openxiangda 1.0.206 → 1.0.207

package/README.md

@@ -208,6 +208,8 @@ Page repair publishing is staged by default. It first freezes `pages/snapshot`,
 
 Use `openxiangda release app-capture` to read the platform's transactionally consistent whole-app manifest. For a normal multi-resource release, stage the changed Runtime/Page/Backend/Form child releases; commands carrying the same `--change` atomically accumulate their canonical immutable entries in `.openxiangda/releases/<change>/staged-resources.json`. Then run `app-finalize --change <change> --staged-resources-json <JSON|file>`. The CLI overlays Runtime/Page/Backend by singleton kind and Form by `formUuid`, preserves every unmodified active child from the read-only capture, and sends the complete frozen manifest through `prepare -> verify -> activate` with `activateStagedChildren=true`. Runtime staging never rewrites local active Runtime state, and a malformed staged response fails closed. The child heads and App head therefore switch in one database transaction (`atomic_staged_children_v1`); any parent, revision, asset, or hash drift stops with zero root activation and is never refreshed or retried. An aborted Form Release is never an idempotent success: rerunning the same scoped form publish removes its aborted staged index and creates a new immutable attempt automatically, after which the whole App is retried atomically. Never work around an App failure by sequentially activating forms. `app-prepare` accepts the same overlay for a manual reviewed flow, and `app-activate <releaseId> --activate-staged-children` performs the explicit atomic activation. Calling `app-finalize` without an overlay remains a compatibility-only retrospective aggregation of already-active children. `app-rollback <releaseId> --change <change> --reason "..."` prepares the audited rollback manifest.
 
+If exact FormRelease children were already staged for the same change before a new release baseline or lease is acquired, the CLI reuses them only after checking the server's immutable, inactive, non-aborted release, exact app/form identity and content hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. Verified children are rebound to the newly owned baseline/session; local `schemaSyncedAt` is not treated as release evidence. Missing or conflicting evidence still fails closed, and neither direct schema synchronization nor early Form activation is required.
+
 For small live fixes, diagnosis, or AI command discovery, use first-class resource commands. They all accept `--profile`, `--app-type`, `--json`, `--json-file`, `--dry-run`, and write commands can use `--write-manifest` to avoid repo/platform drift:
 
 ```bash

package/lib/cli.js

@@ -3834,7 +3834,10 @@ async function release(args) {
       );
     }
     const pendingBaseline = getStoredChangeBaseline(target);
-    const newReleaseLifecycle = !stored && !pendingBaseline;
+    const newReleaseLifecycle = !existing && !pendingBaseline;
+    const reusableFormCandidates = newReleaseLifecycle
+      ? reusableStagedFormReleaseCandidates(target, changeId)
+      : [];
     const clientSessionId =
       existing?.clientSessionId ||
       (pendingBaseline?.changeId === changeId &&
@@ -3866,6 +3869,7 @@ async function release(args) {
     let frozenCapture = null;
     let releaseSessionFile = null;
     let stagedResourcesFile = null;
+    let reusedStagedFormReleases = [];
     try {
       if (flags['freeze-app-capture']) {
         frozenCapture = await fetchAppReleaseCapture(config, target, flags);
@@ -3877,9 +3881,16 @@ async function release(args) {
           frozenCapture
         );
       }
-      stagedResourcesFile = newReleaseLifecycle
-        ? initializeStagedAppReleaseResources(target, changeId)
-        : null;
+      if (newReleaseLifecycle) {
+        const initialized = await initializeNewReleaseStagedResources(
+          config,
+          target,
+          changeId,
+          reusableFormCandidates
+        );
+        stagedResourcesFile = initialized.file;
+        reusedStagedFormReleases = initialized.reused;
+      }
     } catch (error) {
       if (newReleaseLifecycle) {
         try {
@@ -3914,6 +3925,9 @@ async function release(args) {
           }
         : {}),
       ...(stagedResourcesFile ? { stagedResourcesFile } : {}),
+      ...(reusedStagedFormReleases.length > 0
+        ? { reusedStagedFormReleases }
+        : {}),
     };
     if (flags.json) return writeJson(result);
     print(
@@ -4893,14 +4907,22 @@ function writeStagedResourcesFiles(
   return path.relative(process.cwd(), file).replace(/\\/g, '/');
 }
 
-function initializeStagedAppReleaseResources(target, changeId) {
+function initializeStagedAppReleaseResources(
+  target,
+  changeId,
+  resources = [],
+  metadata = {}
+) {
   const context = currentStagedResourcesContext(target, changeId);
   return writeStagedResourcesFiles(
     changeId,
-    [],
+    Array.isArray(resources) && resources.length === 0
+      ? []
+      : normalizeStagedAppReleaseResources(resources),
     {
       ...context,
       initializedAt: new Date().toISOString(),
+      ...metadata,
     },
     target.deploymentId
   );
@@ -5083,6 +5105,278 @@ function stagedFormCode(target, resource) {
   return formUuid;
 }
 
+function reusableStagedFormReleaseCandidates(target, changeId) {
+  const normalizedChangeId = String(changeId || '').trim();
+  if (!normalizedChangeId) return [];
+  const file = stagedResourcesFileForChange(
+    normalizedChangeId,
+    target.deploymentId
+  );
+  if (!fs.existsSync(file)) return [];
+  const contextFile = stagedResourcesContextFileForChange(
+    normalizedChangeId,
+    target.deploymentId
+  );
+  if (!fs.existsSync(contextFile)) {
+    fail(
+      `FORM_RELEASE_REUSE_CONTEXT_REQUIRED: change ${normalizedChangeId} 的 staged FormRelease 缺少 context，拒绝重挂接`
+    );
+  }
+  const context = JSON.parse(fs.readFileSync(contextFile, 'utf8'));
+  const expected = {
+    contractVersion: 'staged_resources_context_v1',
+    appType: target.appType,
+    profile: target.profileName,
+    changeId: normalizedChangeId,
+    deploymentId: target.deploymentId || null,
+  };
+  for (const [field, value] of Object.entries(expected)) {
+    if ((context?.[field] ?? null) !== (value ?? null)) {
+      fail(
+        `FORM_RELEASE_REUSE_CONTEXT_MISMATCH: ${field} 不属于当前 app/profile/change/deployment，拒绝重挂接 staged FormRelease`
+      );
+    }
+  }
+  const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const resources = Array.isArray(parsed) && parsed.length === 0
+    ? []
+    : normalizeStagedAppReleaseResources(parsed);
+  let scopedForms = null;
+  try {
+    scopedForms = new Set(
+      getSddChangeScope({
+        cwd: process.cwd(),
+        configText: readWorkspaceConfigText(),
+        changeId: normalizedChangeId,
+      }).targets.forms || []
+    );
+  } catch (error) {
+    // A direct release may use --change without a local SDD record. The
+    // exact local context still supplies the app/profile/change scope, while
+    // every candidate is independently verified against immutable server data.
+    if (!/SDD 未初始化|change 不存在|ENOENT/i.test(String(error?.message || ''))) {
+      throw error;
+    }
+  }
+  return resources
+    .filter(resource => resource.kind === 'FormRelease')
+    .map(resource => {
+      const formCode = stagedFormCode(target, resource);
+      if (
+        scopedForms &&
+        (!formCode || !scopedForms.has(formCode))
+      ) {
+        fail(
+          `FORM_RELEASE_REUSE_SCOPE_MISMATCH: ${formCode || resource.identity?.formUuid || '(unknown)'} 不在 change ${normalizedChangeId} 的精确 Form 范围内`
+        );
+      }
+      return { resource, formCode };
+    });
+}
+
+function nullableReleaseId(value) {
+  const normalized = String(value || '').trim();
+  return normalized || null;
+}
+
+async function verifyReusableStagedFormRelease(
+  config,
+  target,
+  candidate
+) {
+  const resource = candidate.resource;
+  const formCode = String(candidate.formCode || '').trim();
+  const releaseId = String(resource.identity?.releaseId || '').trim();
+  const formUuid = String(resource.identity?.formUuid || '').trim();
+  const boundFormUuid = String(
+    target.bound.resources?.forms?.[formCode]?.formUuid ||
+      target.bound.resources?.formSettings?.[formCode]?.formUuid ||
+      ''
+  ).trim();
+  if (!formCode || !boundFormUuid || boundFormUuid !== formUuid) {
+    fail(
+      `FORM_RELEASE_REUSE_BINDING_MISMATCH: ${formCode || formUuid || '(unknown)'} 的本地 binding 与 staged FormRelease identity 不一致`
+    );
+  }
+  const basePath = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}`;
+  const [detail, head] = await Promise.all([
+    requestWithAuth(
+      config,
+      target.profileName,
+      `${basePath}/releases/${encodeURIComponent(releaseId)}`
+    ),
+    requestWithAuth(
+      config,
+      target.profileName,
+      `${basePath}/releases/head`
+    ),
+  ]);
+  if (
+    detail?.immutable !== true ||
+    detail?.active === true ||
+    detail?.aborted === true ||
+    (Array.isArray(detail?.journal) ? detail.journal : []).some(
+      entry => entry?.action === 'abort'
+    )
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_STATE_INVALID: ${formCode} 的 FormRelease ${releaseId} 必须 immutable=true、active=false、aborted=false`
+    );
+  }
+  if (
+    String(detail?.id || '').trim() !== releaseId ||
+    String(detail?.formUuid || '').trim() !== formUuid
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_IDENTITY_MISMATCH: ${formCode} 的 releaseId/formUuid 与服务端冻结证据不一致`
+    );
+  }
+  const contentHash = String(detail?.contentHash || '')
+    .trim()
+    .toLowerCase();
+  if (
+    !/^[a-f0-9]{64}$/.test(contentHash) ||
+    contentHash !== String(resource.hash || '').trim().toLowerCase()
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_HASH_MISMATCH: ${formCode} 的 staged hash 与 immutable FormRelease 不一致`
+    );
+  }
+  const parentReleaseId = nullableReleaseId(detail?.parentReleaseId);
+  const baseRevision = Number(detail?.baseRevision);
+  if (
+    nullableReleaseId(resource.revision?.parentReleaseId) !==
+      parentReleaseId ||
+    Number(resource.revision?.baseRevision) !== baseRevision
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_REVISION_MISMATCH: ${formCode} 的 staged parent/baseRevision 与 immutable FormRelease 不一致`
+    );
+  }
+  const activeHead = head?.activeFormReleaseHead || {};
+  const currentRevision = Number(head?.revision ?? activeHead.revision);
+  if (
+    nullableReleaseId(activeHead.releaseId) !== parentReleaseId ||
+    !Number.isSafeInteger(currentRevision) ||
+    currentRevision !== baseRevision
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_PARENT_CONFLICT: ${formCode} 的 active head/revision 已变化，拒绝重挂接 staged FormRelease`
+    );
+  }
+  if (
+    !Array.isArray(detail?.resources) ||
+    detail.resources.length === 0 ||
+    detail.resources.some(item => !item?.finalizedAt)
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_RESOURCES_INVALID: ${formCode} 的 FormRelease 资源尚未全部 finalized`
+    );
+  }
+  const frozenForm = detail?.snapshotJson?.form;
+  if (!frozenForm || frozenForm.schema === undefined || !frozenForm.formType) {
+    fail(
+      `FORM_RELEASE_REUSE_SCHEMA_MISSING: ${formCode} 的 FormRelease 缺少冻结 schema/formType`
+    );
+  }
+  let frozenSchema = frozenForm.schema;
+  if (typeof frozenSchema === 'string') {
+    try {
+      frozenSchema = JSON.parse(frozenSchema);
+    } catch {
+      fail(
+        `FORM_RELEASE_REUSE_SCHEMA_INVALID: ${formCode} 的 FormRelease 冻结 schema 不是合法 JSON`
+      );
+    }
+  }
+  if (!frozenSchema || typeof frozenSchema !== 'object') {
+    fail(
+      `FORM_RELEASE_REUSE_SCHEMA_INVALID: ${formCode} 的 FormRelease 冻结 schema 无效`
+    );
+  }
+  return {
+    resource: {
+      kind: 'FormRelease',
+      identity: { releaseId, formUuid },
+      action: resource.action || 'update',
+      hash: contentHash,
+      revision: { parentReleaseId, baseRevision },
+      metadata: {
+        ...(resource.metadata || {}),
+        formCode,
+        releaseStatus: 'staged',
+      },
+    },
+    formCode,
+    formUuid,
+    releaseId,
+    contentHash,
+    baseRevision,
+    parentReleaseId,
+    formSnapshot: {
+      ...clonePlainJson(frozenForm),
+      schema: clonePlainJson(frozenSchema),
+    },
+    formType: frozenForm.formType,
+  };
+}
+
+async function resolveReusableStagedFormReleaseOverlays(
+  config,
+  target,
+  changeId,
+  options = {}
+) {
+  const requested = new Set(
+    (options.formCodes || [])
+      .map(value => String(value || '').trim())
+      .filter(Boolean)
+  );
+  const candidates = reusableStagedFormReleaseCandidates(target, changeId)
+    .filter(candidate => requested.size === 0 || requested.has(candidate.formCode));
+  const verified = [];
+  for (const candidate of candidates) {
+    verified.push(
+      await verifyReusableStagedFormRelease(config, target, candidate)
+    );
+  }
+  return new Map(verified.map(item => [item.formCode, item]));
+}
+
+async function initializeNewReleaseStagedResources(
+  config,
+  target,
+  changeId,
+  candidates
+) {
+  const verified = [];
+  for (const candidate of candidates || []) {
+    verified.push(
+      await verifyReusableStagedFormRelease(config, target, candidate)
+    );
+  }
+  const reused = verified.map(item => ({
+    formCode: item.formCode,
+    formUuid: item.formUuid,
+    releaseId: item.releaseId,
+    contentHash: item.contentHash,
+    baseRevision: item.baseRevision,
+    parentReleaseId: item.parentReleaseId,
+  }));
+  const file = initializeStagedAppReleaseResources(
+    target,
+    changeId,
+    verified.map(item => item.resource),
+    reused.length > 0
+      ? {
+          reusedStagedFormReleases: reused,
+          reusedAt: new Date().toISOString(),
+        }
+      : {}
+  );
+  return { file, reused };
+}
+
 function assertStagedAppReleaseScope(target, flags, resources) {
   const changeId = readStringFlag(flags, 'change');
   if (!changeId) {
@@ -6083,6 +6377,15 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
   const explicitLeaseId = readStringFlag(flags, 'publish-lease-id');
   const changeId = readStringFlag(flags, 'change');
   const storedLease = getStoredPublishLease(target);
+  const baselineAtStart = changeId
+    ? getStoredChangeBaseline(target)
+    : null;
+  const newReleaseLifecycle = Boolean(
+    changeId && !getUsableStoredPublishLease(target) && !baselineAtStart
+  );
+  const reusableFormCandidates = newReleaseLifecycle
+    ? reusableStagedFormReleaseCandidates(target, changeId)
+    : [];
   let acquiredByCommand = false;
   assertOrClaimWorktreeOwner({
     cwd: process.cwd(),
@@ -6152,7 +6455,41 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
       clearRejectedPendingBaseline(target, baseline, error);
       throw error;
     }
-    finalizeReleaseBaseline(target, baseline);
+    const finalizedBaseline = finalizeReleaseBaseline(target, baseline);
+    if (newReleaseLifecycle) {
+      try {
+        await initializeNewReleaseStagedResources(
+          config,
+          target,
+          changeId,
+          reusableFormCandidates
+        );
+      } catch (error) {
+        try {
+          await requestWithAuth(
+            config,
+            target.profileName,
+            publishLeaseApiPath(
+              target,
+              `/${encodeURIComponent(lease.leaseId)}/release`
+            ),
+            {
+              method: 'POST',
+              body: { completion: 'local-prepare-failed' },
+            }
+          );
+        } catch {
+          // Keep the staged child verification failure as the primary error.
+        }
+        clearPublishLease(target, lease.leaseId);
+        clearChangeBaseline(
+          target,
+          finalizedBaseline?.baselineId || finalizedBaseline?.id
+        );
+        releaseWorktreeOwner({ cwd: process.cwd() });
+        throw error;
+      }
+    }
   }
   if (!lease) return null;
   if (changeId && lease.changeId !== changeId) {
@@ -12635,9 +12972,34 @@ async function resource(args) {
 
   const validation = validateWorkspaceResources(manifest);
   let target = null;
+  let stagedFormBindingOverlays = new Map();
   if (!isManifestEmpty(manifest)) {
     target = getWorkspaceTarget(config, profileName, flags);
-    validateWorkspaceResourceBindings(manifest, target.bound, validation);
+    const workflowFormCodes = unique(
+      (manifest.workflows || [])
+        .map(item => item.formCode || item.form)
+        .filter(Boolean)
+    );
+    const stagedChangeId =
+      readStringFlag(flags, 'change') ||
+      getStoredChangeBaseline(target, { access: 'reconciliation-read' })
+        ?.changeId ||
+      '';
+    if (workflowFormCodes.length > 0 && stagedChangeId) {
+      stagedFormBindingOverlays =
+        await resolveReusableStagedFormReleaseOverlays(
+          config,
+          target,
+          stagedChangeId,
+          { formCodes: workflowFormCodes }
+        );
+    }
+    validateWorkspaceResourceBindings(
+      manifest,
+      target.bound,
+      validation,
+      stagedFormBindingOverlays
+    );
   }
   await validateCompiledWorkflowResources(manifest, validation);
   if (subcommand === 'validate') {
@@ -16123,7 +16485,12 @@ function validateWorkspaceResources(manifest) {
   };
 }
 
-function validateWorkspaceResourceBindings(manifest, bound, validation) {
+function validateWorkspaceResourceBindings(
+  manifest,
+  bound,
+  validation,
+  stagedFormBindingOverlays = new Map()
+) {
   for (const item of manifest.workflows || []) {
     if (!item.formCode && !item.form) continue;
     const formCode = item.formCode || item.form;
@@ -16136,14 +16503,25 @@ function validateWorkspaceResourceBindings(manifest, bound, validation) {
       continue;
     }
     const localSchemaPath = path.join(process.cwd(), 'src', 'forms', formCode, 'schema.ts');
-    if (fs.existsSync(localSchemaPath) && !formBinding.schemaSyncedAt) {
+    const stagedOverlay = stagedFormBindingOverlays.get(formCode);
+    if (
+      fs.existsSync(localSchemaPath) &&
+      !formBinding.schemaSyncedAt &&
+      !stagedOverlay
+    ) {
       validation.errors.push(
         `${resourceLabel('workflow', item)}: formCode ${formCode} 已绑定但本地 schema 尚未同步。请先运行 openxiangda workspace publish --profile <name> --form ${formCode}`
       );
     }
-    if (formBinding.formType && formBinding.formType !== 'process') {
+    if (stagedOverlay) {
+      validation.warnings.push(
+        `${resourceLabel('workflow', item)}: formCode ${formCode} 使用已验证 staged FormRelease ${stagedOverlay.releaseId} 的冻结 schema/formType`
+      );
+    }
+    const effectiveFormType = stagedOverlay?.formType || formBinding.formType;
+    if (effectiveFormType && effectiveFormType !== 'process') {
       validation.errors.push(
-        `${resourceLabel('workflow', item)}: formCode ${formCode} 当前 formType=${formBinding.formType}，流程表单需要 process`
+        `${resourceLabel('workflow', item)}: formCode ${formCode} 当前 formType=${effectiveFormType}，流程表单需要 process`
       );
     }
   }
@@ -17397,8 +17775,12 @@ async function buildResourcePlan(
   await prepareManifestJsCodeBundlesForPlan(manifest);
   const stagedLocalFormSnapshots =
     await resolveStagedLocalFormContractSnapshots(
+      config,
       target,
-      options.flags || {}
+      options.flags || {},
+      (manifest.workflows || [])
+        .map(item => item.formCode || item.form)
+        .filter(Boolean)
     );
   const [existing, formFieldContracts] = await Promise.all([
     fetchExistingResourceMaps(config, target, manifest),
@@ -26855,32 +27237,38 @@ async function runWorkspaceChildCommand(command, args, options = {}) {
 }
 
 async function resolveStagedLocalFormContractSnapshots(
+  config,
   target,
-  flags = {}
+  flags = {},
+  implicitFormCodes = []
 ) {
-  const formCodes = unique(
+  const explicitFormCodes = unique(
     String(flags['staged-form-contracts'] || '')
       .split(',')
       .map(value => value.trim())
       .filter(Boolean)
   ).sort();
+  const formCodes = unique([
+    ...explicitFormCodes,
+    ...(implicitFormCodes || [])
+      .map(value => String(value || '').trim())
+      .filter(Boolean),
+  ]).sort();
   if (formCodes.length === 0) return new Map();
   const changeId = readStringFlag(flags, 'change');
   if (!changeId) {
+    if (explicitFormCodes.length === 0) return new Map();
     fail(
       'FORM_FIELD_STAGED_CONTRACT_CHANGE_REQUIRED: --staged-form-contracts 必须与 --change 一起使用'
     );
   }
-  const context = assertStagedResourcesContext(target, changeId);
-  const file = stagedResourcesFileForChange(
-    changeId,
-    target.deploymentId
-  );
-  const resources = fs.existsSync(file)
-    ? normalizeStagedAppReleaseResources(
-        JSON.parse(fs.readFileSync(file, 'utf8'))
-      )
-    : [];
+  const stagedOverlays =
+    await resolveReusableStagedFormReleaseOverlays(
+      config,
+      target,
+      changeId,
+      { formCodes }
+    );
   const snapshots = new Map();
   for (const formCode of formCodes) {
     const formUuid = resolveManifestFormUuid(
@@ -26888,29 +27276,15 @@ async function resolveStagedLocalFormContractSnapshots(
       { formCode },
       { fallbackToCode: false }
     );
-    const staged = resources.find(
-      resource =>
-        resource.kind === 'FormRelease' &&
-        String(resource.identity?.formUuid || '').trim() === formUuid
-    );
-    if (!staged) {
+    const staged = stagedOverlays.get(formCode);
+    if (!staged || staged.formUuid !== formUuid) {
       fail(
         `FORM_FIELD_STAGED_CONTRACT_REQUIRED: ${formCode} 尚未在 change ${changeId} 的当前 deployment 中获得 verified FormRelease`
       );
     }
-    const localSchema = await loadLocalFormSchema(
-      process.cwd(),
-      formCode
-    );
-    if (!localSchema) {
-      fail(
-        `FORM_FIELD_STAGED_CONTRACT_SCHEMA_MISSING: ${formCode} 缺少本地 schema`
-      );
-    }
-    const schema = JSON.parse(localSchema.schema);
     snapshots.set(
       formUuid,
-      collectFormSnapshotFieldIds({ form: { schema } })
+      collectFormSnapshotFieldIds({ form: staged.formSnapshot })
     );
   }
   return snapshots;

package/openxiangda-skills/SKILL.md

@@ -126,6 +126,8 @@ Because promotion begins from the already-pushed authoritative mainline, `releas
 
 For a whole-app release, keep changed Runtime/Page/Backend/Form children staged and run `openxiangda release app-finalize --change <change> --staged-resources-json <JSON|file> --profile <name>`. The JSON contains only changed immutable child entries; the CLI overlays Runtime/Page/Backend by singleton kind and FormRelease by `formUuid` onto one authoritative read-only capture, preserving every unmodified active child. It then performs `prepare -> verify -> activateStagedChildren=true`, switching child heads and the App head atomically (`atomic_staged_children_v1`, or `atomic_staged_children_v2` when a Backend Release v2 child is present). Never refresh or retry after a conflict. The flow requires the owned stored lease/change baseline and carries the same client session and Git lineage on every write. Omitting the overlay is compatibility-only retrospective aggregation of already-active children.
 
+When the same change already has staged FormRelease children before a fresh baseline/lease is acquired, keep them staged. The CLI may rebind each child into the new session only after server verification of immutable/inactive/non-aborted state, exact app/form identity and content hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is local cache metadata, not release evidence. Do not direct-publish or activate a Form to bypass Workflow validation; missing or conflicting staged evidence must fail closed.
+
 When a Function or Automation is selected because its TypeScript source changed, publishing is source-only by default. Backend Release v2 accepts source-backed create, source-free declarative Automation manifest create, source-only update, and manifest replacement update in one immutable child and one database transaction, so a stale member produces zero resource writes and noops do not advance versions/timestamps. A new Automation with a complete `definitionJson.version="v3"` and no `sourceFile` automatically uses manifest create without `--replace-manifest`; an incomplete definition still fails closed. `--stage-only` is fail-closed: every selected mutation must enter that child, and a missing/incompatible Backend Release API never falls back to direct writes. Online bindings, input/output contracts, metadata, trigger/view configuration, and enabled/published state remain unchanged unless exact `--replace-manifest --reason "..."` authority was provided for an existing resource.
 
 An App Function may declare metadata-only top-level `secretRefs: [{ name, required }]` only with `function_v2` + `trusted_node_v2`; source resolves values with `await ctx.secrets.get(name)` and uses `ctx.utils.http` for controlled public HTTPS. Create/rotate values through hidden TTY or `openxiangda secret ... --value-stdin --change <change> --profile <name>`. Never put values in arguments, files, manifests, state, plans, logs, errors, or chat. Secret bindings require `backend_release_v2` and whole-app `atomic_staged_children_v2`; a missing capability is fail-closed and never uses the legacy source PATCH. For whole-app activation use exact-scope `resource publish <type> --only <code> --stage-only`, then pass the returned verified `stagedResource` to `release app-finalize`; an active Backend Release is never labeled staged.

package/openxiangda-skills/skills/openxiangda-form/SKILL.md

@@ -86,6 +86,8 @@ openxiangda resource publish form-setting --only <formCode> --change <change> --
 
 The Form resource bundle carries schema, settings, indexes, data-management, runtime-write, public-access configuration, and changed form permission groups under one CAS parent. It returns a canonical staged FormRelease and the CLI records it in the change-scoped staged-resources file. `workspace publish --form` is limited to an intentional first-time bootstrap or isolated repair outside a governed multi-resource release; it is not the normal release path.
 
+An exact staged FormRelease remains usable across a fresh release baseline/lease for the same app/profile/change/deployment only after the CLI re-verifies its immutable, inactive, non-aborted server state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. Workflow planning reads that frozen contract even when the live Form head is intentionally not activated and local `schemaSyncedAt` is absent. Never synthesize `schemaSyncedAt`, direct-publish the schema, or activate the Form early as a workaround; all conflicts fail closed.
+
 For Phase 6 React SPA workspaces, `app-workspace.config.ts` should declare
 `runtimeMode: "react-spa"`. In that mode, `workspace publish --form <code>` is
 schema-only by default: it creates/binds the form and syncs schema, but skips

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.206",
+  "version": "1.0.207",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda.mdc

@@ -34,6 +34,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 - `src/resources/**` is the resource source of truth; use `validate -> plan -> publish`.
 - Select logical resource codes with `--only`, or one code with `--code`; type-wide/app-wide release requires an approved dependency closure.
 - Source-triggered Function/Automation publishing uses server-side source-field PATCH and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses Backend Release manifest create without `--replace-manifest`; replacing an existing whole manifest requires `--replace-manifest --reason "..."`. On `SOURCE_BASE_DIVERGED` or `RESOURCE_FIELD_CONFLICT`, reconcile, rebuild, and re-plan.
+- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
 - Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
 - React routes live in `src/app/router.tsx`; frontend artifacts are deployed with `openxiangda runtime deploy`.
 - Use `AttachmentField` / `ImageField` for form-context previews, and `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview` for standalone custom pages. Do not fake form context, import internal preview implementations, or maintain local previewable-extension lists.

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda.md

@@ -30,6 +30,7 @@ This is an OpenXiangda React SPA workspace. Read [AGENTS.md](AGENTS.md) for full
 - `src/resources/**` 是工程化资源来源，正式多资源变更走 `validate -> plan -> publish`。
 - 默认按逻辑资源 code 使用 `--only` 或单资源 `--code`；全类型/全应用发布必须由批准的依赖闭包明确覆盖。
 - Function/Automation 源码触发默认走服务端 source-field PATCH，保留线上 bindings/contracts/metadata/trigger/view/enabled/published state；无源码且 `definitionJson.version="v3"` 完整的新建 Automation 自动走 manifest create，只有替换已有整包 manifest 才必须加 `--replace-manifest --reason "..."`。
+- 相同 change 的 staged FormRelease 只有经服务端重新核验 immutable/inactive/non-aborted、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才可重挂接新 baseline/session。`schemaSyncedAt` 不是发布证据；禁止伪造、直发 schema 或提前激活 Form 绕过 Workflow 校验。
 - 环境托管 `release ship --replace-manifest --reason "..."` 必须成对、reason 至少 8 字符且仅限精确 Backend selector；正式确认复用与预发完全相同的参数，不透传 Form/Workflow/Runtime/配置或全量步骤。
 - Promotion 必须持有 `release begin/end` 租约；`release begin` 只接受与权威远端 tip 完全一致的 clean main/master。feature branch 或未 push 主线在任何写入前失败。激活后直接运行 `integration-status` 和 `release end`，不再补做发布后合并。
 - 已有工作区通过 `environment attach` 接入环境组，旧资源映射只迁移到 appType 相同的预发 target，正式 target 必须为空。preproduction / production 分别拥有独立 appType、资源 ID、数据和副作用策略；禁止直接 `release publish`，禁止跨环境复制 ID，使用 `openxiangda studio` 查看状态。只有用户明确授权的投产前重分类可执行 `environment swap --reason "..." --confirm-production`；它不移动应用数据或 Release Head，且默认不放开副作用。

package/templates/openxiangda-react-spa/AGENTS.md

@@ -51,7 +51,7 @@ openxiangda studio
 openxiangda commands --json
 ```
 
-模板已停用无范围的 `pnpm deploy` 聚合入口。日常变更必须使用 `resource plan|publish <type> --only <codes>`（单资源可用 `--code <code>`）。Form bundle、Backend Release 和 Runtime 都先暂存；CLI 会按 `--change` 自动聚合 `.openxiangda/releases/<change>/staged-resources.json`，最后只由一次 Root App finalize 原子激活。Form Release 一旦 abort 绝不能作为幂等结果复用；重新执行相同精确表单发布时，CLI 会淘汰旧 staged 索引，平台会创建新的不可变 attempt，再由 Root App 一次事务重试。禁止用顺序激活多张表单绕过失败。不要使用 `workspace publish --form`、单独 `runtime activate`、`pnpm publish:all`、`pnpm openxiangda:publish` 或 `lowcode-workspace publish-all`。
+模板已停用无范围的 `pnpm deploy` 聚合入口。日常变更必须使用 `resource plan|publish <type> --only <codes>`（单资源可用 `--code <code>`）。Form bundle、Backend Release 和 Runtime 都先暂存；CLI 会按 `--change` 自动聚合 `.openxiangda/releases/<change>/staged-resources.json`，最后只由一次 Root App finalize 原子激活。Form Release 一旦 abort 绝不能作为幂等结果复用；重新执行相同精确表单发布时，CLI 会淘汰旧 staged 索引，平台会创建新的不可变 attempt，再由 Root App 一次事务重试。相同 change 的既有 staged FormRelease 只有在 CLI 重新核验服务端不可变状态、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 和当前 Form Head 后，才可重挂接到新的 baseline/session；`schemaSyncedAt` 只是本地缓存元数据。禁止伪造它、提前激活 Form 或用顺序激活多张表单绕过失败。不要使用 `workspace publish --form`、单独 `runtime activate`、`pnpm publish:all`、`pnpm openxiangda:publish` 或 `lowcode-workspace publish-all`。
 
 工作区一旦通过 `environment init` 登记，或通过 `environment attach` 接入已有环境组，`release publish` 即不再是入口。日常使用两段式 `release ship`：第一次冻结不可变 candidate 并只部署到 preproduction，停止在 `awaiting_production_confirmation`；确认预发结果后，第二次命令提供 `--confirm-production`，把同一 candidate 晋级 production，不会重新构建。真实人工验收是默认建议，可用可选的 `--acceptance-note` 留痕；但用户明确授权的低风险或紧急发布不受僵硬审批门禁阻塞。两套环境的 appType、资源 ID、数据和副作用策略完全独立；旧单目标资源映射只允许迁移到 appType 相同的预发 target，正式 target 必须为空。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单独调整某个环境的副作用策略时，先运行 `environment policy update <kind|id> ... --dry-run` 查看差异，再按 CAS revision 写入；patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段。不得借用 swap，正式写入另需 `--confirm-production`。`organizationWrites=explicit_capability_only` 仍强制 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。`openxiangda studio` 提供仅本机访问的开发者页面，用于查看绑定、漂移、候选、部署、证据和下一安全动作。
 

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda.mdc

@@ -30,6 +30,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGEN
 - Very small copy/style/binding changes may use `openxiangda sdd quick <change> ...`; quick mode is limited to an exact low-risk scope and does not add a redundant proposal/approval loop when the user already requested that exact edit.
 - SDD is streamlined by default: approval and exact structured scope are hard gates, while unfinished task/evidence/spec prose only warns. Use `strictDocumentation: true` only when prose must block.
 - Source-triggered Function/Automation publishing uses server-side source-field PATCH by default and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires exact `--only/--code` plus `--replace-manifest --reason "..."`.
+- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
 - Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
 - Before platform writes, run `release begin` only from clean main/master exactly equal to the authoritative remote tip. Feature branches and unpushed mainline commits fail before writes. After activation, run `integration-status` and `release end`; no post-release merge is needed.
 - Environment-managed workspaces never publish directly. Existing workspaces use `environment attach`; only an appType-matching legacy binding may seed preproduction and production starts empty. Run `release candidate`, `release deploy --environment preproduction`, `release test`, then promote that same candidate with `release promote --environment production --confirm-production`. Keep app/resource/data IDs isolated and inspect state with `openxiangda studio`. Only an explicitly authorized commissioning reclassification may use `environment swap --reason "..." --confirm-production`; it preserves app data/Release Heads and keeps side effects restricted by default.

package/templates/sy-lowcode-app-workspace/.qoder/rules/openxiangda.md

@@ -30,6 +30,7 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. Read [AGE
 - 极小的文案、样式、绑定修正可使用 `openxiangda sdd quick <change> ...`，但必须限制在精确的低风险范围内；用户已明确要求该小改时不再重复 propose/approve。
 - SDD 默认 streamlined：approval 与结构化精确范围是硬门禁，未完成的 task/evidence/spec 文案只告警；只有 `strictDocumentation: true` 才阻断。
 - Function/Automation 源码触发默认走服务端 source-field PATCH，保留线上 bindings/contracts/metadata/trigger/view/enabled/published state；无源码且 `definitionJson.version="v3"` 完整的新建 Automation 自动走 manifest create，只有替换已有整包 manifest 才必须精确 `--only/--code` 并加 `--replace-manifest --reason "..."`。
+- 相同 change 的 staged FormRelease 只有经服务端重新核验 immutable/inactive/non-aborted、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才可重挂接新 baseline/session。`schemaSyncedAt` 不是发布证据；禁止伪造、直发 schema 或提前激活 Form 绕过 Workflow 校验。
 - 环境托管 `release ship --replace-manifest --reason "..."` 必须成对、reason 至少 8 字符且仅限精确 Backend selector；正式确认复用与预发完全相同的参数，不透传 Form/Workflow/Runtime/配置或全量步骤。
 - 写入平台前只从与权威远端 tip 完全一致的 clean main/master 执行 `release begin`。feature branch 或未 push 主线在任何写入前失败；激活后直接运行 `integration-status` 和 `release end`，无需发布后再合并。
 - 环境托管工作区禁止直发：已有工作区先用 `environment attach` 接入，旧映射只能迁移到 appType 相同的预发 target，正式 target 必须为空。然后执行 `release candidate`、`release deploy --environment preproduction`、`release test`，最后将同一 candidate 用 `release promote --environment production --confirm-production` 晋级。两套环境的 appType、资源 ID 和数据不可互拷；用 `openxiangda studio` 查看状态。只有用户明确授权的投产前重分类可执行 `environment swap --reason "..." --confirm-production`；它不移动应用数据或 Release Head，且默认不放开副作用。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -56,6 +56,7 @@
 - ✅ 正式多资源开发优先写 `src/resources/**` 后执行 `openxiangda resource validate|plan|publish <type> --only <codes>`；单资源可用 `--code <code>`。直接 CLI 写平台资源时先 `--dry-run`，需要避免漂移就加 `--write-manifest`。
 - ✅ `resource plan` 与 publish dry-run 严格只允许 GET/HEAD；遇到 `READ_ONLY_AUTH_REQUIRED` 时先执行 `openxiangda auth refresh --profile <name>` 或重新登录，不得在 plan 内自动 POST 刷新 token。
 - ✅ Function/Automation 使用 Backend Release v2；正式多资源发布用精确 `--only/--code` 加 `--stage-only` 暂存，同一 child 可混合源码 create、无 `sourceFile` 的完整 v3 声明式 Automation manifest create、source-only update 和显式 manifest replacement，再由 Root App finalize 原子激活。声明式 create 自动选路；替换已有资源的整包 manifest 才需要另加 `--replace-manifest --reason "..."`。
+- ✅ 相同 change 已有 staged FormRelease 时，不要直发 schema、伪造 `schemaSyncedAt` 或提前激活 Form。CLI 只在重新核验服务端不可变状态、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才将 child 重挂接到新的 baseline/session；冲突继续失败关闭。
 - ✅ 未登记环境的旧工作区，正式 promotion 先聚合 mainline bundle 并 commit/push，再运行 `release publish --change <id> --profile <name>`。
 - ✅ 已通过 `environment init` 登记或 `environment attach` 接入的工作区默认使用两段式 `release ship`。第一次命令只冻结 candidate 并部署 preproduction，停止等待正式晋级确认；确认预发结果后，另一次命令提供 `--confirm-production`，即可晋级同一 candidate。人工验收是默认建议，可用可选的 `--acceptance-note` 留痕，但不是所有低风险或紧急发布的硬审批门禁。preproduction / production 的 appType、资源 ID、数据和副作用策略完全隔离，严禁跨环境复制 ID 或直接 `release publish`。旧单目标映射只允许按相同 appType 迁移到预发。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单环境副作用策略用 `environment policy update <kind|id> ... --dry-run` 预览后按 revision CAS 写入，禁止借用 swap；patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段，正式写入需 `--confirm-production`，且 `organizationWrites=explicit_capability_only` 不绕过 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。
 - ✅ 只有已审计目标早已进入权威主线、线上却由多次历史 lineage 组成且无法对应单一 Git 基线时，第一次 `release ship` 才可增加 `--adopt-online-baseline --adoption-reason "..."`；仅允许精确非删除 selectors，冻结 Head、change/lease、服务端 CAS、staged children 与单次 App finalize 仍是硬门禁。