agentworkshop 0.8.5 → 0.8.6

package/server/services/workshop/db/database/migrations.ts

@@ -235,80 +235,95 @@ export function migrateMissingForeignKeys(db: DatabaseSync): void {
  * 身份与 token 已迁移至全局用户系统(data/users.sqlite),owner 列仅存用户 id 引用,
  * 保留 FK 会使新全局用户 id 在本地 users 表无行而写入失败。
  * 表重建期间临时关闭外键,避免 DROP 触发级联;重建后以原名重新命名,引用方 FK 依旧有效。
+ *
+ * 2026-10-28 审查 D-P1-2:旧实现用**白名单 DDL** 重建 channels/agents/teams ——
+ * 白名单随后续版本加列而漂移(channels 缺 scenario_prompt/llm_json/visibility/
+ * join_policy/approval_policy/chat_enabled/version/line_id 共 8 列),带 owner FK 的
+ * 老库升级时整列数据被静默丢弃且不可复现。现在每条重建语句都携带**完整列清单**,
+ * 由 tests/migration-owner-fk.test.ts 守护:升级前后"列集 + 全部业务数据"逐列相等
+ * (任一列漏抄 → 列集变化 → 测试红)。
  */
 export function migrateDropOwnerFks(db: DatabaseSync): void {
-  const rebuilds: Array<{ table: string, ddl: string }> = []
-  if (hasForeignKey(db, 'workspaces', 'owner_user_id', 'users')) {
-    rebuilds.push({
-      table: 'workspaces',
-      ddl: `CREATE TABLE workspaces_new (
-          id            TEXT PRIMARY KEY,
-          owner_user_id TEXT NOT NULL,
-          name          TEXT NOT NULL,
-          created_at    TEXT NOT NULL
-        );
-        INSERT INTO workspaces_new SELECT id, owner_user_id, name, created_at FROM workspaces;`,
-    })
-  }
-  if (hasForeignKey(db, 'channels', 'owner_user_id', 'users')) {
-    rebuilds.push({
-      table: 'channels',
-      ddl: `CREATE TABLE channels_new (
-          id             TEXT PRIMARY KEY,
-          name           TEXT NOT NULL,
-          description    TEXT NOT NULL DEFAULT '',
-          lead_agent_id  TEXT,
-          workspace      TEXT NOT NULL DEFAULT '',
-          enabled        INTEGER NOT NULL DEFAULT 1,
-          owner_user_id  TEXT,
-          created_at     TEXT NOT NULL,
-          updated_at     TEXT NOT NULL
-        );
-        INSERT INTO channels_new SELECT id, name, description, lead_agent_id, workspace, enabled, owner_user_id, created_at, updated_at FROM channels;`,
-    })
-  }
-  if (hasForeignKey(db, 'agents', 'owner_user_id', 'users')) {
-    rebuilds.push({
-      table: 'agents',
-      ddl: `CREATE TABLE agents_new (
-          id           TEXT PRIMARY KEY,
-          name         TEXT NOT NULL,
-          harness      TEXT NOT NULL,
-          config_json  TEXT NOT NULL DEFAULT '{}',
-          enabled      INTEGER NOT NULL DEFAULT 1,
-          visibility   TEXT NOT NULL DEFAULT 'private',
-          owner_user_id TEXT,
-          created_at   TEXT NOT NULL,
-          updated_at   TEXT NOT NULL
-        );
-        INSERT INTO agents_new SELECT id, name, harness, config_json, enabled, visibility, owner_user_id, created_at, updated_at FROM agents;`,
-    })
-  }
-  if (hasForeignKey(db, 'teams', 'owner_user_id', 'users')) {
-    rebuilds.push({
-      table: 'teams',
-      ddl: `CREATE TABLE teams_new (
-          id            TEXT PRIMARY KEY,
-          name          TEXT NOT NULL,
-          description   TEXT NOT NULL DEFAULT '',
-          visibility    TEXT NOT NULL DEFAULT 'private',
-          owner_user_id TEXT,
-          created_at    TEXT NOT NULL,
-          updated_at    TEXT NOT NULL
-        );
-        INSERT INTO teams_new SELECT id, name, description, visibility, owner_user_id, created_at, updated_at FROM teams;`,
-    })
-  }
-  if (rebuilds.length === 0) return
+  const needWorkspaces = hasForeignKey(db, 'workspaces', 'owner_user_id', 'users')
+  const needChannels = hasForeignKey(db, 'channels', 'owner_user_id', 'users')
+  const needAgents = hasForeignKey(db, 'agents', 'owner_user_id', 'users')
+  const needTeams = hasForeignKey(db, 'teams', 'owner_user_id', 'users')
+  if (!needWorkspaces && !needChannels && !needAgents && !needTeams) return
 
   db.exec('PRAGMA foreign_keys = OFF;')
   try {
-    for (const { table, ddl } of rebuilds) {
-      db.exec(`${ddl}
-        DROP TABLE ${table};
-        ALTER TABLE ${table}_new RENAME TO ${table};`)
+    if (needWorkspaces) {
+      db.prepare(`CREATE TABLE workspaces_new (
+        id            TEXT PRIMARY KEY,
+        owner_user_id TEXT NOT NULL,
+        name          TEXT NOT NULL,
+        created_at    TEXT NOT NULL
+      )`).run()
+      db.prepare('INSERT INTO workspaces_new (id, owner_user_id, name, created_at) SELECT id, owner_user_id, name, created_at FROM workspaces').run()
+      db.prepare('DROP TABLE workspaces').run()
+      db.prepare('ALTER TABLE workspaces_new RENAME TO workspaces').run()
+    }
+    if (needChannels) {
+      db.prepare(`CREATE TABLE channels_new (
+        id              TEXT PRIMARY KEY,
+        name            TEXT NOT NULL,
+        description     TEXT NOT NULL DEFAULT '',
+        scenario_prompt TEXT NOT NULL DEFAULT '',
+        llm_json        TEXT NOT NULL DEFAULT '',
+        lead_agent_id   TEXT,
+        workspace       TEXT NOT NULL DEFAULT '',
+        enabled         INTEGER NOT NULL DEFAULT 1,
+        created_at      TEXT NOT NULL,
+        updated_at      TEXT NOT NULL,
+        owner_user_id   TEXT,
+        visibility      TEXT NOT NULL DEFAULT 'private',
+        join_policy     TEXT NOT NULL DEFAULT 'owner_approve',
+        approval_policy TEXT NOT NULL DEFAULT 'owner_only',
+        chat_enabled    INTEGER NOT NULL DEFAULT 0,
+        version         INTEGER NOT NULL DEFAULT 1,
+        line_id         TEXT NOT NULL DEFAULT ''
+      )`).run()
+      db.prepare(`INSERT INTO channels_new (id, name, description, scenario_prompt, llm_json, lead_agent_id,
+          workspace, enabled, created_at, updated_at, owner_user_id, visibility,
+          join_policy, approval_policy, chat_enabled, version, line_id)
+        SELECT id, name, description, scenario_prompt, llm_json, lead_agent_id,
+          workspace, enabled, created_at, updated_at, owner_user_id, visibility,
+          join_policy, approval_policy, chat_enabled, version, line_id FROM channels`).run()
+      db.prepare('DROP TABLE channels').run()
+      db.prepare('ALTER TABLE channels_new RENAME TO channels').run()
+    }
+    if (needAgents) {
+      db.prepare(`CREATE TABLE agents_new (
+        id            TEXT PRIMARY KEY,
+        name          TEXT NOT NULL,
+        harness       TEXT NOT NULL,
+        config_json   TEXT NOT NULL DEFAULT '{}',
+        enabled       INTEGER NOT NULL DEFAULT 1,
+        visibility    TEXT NOT NULL DEFAULT 'private',
+        created_at    TEXT NOT NULL,
+        updated_at    TEXT NOT NULL,
+        owner_user_id TEXT
+      )`).run()
+      db.prepare('INSERT INTO agents_new (id, name, harness, config_json, enabled, visibility, created_at, updated_at, owner_user_id) SELECT id, name, harness, config_json, enabled, visibility, created_at, updated_at, owner_user_id FROM agents').run()
+      db.prepare('DROP TABLE agents').run()
+      db.prepare('ALTER TABLE agents_new RENAME TO agents').run()
+    }
+    if (needTeams) {
+      db.prepare(`CREATE TABLE teams_new (
+        id            TEXT PRIMARY KEY,
+        name          TEXT NOT NULL,
+        description   TEXT NOT NULL DEFAULT '',
+        visibility    TEXT NOT NULL DEFAULT 'private',
+        created_at    TEXT NOT NULL,
+        updated_at    TEXT NOT NULL,
+        owner_user_id TEXT
+      )`).run()
+      db.prepare('INSERT INTO teams_new (id, name, description, visibility, created_at, updated_at, owner_user_id) SELECT id, name, description, visibility, created_at, updated_at, owner_user_id FROM teams').run()
+      db.prepare('DROP TABLE teams').run()
+      db.prepare('ALTER TABLE teams_new RENAME TO teams').run()
     }
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_workspaces_owner ON workspaces(owner_user_id);`)
+    // 重建会连带删除该表的索引;这 4 张表在 SCHEMA_SQL 里只有一个索引,原样补回
+    db.prepare('CREATE INDEX IF NOT EXISTS idx_workspaces_owner ON workspaces(owner_user_id)').run()
   }
   finally {
     db.exec('PRAGMA foreign_keys = ON;')

package/server/services/workshop/dcw/dcw-controller/crud.ts

@@ -7,10 +7,12 @@ import type { DcwCreateInput, DcwPatchInput } from './types'
 import { AppError, ErrorCodes } from '../../../../utils/errors'
 import { DcwNode } from '../dcw-node'
 import { dcwKeyFromRef, normalizeDataTransform } from '../../../../../shared/dcw-protocol'
+import { stripMaskedSecrets } from '../../../../../shared/daq-protocol'
 import { findDcwTemplate } from '../dcw-templates'
 import { getDcwLineRepo } from '../dcw-line.repo'
 import { getDcwParamRepo } from '../param-map.repo'
 import { requireDcwDriverKind } from '../drivers'
+import { assertDriverRawRange } from '../drivers/shared'
 import { randomUUID } from 'node:crypto'
 
 function normalizeStepLimitInput(value: unknown): number | null | undefined {
@@ -37,7 +39,7 @@ export abstract class DcwControllerCrud extends DcwControllerControl {
       templateRef: input.templateRef,
       name: input.name ?? `${tpl.name} ${String(seq).padStart(2, '0')}`,
       driver: input.driver ? requireDcwDriverKind(input.driver) : undefined,
-      driverConfig: input.driverConfig ?? {},
+      driverConfig: stripMaskedSecrets(input.driverConfig ?? {}),
       transform: normalizeDataTransform(input.transform),
       enabled: input.enabled,
       holdIntervalMs: input.holdIntervalMs ?? null,
@@ -55,6 +57,13 @@ export abstract class DcwControllerCrud extends DcwControllerControl {
       writeLockSeconds: input.writeLockSeconds,
       stepLimit: normalizeStepLimitInput(input.stepLimit),
     })
+    // S15:Modbus 原始量程必须在配置期可被 dataType 表示(越界运行期会拒绝写,但提前拦更好)
+    try {
+      assertDriverRawRange(node.driver, node.driverConfig)
+    }
+    catch (err) {
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, err instanceof Error ? err.message : String(err))
+    }
     this.repo.insert(node)
     // 工艺参数映射面:节点创建即自动生成同名映射(用户/Agent 的参数语义面;
     // PLC 寻址细节仍封装在节点驱动配置内)。失败不阻断节点创建(可事后手工补建)。
@@ -72,20 +81,34 @@ export abstract class DcwControllerCrud extends DcwControllerControl {
     // 保写心跳若继续按旧值周期重下发,会把陈旧设定写向新目标(10-07 换绑残留事故根因①)。
     // 清值后心跳自动停驻,须新写成功才重新锚定。
     let invalidateValue = false
+    const prevDriver = node.driver
+    const prevDriverConfig = node.driverConfig
     if (patch.name !== undefined) node.name = patch.name
     if (patch.driver !== undefined) {
       node.driver = requireDcwDriverKind(patch.driver)
       invalidateValue = true
     }
     if (patch.driverConfig !== undefined) {
-      node.driverConfig = { ...node.driverConfig, ...patch.driverConfig }
+      // P0-2(2026-10-28 审查):掩码回显不得覆盖真实凭据(与 DAQ 同源单点过滤)
+      node.driverConfig = { ...node.driverConfig, ...stripMaskedSecrets(patch.driverConfig) }
       invalidateValue = true
     }
+    // S15:配置期校验(失败回滚 driver/driverConfig,避免内存里留下半改状态)
+    try {
+      assertDriverRawRange(node.driver, node.driverConfig)
+    }
+    catch (err) {
+      node.driver = prevDriver
+      node.driverConfig = prevDriverConfig
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, err instanceof Error ? err.message : String(err))
+    }
     if (patch.transform !== undefined) {
       if (patch.transform.kind === 'linear' && (!Number.isFinite(Number(patch.transform.scale)) || Number(patch.transform.scale) === 0)) {
         throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '标定系数 scale 必须为非零数字(物理值 = scale × PLC值 + offset)')
       }
       node.transform = normalizeDataTransform(patch.transform)
+      // 标定变了 → 旧 value 的物理含义变了,保写心跳必须停驻到下一次成功写
+      invalidateValue = true
     }
     if (patch.unit !== undefined) node.unit = patch.unit
     // decimals 必须 0..6 整数:它同时喂给 toFixed() —— 越界值会在**驱动已经写进 PLC 之后**
@@ -102,11 +125,13 @@ export abstract class DcwControllerCrud extends DcwControllerControl {
     if (patch.min !== undefined) {
       const v = Number(patch.min)
       if (!Number.isFinite(v)) throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `min 必须为有限数字(当前: ${String(patch.min)})`)
+      if (node.min !== v) invalidateValue = true
       node.min = v
     }
     if (patch.max !== undefined) {
       const v = Number(patch.max)
       if (!Number.isFinite(v)) throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `max 必须为有限数字(当前: ${String(patch.max)})`)
+      if (node.max !== v) invalidateValue = true
       node.max = v
     }
     // 量程交叉校验放在两者都应用之后:min>max 会让 writeTolerance 变负、越界判定恒真

package/server/services/workshop/dcw/dcw-controller/lines.ts

@@ -37,6 +37,10 @@ export abstract class DcwControllerLines extends DcwControllerRecipes {
       if (opts?.purge) this.remove(n.id)
       else {
         n.lineId = ''
+        // 2026-10-28:解绑产线必须清掉当前设定 —— 否则保写心跳会以"未分配产线"身份
+        // 继续把该线最后的 setpoint 写给 PLC(旧逻辑 !lineId 默认豁免产线门)。
+        n.value = null
+        this.runtimes.get(n.id)?.rearm()
         this.emitNodeChanged('updated', n)
       }
     }
@@ -78,10 +82,17 @@ export abstract class DcwControllerLines extends DcwControllerRecipes {
     }
     const line = getDcwLineRepo().byId(lineId)
     if (!line) throw new AppError(404, ErrorCodes.NOT_FOUND, `产线不存在: ${lineId}`)
-    if (getActiveLineRun(lineId)) {
-      throw new AppError(409, ErrorCodes.CONFLICT, `产线「${line.name}」已在运行(批次 ${getActiveLineRun(lineId)!.runId}),请先停止当前数据采集`)
-    }
     const repo = getDcwRecipeRepo()
+    // 2026-10-28:注册表可能指向一个已被关闭/不存在的批次(关闭接口/多入口/崩溃恢复竞态)。
+    // 这种情况应清掉过期窗口后继续开跑,而不是把整条线永久卡在"已在运行"。
+    const current = getActiveLineRun(lineId)
+    if (current) {
+      const dbRun = repo.runById(current.runId)
+      if (dbRun && !dbRun.endedAt) {
+        throw new AppError(409, ErrorCodes.CONFLICT, `产线「${line.name}」已在运行(批次 ${current.runId}),请先停止当前数据采集`)
+      }
+      clearActiveLineRun(lineId)
+    }
     const recipe = repo.byId(recipeId)
     if (!recipe) throw new AppError(404, ErrorCodes.NOT_FOUND, `Recipe 不存在: ${recipeId}`)
     if (recipe.lineId !== lineId) {

package/server/services/workshop/dcw/dcw-controller/recipes.ts

@@ -7,12 +7,13 @@ import type { DcwWriteHistoryEntry } from '../dcw-recipe.repo'
 import type { RecipeInput, RecipeRunView, RecipeView, WriteVerifyOutcome } from '../../../../../shared/dcw-protocol'
 import { AppError, ErrorCodes } from '../../../../utils/errors'
 import { getDcwRecipeRepo } from '../dcw-recipe.repo'
-import { assertRecipeOpIntervalForExecution, recordRecipeOpAnchor } from '../recipe-op-anchor'
+import { assertRecipeOpIntervalForExecution, beginRecipeOp, endRecipeOp, recordRecipeOpAnchor } from '../recipe-op-anchor'
 import { hydrateTrialLastAt, setTrialLastAt } from './gate-persist'
 import { recordOps } from '../../ops/ops'
 import { summarizeAck, verifyRecipeWrite } from './write-verify'
 import { writeTolerance } from '../dcw-runtime'
 import { notifyLineOperators } from '../../runtime/line-notify'
+import { assertWithinLimits } from '../param-limits'
 
 /**
  * 试验节拍 env 解析(显式 0 = 关闭;空/非法 = 默认 5 分钟)。
@@ -111,7 +112,7 @@ export abstract class DcwControllerRecipes extends DcwControllerParams {
    * 2026-10-08 ACK 鉴定:每参数写后经 verifyRecipeWrite 补验(链路受理→独立回读
    * 证实),结果行携带 ack/verify —— 「ok」不再被当成「设备已生效」。
    */
-  protected async writeRecipeParams(recipe: RecipeView, run: RecipeRunView): Promise<void> {
+  protected async writeRecipeParams(recipe: RecipeView, run: RecipeRunView, opts: { enforceRecipeWindow?: boolean } = {}): Promise<void> {
     const results: RecipeRunView['results'] = []
     for (const param of recipe.params) {
       const node = param.nodeId ? this.repo.byId(param.nodeId) : undefined
@@ -129,6 +130,24 @@ export abstract class DcwControllerRecipes extends DcwControllerParams {
         results.push({ templateRef: node.templateRef, nodeId: node.id, ok: false, message: `已跳过:节点「${node.name}」已取消绑定(${node.lineId ? '已改挂其他产线' : '已从产线移除'}),参数未下发`, value: param.value })
         continue
       }
+      // 2026-10-28:trial/候选覆盖值必须再过一次配方工艺窗口。
+      // 配方路径在 write() 里 skipRecipe:true(保存值已在保存时校验),但 trial 的
+      // overrides 是新值 —— 曾在 40~48 的配方窗下把 80/120 写进 PLC。
+      if (opts.enforceRecipeWindow) {
+        try {
+          assertWithinLimits(node, param.value, { includeSoft: true, skipRecipe: false })
+        }
+        catch (err) {
+          results.push({
+            templateRef: node.templateRef,
+            nodeId: node.id,
+            ok: false,
+            message: `候选值未下发(越界):${err instanceof Error ? err.message : String(err)}`,
+            value: param.value,
+          })
+          continue
+        }
+      }
       try {
         const outcome = await this.write(node.id, param.value, run.id, { source: 'recipe', actor: 'recipe' })
         // ACK 鉴定:命令 ok 但仅链路受理(mqtt/http-no-echo/mock)→ 独立回读补验
@@ -169,6 +188,13 @@ export abstract class DcwControllerRecipes extends DcwControllerParams {
     }
   }
 
+  /** 占位试验节拍(与 assertTrialCadence 同步调用,中间不得有 await;B-P1-2)。 */
+  private claimTrialCadence(lineId: string): void {
+    const at = Date.now()
+    this.trialLastAt.set(lineId, at)
+    setTrialLastAt(lineId, at) // P1-5 落盘
+  }
+
   /**
    * Recipe 手动应用 / Agent 试验(一键下发工艺参数集;不激活产线窗口)。
    * v19 trial 语义:**声明式覆盖集** —— 提供 overrides 时只写 overrides 列出的节点
@@ -197,9 +223,41 @@ export abstract class DcwControllerRecipes extends DcwControllerParams {
     if (unknown.length) {
       throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `覆盖参数不在配方内: ${unknown.map(o => o.nodeId).join(', ')}(试验只能修改配方已有参数的值;新增参数请先 recipe_update)`)
     }
-    if (opts.trial) this.assertTrialCadence(recipe.lineId)
+    if (opts.trial) {
+      // B-P1-2(2026-10-28 审查):判定与占位必须同一次同步执行(中间无 await),
+      // 否则并发 trial 双双过检;写入完成前第二次会被节拍拦下。
+      this.assertTrialCadence(recipe.lineId)
+      this.claimTrialCadence(recipe.lineId)
+    }
     // Recipe 级下发间隔卡控(执行时兜底):仅 Agent 路径;approvalId 自豁免防审批竞态
-    if (opts.agentDispatch) assertRecipeOpIntervalForExecution(recipe, { approvalId: opts.agentApprovalId, emergency: opts.emergency })
+    if (opts.agentDispatch) {
+      assertRecipeOpIntervalForExecution(recipe, { approvalId: opts.agentApprovalId, emergency: opts.emergency })
+      // 在飞占位:频控是"查-做-记"三段,首尾之间隔着整批写入(秒级)。两个并发下发
+      // 都会在"查"时看到旧锚。占位与判定同步完成,follow 到 finally 释放。
+      beginRecipeOp(recipeId, recipe.name)
+    }
+    try {
+      return await this.applyRecipeLocked(recipe, opts, overrides)
+    }
+    finally {
+      if (opts.agentDispatch) endRecipeOp(recipeId)
+    }
+  }
+
+  /** applyRecipe 的持锁段(调用方已通过节拍/频控判定并在飞占位;不得在此重复占位)。 */
+  private async applyRecipeLocked(
+    recipe: RecipeView,
+    opts: {
+      overrides?: Array<{ nodeId: string, value: number }>
+      trial?: boolean
+      agentDispatch?: boolean
+      agentApprovalId?: string
+      emergency?: boolean
+    },
+    overrides: Array<{ nodeId: string, value: number }>,
+  ): Promise<RecipeRunView> {
+    const repo = getDcwRecipeRepo()
+    const recipeId = recipe.id
     // 声明式覆盖集:有 overrides 只写声明的节点(未声明参数保持现状,绝不顺带整批);
     // 无 overrides(手动应用/统一回退重下发)= 整批语义
     const effective = overrides.length > 0
@@ -209,7 +267,7 @@ export abstract class DcwControllerRecipes extends DcwControllerParams {
         })
       : recipe.params
     const run = repo.createRun(recipe, effective)
-    await this.writeRecipeParams({ ...recipe, params: effective }, run)
+    await this.writeRecipeParams({ ...recipe, params: effective }, run, { enforceRecipeWindow: overrides.length > 0 })
     // 运行中应用新配方版本 → 谱系拆段(A13):旧段在 now 闭合,新段记录新版本/内容 hash。
     try {
       const { getActiveLineRun, setActiveLineRun } = await import('../line-run')

package/server/services/workshop/dcw/dcw-recipe.repo.ts

@@ -357,7 +357,16 @@ class DcwRecipeRepo {
   markGood(recipeId: string, runId: string): RecipeView {
     const r = this.byId(recipeId)
     if (!r) throw new AppError(404, ErrorCodes.NOT_FOUND, `Recipe 不存在: ${recipeId}`)
-    if (!this.runById(runId)) throw new AppError(404, ErrorCodes.NOT_FOUND, `批次不存在: ${runId}`)
+    const run = this.runById(runId)
+    if (!run) throw new AppError(404, ErrorCodes.NOT_FOUND, `批次不存在: ${runId}`)
+    // 2026-10-28:此前只校验 run 存在 —— 可把同线另一个配方/别的产品的批次标为"已知良好",
+    // 之后 to_last_good 会把那个批次的 setpoints 整批写进当前配方。
+    if (run.recipeId !== recipeId) {
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `批次 ${runId} 属于配方 ${run.recipeId},不能标记为配方 ${recipeId} 的良好批次`)
+    }
+    if (run.lineId !== r.lineId) {
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `批次 ${runId} 属于产线 ${run.lineId},与配方产线 ${r.lineId} 不一致`)
+    }
     r.lastGoodRunId = runId
     this.flushRecipes()
     return r

package/server/services/workshop/dcw/dcw-runtime.ts

@@ -8,6 +8,7 @@
 
 import { AppError, ErrorCodes } from '../../../utils/errors'
 import type { DcwNode } from './dcw-node'
+import { assertWithinLimits } from './param-limits'
 
 /** 回读死区容差:max(0.5×10^-小数位, 量程 0.5%) */
 export function writeTolerance(node: DcwNode): number {
@@ -49,6 +50,8 @@ export interface DcwReadOutcome {
 export class DcwNodeRuntime {
   private writing = false
   private lastHoldAt = 0
+  /** 保写被限界拒绝的最近告警时刻(节流,避免每拍刷日志) */
+  private holdBlockedAt = 0
   /** 周期读节拍 + 在飞互斥(读事务不与写事务互斥,但同节点读不重入) */
   private lastReadTick = 0
   private reading = false
@@ -107,20 +110,40 @@ export class DcwNodeRuntime {
       const hold = node.holdIntervalMs ?? this.host.defaults().holdIntervalMs
       // P0-1 保写产线门:绑定产线的节点仅在产线活动(有运行批次窗口)时保写,停线即挂起,
       // 开线后下一拍自然恢复(10-07 事故根因④:停线不挂起心跳,残留节点持续直写)。
-      // lineId=''(未分配产线的独立通道)不受门控,保持独立节点用法。
-      if (hold && hold > 0 && now - this.lastHoldAt >= hold && (!node.lineId || this.host.lineActive(node.lineId))) {
-        this.lastHoldAt = now
-        this.writing = true
-        node.state = 'writing'
-        // tick 是同步节拍(由 sweep 同步调用),这里 fire-and-forget 但**全程持锁**,
-        // 保证与 write() 互斥;finally 里收敛状态并释放闸门。
-        void Promise.resolve()
-          .then(() => this.host.executeWrite(node, node.value!, writeTolerance(node), null))
-          .catch(() => { /* 保写失败不抛出:下一拍重试 */ })
-          .finally(() => {
-            this.writing = false
-            if (node.state === 'writing') node.state = 'error'
-          })
+      // 2026-10-28:未分配产线的节点不再默认豁免 —— 删线(purge=false)会把 lineId 置空,
+      // 旧逻辑因此让已下线产线的设定值被永久重写。现在必须显式 AW_HOLD_UNASSIGNED=1 才保写。
+      const lineGate = node.lineId ? this.host.lineActive(node.lineId) : process.env.AW_HOLD_UNASSIGNED === '1'
+      if (hold && hold > 0 && now - this.lastHoldAt >= hold && lineGate) {
+        // 2026-10-28:保写心跳也过四层限界(含配方窗)。此前只查在飞闸门,操作员收窄量程/
+        // 换配方后可写被拒、心跳却按旧值持续重写 PLC。
+        let withinLimits = true
+        try {
+          assertWithinLimits(node, node.value!, { includeSoft: true, skipRecipe: false })
+        }
+        catch (err) {
+          withinLimits = false
+          if (now - this.holdBlockedAt > 60_000) {
+            this.holdBlockedAt = now
+            console.warn(`[dcw] 保写心跳被限界拒绝(跳过本拍):${node.name}(${node.id}) ${err instanceof Error ? err.message : String(err)}`)
+          }
+        }
+        if (!withinLimits) {
+          // 不写,但周期读继续(下方读路径与本块独立)
+        }
+        else {
+          this.lastHoldAt = now
+          this.writing = true
+          node.state = 'writing'
+          // tick 是同步节拍(由 sweep 同步调用),这里 fire-and-forget 但**全程持锁**,
+          // 保证与 write() 互斥;finally 里收敛状态并释放闸门。
+          void Promise.resolve()
+            .then(() => this.host.executeWrite(node, node.value!, writeTolerance(node), null))
+            .catch(() => { /* 保写失败不抛出:下一拍重试 */ })
+            .finally(() => {
+              this.writing = false
+              if (node.state === 'writing') node.state = 'error'
+            })
+        }
       }
     }
     // 周期读:被动观测,不依赖写过、不与写在飞互斥(仅同节点读串行)。

package/server/services/workshop/dcw/drivers/shared.ts

@@ -164,6 +164,8 @@ export const num = (v: unknown): number | undefined => {
 /**
  * 工程量 → 原始值:线性映射 eng ∈ [engMin, engMax] ↔ raw ∈ [rawMin, rawMax]。
  * 未提供原始量程时 raw = eng(float32 直写;int 类型仍需映射,缺省按量程直传并取整)。
+ * 2026-10-28(S15):换算结果必须落在 rawMin~rawMax 内 —— 此前越界值会被 encodeWords
+ * 静默按位回绕(int16/uint16)后写进 PLC,造成"写失败但设备已变"。
  */
 export function engToRaw(eng: number, input: DcwWriteInput): number {
   const cfg = input.driverConfig
@@ -173,7 +175,14 @@ export function engToRaw(eng: number, input: DcwWriteInput): number {
   const engMin = num(cfg.engMin) ?? input.domain.min
   const engMax = num(cfg.engMax) ?? input.domain.max
   if (engMax === engMin) return eng
-  return rawMin + ((eng - engMin) / (engMax - engMin)) * (rawMax - rawMin)
+  const out = rawMin + ((eng - engMin) / (engMax - engMin)) * (rawMax - rawMin)
+  if (!Number.isFinite(out)) throw new Error(`工程量 ${eng} 换算原始值失败(结果非有限数)`)
+  const lo = Math.min(rawMin, rawMax)
+  const hi = Math.max(rawMin, rawMax)
+  if (out < lo - 1e-9 || out > hi + 1e-9) {
+    throw new Error(`工程量 ${eng} 换算原始值 ${Number(out.toFixed(4))} 超出驱动原始量程 ${lo}~${hi}(eng ${engMin}~${engMax});请核对节点量程与 engMin/engMax/rawMin/rawMax 配置`)
+  }
+  return out
 }
 
 /** 原始值 → 工程量(回读换算;映射参数对称) */
@@ -208,16 +217,63 @@ export function readbackAck(
   return { ok, message, raw: opts.raw, readback, ack: ok ? 'readback-verified' : 'unverified' }
 }
 
-/** 原始值 → 寄存器字序(数据类型 + 字节序;与数采 decodeRegisters 互逆) */
+/**
+ * 原始值 → 寄存器字序(数据类型 + 字节序;与数采 decodeRegisters 互逆)。
+ * 2026-10-28(S15):整数类型先校验可表示范围,越界抛错而不是按位回绕。
+ */
 export function encodeWords(raw: number, dataType: string, byteOrder: string): number[] {
-  if (dataType === 'int16' || dataType === 'uint16') return [raw & 0xFFFF]
+  if (dataType === 'int16' || dataType === 'uint16') {
+    const r = Math.round(raw)
+    if (!Number.isFinite(r)) throw new Error(`原始值 ${raw} 不是有限数,拒绝编码为 ${dataType}`)
+    if (dataType === 'int16' && (r < -32768 || r > 32767)) throw new Error(`原始值 ${r} 超出 int16 范围(-32768~32767),拒绝写入`)
+    if (dataType === 'uint16' && (r < 0 || r > 65535)) throw new Error(`原始值 ${r} 超出 uint16 范围(0~65535),拒绝写入`)
+    return [r & 0xFFFF]
+  }
+  if (dataType === 'uint32') {
+    const r = Math.round(raw)
+    if (!Number.isFinite(r) || r < 0 || r > 4294967295) throw new Error(`原始值 ${raw} 超出 uint32 范围,拒绝写入`)
+  }
+  if (dataType === 'int32') {
+    const r = Math.round(raw)
+    if (!Number.isFinite(r) || r < -2147483648 || r > 2147483647) throw new Error(`原始值 ${raw} 超出 int32 范围,拒绝写入`)
+  }
   const buf = Buffer.alloc(4)
   if (dataType === 'float32') buf.writeFloatBE(raw, 0)
-  else if (dataType === 'uint32') buf.writeUInt32BE(raw, 0)
-  else buf.writeInt32BE(raw, 0)
+  else if (dataType === 'uint32') buf.writeUInt32BE(Math.round(raw), 0)
+  else buf.writeInt32BE(Math.round(raw), 0)
   const B = [buf[0]!, buf[1]!, buf[2]!, buf[3]!]
   const word = (hi: number, lo: number) => ((hi & 0xFF) << 8) | (lo & 0xFF)
-  if (byteOrder === 'little') return [word(B[1]!, B[0]!), word(B[3]!, B[2]!)]
+  // 与 daq/drivers/modbus-tcp.ts:decodeRegisters 严格互逆(2026-10-28 P0-1):
+  //   little=DCBA → [D C][B A];wordSwap=CDAB → [C D][A B];big=ABCD → [A B][C D]
+  if (byteOrder === 'little') return [word(B[3]!, B[2]!), word(B[1]!, B[0]!)]
   if (byteOrder === 'wordSwap') return [word(B[2]!, B[3]!), word(B[0]!, B[1]!)]
   return [word(B[0]!, B[1]!), word(B[2]!, B[3]!)]
 }
+
+const INT_RANGES: Record<string, [number, number]> = {
+  int16: [-32768, 32767],
+  uint16: [0, 65535],
+  int32: [-2147483648, 2147483647],
+  uint32: [0, 4294967295],
+}
+
+/**
+ * 配置期校验(S15):Modbus 原始量程必须能被 dataType 表示。
+ * 在节点创建/编辑时拒绝,避免运行期写坏 PLC 后才发现。
+ */
+export function assertDriverRawRange(driver: string, cfg: Record<string, unknown> = {}): void {
+  if (!driver.startsWith('modbus')) return
+  const rawMin = num(cfg.rawMin)
+  const rawMax = num(cfg.rawMax)
+  if (rawMin === undefined && rawMax === undefined) return
+  if (rawMin === undefined || rawMax === undefined) throw new Error('rawMin 与 rawMax 必须同时提供')
+  if (!(rawMax > rawMin)) throw new Error('rawMin 必须小于 rawMax')
+  const dt = String(cfg.dataType ?? 'float32')
+  const range = INT_RANGES[dt]
+  if (range && (rawMin < range[0] || rawMax > range[1])) {
+    throw new Error(`原始量程 ${rawMin}~${rawMax} 超出 ${dt} 可表示范围 ${range[0]}~${range[1]}`)
+  }
+  const engMin = num(cfg.engMin)
+  const engMax = num(cfg.engMax)
+  if (engMin !== undefined && engMax !== undefined && !(engMax > engMin)) throw new Error('engMin 必须小于 engMax')
+}

package/server/services/workshop/dcw/recipe-op-anchor.ts

@@ -67,6 +67,34 @@ export function getRecipeOpAnchor(recipeId: string): RecipeOpAnchor | null {
   return store().anchors.find(a => a.recipeId === recipeId) ?? null
 }
 
+/**
+ * 执行在飞占位(2026-10-28 审查 B-P1-2)。
+ *
+ * 频控判定是"查锚 → 写入(秒级 await)→ 落锚"三段:两个并发下发都会在"查"时
+ * 读到同一旧锚而双双过检,opIntervalMs/试验节拍被整体绕过。占位与判定必须在
+ * 同一次同步执行内完成(JS 单线程内天然原子),写入结束在 finally 释放。
+ * 跨进程语义仍由单进程写锁约束(与本仓库其它写路径同口径)。
+ */
+const inflight = new Set<string>()
+
+export function beginRecipeOp(recipeId: string, recipeName: string): void {
+  if (inflight.has(recipeId)) {
+    throw new AppError(429, ErrorCodes.WRITE_FREQUENT,
+      `配方「${recipeName}」已有一次下发正在执行(在飞占位),本次未获执行、产线未做任何变更。`
+      + `请等待该次下发返回后重试;若长时间无响应,请检查产线连接与写历史。`)
+  }
+  inflight.add(recipeId)
+}
+
+export function endRecipeOp(recipeId: string): void {
+  inflight.delete(recipeId)
+}
+
+/** 仅供测试/观测:该配方是否有在飞下发。 */
+export function isRecipeOpInflight(recipeId: string): boolean {
+  return inflight.has(recipeId)
+}
+
 /** 仅供测试:清空全部锚(内存+落盘) */
 export function resetRecipeOpAnchors(): void {
   g.__recipeOpAnchors = { anchors: [] }