadeImpl:1905) 先 getAppFunction(id)，找不到即抛 APP_FUNCTION_MODEL_NOTEXIST——没有 AppFunction 行的业务模型记录在 8.6 平台上无法通过 physically_delete 删除。",
+                    message: `${args.schemaCode} 的业务模型记录仍在（bizmodels/get_all 持续返回），但应用树里没有它的节点（AppFunction）。` +
+                        `**这是平台侧的不可删状态**：physically_delete 用 AppFunction id 定位，而平台 removeBizModel 找不到 AppFunction 行时抛 APP_FUNCTION_MODEL_NOTEXIST——本工具不猜测 id（传业务记录 id 只会得到 601003 业务模型不存在），因此无法通过 physically_delete 删除。` +
+                        `已连续复查 4 次、间隔约 1s，记录仍在，因此不是读缓存滞后。` +
+                        `已知成因：删除级联被中断（逐列异步 40-60s，中途失败会留下「记录在、节点没了」的残骸）。` +
+                        `可行出路（按代价排序）：① 用平台「回收站 → 物理删除」清理该残留（apppackage/physically_deleteAll 同一路径）；` +
+                        `② 换一个未占用的 schema code 继续（r11/r12 探针均采用此法）；` +
+                        `③ 若你有平台数据库权限，删除 h_biz_schema/h_biz_property/h_biz_sheet 对应行并重启 launcher 清缓存——但这是维护者操作，不在工具权限内。` +
+                        `**不要再重复调用 model.delete / model.move / model.create**：三方都会给出同样的答复。`,
+                });
             }
-            // Cause B: a genuine orphan. The platform has no path: physically_delete
-            // resolves the id through AppFunction and `removeBizModel` throws
-            // APP_FUNCTION_MODEL_NOTEXIST when the row is gone
-            // (AppIntegrationFacadeImpl:1905-1910), so no id can satisfy it.
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-orphaned-record",
-                schemaCode: args.schemaCode,
-                retryable: false,
-                platformLimitation: "removeBizModel(AppIntegrationFacadeImpl:1905) 先 getAppFunction(id)，找不到即抛 APP_FUNCTION_MODEL_NOTEXIST——没有 AppFunction 行的业务模型记录在 8.6 平台上无法通过 physically_delete 删除。",
-                message: `${args.schemaCode} 的业务模型记录仍在（bizmodels/get_all 持续返回），但应用树里没有它的节点（AppFunction）。` +
-                    `**这是平台侧的不可删状态**：physically_delete 用 AppFunction id 定位，而平台 removeBizModel 找不到 AppFunction 行时抛 APP_FUNCTION_MODEL_NOTEXIST——本工具不猜测 id（传业务记录 id 只会得到 601003 业务模型不存在），因此无法通过 physically_delete 删除。` +
-                    `已连续复查 4 次、间隔约 1s，记录仍在，因此不是读缓存滞后。` +
-                    `已知成因：删除级联被中断（逐列异步 40-60s，中途失败会留下「记录在、节点没了」的残骸）。` +
-                    `可行出路（按代价排序）：① 用平台「回收站 → 物理删除」清理该残留（apppackage/physically_deleteAll 同一路径）；` +
-                    `② 换一个未占用的 schema code 继续（r11/r12 探针均采用此法）；` +
-                    `③ 若你有平台数据库权限，删除 h_biz_schema/h_biz_property/h_biz_sheet 对应行并重启 launcher 清缓存——但这是维护者操作，不在工具权限内。` +
-                    `**不要再重复调用 model.delete / model.move / model.create**：三方都会给出同样的答复。`,
-            });
-        }
-        const targetId = node.id;
-        const treeRowList = resolved.treeRows.length > 0 ? resolved.treeRows : await treeRows();
-        // Ticket 23 inbound-reference precheck: the platform's sync face answers
-        // errcode 0 while the async deleteFunctions dispatcher refuses with
-        // "xxx被模型 yyy 引用,不能删除" — surface that refusal at call time with
-        // the referencing models, before any write reaches the environment.
-        const siblings = treeRowList
-            .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== args.schemaCode)
-            .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
-        const referencingModels = [];
-        for (const sibling of siblings) {
-            const referencedFields = [];
-            for (const isPublish of ["false", "true"]) {
-                const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
-                for (const row of wireRows(listed.data)) {
-                    if (relationTargetOf(row) !== args.schemaCode)
-                        continue;
-                    const code = row.code ?? row.propertyCode;
-                    if (typeof code === "string" && !referencedFields.some((field) => field.code === code)) {
-                        referencedFields.push({ code, type: row.type ?? row.propertyType });
+            const targetId = node.id;
+            const treeRowList = resolved.treeRows.length > 0 ? resolved.treeRows : await treeRows();
+            // Ticket 23 inbound-reference precheck: the platform's sync face answers
+            // errcode 0 while the async deleteFunctions dispatcher refuses with
+            // "xxx被模型 yyy 引用,不能删除" — surface that refusal at call time with
+            // the referencing models, before any write reaches the environment.
+            const siblings = treeRowList
+                .filter((row) => row.type === "BizModel" && typeof row.code === "string" && row.code !== args.schemaCode)
+                .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
+            const referencingModels = [];
+            for (const sibling of siblings) {
+                const referencedFields = [];
+                for (const isPublish of ["false", "true"]) {
+                    const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
+                    for (const row of wireRows(listed.data)) {
+                        if (relationTargetOf(row) !== args.schemaCode)
+                            continue;
+                        const code = row.code ?? row.propertyCode;
+                        if (typeof code === "string" && !referencedFields.some((field) => field.code === code)) {
+                            referencedFields.push({ code, type: row.type ?? row.propertyType });
+                        }
                     }
                 }
+                if (referencedFields.length > 0)
+                    referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields: referencedFields });
             }
-            if (referencedFields.length > 0)
-                referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields: referencedFields });
-        }
-        if (referencingModels.length > 0) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-referenced-by",
-                schemaCode: args.schemaCode,
-                referencingModels,
-                deletionOrder: [...referencingModels.map((model) => model.schemaCode), args.schemaCode],
-                nextCommand: `omc call model.delete --args '${JSON.stringify({ schemaCode: referencingModels[0].schemaCode })}'`,
-                message: `${args.schemaCode} 被模型 ${referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用，不能删除（服务端 deleteFunctions 的异步拒绝已提前到调用时）。依赖倒序清理：先删引用方模型（或先删其关联字段），再删被引用模型；引用方物理删除的逐列异步级联需 40-60s，完成后再删本模型。`,
+            if (referencingModels.length > 0) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-referenced-by",
+                    schemaCode: args.schemaCode,
+                    referencingModels,
+                    deletionOrder: [...referencingModels.map((model) => model.schemaCode), args.schemaCode],
+                    nextCommand: `omc call model.delete --args '${JSON.stringify({ schemaCode: referencingModels[0].schemaCode })}'`,
+                    message: `${args.schemaCode} 被模型 ${referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用，不能删除（服务端 deleteFunctions 的异步拒绝已提前到调用时）。依赖倒序清理：先删引用方模型（或先删其关联字段），再删被引用模型；引用方物理删除的逐列异步级联需 40-60s，完成后再删本模型。`,
+                });
+            }
+            // Model deletion CASCADES the workflow template away but leaves
+            // `biz_workitem` rows pointing at it. The platform's global todo search
+            // resolves every hit's template, so ONE orphan NPEs the whole page for
+            // everyone (r14 live: 8 consecutive 50000s; cleanup needed a maintainer
+            // with DB access). Warn while it is still actionable.
+            const liveWorkflows = await pendingWorkflowItems(session, args.schemaCode);
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.appPackagePhysicallyDelete,
+                method: "POST",
+                body: [{ id: targetId, code: args.schemaCode, type: "BizModel" }],
             });
-        }
-        // Model deletion CASCADES the workflow template away but leaves
-        // `biz_workitem` rows pointing at it. The platform's global todo search
-        // resolves every hit's template, so ONE orphan NPEs the whole page for
-        // everyone (r14 live: 8 consecutive 50000s; cleanup needed a maintainer
-        // with DB access). Warn while it is still actionable.
-        const liveWorkflows = await pendingWorkflowItems(session, args.schemaCode);
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.appPackagePhysicallyDelete,
-            method: "POST",
-            body: [{ id: targetId, code: args.schemaCode, type: "BizModel" }],
-        });
-        // Both the model record and the app-tree node are eventually consistent
-        // (the per-column async cascade takes 3-4s per column, 40-60s for a
-        // 12-column model). Poll the authoritative record face for verified
-        // absence (~60s budget), then report the tree-node state as a pending
-        // hint with explicit wait-and-recheck guidance instead of a failure.
-        let absent = false;
-        for (let attempt = 0; attempt < 16 && !absent; attempt += 1) {
-            if (attempt > 0)
-                await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
-            absent = (await readRecord()) === null;
-        }
-        const treeNodePending = (await treeRows()).some((row) => row.type === "BizModel" && row.code === args.schemaCode);
-        return {
-            performed: { errcode: performed.errcode, deletedId: targetId, applicationCode },
-            readback: {
-                absent,
-                treeNodePending,
-                ...(liveWorkflows.length > 0
-                    ? {
-                        workflowWarning: {
-                            code: "model-deleted-with-pending-work-items",
-                            severity: "warning",
-                            workflows: liveWorkflows,
-                            message: `删除前该模型的流程还有未完结待办（${liveWorkflows.map((row) => `${row.workflowCode}:${row.pending}`).join("、")}）。` +
-                                `模型删除会级联掉流程模板，但**不会**清掉这些待办；它们从此指向空模板，而平台全局待办搜索会给每条待办解析模板 —— **一条缺失就整页 NPE（50000），所有用户的待办列表一起坏掉**（r14 实测 8 连击，只能靠维护者清库恢复）。` +
-                                `若 now 已经删了：用 workitem.list 的 \`workflowCode\` 或 \`participant\` 参数绕开全局搜索，并请维护者清理这些脏待办。下次请先完结实例再删模型。`,
-                        },
-                    }
-                    : {}),
-                ...(absent
-                    ? {}
-                    : {
-                        nextAction: "wait-and-recheck",
-                        note: "异步逐列级联实测 40-60s：absent:false + treeNodePending:true 表示删除级联仍在进行，不是失败。等待约 60s 后重跑 model.delete（幂等，already-absent 短路）复核；若刚删除引用方模型，其级联可能仍在拆除关联列，必须等它完成后再删本模型。",
-                    }),
-            },
-        };
-    }, undefined, modelDeleteDryRun, modelRollbackSpec("model.delete"));
-    writeTool(tools, "model.deleteMany", MODEL_LANE, MODEL_TOOLS["model.deleteMany"].scope, MODEL_TOOLS["model.deleteMany"].description, { schemaCodes: z.array(z.string().min(1)).min(1), applicationCode: z.string().optional() }, async (session, args) => {
-        // Platform evidence: physically_delete takes the WHOLE list in ONE
-        // request (AppPackageController.java:1424 @RequestBody
-        // List<AppDeleteParamVO>, 8.6.26 decompiled-full). The batch tool sends
-        // every existing model in that single request after prechecking each
-        // target's inbound references — a referenced model refuses the whole
-        // batch with per-target evidence and ZERO side effects.
-        const readRecord = (schemaCode) => readModelRecord(session, schemaCode);
-        const applicationCode = await resolveApplicationCode(session, args.applicationCode).catch(() => "");
-        const targets = [...new Set(args.schemaCodes)];
-        const alreadyAbsent = [];
-        const entries = [];
-        const unresolved = [];
-        // Ticket 68: resolve each model's app-tree node across applications; the
-        // tree id (AppFunction id) is what physically_delete needs. Collect the
-        // resolved trees for the sibling scan (cross-application references too).
-        const resolvedTrees = [];
-        const seenTrees = new Set();
-        const appsToScan = new Set();
-        for (const code of targets) {
-            const resolved = await resolveModelTreeNode(session, code, args.applicationCode);
-            appsToScan.add(resolved.applicationCode);
-            if (!seenTrees.has(resolved.applicationCode) && resolved.treeRows.length > 0) {
-                seenTrees.add(resolved.applicationCode);
-                resolvedTrees.push(...resolved.treeRows);
+            // Both the model record and the app-tree node are eventually consistent
+            // (the per-column async cascade takes 3-4s per column, 40-60s for a
+            // 12-column model). Poll the authoritative record face for verified
+            // absence (~60s budget), then report the tree-node state as a pending
+            // hint with explicit wait-and-recheck guidance instead of a failure.
+            let absent = false;
+            for (let attempt = 0; attempt < 16 && !absent; attempt += 1) {
+                if (attempt > 0)
+                    await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
+                absent = (await readRecord()) === null;
             }
-            if (resolved.node?.id) {
-                entries.push({ id: resolved.node.id, code, type: "BizModel" });
+            const treeNodePending = (await treeRows()).some((row) => row.type === "BizModel" && row.code === args.schemaCode);
+            return {
+                performed: { errcode: performed.errcode, deletedId: targetId, applicationCode },
+                readback: {
+                    absent,
+                    treeNodePending,
+                    ...(liveWorkflows.length > 0
+                        ? {
+                            workflowWarning: {
+                                code: "model-deleted-with-pending-work-items",
+                                severity: "warning",
+                                workflows: liveWorkflows,
+                                message: `删除前该模型的流程还有未完结待办（${liveWorkflows.map((row) => `${row.workflowCode}:${row.pending}`).join("、")}）。` +
+                                    `模型删除会级联掉流程模板，但**不会**清掉这些待办；它们从此指向空模板，而平台全局待办搜索会给每条待办解析模板 —— **一条缺失就整页 NPE（50000），所有用户的待办列表一起坏掉**（r14 实测 8 连击，只能靠维护者清库恢复）。` +
+                                    `若 now 已经删了：用 workitem.list 的 \`workflowCode\` 或 \`participant\` 参数绕开全局搜索，并请维护者清理这些脏待办。下次请先完结实例再删模型。`,
+                            },
+                        }
+                        : {}),
+                    ...(absent
+                        ? {}
+                        : {
+                            nextAction: "wait-and-recheck",
+                            note: "异步逐列级联实测 40-60s：absent:false + treeNodePending:true 表示删除级联仍在进行，不是失败。等待约 60s 后重跑 model.delete（幂等，already-absent 短路）复核；若刚删除引用方模型，其级联可能仍在拆除关联列，必须等它完成后再删本模型。",
+                        }),
+                },
+            };
+        },
+        dryRunPayload: modelDeleteDryRun,
+        rollback: modelRollbackSpec("model.delete"),
+    });
+    writeTool({
+        tools,
+        name: "model.deleteMany",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.deleteMany"].scope,
+        description: MODEL_TOOLS["model.deleteMany"].description,
+        inputSchema: { schemaCodes: z.array(z.string().min(1)).min(1), applicationCode: z.string().optional() },
+        execute: async (session, args) => {
+            // Platform evidence: physically_delete takes the WHOLE list in ONE
+            // request (AppPackageController.java:1424 @RequestBody
+            // List<AppDeleteParamVO>, 8.6.26 decompiled-full). The batch tool sends
+            // every existing model in that single request after prechecking each
+            // target's inbound references — a referenced model refuses the whole
+            // batch with per-target evidence and ZERO side effects.
+            const readRecord = (schemaCode) => readModelRecord(session, schemaCode);
+            const applicationCode = await resolveApplicationCode(session, args.applicationCode).catch(() => "");
+            const targets = [...new Set(args.schemaCodes)];
+            const alreadyAbsent = [];
+            const entries = [];
+            const unresolved = [];
+            // Ticket 68: resolve each model's app-tree node across applications; the
+            // tree id (AppFunction id) is what physically_delete needs. Collect the
+            // resolved trees for the sibling scan (cross-application references too).
+            const resolvedTrees = [];
+            const seenTrees = new Set();
+            const appsToScan = new Set();
+            for (const code of targets) {
+                const resolved = await resolveModelTreeNode(session, code, args.applicationCode);
+                appsToScan.add(resolved.applicationCode);
+                if (!seenTrees.has(resolved.applicationCode) && resolved.treeRows.length > 0) {
+                    seenTrees.add(resolved.applicationCode);
+                    resolvedTrees.push(...resolved.treeRows);
+                }
+                if (resolved.node?.id) {
+                    entries.push({ id: resolved.node.id, code, type: "BizModel" });
+                }
+                else if ((await readRecord(code)) === null) {
+                    alreadyAbsent.push(code);
+                }
+                else {
+                    unresolved.push(code);
+                }
             }
-            else if ((await readRecord(code)) === null) {
-                alreadyAbsent.push(code);
+            if (unresolved.length > 0) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-application-unresolved",
+                    unresolved,
+                    message: `批量删除被拒（零副作用）：${unresolved.join("、")} 的业务模型记录仍存在但在任何应用树中都找不到节点（AppFunction）——physically_delete 需要 AppFunction id，不能拿业务模型记录 id 猜测。请显式传 applicationCode，或先用 discover_environment 确认归属应用。`,
+                });
             }
-            else {
-                unresolved.push(code);
+            const treeRowList = resolvedTrees;
+            // Per-target inbound-reference precheck (ticket 23 semantics, scanned
+            // once per sibling across all batch targets). Siblings INSIDE the batch
+            // are being deleted together and therefore do not block.
+            const batchSet = new Set(targets);
+            const siblings = treeRowList
+                .filter((row) => row.type === "BizModel" && typeof row.code === "string" && !batchSet.has(String(row.code)))
+                .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
+            const blockedTargets = [];
+            for (const sibling of siblings) {
+                const hitsByTarget = new Map();
+                for (const isPublish of ["false", "true"]) {
+                    const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
+                    for (const row of wireRows(listed.data)) {
+                        const target = relationTargetOf(row);
+                        if (target === undefined || !batchSet.has(target))
+                            continue;
+                        const code = row.code ?? row.propertyCode;
+                        if (typeof code !== "string")
+                            continue;
+                        const hits = hitsByTarget.get(target) ?? [];
+                        if (!hits.some((field) => field.code === code))
+                            hits.push({ code, type: row.type ?? row.propertyType });
+                        hitsByTarget.set(target, hits);
+                    }
+                }
+                for (const [target, fields] of hitsByTarget) {
+                    const blocked = blockedTargets.find((entry) => entry.schemaCode === target) ?? { schemaCode: target, referencingModels: [] };
+                    blocked.referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields });
+                    if (!blockedTargets.includes(blocked))
+                        blockedTargets.push(blocked);
+                }
             }
-        }
-        if (unresolved.length > 0) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-application-unresolved",
-                unresolved,
-                message: `批量删除被拒（零副作用）：${unresolved.join("、")} 的业务模型记录仍存在但在任何应用树中都找不到节点（AppFunction）——physically_delete 需要 AppFunction id，不能拿业务模型记录 id 猜测。请显式传 applicationCode，或先用 discover_environment 确认归属应用。`,
+            if (blockedTargets.length > 0) {
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-referenced-by",
+                    blockedTargets,
+                    message: `批量删除被拒（零副作用）：${blockedTargets.map((blocked) => `${blocked.schemaCode} 被模型 ${blocked.referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用`).join("；")}。依赖倒序清理：把引用方模型一并纳入 schemaCodes（或先删其关联字段）；引用方物理删除的逐列异步级联需 40-60s，完成后再删被引用模型。`,
+                });
+            }
+            if (entries.length === 0) {
+                return { performed: { skipped: "already-absent", alreadyAbsent }, readback: { perCode: Object.fromEntries(targets.map((code) => [code, { absent: true }])), allAbsent: true } };
+            }
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.appPackagePhysicallyDelete,
+                method: "POST",
+                body: entries,
             });
-        }
-        const treeRowList = resolvedTrees;
-        // Per-target inbound-reference precheck (ticket 23 semantics, scanned
-        // once per sibling across all batch targets). Siblings INSIDE the batch
-        // are being deleted together and therefore do not block.
-        const batchSet = new Set(targets);
-        const siblings = treeRowList
-            .filter((row) => row.type === "BizModel" && typeof row.code === "string" && !batchSet.has(String(row.code)))
-            .map((row) => ({ schemaCode: String(row.code), name: typeof row.name === "string" && row.name ? row.name : String(row.code) }));
-        const blockedTargets = [];
-        for (const sibling of siblings) {
-            const hitsByTarget = new Map();
-            for (const isPublish of ["false", "true"]) {
-                const listed = await wireCall(session, { path: ENDPOINTS.fieldList, query: { schemaCode: sibling.schemaCode, isPublish } });
-                for (const row of wireRows(listed.data)) {
-                    const target = relationTargetOf(row);
-                    if (target === undefined || !batchSet.has(target))
+            // Per-model absence polling on the authoritative record face (the async
+            // per-column cascade takes 40-60s per model); pending codes carry the
+            // same wait-and-recheck guidance as model.delete.
+            const absentSet = new Set();
+            for (let attempt = 0; attempt < 16 && absentSet.size < entries.length; attempt += 1) {
+                if (attempt > 0)
+                    await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
+                for (const entry of entries) {
+                    if (absentSet.has(entry.code))
                         continue;
-                    const code = row.code ?? row.propertyCode;
-                    if (typeof code !== "string")
-                        continue;
-                    const hits = hitsByTarget.get(target) ?? [];
-                    if (!hits.some((field) => field.code === code))
-                        hits.push({ code, type: row.type ?? row.propertyType });
-                    hitsByTarget.set(target, hits);
+                    if ((await readRecord(entry.code)) === null)
+                        absentSet.add(entry.code);
                 }
             }
-            for (const [target, fields] of hitsByTarget) {
-                const blocked = blockedTargets.find((entry) => entry.schemaCode === target) ?? { schemaCode: target, referencingModels: [] };
-                blocked.referencingModels.push({ schemaCode: sibling.schemaCode, name: sibling.name, fields });
-                if (!blockedTargets.includes(blocked))
-                    blockedTargets.push(blocked);
-            }
-        }
-        if (blockedTargets.length > 0) {
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-referenced-by",
-                blockedTargets,
-                message: `批量删除被拒（零副作用）：${blockedTargets.map((blocked) => `${blocked.schemaCode} 被模型 ${blocked.referencingModels.map((model) => model.schemaCode).join("、")} 的关联字段引用`).join("；")}。依赖倒序清理：把引用方模型一并纳入 schemaCodes（或先删其关联字段）；引用方物理删除的逐列异步级联需 40-60s，完成后再删被引用模型。`,
-            });
-        }
-        if (entries.length === 0) {
-            return { performed: { skipped: "already-absent", alreadyAbsent }, readback: { perCode: Object.fromEntries(targets.map((code) => [code, { absent: true }])), allAbsent: true } };
-        }
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.appPackagePhysicallyDelete,
-            method: "POST",
-            body: entries,
-        });
-        // Per-model absence polling on the authoritative record face (the async
-        // per-column cascade takes 40-60s per model); pending codes carry the
-        // same wait-and-recheck guidance as model.delete.
-        const absentSet = new Set();
-        for (let attempt = 0; attempt < 16 && absentSet.size < entries.length; attempt += 1) {
-            if (attempt > 0)
-                await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 4000)));
-            for (const entry of entries) {
-                if (absentSet.has(entry.code))
+            const afterTree = (await Promise.all([...appsToScan]
+                .filter((appCode) => appCode)
+                .map(async (appCode) => flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data))))).flat();
+            const perCode = {};
+            for (const code of targets) {
+                if (alreadyAbsent.includes(code)) {
+                    perCode[code] = { absent: true };
                     continue;
-                if ((await readRecord(entry.code)) === null)
-                    absentSet.add(entry.code);
+                }
+                const absent = absentSet.has(code);
+                const treeNodePending = afterTree.some((row) => row.type === "BizModel" && row.code === code);
+                perCode[code] = absent ? { absent, ...(treeNodePending ? { treeNodePending } : {}) } : { absent, treeNodePending, nextAction: "wait-and-recheck", note: "异步逐列级联实测 40-60s：absent:false 表示该模型的删除级联仍在进行，不是失败。等待约 60s 后重跑 model.deleteMany（幂等，already-absent 短路）复核。" };
             }
-        }
-        const afterTree = (await Promise.all([...appsToScan]
-            .filter((appCode) => appCode)
-            .map(async (appCode) => flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data))))).flat();
-        const perCode = {};
-        for (const code of targets) {
-            if (alreadyAbsent.includes(code)) {
-                perCode[code] = { absent: true };
-                continue;
+            const allAbsent = targets.every((code) => perCode[code]?.absent === true);
+            return {
+                performed: { errcode: performed.errcode, deletedIds: entries.map((entry) => entry.id), alreadyAbsent, requested: targets, applicationCode },
+                readback: {
+                    perCode,
+                    allAbsent,
+                    ...(allAbsent ? {} : { nextAction: "wait-and-recheck", note: "部分模型仍在异步级联中；按 perCode 逐项查看，等待约 60s 后重跑（幂等）。" }),
+                },
+            };
+        },
+        preflight: (args) => {
+            const codes = args.schemaCodes;
+            if (!Array.isArray(codes) || codes.length === 0 || new Set(codes).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0)) {
+                throw new ToolRefusalError({ status: "refused", blocker: "model-delete-many-invalid", message: "schemaCodes 必须是非空、去重的模型 code 数组" });
             }
-            const absent = absentSet.has(code);
-            const treeNodePending = afterTree.some((row) => row.type === "BizModel" && row.code === code);
-            perCode[code] = absent ? { absent, ...(treeNodePending ? { treeNodePending } : {}) } : { absent, treeNodePending, nextAction: "wait-and-recheck", note: "异步逐列级联实测 40-60s：absent:false 表示该模型的删除级联仍在进行，不是失败。等待约 60s 后重跑 model.deleteMany（幂等，already-absent 短路）复核。" };
-        }
-        const allAbsent = targets.every((code) => perCode[code]?.absent === true);
-        return {
-            performed: { errcode: performed.errcode, deletedIds: entries.map((entry) => entry.id), alreadyAbsent, requested: targets, applicationCode },
-            readback: {
-                perCode,
-                allAbsent,
-                ...(allAbsent ? {} : { nextAction: "wait-and-recheck", note: "部分模型仍在异步级联中；按 perCode 逐项查看，等待约 60s 后重跑（幂等）。" }),
-            },
-        };
-    }, (args) => {
-        const codes = args.schemaCodes;
-        if (!Array.isArray(codes) || codes.length === 0 || new Set(codes).size !== codes.length || codes.some((code) => typeof code !== "string" || code.length === 0)) {
-            throw new ToolRefusalError({ status: "refused", blocker: "model-delete-many-invalid", message: "schemaCodes 必须是非空、去重的模型 code 数组" });
-        }
-    });
-    writeTool(tools, "model.setSummary", MODEL_LANE, MODEL_TOOLS["model.setSummary"].scope, MODEL_TOOLS["model.setSummary"].description, {
-        schemaCode: z.string().min(1),
-        summary: z.string().min(1).describe('数据标题表达式，线上存储形状是 Summary[] JSON（isDataItem 1=表单字段、2=查询字段），如 [{"isDataItem":1,"code":"subject"}]；也接受纯 {字段} 占位串（自动转换为 Summary[]）。含字面文本的模板无法表示会被拒（model-summary-invalid）'),
-    }, async (session, args) => {
-        // 8.6.26 BizSchemaController.updateSummary (decompiled :700-736):
-        // POST bizmodels/update_summary {schemaCode, summary}; the platform
-        // itself requires a non-empty summary (validateNotEmpty) and answers
-        // 300014 BIZ_SCHEMA_NOT_PUBLISHED for a missing schema. Readback is the
-        // sibling GET get_summary face.
-        const summary = normalizeSummaryInput(args.summary);
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.modelUpdateSummary,
-            method: "POST",
-            body: { schemaCode: args.schemaCode, summary },
-        });
-        const readback = await wireCall(session, { path: ENDPOINTS.modelGetSummary, query: { schemaCode: args.schemaCode } });
-        const stored = readback.data ?? "";
-        const storedValid = isCanonicalSummary(stored);
-        return {
-            performed: { errcode: performed.errcode },
-            readback: {
-                summary: stored,
-                normalized: summary,
-                ...(storedValid ? {} : { warning: "读回的 summary 不是合法 Summary[]（平台运行时标题解析会抛反序列化异常 → 该模型 data.save/submit 恒 50000）；用本工具以 Summary[] 或纯 {字段} 串重写修复" }),
-            },
-        };
-    }, (args) => {
-        if (typeof args.summary !== "string" || args.summary.trim().length === 0)
-            throw new ToolRefusalError({ status: "refused", blocker: "model-summary-empty", message: "数据标题 summary 不允许为空（平台 validateNotEmpty 同语义）" });
-        normalizeSummaryInput(args.summary);
+        },
     });
-    writeTool(tools, "model.update", MODEL_LANE, MODEL_TOOLS["model.update"].scope, MODEL_TOOLS["model.update"].description, {
-        schemaCode: z.string().min(1),
-        name: z.string().min(1).optional().describe("新显示名（bizmodels/update 补丁语义，读回 get_all + 应用树节点）"),
-        modelType: z.enum(["LIST", "TREE"]).optional().describe("恒拒（model-type-immutable）：模型类型创建时固化，bizmodels/update 只更新菜单节点显示"),
-    }, async (session, args) => {
-        // Source-pinned contract (BizSchemaController.update, 8.6.26
-        // decompiled :266-305): POST/PUT bizmodels/update with AppFunctionVO —
-        // bizSchemaCode, id (AppFunction node id), name, parentId are ALL
-        // validateNotEmpty-required; the endpoint patches the AppFunction MENU
-        // NODE (setName/setIcon/setModelType...), it does not migrate the
-        // underlying schema (probe evidence: get_all keeps the original type).
-        // So: resolve the tree node for id + parentId, patch the name, and read
-        // the NODE face back (the schema record name may stay unchanged).
-        const resolved = await resolveModelTreeNode(session, args.schemaCode);
-        const node = resolved.node;
-        if (!node)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-update-target-absent",
-                schemaCode: args.schemaCode,
-                message: `模型 ${args.schemaCode} 无应用树节点（bizmodels/update 只更新 AppFunction 菜单节点，id/parentId 均必需）——确认 schemaCode 或先用 model.create`,
-            });
-        if (args.name === undefined)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-update-empty-patch",
-                schemaCode: args.schemaCode,
-                message: "没有可应用的补丁字段——至少提供 name（改名节点显示）；数据标题用 model.setSummary",
-            });
-        const nodeId = typeof node.id === "string" ? node.id : String(node.id ?? "");
-        const parentId = typeof node.parentId === "string" ? node.parentId : String(node.parentId ?? "");
-        if (!nodeId || !parentId)
-            throw new WireError("business", `app tree node for ${args.schemaCode} lacks id/parentId (bizmodels/update requires both)`, 10005);
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.modelUpdate,
-            method: "POST",
-            body: { bizSchemaCode: args.schemaCode, id: nodeId, parentId, name: args.name },
-        });
-        // Authoritative readback: the tree NODE name (the patched face). The
-        // get_all record face is read informationally — the schema record is
-        // NOT migrated by this endpoint (probe evidence).
-        const after = await resolveModelTreeNode(session, args.schemaCode);
-        const nodeAfter = after.node;
-        // Informational only: the app-tree node is the authoritative face for a
-        // rename, so an unreadable record face must not fail the whole call.
-        const record = await readModelRecord(session, args.schemaCode).catch(() => null);
-        const recordName = record?.name ?? null;
-        const nodeName = typeof nodeAfter?.name === "string" ? nodeAfter.name : null;
-        return {
-            performed: { errcode: performed.errcode },
-            readback: { schemaCode: args.schemaCode, name: nodeName, renamed: nodeName === args.name, recordName, authoritativeFace: "app-tree-node" },
-        };
-    }, (args) => {
-        // `omc call` bypasses zod, so an extra modelType key still reaches here.
-        const raw = args;
-        // Probe evidence (yunshu ledger + ticket 09): bizmodels/update only
-        // updates the app-menu node display — the underlying schema (type, tree
-        // system fields) is FIXED at create. A modelType patch here would look
-        // accepted while get_all keeps the original type: refuse it.
-        if (raw.modelType !== undefined)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-type-immutable",
-                schemaCode: raw.schemaCode,
-                message: "模型类型在创建时固化——bizmodels/update 只更新应用菜单节点显示，不能把底层 schema 从 LIST 迁移为 TREE（get_all 仍返回原类型与树系统字段，live 取证）。要树模型请建新模型",
+    writeTool({
+        tools,
+        name: "model.setSummary",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.setSummary"].scope,
+        description: MODEL_TOOLS["model.setSummary"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            summary: z.string().min(1).describe('数据标题表达式，线上存储形状是 Summary[] JSON（isDataItem 1=表单字段、2=查询字段），如 [{"isDataItem":1,"code":"subject"}]；也接受纯 {字段} 占位串（自动转换为 Summary[]）。含字面文本的模板无法表示会被拒（model-summary-invalid）'),
+        },
+        execute: async (session, args) => {
+            // 8.6.26 BizSchemaController.updateSummary (decompiled :700-736):
+            // POST bizmodels/update_summary {schemaCode, summary}; the platform
+            // itself requires a non-empty summary (validateNotEmpty) and answers
+            // 300014 BIZ_SCHEMA_NOT_PUBLISHED for a missing schema. Readback is the
+            // sibling GET get_summary face.
+            const summary = normalizeSummaryInput(args.summary);
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.modelUpdateSummary,
+                method: "POST",
+                body: { schemaCode: args.schemaCode, summary },
             });
-    }, undefined, modelRollbackSpec("model.update"));
-    writeTool(tools, "model.move", MODEL_LANE, "move a model's app-tree node to another folder (bizmodels/update parentId)", "把模型移动到指定应用目录（分组）：`POST bizmodels/update` 的 `parentId`（与 model.update 同一端点，AppFunctionController 补丁语义：bizSchemaCode/id/name/parentId 全量必填，工具从应用树解析）。`folderId` 必须是目录节点 id（`folder.tree` 的 id），**不能直接给目录名**——重名目录会定位错。移动后按应用树回读 `parentId/path` 确认；模型的 schema、字段、表单、视图都不动，只换菜单节点归属。目标目录不存在时拒绝 `folder-not-found` 并列出目录树。", {
-        schemaCode: z.string().min(1),
-        folderId: z.string().min(1).describe("目标目录 id（folder.tree 的 id）；顶层目录也是真实 id，不要传空"),
-        applicationCode: z.string().optional().describe("模型所在应用 code（跨应用时显式给）"),
-    }, async (session, args) => {
-        const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
-        if (!resolved.node)
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: "model-update-target-absent",
-                schemaCode: args.schemaCode,
-                message: `模型 ${args.schemaCode} 无应用树节点——确认 schemaCode/应用 code（model.move 只改 AppFunction 节点归属）`,
+            const readback = await wireCall(session, { path: ENDPOINTS.modelGetSummary, query: { schemaCode: args.schemaCode } });
+            const stored = readback.data ?? "";
+            const storedValid = isCanonicalSummary(stored);
+            return {
+                performed: { errcode: performed.errcode },
+                readback: {
+                    summary: stored,
+                    normalized: summary,
+                    ...(storedValid ? {} : { warning: "读回的 summary 不是合法 Summary[]（平台运行时标题解析会抛反序列化异常 → 该模型 data.save/submit 恒 50000）；用本工具以 Summary[] 或纯 {字段} 串重写修复" }),
+                },
+            };
+        },
+        preflight: (args) => {
+            if (typeof args.summary !== "string" || args.summary.trim().length === 0)
+                throw new ToolRefusalError({ status: "refused", blocker: "model-summary-empty", message: "数据标题 summary 不允许为空（平台 validateNotEmpty 同语义）" });
+            normalizeSummaryInput(args.summary);
+        },
+    });
+    writeTool({
+        tools,
+        name: "model.update",
+        lane: MODEL_LANE,
+        scope: MODEL_TOOLS["model.update"].scope,
+        description: MODEL_TOOLS["model.update"].description,
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            name: z.string().min(1).optional().describe("新显示名（bizmodels/update 补丁语义，读回 get_all + 应用树节点）"),
+            modelType: z.enum(["LIST", "TREE"]).optional().describe("恒拒（model-type-immutable）：模型类型创建时固化，bizmodels/update 只更新菜单节点显示"),
+        },
+        execute: async (session, args) => {
+            // Source-pinned contract (BizSchemaController.update, 8.6.26
+            // decompiled :266-305): POST/PUT bizmodels/update with AppFunctionVO —
+            // bizSchemaCode, id (AppFunction node id), name, parentId are ALL
+            // validateNotEmpty-required; the endpoint patches the AppFunction MENU
+            // NODE (setName/setIcon/setModelType...), it does not migrate the
+            // underlying schema (probe evidence: get_all keeps the original type).
+            // So: resolve the tree node for id + parentId, patch the name, and read
+            // the NODE face back (the schema record name may stay unchanged).
+            const resolved = await resolveModelTreeNode(session, args.schemaCode);
+            const node = resolved.node;
+            if (!node)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-update-target-absent",
+                    schemaCode: args.schemaCode,
+                    message: `模型 ${args.schemaCode} 无应用树节点（bizmodels/update 只更新 AppFunction 菜单节点，id/parentId 均必需）——确认 schemaCode 或先用 model.create`,
+                });
+            if (args.name === undefined)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-update-empty-patch",
+                    schemaCode: args.schemaCode,
+                    message: "没有可应用的补丁字段——至少提供 name（改名节点显示）；数据标题用 model.setSummary",
+                });
+            const nodeId = typeof node.id === "string" ? node.id : String(node.id ?? "");
+            const parentId = typeof node.parentId === "string" ? node.parentId : String(node.parentId ?? "");
+            if (!nodeId || !parentId)
+                throw new WireError("business", `app tree node for ${args.schemaCode} lacks id/parentId (bizmodels/update requires both)`, 10005);
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.modelUpdate,
+                method: "POST",
+                body: { bizSchemaCode: args.schemaCode, id: nodeId, parentId, name: args.name },
             });
-        const appCode = resolved.applicationCode;
-        const tree = resolved.treeRows.length > 0 ? resolved.treeRows : flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data));
-        const target = tree.find((row) => String(row.id ?? "") === args.folderId);
-        if (!target || String(target.type ?? "") !== "Folder") {
-            // A folder from ANOTHER application is the common miss (the model and
-            // the folder must live in the same app tree). Name that instead of a
-            // bare "not found".
-            const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data);
-            let otherApp;
-            for (const app of apps) {
-                const candidate = String(app.appCode ?? app.code ?? "");
-                if (!candidate || candidate === appCode)
-                    continue;
-                const rows = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: candidate } })).data));
-                if (rows.some((row) => String(row.id ?? "") === args.folderId && String(row.type ?? "") === "Folder")) {
-                    otherApp = candidate;
-                    break;
+            // Authoritative readback: the tree NODE name (the patched face). The
+            // get_all record face is read informationally — the schema record is
+            // NOT migrated by this endpoint (probe evidence).
+            const after = await resolveModelTreeNode(session, args.schemaCode);
+            const nodeAfter = after.node;
+            // Informational only: the app-tree node is the authoritative face for a
+            // rename, so an unreadable record face must not fail the whole call.
+            const record = await readModelRecord(session, args.schemaCode).catch(() => null);
+            const recordName = record?.name ?? null;
+            const nodeName = typeof nodeAfter?.name === "string" ? nodeAfter.name : null;
+            return {
+                performed: { errcode: performed.errcode },
+                readback: { schemaCode: args.schemaCode, name: nodeName, renamed: nodeName === args.name, recordName, authoritativeFace: "app-tree-node" },
+            };
+        },
+        preflight: (args) => {
+            // `omc call` bypasses zod, so an extra modelType key still reaches here.
+            const raw = args;
+            // Probe evidence (yunshu ledger + ticket 09): bizmodels/update only
+            // updates the app-menu node display — the underlying schema (type, tree
+            // system fields) is FIXED at create. A modelType patch here would look
+            // accepted while get_all keeps the original type: refuse it.
+            if (raw.modelType !== undefined)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-type-immutable",
+                    schemaCode: raw.schemaCode,
+                    message: "模型类型在创建时固化——bizmodels/update 只更新应用菜单节点显示，不能把底层 schema 从 LIST 迁移为 TREE（get_all 仍返回原类型与树系统字段，live 取证）。要树模型请建新模型",
+                });
+        },
+        rollback: modelRollbackSpec("model.update"),
+    });
+    writeTool({
+        tools,
+        name: "model.move",
+        lane: MODEL_LANE,
+        scope: "move a model's app-tree node to another folder (bizmodels/update parentId)",
+        description: "把模型移动到指定应用目录（分组）：`POST bizmodels/update` 的 `parentId`（与 model.update 同一端点，AppFunctionController 补丁语义：bizSchemaCode/id/name/parentId 全量必填，工具从应用树解析）。`folderId` 必须是目录节点 id（`folder.tree` 的 id），**不能直接给目录名**——重名目录会定位错。移动后按应用树回读 `parentId/path` 确认；模型的 schema、字段、表单、视图都不动，只换菜单节点归属。目标目录不存在时拒绝 `folder-not-found` 并列出目录树。",
+        inputSchema: {
+            schemaCode: z.string().min(1),
+            folderId: z
+                .string()
+                .min(1)
+                .describe("目标目录 id（必须是 folder.tree 里 type=Folder 的 id；顶层目录也是真实 id，不要传空或目录名）"),
+            applicationCode: z
+                .string()
+                .optional()
+                .describe("模型所在应用 code（应用包，跨应用时显式给）；folder.* 的 appCode 别名本工具不认。"),
+        },
+        execute: async (session, args) => {
+            const resolved = await resolveModelTreeNode(session, args.schemaCode, args.applicationCode);
+            if (!resolved.node)
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: "model-update-target-absent",
+                    schemaCode: args.schemaCode,
+                    message: `模型 ${args.schemaCode} 无应用树节点——确认 schemaCode/应用 code（model.move 只改 AppFunction 节点归属）`,
+                });
+            const appCode = resolved.applicationCode;
+            const tree = resolved.treeRows.length > 0 ? resolved.treeRows : flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode } })).data));
+            const target = tree.find((row) => String(row.id ?? "") === args.folderId);
+            if (!target || String(target.type ?? "") !== "Folder") {
+                // A folder from ANOTHER application is the common miss (the model and
+                // the folder must live in the same app tree). Name that instead of a
+                // bare "not found".
+                const apps = wireRows((await wireCall(session, { path: ENDPOINTS.applicationList, query: {} })).data);
+                let otherApp;
+                for (const app of apps) {
+                    const candidate = String(app.appCode ?? app.code ?? "");
+                    if (!candidate || candidate === appCode)
+                        continue;
+                    const rows = flattenTreeRows(wireRows((await wireCall(session, { path: ENDPOINTS.applicationTree, query: { appCode: candidate } })).data));
+                    if (rows.some((row) => String(row.id ?? "") === args.folderId && String(row.type ?? "") === "Folder")) {
+                        otherApp = candidate;
+                        break;
+                    }
                 }
+                throw new ToolRefusalError({
+                    status: "refused",
+                    blocker: otherApp ? "folder-other-application" : "folder-not-found",
+                    folderId: args.folderId,
+                    applicationCode: appCode,
+                    ...(otherApp ? { folderApplicationCode: otherApp } : {}),
+                    available: tree.filter((row) => row.type === "Folder").map((row) => ({ id: row.id, name: row.name })).slice(0, 40),
+                    message: otherApp
+                        ? `目录 ${args.folderId} 属于应用 ${otherApp}，而模型 ${args.schemaCode} 在应用 ${appCode}——模型的目录必须同应用；跨应用请先在 ${appCode} 建同名目录再移动`
+                        : `应用 ${appCode} 没有目录 ${args.folderId}——folderId 必须用 folder.tree 的目录节点 id（不是目录名）`,
+                });
             }
-            throw new ToolRefusalError({
-                status: "refused",
-                blocker: otherApp ? "folder-other-application" : "folder-not-found",
-                folderId: args.folderId,
-                applicationCode: appCode,
-                ...(otherApp ? { folderApplicationCode: otherApp } : {}),
-                available: tree.filter((row) => row.type === "Folder").map((row) => ({ id: row.id, name: row.name })).slice(0, 40),
-                message: otherApp
-                    ? `目录 ${args.folderId} 属于应用 ${otherApp}，而模型 ${args.schemaCode} 在应用 ${appCode}——模型的目录必须同应用；跨应用请先在 ${appCode} 建同名目录再移动`
-                    : `应用 ${appCode} 没有目录 ${args.folderId}——folderId 必须用 folder.tree 的目录节点 id（不是目录名）`,
+            const node = resolved.node;
+            const nodeId = String(node.id ?? "");
+            const beforeParent = String(node.parentId ?? "");
+            const performed = await wireCall(session, {
+                path: ENDPOINTS.modelUpdate,
+                method: "POST",
+                body: { bizSchemaCode: args.schemaCode, id: nodeId, parentId: args.folderId, name: String(node.name ?? args.schemaCode) },
             });
-        }
-        const node = resolved.node;
-        const nodeId = String(node.id ?? "");
-        const beforeParent = String(node.parentId ?? "");
-        const performed = await wireCall(session, {
-            path: ENDPOINTS.modelUpdate,
-            method: "POST",
-            body: { bizSchemaCode: args.schemaCode, id: nodeId, parentId: args.folderId, name: String(node.name ?? args.schemaCode) },
-        });
-        const after = await resolveModelTreeNode(session, args.schemaCode, appCode);
-        const parentNow = String(after.node?.parentId ?? "");
-        return {
-            performed: { errcode: performed.errcode },
-            readback: {
-                schemaCode: args.schemaCode,
-                applicationCode: appCode,
-                moved: parentNow === args.folderId,
-                beforeParentId: beforeParent,
-                afterParentId: parentNow || null,
-                folder: { id: args.folderId, name: target.name ?? null },
-                note: "只改菜单节点归属；schema/字段/表单/视图与发布状态都不动",
-            },
-        };
-    }, undefined, undefined, modelRollbackSpec("model.move"));
+            const after = await resolveModelTreeNode(session, args.schemaCode, appCode);
+            const parentNow = String(after.node?.parentId ?? "");
+            return {
+                performed: { errcode: performed.errcode },
+                readback: {
+                    schemaCode: args.schemaCode,
+                    applicationCode: appCode,
+                    moved: parentNow === args.folderId,
+                    beforeParentId: beforeParent,
+                    afterParentId: parentNow || null,
+                    folder: { id: args.folderId, name: target.name ?? null },
+                    note: "只改菜单节点归属；schema/字段/表单/视图与发布状态都不动",
+                },
+            };
+        },
+        rollback: modelRollbackSpec("model.move"),
+    });
     registerPackageTool(tools, {
         name: "configure_model",
         lane: MODEL_LANE,