oasis_test_v2 2.2.81 → 2.2.82

package/dist/index.js

@@ -2950,6 +2950,25 @@ async function fetchResultPackage(base, fetchImpl, runId) {
   }));
   return { artifacts, fileCount: body2.project?.fileCount ?? artifacts.length };
 }
+function toEpochMs(v2) {
+  if (typeof v2 === "number" && Number.isFinite(v2)) return v2;
+  if (typeof v2 === "string" && v2.length > 0) {
+    const ms = Date.parse(v2);
+    return Number.isNaN(ms) ? void 0 : ms;
+  }
+  return void 0;
+}
+function runTime(r) {
+  return r.createdAt ?? r.updatedAt ?? Number.NEGATIVE_INFINITY;
+}
+function latestSucceededRun(runs) {
+  let best;
+  for (const r of runs) {
+    if (r.status !== "succeeded") continue;
+    if (best === void 0 || runTime(r) > runTime(best)) best = r;
+  }
+  return best;
+}
 async function fetchBoardStatus(base, fetchImpl, artifactId) {
   const boardKey = deriveBoardKey(artifactId);
   let boardExists = true;
@@ -2975,10 +2994,20 @@ async function fetchBoardStatus(base, fetchImpl, artifactId) {
         "GET",
         `/api/runs?projectId=${encodeURIComponent(boardKey)}`
       );
-      runs = (body2.runs ?? []).map((r) => ({
-        runId: String(r["runId"] ?? r["id"] ?? ""),
-        status: String(r["status"] ?? "unknown")
-      }));
+      runs = (body2.runs ?? []).map((r) => {
+        const run = {
+          runId: String(r["runId"] ?? r["id"] ?? ""),
+          status: String(r["status"] ?? "unknown")
+        };
+        if (typeof r["agentId"] === "string" && r["agentId"].length > 0) run.agentId = r["agentId"];
+        if (typeof r["error"] === "string" && r["error"].trim().length > 0) run.error = r["error"];
+        const createdAt = toEpochMs(r["createdAt"]);
+        if (createdAt !== void 0) run.createdAt = createdAt;
+        const updatedAt = toEpochMs(r["updatedAt"]);
+        if (updatedAt !== void 0) run.updatedAt = updatedAt;
+        return run;
+      });
+      runs.sort((a, b2) => runTime(b2) - runTime(a) || 0);
     } catch {
     }
   }
@@ -218354,13 +218383,22 @@ function cloneOffboarding(op) {
     assignmentDecisions: op.assignmentDecisions.map((d) => ({ ...d, toPrincipal: { ...d.toPrincipal } }))
   };
 }
-var memberKey, scopedKey, bridgeKey, MemoryControlPlaneStore;
+var memberKey, scopedKey, bridgeKey, migrationRow, MemoryControlPlaneStore;
 var init_memory_control_plane_store = __esm({
   "../testkit/src/memory-control-plane-store.ts"() {
     "use strict";
     memberKey = (companyId, accountId) => `${companyId} ${accountId}`;
     scopedKey = (companyId, id) => `${companyId}\0${id}`;
     bridgeKey = (companyId, type, id) => `${companyId}\0${type}\0${id}`;
+    migrationRow = (companyId, accountId, roleBefore, roleAfter, audit2) => ({
+      companyId,
+      accountId,
+      roleBefore,
+      roleAfter,
+      evidence: audit2.evidence,
+      ...audit2.evidence === "manifest" && audit2.manifestVersion !== void 0 ? { manifestVersion: audit2.manifestVersion } : {},
+      appliedAt: audit2.appliedAt
+    });
     MemoryControlPlaneStore = class {
       companies = /* @__PURE__ */ new Map();
       members = /* @__PURE__ */ new Map();
@@ -218480,6 +218518,21 @@ var init_memory_control_plane_store = __esm({
         this.members.delete(key2);
         return { ok: true, member: { ...target } };
       }
+      async removeMemberAndReleaseOwnedAgents(companyId, accountId, at2) {
+        const target = this.members.get(memberKey(companyId, accountId));
+        if (!target) return { ok: false, reason: "not_found" };
+        if (target.role === "owner") return { ok: false, reason: "owner_protected" };
+        const releasedAgents = [];
+        for (const [key2, e] of this.digitalEmployees) {
+          if (e.companyId !== companyId || e.ownerAccountId !== accountId) continue;
+          const { ownerAccountId: _cleared, ...rest } = e;
+          this.digitalEmployees.set(key2, { ...rest, updatedAt: at2 });
+          releasedAgents.push(e.id);
+        }
+        this.principalBridges.delete(bridgeKey(companyId, "human", accountId));
+        this.members.delete(memberKey(companyId, accountId));
+        return { ok: true, member: { ...target }, releasedAgents };
+      }
       async updateMemberRoleIfNotLastOwner(companyId, accountId, role) {
         const key2 = memberKey(companyId, accountId);
         const target = this.members.get(key2);
@@ -218506,7 +218559,7 @@ var init_memory_control_plane_store = __esm({
           return { ok: false, reason: "target_not_listed" };
         }
         const acc = this.accounts.get(toAccountId);
-        if (acc && acc.status !== "active") return { ok: false, reason: "target_inactive" };
+        if (!acc || acc.status !== "active") return { ok: false, reason: "target_inactive" };
         const others = [];
         for (const m2 of this.members.values()) {
           if (m2.companyId === companyId && m2.role === "owner" && m2.accountId !== toAccountId) others.push(m2);
@@ -218523,6 +218576,37 @@ var init_memory_control_plane_store = __esm({
         this.members.set(memberKey(companyId, toAccountId), owner);
         return { ok: true, owner: { ...owner }, demoted };
       }
+      // —— 存量身份映射（ADR D3）——
+      async migrateSoleCompanyOwner(companyId, toAccountId, audit2) {
+        const target = this.members.get(memberKey(companyId, toAccountId));
+        if (!target) return { ok: false, reason: "not_found" };
+        const others = [];
+        for (const m2 of this.members.values()) {
+          if (m2.companyId === companyId && m2.role === "owner" && m2.accountId !== toAccountId) others.push(m2);
+        }
+        if (others.length === 0 && target.role === "owner") {
+          return { ok: true, owner: { ...target }, demoted: [], auditRows: [] };
+        }
+        const auditRows = [];
+        const demoted = others.map((m2) => {
+          const next = { ...m2, role: "admin" };
+          this.members.set(memberKey(companyId, m2.accountId), next);
+          auditRows.push(migrationRow(companyId, m2.accountId, "owner", "admin", audit2));
+          return { ...next };
+        });
+        if (target.role !== "owner") auditRows.push(migrationRow(companyId, toAccountId, target.role, "owner", audit2));
+        const owner = { ...target, role: "owner" };
+        this.members.set(memberKey(companyId, toAccountId), owner);
+        for (const r of auditRows) this.roleMigrations.push({ ...r });
+        return { ok: true, owner: { ...owner }, demoted, auditRows };
+      }
+      async setMemberRoleOnly(companyId, accountId, role) {
+        const key2 = memberKey(companyId, accountId);
+        const cur = this.members.get(key2);
+        if (!cur) return false;
+        this.members.set(key2, { ...cur, role });
+        return true;
+      }
       // —— 存量身份映射审计（ADR D3.4）：只追加 ——
       async appendMemberRoleMigrations(rows) {
         for (const r of rows) this.roleMigrations.push({ ...r });
@@ -223813,6 +223897,9 @@ var init_control_plane_file_store = __esm({
       "removeMemberIfNotLastOwner",
       "updateMemberRoleIfNotLastOwner",
       "setSoleCompanyOwner",
+      "removeMemberAndReleaseOwnedAgents",
+      "migrateSoleCompanyOwner",
+      "setMemberRoleOnly",
       "appendMemberRoleMigrations",
       "createInvitation",
       "updateInvitationStatus",
@@ -225260,38 +225347,17 @@ async function backfillOrgIdentity(deps, opts = {}) {
     const desc = row.changes.map((c) => `${c.accountId} ${c.roleBefore}\u2192${c.roleAfter}`).join("\uFF0C");
     log3(`  ${row.companyId}\uFF1A${desc}${opts.apply ? "" : "\uFF08dry-run\uFF09"}`);
     if (!opts.apply) continue;
-    const res = await deps.store.setSoleCompanyOwner(row.companyId, target);
-    if (!res.ok) {
-      throw new Error(
-        `${row.companyId} \u6536\u655B\u5230 ${target} \u5931\u8D25\uFF1A${res.reason}\uFF08target_not_listed = \u90A3\u4E2A\u4EBA\u8FD8\u6CA1\u8D70\u5B8C\u65B0\u624B\u6307\u5F15\uFF1Btarget_inactive = \u8D26\u53F7\u5DF2\u505C\u7528\uFF09`
-      );
-    }
-    applied += 1;
-    const at2 = now();
     const evidence = row.decision === "manifest" ? "manifest" : "E1";
-    const rows = res.demoted.map((m2) => ({
-      companyId: row.companyId,
-      accountId: m2.accountId,
-      roleBefore: "owner",
-      roleAfter: "admin",
+    const res = await deps.store.migrateSoleCompanyOwner(row.companyId, target, {
       evidence,
-      ...opts.manifest?.manifestVersion !== void 0 && evidence === "manifest" ? { manifestVersion: opts.manifest.manifestVersion } : {},
-      appliedAt: at2
-    }));
-    const promoted = row.changes.find((c) => c.accountId === target);
-    if (promoted) {
-      rows.push({
-        companyId: row.companyId,
-        accountId: target,
-        roleBefore: promoted.roleBefore,
-        roleAfter: "owner",
-        evidence,
-        ...opts.manifest?.manifestVersion !== void 0 && evidence === "manifest" ? { manifestVersion: opts.manifest.manifestVersion } : {},
-        appliedAt: at2
-      });
+      ...opts.manifest?.manifestVersion !== void 0 ? { manifestVersion: opts.manifest.manifestVersion } : {},
+      appliedAt: now()
+    });
+    if (!res.ok) {
+      throw new Error(`${row.companyId} \u6536\u655B\u5230 ${target} \u5931\u8D25\uFF1A${res.reason}\uFF08\u90A3\u4E00\u884C\u4E0D\u5728\u8BE5\u7EC4\u7EC7\u7684\u6210\u5458\u8868\u91CC\uFF09`);
     }
-    await deps.store.appendMemberRoleMigrations(rows);
-    auditRows += rows.length;
+    applied += 1;
+    auditRows += res.auditRows.length;
   }
   return { ...inv, applied, auditRows };
 }
@@ -225311,7 +225377,7 @@ async function rollbackOrgIdentity(deps, opts) {
     plan.push({ companyId: r.companyId, accountId: r.accountId, from: member.role, to: r.roleBefore });
     log3(`  ${r.companyId} ${r.accountId} ${member.role}\u2192${r.roleBefore}${opts.apply ? "" : "\uFF08dry-run\uFF09"}`);
     if (!opts.apply) continue;
-    await deps.store.upsertMember({ ...member, role: r.roleBefore });
+    await deps.store.setMemberRoleOnly(r.companyId, r.accountId, r.roleBefore);
     reverted += 1;
   }
   return { plan, reverted };
@@ -232799,6 +232865,12 @@ function actorsDomain(opts) {
     }
     await asForbidden(() => assertMayManageAgent(opts.agentManageGuard, ctx, { id: actor.id, positions: actor.roles }));
   };
+  const guardPositionsChange = async (req, existing, nextPositions) => {
+    if (existing.kind !== "agent" || nextPositions === void 0) return;
+    if (isAssistantAgent({ positions: existing.roles }) === isAssistantAgent({ positions: nextPositions })) return;
+    const ctx = { companyId: req.auth.companyId, callerActorId: req.auth.actor };
+    await asForbidden(() => assertMayManageAgent(opts.agentManageGuard, ctx, { id: existing.id, positions: nextPositions }));
+  };
   const guardExistingActorWrite = async (req, service, actorId) => {
     const existing = await service.getActor(actorId);
     if (!existing) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5\uFF1A${actorId}`);
@@ -232891,6 +232963,7 @@ function actorsDomain(opts) {
       const positions = positionsFromPayload(b2);
       const avatar = avatarRefFromPayload(b2);
       const tags = tagsFromPayload(b2);
+      await guardPositionsChange(req, existing, positions);
       const {
         positions: _positions,
         id: _id,
@@ -242321,8 +242394,8 @@ var init_service6 = __esm({
         const target = await this.store.getMember(companyId, accountId);
         if (!target) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
         if (target.role === "owner") throw this.ownerProtected();
-        const res = await this.store.removeMemberIfNotLastOwner(companyId, accountId);
-        if (res.ok) return res.member;
+        const res = await this.store.removeMemberAndReleaseOwnedAgents(companyId, accountId, this.now());
+        if (res.ok) return { member: res.member, releasedAgents: res.releasedAgents };
         if (res.reason === "not_found") throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
         throw this.ownerProtected();
       }
@@ -242846,12 +242919,14 @@ var init_offboarding = __esm({
       listInFlight;
       transferAssignment;
       disableActor;
+      restoreActor;
       constructor(opts) {
         this.store = opts.store;
         this.now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
         this.listInFlight = opts.listInFlightAssignments;
         this.transferAssignment = opts.transferAssignment;
         this.disableActor = opts.disableActor;
+        this.restoreActor = opts.restoreActor;
       }
       /** 该成员是不是公司最后一个 owner（最后一个 owner 立即阻断，先于任何交接讨论）。 */
       async isLastOwner(companyId, accountId) {
@@ -242877,14 +242952,13 @@ var init_offboarding = __esm({
        */
       async blockersForRemoval(companyId, accountId) {
         const blockers = [];
-        const member = await this.store.getMember(companyId, accountId);
+        const members = await this.store.listMembers(companyId);
+        const member = members.find((m2) => m2.accountId === accountId);
         if (!member) {
           return [{ code: "NOT_FOUND", message: `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}` }];
         }
         if (member.role === "owner") {
           blockers.push({ code: "OWNER_PROTECTED", message: OWNER_PROTECTED_MESSAGE });
-        } else if (await this.isLastOwner(companyId, accountId)) {
-          blockers.push({ code: "LAST_OWNER", message: "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner" });
         }
         return blockers;
       }
@@ -242953,12 +243027,9 @@ var init_offboarding = __esm({
         if (op.version !== expectedVersion) {
           throw new CompanyError(409, "STALE_PLAN", `\u8BA1\u5212\u7248\u672C\u5DF2\u53D8\uFF08\u5F53\u524D ${op.version}\uFF0C\u4F60\u7ED9\u7684\u662F ${expectedVersion}\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D6\u8BA1\u5212`);
         }
-        const target = await this.store.getMember(companyId, accountId);
+        const members = await this.store.listMembers(companyId);
+        const target = members.find((m2) => m2.accountId === accountId);
         if (target?.role === "owner") throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
-        if (await this.isLastOwner(companyId, accountId)) {
-          throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner");
-        }
-        const released = await this.releaseOwnedAgents(companyId, accountId);
         const remaining = await this.blockersForRemoval(companyId, accountId);
         if (remaining.length > 0) {
           await this.store.updateMemberOffboardingIfVersion(
@@ -242970,7 +243041,7 @@ var init_offboarding = __esm({
           );
           throw new CompanyError(409, remaining[0].code, `\u4ECD\u6709\u672A\u4EA4\u63A5\u9879\uFF1A${remaining.map((b2) => b2.message).join("; ")}`);
         }
-        await this.applyMemberRemoval(companyId, accountId);
+        const released = await this.applyMemberRemoval(companyId, accountId);
         await this.store.updateMemberOffboardingIfVersion(
           companyId,
           operationId,
@@ -242981,35 +243052,63 @@ var init_offboarding = __esm({
         return { status: "removed", transferred: [], left: released };
       }
       /**
-       * 移除一条成员关系的**全套副作用**，顺序固定，三条移除路径共用：
-       *   ① 清名下 agent 的负责人字段（`digital_employee.owner` 的复合 FK 是 ON DELETE RESTRICT，
-       *      不清就是一个裸 FK 违例）；**只清 owner**——不改状态、不撤凭证、不解绑助理（PRD v1.5）；
-       *   ② 停用花名册里这个人（**还在别家公司在职就不停用**——停用打的是全局那一行）；
-       *   ③ 删 human principal bridge（对 company_member 是 CASCADE，但文件/内存实现没有级联，
-       *      显式删一次让「桥随主体走」在应用层也成立）；
-       *   ④ 删成员行（走 `removeMemberIfNotLastOwner`，组织管理员那一位在这里被纵深防御挡住）。
+       * 移除一条成员关系的**全套副作用**，三条移除路径共用（管理员移除他人 `commit`、
+       * 本人退出组织 `DELETE …/members/me`、注销账号 `DELETE /api/accounts/me`）。
        *
-       * 顺序不能反：成员行一删，本公司的 scoped registry 就不再认这个 actor，②会静默 no-op。
-       * 任何一步失败都停在「人已停用、成员还在」——可重试，每一步都幂等。
+       * 顺序与原子性（2026-09-23 代码评审打回后重排）：
+       *   ① 读一遍成员行：不存在 → 404；**已经是组织管理员 → 当场 403，一个副作用都不做**（D5.2）。
+       *   ② 停用花名册里这个人（**还在别家公司在职就不停用**——停用打的是全局那一行）。
+       *      这一步必须在③之前：成员行一删，本公司的 scoped registry 就不再认这个 actor，
+       *      停用会静默 no-op，人被移除了却还挂在花名册上（QA D3 修过一次的病）。
+       *   ③ **一个事务**做完控制面三件事：锁内复核目标不是组织管理员 → 清名下 agent 的负责人字段
+       *      （`digital_employee.owner` 的复合 FK 是 ON DELETE RESTRICT，不清就是裸 FK 违例；
+       *      **只清 owner**，不改状态、不撤凭证、不解绑助理，PRD v1.5）→ 删 human principal bridge
+       *      → 删成员行（`store.removeMemberAndReleaseOwnedAgents`）。
+       *   ④ ③失败（并发转交把这个人升成了组织管理员，A09）→ 把②CAS 还原回去。
        *
-       * 三个调用点：管理员移除他人（`commit`）、本人退出组织（`DELETE …/members/me`）、
-       * 注销账号（逐家执行，`DELETE /api/accounts/me`）。
+       * **为什么③非要是一个事务**：以前①②③是「先清负责人、再停用、再删桥，最后才去拿锁删成员行」
+       * 四段独立的写。A09 那条并发（`O` 转交给 `A1` 的同时另一位管理员删 `A1`）走到最后一步才被
+       * `OWNER_PROTECTED` 拒——而此刻 `A1` 名下 Agent 的负责人已经被清空、桥已经被删、人已经被停用。
+       * 请求失败了，破坏却留下了：新上任的组织管理员丢了名下全部 Agent 的归属、还从花名册上消失。
+       * 现在控制面那三件事共一把锁（与转交锁同一组行），失败时一行都没写；跨不进这把锁的只有员工侧
+       * 停用，用 CAS 补偿还原——「停用之后有别人写过这个 actor」就跳过，不撤销他人的合法写（QA R9）。
        */
       async applyMemberRemoval(companyId, accountId) {
-        const released = await this.releaseOwnedAgents(companyId, accountId);
         const member = await this.store.getMember(companyId, accountId);
-        if (member && !await isEmployedElsewhere(this.store, companyId, accountId)) {
-          await this.disableActor?.(companyId, member.actorId);
+        if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (member.role === "owner") throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
+        let ticket = null;
+        if (!await isEmployedElsewhere(this.store, companyId, accountId)) {
+          ticket = await this.disableActor?.(companyId, member.actorId) ?? null;
         }
-        await this.store.deletePrincipalBridge(companyId, "human", accountId);
-        const removed = await this.store.removeMemberIfNotLastOwner(companyId, accountId);
+        const removed = await this.store.removeMemberAndReleaseOwnedAgents(companyId, accountId, this.now()).catch(async (e) => {
+          await this.compensateDisable(companyId, ticket);
+          throw e;
+        });
         if (!removed.ok) {
+          await this.compensateDisable(companyId, ticket);
           if (removed.reason === "not_found") {
             throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
           }
           throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
         }
-        return released;
+        return removed.releasedAgents;
+      }
+      /**
+       * 把②那次停用还原回去。**只还原本次自己造成的那一次**：`restoreActor` 走 CAS，
+       * 停用之后但凡有别人写过这个 actor 就跳过——留下「成员还在 + actor 已停用」这个合法终态
+       * （与员工页 `DELETE /api/actors/:id` 的终态同构），比静默撤销他人的合法停用安全。
+       * 补偿本身失败不改写主错误：调用方要看到的是「为什么没删成」，不是补偿的二级故障。
+       */
+      async compensateDisable(companyId, ticket) {
+        if (!ticket || !this.restoreActor) return;
+        try {
+          await this.restoreActor(companyId, ticket);
+        } catch (e) {
+          console.error(
+            `[offboarding] restore actor ${ticket.actorId} failed after removal was rejected: ${e instanceof Error ? e.message : String(e)}`
+          );
+        }
       }
       /**
        * 把该成员名下所有 agent 的负责人字段清空，返回被清的 agent id。
@@ -243098,10 +243197,18 @@ function companiesDomain(opts) {
     }
     return n;
   };
+  const requireActiveCompany = async (companyId) => {
+    const company = await service.get(companyId);
+    if (!company || company.status !== "active") {
+      throw new ApiError(404, "COMPANY_NOT_FOUND", `\u7EC4\u7EC7\u4E0D\u5B58\u5728\u6216\u5DF2\u4E0D\u53EF\u7528\uFF1A${companyId}`);
+    }
+  };
   const requireOwnerOrAdmin = async (req, companyId) => {
     const me = await whoami(req);
     const member = await service.getMember(companyId, me.accountId);
-    if (!member || member.role !== "owner" && member.role !== "admin") {
+    if (!member) throw new ApiError(403, "FORBIDDEN", "\u9700\u8981\u8BE5\u516C\u53F8\u7684 owner/admin \u6743\u9650");
+    await requireActiveCompany(companyId);
+    if (member.role !== "owner" && member.role !== "admin") {
       throw new ApiError(403, "FORBIDDEN", "\u9700\u8981\u8BE5\u516C\u53F8\u7684 owner/admin \u6743\u9650");
     }
   };
@@ -243109,6 +243216,7 @@ function companiesDomain(opts) {
     const me = await whoami(req);
     const member = await service.getMember(companyId, me.accountId);
     if (!member) throw new ApiError(403, "NOT_A_MEMBER", "\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF0C\u8BBF\u95EE\u88AB\u62D2");
+    await requireActiveCompany(companyId);
     return me;
   };
   return (router) => {
@@ -243232,7 +243340,6 @@ function companiesDomain(opts) {
       const aid = req.params.accountId;
       await requireOwnerOrAdmin(req, cid);
       const member = await service.peekRemovableMember(cid, aid).catch(mapErr);
-      if (offboarding) await offboarding.releaseOwnedAgents(cid, aid).catch(mapErr);
       let actorsSvc;
       let ownedDisableBefore = null;
       let disableSeq = 0;
@@ -243628,9 +243735,30 @@ function createCompaniesDomain(opts) {
     ...opts.resolveActorsCtx !== void 0 ? {
       // 未认领转 left 的 agent、以及 commit 移除掉的那位成员，都要把员工侧 ActorRecord
       // 一并软停用——否则控制面说「已离开/已移除」、花名册还显示在岗，两个事实源当场分叉。
+      //
+      // 用 `disableActorIfCurrentlyActive` 而不是 `disableActor`，并把 `{before, seq}` 回给
+      // offboarding：只有**真的把这个 actor 从 active 拉到 disabled** 的那一次调用才拿得到
+      // 返回值，也才「拥有」这次状态变更；已被并发请求或员工页先停用的一律 ok:false，
+      // 本次就不 own、移除失败也不补偿（QA R10 的判据，两条移除路径同一套）。
       disableActor: async (companyId, actorId) => {
         const ctx = await opts.resolveActorsCtx(companyId);
-        await ctx.service.disableActorIfCurrentlyActive(actorId, "system:offboarding");
+        const res = await ctx.service.disableActorIfCurrentlyActive(actorId, "system:offboarding");
+        return res.ok ? { actorId, before: res.before, seq: res.seq } : null;
+      },
+      // 移除最终失败时的补偿：**CAS** 写回停用前那一行。`expectedSeq` 对不上（停用之后
+      // 有任何第三方写过这个 actor）就跳过——不静默撤销他人的合法停用 / 改名（QA R9）。
+      restoreActor: async (companyId, ticket) => {
+        const ctx = await opts.resolveActorsCtx(companyId);
+        const res = await ctx.service.casUpsertActor(
+          { ...ticket.before, status: "active" },
+          ticket.seq,
+          "system:offboarding"
+        );
+        if (!res.ok) {
+          console.info(
+            `[companies] restore skipped for ${ticket.actorId}: another write intervened after the disable`
+          );
+        }
       }
     } : {}
   });
@@ -260652,7 +260780,7 @@ async function ensureOneOwnerInvariant(pool, s2) {
     );
   }
 }
-var ident8, PostgresControlPlaneStore, rowToDigitalEmployee, rowToAgentCredential, rowToBridge, rowToOffboarding, toIso, rowToCompany, rowToRoleMigration, rowToMember, rowToInvitation, rowToInviteLink, rowToAccount, rowToVerificationCode;
+var ident8, PostgresControlPlaneStore, rowToDigitalEmployee, rowToAgentCredential, rowToBridge, rowToOffboarding, toIso, rowToCompany, rowToRoleMigration, migrationRow2, rowToMember, rowToInvitation, rowToInviteLink, rowToAccount, rowToVerificationCode;
 var init_postgres_control_plane = __esm({
   "../storage/src/postgres-control-plane.ts"() {
     "use strict";
@@ -261043,6 +261171,48 @@ var init_postgres_control_plane = __esm({
           client.release();
         }
       }
+      async removeMemberAndReleaseOwnedAgents(companyId, accountId, at2) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const all2 = await client.query(
+            `SELECT company_id, account_id, actor_id, role, display_name, onboarding_completed_at, onboarding_step
+           FROM ${this.s}.company_members WHERE company_id = $1 FOR UPDATE`,
+            [companyId]
+          );
+          const target = all2.rows.map(rowToMember).find((m2) => m2.accountId === accountId);
+          if (!target) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          if (target.role === "owner") {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "owner_protected" };
+          }
+          const released = await client.query(
+            `UPDATE ${this.s}.digital_employees SET owner_account_id = NULL, updated_at = $3
+          WHERE company_id = $1 AND owner_account_id = $2
+        RETURNING id`,
+            [companyId, accountId, at2]
+          );
+          await client.query(
+            `DELETE FROM ${this.s}.principal_bridge WHERE company_id = $1 AND principal_type = 'human' AND principal_id = $2`,
+            [companyId, accountId]
+          );
+          await client.query(
+            `DELETE FROM ${this.s}.company_members WHERE company_id = $1 AND account_id = $2`,
+            [companyId, accountId]
+          );
+          await client.query("COMMIT");
+          return { ok: true, member: target, releasedAgents: released.rows.map((r) => r.id) };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
       async updateMemberRoleIfNotLastOwner(companyId, accountId, role) {
         const client = await this.pool.connect();
         try {
@@ -261111,7 +261281,7 @@ var init_postgres_control_plane = __esm({
             `SELECT status FROM ${this.s}.accounts WHERE id = $1`,
             [toAccountId]
           );
-          if (acc.rows[0] && acc.rows[0].status !== "active") {
+          if (!acc.rows[0] || acc.rows[0].status !== "active") {
             await client.query("ROLLBACK");
             return { ok: false, reason: "target_inactive" };
           }
@@ -261148,6 +261318,73 @@ var init_postgres_control_plane = __esm({
           client.release();
         }
       }
+      // —— 存量身份映射（ADR D3）——
+      async migrateSoleCompanyOwner(companyId, toAccountId, audit2) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const all2 = await client.query(
+            `SELECT company_id, account_id, actor_id, role, display_name, onboarding_completed_at, onboarding_step
+           FROM ${this.s}.company_members WHERE company_id = $1 FOR UPDATE`,
+            [companyId]
+          );
+          const rows = all2.rows.map(rowToMember);
+          const target = rows.find((m2) => m2.accountId === toAccountId);
+          if (!target) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          const others = rows.filter((m2) => m2.role === "owner" && m2.accountId !== toAccountId);
+          if (others.length === 0 && target.role === "owner") {
+            await client.query("COMMIT");
+            return { ok: true, owner: target, demoted: [], auditRows: [] };
+          }
+          if (others.length > 0) {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'admin' WHERE company_id = $1 AND role = 'owner' AND account_id <> $2`,
+              [companyId, toAccountId]
+            );
+          }
+          if (target.role !== "owner") {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'owner' WHERE company_id = $1 AND account_id = $2`,
+              [companyId, toAccountId]
+            );
+          }
+          const auditRows = [
+            ...others.map((m2) => migrationRow2(companyId, m2.accountId, "owner", "admin", audit2)),
+            ...target.role !== "owner" ? [migrationRow2(companyId, toAccountId, target.role, "owner", audit2)] : []
+          ];
+          for (const r of auditRows) {
+            await client.query(
+              `INSERT INTO ${this.s}.company_member_role_migrations
+             (company_id, account_id, role_before, role_after, evidence, manifest_version, applied_at)
+           VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+              [r.companyId, r.accountId, r.roleBefore, r.roleAfter, r.evidence, r.manifestVersion ?? null, r.appliedAt]
+            );
+          }
+          await client.query("COMMIT");
+          return {
+            ok: true,
+            owner: { ...target, role: "owner" },
+            demoted: others.map((m2) => ({ ...m2, role: "admin" })),
+            auditRows
+          };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
+      async setMemberRoleOnly(companyId, accountId, role) {
+        const r = await this.pool.query(
+          `UPDATE ${this.s}.company_members SET role = $3 WHERE company_id = $1 AND account_id = $2`,
+          [companyId, accountId, role]
+        );
+        return (r.rowCount ?? 0) > 0;
+      }
       // —— 存量身份映射审计（ADR D3.4）——
       async appendMemberRoleMigrations(rows) {
         if (rows.length === 0) return;
@@ -261661,6 +261898,15 @@ var init_postgres_control_plane = __esm({
       ...row.manifest_version != null ? { manifestVersion: row.manifest_version } : {},
       appliedAt: toIso(row.applied_at)
     });
+    migrationRow2 = (companyId, accountId, roleBefore, roleAfter, audit2) => ({
+      companyId,
+      accountId,
+      roleBefore,
+      roleAfter,
+      evidence: audit2.evidence,
+      ...audit2.evidence === "manifest" && audit2.manifestVersion !== void 0 ? { manifestVersion: audit2.manifestVersion } : {},
+      appliedAt: audit2.appliedAt
+    });
     rowToMember = (row) => ({
       companyId: row.company_id,
       accountId: row.account_id,
@@ -293490,7 +293736,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.81" ? "2.2.81" : "dev";
+var CLI_VERSION = "2.2.82" ? "2.2.82" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -295287,7 +295533,13 @@ ${res.warning}`);
         if (live.length > 0) {
           for (const r of live) println(`[design] \u5F15\u64CE\u5728\u8DD1\uFF1Arun ${r.runId.slice(0, 8)} \u72B6\u6001=${r.status}\u2014\u2014\u522B\u518D\u8D77\u65B0\u8F6E\uFF1B\u8FC7\u51E0\u5206\u949F\u518D status\uFF0C\u6216\u672C\u8F6E\u6536\u5DE5\u7B49\u91CD\u6D3E\u3002`);
         } else if (st.runs.length > 0) {
-          for (const r of st.runs.slice(0, 3)) println(`[design] \u8FD1\u671F run\uFF1A${r.runId.slice(0, 8)} \u7EC8\u6001=${r.status}`);
+          for (const r of st.runs.slice(0, 3)) {
+            println(`[design] \u8FD1\u671F run\uFF1A${r.runId.slice(0, 8)} \u7EC8\u6001=${r.status}${r.agentId ? ` \u5F15\u64CE=${r.agentId}` : ""}`);
+            if (r.status === "failed" && r.error) {
+              const reason = r.error.length > 300 ? `${r.error.slice(0, 300)}\u2026` : r.error;
+              println(`[design]   \u5931\u8D25\u539F\u56E0\uFF08od \u539F\u6587\uFF09\uFF1A${reason}`);
+            }
+          }
         } else {
           println(`[design] \u65E0\u5728\u4E16 run \u8BB0\u5F55\uFF08od \u91CD\u542F\u540E\u4E3A\u7A7A\uFF0C\u5C5E\u6B63\u5E38\uFF09\u2014\u2014\u770B\u4E0B\u9762\u677F\u4E0A\u4EA7\u7269\u5373\u6301\u4E45\u771F\u76F8\u3002`);
         }
@@ -295299,7 +295551,7 @@ ${res.warning}`);
         for (const a of st.artifacts) println(`  - ${a.path}\uFF08${a.kind ?? "?"}\uFF09status=${a.status ?? "?"}${a.mtime ? ` \xB7 ${new Date(a.mtime).toISOString()}` : ""}`);
         if (flags.get("pull") === "true") {
           const odPublic = (flags.get("od-public-url") ?? process.env["OASIS_OPEN_DESIGN_PUBLIC_URL"] ?? "https://design.open-friday.com").replace(/\/$/, "");
-          const { dir: dir2, entry } = await harvestBoard(odBase, odFetch, odPublic, os13.tmpdir(), st.boardKey, st.runs[0]?.runId ?? "status-pull");
+          const { dir: dir2, entry } = await harvestBoard(odBase, odFetch, odPublic, os13.tmpdir(), st.boardKey, latestSucceededRun(st.runs)?.runId ?? "status-pull");
           println(`[design] \u5DF2\u62C9\u5230\u672C\u5730\uFF1A${dir2}\uFF08\u5165\u53E3 ${entry}\uFF09`);
           println(`[design] \u8BFB\u5B8C\u6EE1\u610F\u5373\u4EA4\u7A3F\uFF1Aoasis propose ${artifactId} --from-dir ${dir2} --reason "<\u8FD9\u7248\u505A\u4E86\u4EC0\u4E48>"`);
         } else {
@@ -297400,7 +297652,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.81" : "dev";
+var PKG_VERSION = true ? "2.2.82" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.81",
+  "version": "2.2.82",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "3aab21cfa53fd28b194371066125b2b81c9f846d"
+    "sourceHead": "6a195fdb899ac4fe62d0cb8a164be7840880a6a7"
   }
 }