agentworkshop 0.7.54 → 0.7.59

package/server/services/workshop/dcw/dcw-controller/write-verify.ts

@@ -0,0 +1,98 @@
+/**
+ * 写后验证器(ACK 鉴定层,2026-10-08 生产化)—— recipe 整批下发的"参数真实生效"鉴定。
+ *
+ * 背景(用户铁律):下发后要观察**所有写控节点**是否真正返回 ack/response;没有回执或
+ * 回执错误必须如实反馈给 Agent 并记 error。驱动层 ack 如实分级后(readback-verified /
+ * transport-ack / unverified),本模块负责把"仅链路受理"的写补验到"设备证实":
+ *   ① 命令失败(!ok)→ failed,不补验;
+ *   ② 驱动内已回读一致(readback-verified)→ 直接 verified;
+ *   ③ 其余(transport-ack/unverified)→ 经 readNow 独立回读,容差内 = verified;
+ *      最多 VERIFY_ATTEMPTS 次、间隔 VERIFY_INTERVAL_MS;驱动不支持读 → 立即 unverified。
+ *
+ * 读回比对用**工程量目标值**(eng)与节点写容差(writeTolerance 同口径)——与驱动内
+ * readbackAck 同一判据,但读回值已经由 executeRead 换算回物理量(applyTransform)。
+ */
+import type { WriteAckLevel, WriteVerifyOutcome } from '../../../../../shared/dcw-protocol'
+import type { DcwNode } from '../dcw-node'
+
+/** 补验次数与间隔(默认 3 次 × 2s;env AW_WRITE_VERIFY_* 可调,≤0 关闭补验直判 unverified) */
+const VERIFY_ATTEMPTS = Math.max(1, Number(process.env.AW_WRITE_VERIFY_ATTEMPTS) || 3)
+const VERIFY_INTERVAL_MS = Math.max(0, Number(process.env.AW_WRITE_VERIFY_INTERVAL_MS) || 2_000)
+
+const sleep = (ms: number): Promise<void> => new Promise(r => setTimeout(r, ms))
+
+/** 批次结果行需要的最小读能力面(controller.readNow 的结构子集,便于单测注入) */
+export interface WriteVerifyReader {
+  readNow(id: string): Promise<{ ok: boolean, value: number | null, message: string }>
+}
+
+/**
+ * 对一次写结果做 ACK 鉴定(必要时补验)。
+ * @param eng 工程量目标值(物理量);读回值同为物理量(已过 executeRead 标定换算)
+ */
+export async function verifyRecipeWrite(
+  reader: WriteVerifyReader,
+  node: Pick<DcwNode, 'id' | 'name' | 'driver' | 'decimals'>,
+  eng: number,
+  outcome: { ok: boolean, ack?: WriteAckLevel, readback: number | null, message: string },
+  opts: { tolerance: number },
+): Promise<WriteVerifyOutcome> {
+  // ① 命令本身失败:无证实可言(failed)
+  if (!outcome.ok) {
+    return { verdict: 'failed', ack: 'unverified', attempts: 0, message: outcome.message }
+  }
+  const ack: WriteAckLevel = outcome.ack ?? (outcome.readback != null ? 'readback-verified' : 'transport-ack')
+  // ② 驱动内已独立回读且一致:免补验
+  if (ack === 'readback-verified') {
+    return { verdict: 'verified', ack, attempts: 0, message: '设备回读证实' }
+  }
+  const configuredAttempts = process.env.AW_WRITE_VERIFY_ATTEMPTS
+  if (configuredAttempts !== undefined && Number(configuredAttempts) <= 0) {
+    return { verdict: 'unverified', ack, attempts: 0, message: '写后验证已配置关闭(AW_WRITE_VERIFY_ATTEMPTS≤0)' }
+  }
+  // ③ 补验:独立回读比对(驱动不支持读时 readNow 返回 ok:false + 不支持文案,立即收敛)
+  let lastMsg = ''
+  for (let attempt = 1; attempt <= VERIFY_ATTEMPTS; attempt++) {
+    if (attempt > 1) await sleep(VERIFY_INTERVAL_MS)
+    let r: { ok: boolean, value: number | null, message: string }
+    try {
+      r = await reader.readNow(node.id)
+    }
+    catch (err) {
+      r = { ok: false, value: null, message: err instanceof Error ? err.message : String(err) }
+    }
+    if (!r.ok) {
+      // 不支持读取的驱动(如 mqtt)无补验通道:如实判 unverified,不空转重试
+      lastMsg = r.message
+      if (r.message.includes('不支持读取') || r.message.includes('不支持读')) break
+      continue
+    }
+    if (r.value != null && Math.abs(r.value - eng) <= opts.tolerance) {
+      return {
+        verdict: 'verified',
+        ack: 'readback-verified',
+        attempts: attempt,
+        message: `写后验证证实(第 ${attempt} 次回读 ${Number(r.value.toFixed(node.decimals))} 在容差内)`,
+      }
+    }
+    lastMsg = `回读 ${r.value ?? '无读数'} ≠ 设定 ${eng}(容差 ${opts.tolerance})`
+  }
+  return {
+    verdict: 'unverified',
+    ack,
+    attempts: VERIFY_ATTEMPTS,
+    message: `设备侧未证实:${lastMsg || `节点「${node.name}」(${node.driver})无可用回读通道,仅链路受理`}`,
+  }
+}
+
+/** 批次 ACK 汇总(三段口径:verified / unverified / failed;ok 但未证实计入 unverified) */
+export function summarizeAck(results: Array<{ ok: boolean, verify?: { verdict: string } }>): { verified: number, unverified: number, failed: number, total: number } {
+  const s = { verified: 0, unverified: 0, failed: 0, total: results.length }
+  for (const r of results) {
+    const v = r.verify?.verdict ?? (r.ok ? 'unverified' : 'failed')
+    if (v === 'verified') s.verified++
+    else if (v === 'failed') s.failed++
+    else s.unverified++
+  }
+  return s
+}

package/server/services/workshop/dcw/dcw-controller/write.ts

@@ -4,13 +4,52 @@
  */
 import { DcwControllerBindings } from './bindings'
 import type { DcwDriverKind, DcwWriteMeta } from '../../../../../shared/dcw-protocol'
+import type { DcwNode } from '../dcw-node'
 import { AppError, ErrorCodes } from '../../../../utils/errors'
 import { assertWithinLimits, assertStepLimit } from '../param-limits'
 import { getRecipeRollBackManager } from '../recipe-rollback-manager'
-import { normalizeDcwDriverKind, resolveDcwDriver } from '../drivers'
+import { requireDcwDriverKind, resolveDcwDriver } from '../drivers'
 import { recordDcwWriteOps } from './write-audit'
+import { setWriteLockUntil } from './gate-persist'
 import { recordOps } from '../../ops/ops'
 
+// ================================================================
+// 只读预检谓词(产线 Co-Pilot P2:recipe_propose 整包方案的预审批校验)
+// ================================================================
+
+/** 预检结果:ok=false 时 violations[0] 即 write() 咽喉点会抛出的同文错误(单点收敛,消息零漂移) */
+export interface RecipeParamPreflight {
+  ok: boolean
+  violations: string[]
+  /** 原始错误(assertWithinLimits 抛出的 AppError;预检方需要复刻拒绝语义时原样复抛) */
+  error?: AppError
+}
+
+/**
+ * 限界预检(只读,不写不下发不锁窗):对「节点+目标工程量」复跑 write() 咽喉点的
+ * assertWithinLimits 断言,把 throw 式拒绝归一为 { ok, violations } 结果。
+ * 选项镜像 write() 的真实语义:skipRecipe=true 即配方下发路径(量程∩参数基准∩产品三层,
+ * **不含**步长/60s 间隔/保持窗 —— recipe 执行路径本就不走这些,预检不得擅自收紧);
+ * 缺省 skipRecipe=false 即在线写路径(含活动配方工艺窗口)。
+ * 消费方:① write() 咽喉点(行为零变化: violations[0]/error 复刻原 throw);
+ *        ② recipe_propose 预检(越界参数在审批单生成前剔除,「批准必被拒包」不可达)。
+ */
+export function evaluateRecipeParamLimits(node: DcwNode, eng: number, opts?: { includeSoft?: boolean, skipRecipe?: boolean }): RecipeParamPreflight {
+  try {
+    assertWithinLimits(node, eng, { includeSoft: opts?.includeSoft !== false, skipRecipe: opts?.skipRecipe === true })
+    return { ok: true, violations: [] }
+  }
+  catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    return {
+      ok: false,
+      violations: [msg],
+      // 复刻 write() 原分类:AppError 原样透传;非 AppError 按 400 归一(与原 catch 同口径)
+      error: err instanceof AppError ? err : new AppError(400, ErrorCodes.VALIDATION_ERROR, msg),
+    }
+  }
+}
+
 export abstract class DcwControllerWrite extends DcwControllerBindings {
   /** 手动设定:用户提交工程量,网关校验/换算/下发/回读校验。
    *  配方联锁:产线运行中,写入值还须落在活动配方对该参数的工艺窗口内
@@ -59,11 +98,11 @@ export abstract class DcwControllerWrite extends DcwControllerBindings {
     const benchNoInterlock = process.env.AW_BENCH_MODE === '1' && (meta?.benchArm === 'no-interlock' || meta?.benchArm === 'ungated')
     // 配方下发路径(recipeRunId != null)跳过配方窗口层:下发值已在配方保存时对自身窗口校验,
     // 且中途应用新配方不应被旧批次配方窗口误伤;产品/参数基准层对配方下发照常约束。
-    try {
-      assertWithinLimits(node, eng, { includeSoft: !benchNoInterlock, skipRecipe: recipeRunId != null })
-    }
-    catch (err) {
-      reject(err instanceof AppError ? err : new AppError(400, ErrorCodes.VALIDATION_ERROR, String(err instanceof Error ? err.message : err)))
+    // 预检谓词(evaluateRecipeParamLimits)与本咽喉点共用同一断言:结果 ok=false 时
+    // 复抛其捕获的原始错误 —— 拒绝语义/错误码/消息与原 inline throw 逐字节一致。
+    const limits = evaluateRecipeParamLimits(node, eng, { includeSoft: !benchNoInterlock, skipRecipe: recipeRunId != null })
+    if (!limits.ok) {
+      reject(limits.error ?? new AppError(400, ErrorCodes.VALIDATION_ERROR, limits.violations[0] ?? '写入限界校验失败'))
     }
     const srcForLock = meta?.source ?? (recipeRunId ? 'recipe' : 'manual')
     const benchBypass = process.env.AW_BENCH_MODE === '1'
@@ -123,7 +162,10 @@ export abstract class DcwControllerWrite extends DcwControllerBindings {
     // 窗口聚合异步回填(F2)
     if (outcome.ok !== false) {
       // 写成功 → 锁定写入保持窗(agent/manual 路径;recipe/rollback 豁免)
-      if (lockable) this.writeLocks.set(id, Date.now() + lockMs)
+      if (lockable) {
+        this.writeLocks.set(id, Date.now() + lockMs)
+        setWriteLockUntil(id, Date.now() + lockMs) // P1-5 落盘:重启窗口延续
+      }
       try {
         const rbInfo = getRecipeRollBackManager().afterWrite(
           node,
@@ -151,9 +193,9 @@ export abstract class DcwControllerWrite extends DcwControllerBindings {
     return outcome
   }
 
-  /** 连接测试 */
+  /** 连接测试(显式声明的驱动 kind 必须可解析;未知协议显式报错,不静默 mock —— P0-5) */
   async testDriver(kind: DcwDriverKind, driverConfig: Record<string, unknown>) {
-    return resolveDcwDriver(normalizeDcwDriverKind(kind)).test(driverConfig)
+    return resolveDcwDriver(requireDcwDriverKind(kind)).test(driverConfig)
   }
 
   async testNode(id: string) {

package/server/services/workshop/dcw/dcw-line.repo.ts

@@ -10,6 +10,7 @@ import { join } from 'node:path'
 import { dcwLineColorFor, type LineInput, type LineView } from '../../../../shared/dcw-protocol'
 import { ensureDataDir } from '@/shared/config/home.mjs'
 import { AppError, ErrorCodes } from '../../../utils/errors'
+import { resolveModeChange } from '../agents/binding-mode'
 import { loadJsonFile, saveJsonFileAtomic } from '../json-store.mjs'
 
 // 配置根 .AgentWorkShop/data（ensureDataDir 自动迁移旧 cwd/server/data 位置）
@@ -25,7 +26,7 @@ function save(list: LineView[]): void {
 }
 
 export class DcwLineRepo {
-  private list: LineView[] = load()
+  private list: LineView[] = load().map(l => ({ controlMode: 'manual', ...l }) as LineView)
 
   all(): LineView[] {
     return this.list
@@ -35,15 +36,24 @@ export class DcwLineRepo {
     return this.list.find(l => l.id === id)
   }
 
+  /** 线级控制模式总闸(读侧归一):存量数据无字段按 'manual'(fail-safe)生效 */
+  controlModeOf(id: string): 'auto' | 'manual' {
+    return this.byId(id)?.controlMode === 'auto' ? 'auto' : 'manual'
+  }
+
   create(input: LineInput): LineView {
     const name = String(input.name ?? '').trim()
     if (!name) throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '产线名称必填')
+    // 新线缺省 manual(fail-safe):宁多批一次,不可漏批一次;显式 controlMode='auto'
+    // 视为建线即知悉(带确认语义的调用方使用;REST 建线不透传该字段)。
+    const mode = input.controlMode === 'auto' ? 'auto' : 'manual'
     const line: LineView = {
       id: `ln-${randomUUID().slice(0, 8)}`,
       name,
       // 缺省按创建序取光晕色板(1号蓝 2号黄…);用户可显式指定
       color: String(input.color ?? '').trim() || dcwLineColorFor(this.list.length),
       description: String(input.description ?? '').trim(),
+      controlMode: mode,
       createdAt: new Date().toISOString(),
     }
     this.list.push(line)
@@ -61,6 +71,12 @@ export class DcwLineRepo {
     }
     if (patch.color !== undefined) line.color = String(patch.color).trim() || line.color
     if (patch.description !== undefined) line.description = String(patch.description).trim()
+    if (patch.controlMode !== undefined) {
+      // 复用绑定模式守卫:manual→auto 等于摘掉人工审批闸门,必须显式 confirm:true
+      const decision = resolveModeChange(this.controlModeOf(id), patch.controlMode, patch.confirm)
+      if (!decision.ok) throw new AppError(400, 'MODE_CONFIRM_REQUIRED', decision.error ?? '切换控制模式需显式风险确认')
+      if (!decision.noop) line.controlMode = patch.controlMode
+    }
     save(this.list)
     return line
   }

package/server/services/workshop/dcw/dcw-node.repo.ts

@@ -1,87 +1,110 @@
-/**
- * DcwNode 持久化仓库 —— 对象快照落盘(server/data/dcws.json),与 DaqNodeRepo 同风格。
- * 配置类变更立即刷盘;写值变更走短窗防抖(保写心跳按 holdIntervalMs 周期重下发,
- * 同步全量重写会随节点数放大;防抖窗口内崩溃丢失的设定值可从 PLC 回读恢复)。
- */
-
-import { createLogger } from '../logger'
-import { join } from 'node:path'
-import { DcwNode } from './dcw-node'
-import { ensureDataDir } from '@/shared/config/home.mjs'
-import { loadJsonFile, saveJsonFileAtomic } from '../json-store.mjs'
-
-const log = createLogger('dcw.node-repo')
-
-// 配置根 .AgentWorkShop/data（ensureDataDir 自动迁移旧 cwd/server/data 位置）
-const DB_PATH = join(ensureDataDir(), 'dcws.json')
-
-function load(): DcwNode[] {
-  try {
-    const parsed = loadJsonFile(DB_PATH, null)
-    return Array.isArray(parsed) ? parsed.map(r => DcwNode.fromRow(r as Record<string, unknown>)) : []
-  }
-  catch {
-    return []
-  }
-}
-
-class DcwNodeRepo {
-  private list: DcwNode[]
-  private flushTimer: NodeJS.Timeout | null = null
-
-  constructor() {
-    this.list = load()
-  }
-
-  all(): DcwNode[] {
-    return this.list
-  }
-
-  byId(id: string): DcwNode | undefined {
-    return this.list.find(n => n.id === id)
-  }
-
-  insert(node: DcwNode): void {
-    this.list.push(node)
-    this.flushNow()
-  }
-
-  remove(id: string): boolean {
-    const before = this.list.length
-    this.list = this.list.filter(n => n.id !== id)
-    if (this.list.length !== before) {
-      this.flushNow()
-      return true
-    }
-    return false
-  }
-
-  /** 写值路径防抖落盘(1.5s 合并窗;保写心跳多节点同拍只落一次盘) */
-  flushDebounced(): void {
-    this.flushTimer ??= setTimeout(() => {
-      this.flushTimer = null
-      this.flushNow()
-    }, 1500)
-    this.flushTimer.unref?.()
-  }
-
-  flushNow(): void {
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer)
-      this.flushTimer = null
-    }
-    try {
-      saveJsonFileAtomic(DB_PATH, this.list.map(n => n.toRow()))
-    }
-    catch (err) {
-      log.error('[dcw] 快照落盘失败:', err)
-    }
-  }
-}
-
-let singleton: DcwNodeRepo | null = null
-
-export function getDcwNodeRepo(): DcwNodeRepo {
-  singleton ??= new DcwNodeRepo()
-  return singleton
-}
+/**
+ * DcwNode 持久化仓库 —— 对象快照落盘(server/data/dcws.json),与 DaqNodeRepo 同风格。
+ * 配置类变更立即刷盘;写值变更走短窗防抖(保写心跳按 holdIntervalMs 周期重下发,
+ * 同步全量重写会随节点数放大;防抖窗口内崩溃丢失的设定值可从 PLC 回读恢复)。
+ */
+
+import { createLogger } from '../logger'
+import { join } from 'node:path'
+import { DcwNode } from './dcw-node'
+import { ensureDataDir } from '@/shared/config/home.mjs'
+import { loadJsonFile, saveJsonFileAtomic } from '../json-store.mjs'
+import { migrateDcwDriverKind } from './drivers'
+
+const log = createLogger('dcw.node-repo')
+
+// 配置根 .AgentWorkShop/data（ensureDataDir 自动迁移旧 cwd/server/data 位置）
+const DB_PATH = join(ensureDataDir(), 'dcws.json')
+
+function load(): { nodes: DcwNode[], migrated: number } {
+  try {
+    const parsed = loadJsonFile(DB_PATH, null)
+    if (!Array.isArray(parsed)) return { nodes: [], migrated: 0 }
+    let migrated = 0
+    const nodes = (parsed as Record<string, unknown>[]).map((r) => {
+      const node = DcwNode.fromRow(r)
+      // P0-5 启动迁移:旧命名归一(modbus→modbus-tcp 等);无法归一的未知 kind
+      // 降级 mock 并打标(fail-visible,不砖启动)—— 该节点后续写路径显式失败待重配。
+      if (r.driver != null) {
+        const m = migrateDcwDriverKind(String(r.driver))
+        if (m.kind !== node.driver) {
+          node.driver = m.kind
+          migrated++
+          if (m.downgraded) {
+            node.lastError = `驱动「${String(r.driver)}」未注册,已降级 mock —— 请重新配置节点驱动后重写`
+            log.warn(`[dcw] 节点 ${node.id}(${node.name}) 驱动「${String(r.driver)}」未注册,已降级 mock`)
+          }
+        }
+      }
+      return node
+    })
+    return { nodes, migrated }
+  }
+  catch {
+    return { nodes: [], migrated: 0 }
+  }
+}
+
+class DcwNodeRepo {
+  private list: DcwNode[]
+  private flushTimer: NodeJS.Timeout | null = null
+
+  constructor() {
+    const { nodes, migrated } = load()
+    this.list = nodes
+    // 迁移结果立即落盘(别名归一/降级打标持久化,避免每次启动重复告警)
+    if (migrated > 0) this.flushNow()
+  }
+
+  all(): DcwNode[] {
+    return this.list
+  }
+
+  byId(id: string): DcwNode | undefined {
+    return this.list.find(n => n.id === id)
+  }
+
+  insert(node: DcwNode): void {
+    this.list.push(node)
+    this.flushNow()
+  }
+
+  remove(id: string): boolean {
+    const before = this.list.length
+    this.list = this.list.filter(n => n.id !== id)
+    if (this.list.length !== before) {
+      this.flushNow()
+      return true
+    }
+    return false
+  }
+
+  /** 写值路径防抖落盘(1.5s 合并窗;保写心跳多节点同拍只落一次盘) */
+  flushDebounced(): void {
+    this.flushTimer ??= setTimeout(() => {
+      this.flushTimer = null
+      this.flushNow()
+    }, 1500)
+    this.flushTimer.unref?.()
+  }
+
+  flushNow(): void {
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer)
+      this.flushTimer = null
+    }
+    try {
+      saveJsonFileAtomic(DB_PATH, this.list.map(n => n.toRow()))
+    }
+    catch (err) {
+      log.error('[dcw] 快照落盘失败:', err)
+    }
+  }
+}
+
+let singleton: DcwNodeRepo | null = null
+
+export function getDcwNodeRepo(): DcwNodeRepo {
+  singleton ??= new DcwNodeRepo()
+  return singleton
+}

package/server/services/workshop/dcw/dcw-node.ts

@@ -1,3 +1,4 @@
+import { maskDriverConfigSecrets } from '../../../../shared/daq-protocol'
 /**
  * DcwNode —— 数据写控制节点领域对象(与 DaqNode 对称)。
  *
@@ -131,11 +132,14 @@ export class DcwNode {
     return null
   }
 
-  /** 记录一次写 ACK(成功)/失败 */
+  /** 记录一次写 ACK(成功)/失败。
+   *  P0-1 失败写不占位:value 只承载「设备确认过的值」(成功取回读,缺失回退指令值)。
+   *  此前失败写把从未被 PLC 接受的指令值占进 value —— 保写心跳按 value 周期重下发,
+   *  会把幻影指令值反复写向设备(10-07 事故放大器);同时污染步长基准与回退账本 prevValue。 */
   applyWriteResult(eng: number, ok: boolean, message: string, at: string): void {
-    this.value = Number(eng.toFixed(this.decimals))
     this.lastWriteAt = at
     if (ok) {
+      this.value = Number(eng.toFixed(this.decimals))
       this.lastAckAt = at
       this.state = 'ok'
       this.lastError = null
@@ -255,7 +259,8 @@ export class DcwNode {
       max: this.max,
       deviceBindingId: this.deviceBindingId,
       deviceIds: this.deviceIds,
-      driverConfig: this.driverConfig,
+      // 凭据脱敏(同 daq 侧 toView;toRow 持久化不掩码)
+      driverConfig: maskDriverConfigSecrets(this.driverConfig),
       transform: this.transform,
       posX: this.posX,
       posZ: this.posZ,

package/server/services/workshop/dcw/dcw-recipe.repo.ts

@@ -50,6 +50,8 @@ export interface DcwWriteHistoryEntry {
   eng: number
   raw: number | null
   ok: boolean
+  /** 写 ACK 鉴定等级(2026-10-08;历史行缺省=旧口径未分级) */
+  ack?: 'readback-verified' | 'transport-ack' | 'unverified'
   message: string
   recipeRunId: string | null
   at: string
@@ -143,6 +145,21 @@ const normDaqWindows = (windows: RecipeDaqWindow[] | undefined, lineId = ''): Re
     return out
   })
 
+/** opIntervalMs 归一:undefined/null/'' = 缺省(60000);0~86400000 整数合法(0=显式禁用);其余 400 */
+export const OP_INTERVAL_DEFAULT_MS = 60_000
+function normOpIntervalMs(v: unknown): number | undefined {
+  if (v === undefined || v === null || v === '') return undefined
+  const n = Number(v)
+  if (!Number.isFinite(n) || n < 0 || n > 86_400_000 || !Number.isInteger(n))
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, 'opIntervalMs 需为 0~86400000 的整数毫秒(0=禁用频控;缺省=默认 60s)')
+  return n
+}
+
+/** 配方下发间隔读取器(老数据无字段 → 默认 60000;0 = 显式禁用) */
+export function recipeOpIntervalMs(r: Pick<RecipeView, 'opIntervalMs'> | undefined): number {
+  return typeof r?.opIntervalMs === 'number' && r.opIntervalMs >= 0 ? r.opIntervalMs : OP_INTERVAL_DEFAULT_MS
+}
+
 class DcwRecipeRepo {
   private recipes: RecipeView[] = loadJson<RecipeView[]>(RECIPES_PATH, [])
   private runs: RecipeRunView[] = loadJson<RecipeRunView[]>(RUNS_PATH, [])
@@ -179,6 +196,7 @@ class DcwRecipeRepo {
       version: 1,
       paramsHistory: [],
       lastGoodRunId: null,
+      ...(normOpIntervalMs(input.opIntervalMs) !== undefined ? { opIntervalMs: normOpIntervalMs(input.opIntervalMs) } : {}),
       createdAt: now,
       updatedAt: now,
     }
@@ -224,6 +242,20 @@ class DcwRecipeRepo {
       r.params = fresh
     }
     if (patch.daqWindows !== undefined) r.daqWindows = normDaqWindows(patch.daqWindows, r.lineId)
+    if (patch.access !== undefined) {
+      // 二级权限归一:requireAuth 布尔;授权清单去重去空(requireAuth=true 且清单空 = fail-closed 无人可操作)
+      const raw = (patch.access ?? {}) as { requireAuth?: unknown, authorizedAgentIds?: unknown }
+      const ids = Array.isArray(raw.authorizedAgentIds)
+        ? [...new Set(raw.authorizedAgentIds.map(x => String(x ?? '').trim()).filter(Boolean))]
+        : []
+      r.access = { requireAuth: raw.requireAuth === true, authorizedAgentIds: ids }
+    }
+    // 治理配置(非工艺参数):与 access 同口径原地改,不进 paramsHistory/不增版本
+    if (patch.opIntervalMs !== undefined) {
+      const v = normOpIntervalMs(patch.opIntervalMs)
+      if (v === undefined) delete r.opIntervalMs
+      else r.opIntervalMs = v
+    }
     r.updatedAt = new Date().toISOString()
     this.flushRecipes()
     return r

package/server/services/workshop/dcw/dcw-runtime.ts

@@ -19,6 +19,8 @@ export interface DcwWriteOutcome {
   message: string
   raw: number | null
   readback: number | null
+  /** 写 ACK 鉴定等级(2026-10-08):设备证实 / 仅链路受理 / 未证实(网关归一后必有) */
+  ack?: 'readback-verified' | 'transport-ack' | 'unverified'
   /** 调控闭环:本次写产生的参数锚(入册成功时) */
   anchorId?: string
   /** 调控闭环:Agent/回退路径开出的优化记录 id(manual/recipe 路径无) */
@@ -28,6 +30,8 @@ export interface DcwWriteOutcome {
 export interface DcwRuntimeHost {
   running(): boolean
   defaults(): { holdIntervalMs: number, readIntervalMs: number }
+  /** 产线活动判定(P0-1 保写产线门):绑定产线在跑(有活动批次窗口)才允许保写心跳 */
+  lineActive(lineId: string): boolean
   /** 网关执行写命令(驱动写 + ACK 记账 + 写历史 + WS 广播) */
   executeWrite(node: DcwNode, eng: number, tolerance: number, recipeRunId: string | null): Promise<DcwWriteOutcome>
   /** 网关执行读数(驱动读 + 读状态记账 + WS 广播;返回物理值) */
@@ -101,7 +105,10 @@ export class DcwNodeRuntime {
     // 语义:写冲突时心跳**跳过本拍**(不排队、不补发),下一拍自然重试 —— 保写是幂等重下发。
     if (!this.writing && node.enabled && node.value != null && node.state !== 'writing') {
       const hold = node.holdIntervalMs ?? this.host.defaults().holdIntervalMs
-      if (hold && hold > 0 && now - this.lastHoldAt >= hold) {
+      // P0-1 保写产线门:绑定产线的节点仅在产线活动(有运行批次窗口)时保写,停线即挂起,
+      // 开线后下一拍自然恢复(10-07 事故根因④:停线不挂起心跳,残留节点持续直写)。
+      // lineId=''(未分配产线的独立通道)不受门控,保持独立节点用法。
+      if (hold && hold > 0 && now - this.lastHoldAt >= hold && (!node.lineId || this.host.lineActive(node.lineId))) {
         this.lastHoldAt = now
         this.writing = true
         node.state = 'writing'