openxiangda 1.0.206 → 1.0.208

package/README.md

@@ -202,12 +202,14 @@ openxiangda resource publish function --code customer_get --change <change> --pr
 
 Exact `--only` / `--code` selectors are applied before unrelated manifests, source dependencies, and JS_CODE targets are read or built. Shared/transitive dependencies of the selected targets remain in scope; omitting a selector intentionally preserves full-workspace validation and planning. Resource commands use the packaged canonical scoped builder for standard workspaces, so an older checked-in `scripts/build-js-code.mjs` does not need to be upgraded before the installed CLI gains this optimization; refresh the workspace template only when developers also need the same behavior from a manual `pnpm build-js-code` command.
 
-For source-only Function/Automation changes, the final command does not reconstruct whole definitions with client-side GET+PUT. `release begin` captures the Git/change baseline, one preflight covers every selected code, and Backend Release performs one `prepare -> verify -> activate` sequence for all eligible updates. Inspect history with `openxiangda release backend-head|backend-list|backend-detail`, compare it with `backend-diff`, or create an audited immutable rollback with `backend-rollback <releaseId> --change <change> --reason "..."`. Always merge/push the frozen SHA and run `release end` when promotion finishes. A lost or expired lease retains the pending-mainline evidence instead of silently clearing it.
+For source-only Function/Automation changes, the final command does not reconstruct whole definitions with client-side GET+PUT. `release begin` captures the Git/change baseline, one preflight covers every selected code, and Backend Release performs one `prepare -> verify -> activate` sequence for all eligible updates. Repository identity is alias-aware but fail-closed: when a clone-derived primary ID differs from the frozen source base, the CLI uses the frozen canonical ID only if it is present in `releaseSourceRevision.repoAliases`; Backend, Workflow, and Root App Release writes all carry that same ID, while a disjoint identity set fails before prepare. Inspect history with `openxiangda release backend-head|backend-list|backend-detail`, compare it with `backend-diff`, or create an audited immutable rollback with `backend-rollback <releaseId> --change <change> --reason "..."`. Always merge/push the frozen SHA and run `release end` when promotion finishes. A lost or expired lease retains the pending-mainline evidence instead of silently clearing it.
 
 Page repair publishing is staged by default. It first freezes `pages/snapshot`, sends the active Page Release parent plus every page revision, and uses revision `0` only for a genuinely new page. Review with `openxiangda page head|releases|detail|diff`; activate an immutable complete release explicitly with `page activate <releaseId> --change <change>`. Historical activation requires `page rollback <releaseId> --rollback --change <change> --reason "..."`. Parent or revision conflicts are never refreshed or retried automatically.
 
 Use `openxiangda release app-capture` to read the platform's transactionally consistent whole-app manifest. For a normal multi-resource release, stage the changed Runtime/Page/Backend/Form child releases; commands carrying the same `--change` atomically accumulate their canonical immutable entries in `.openxiangda/releases/<change>/staged-resources.json`. Then run `app-finalize --change <change> --staged-resources-json <JSON|file>`. The CLI overlays Runtime/Page/Backend by singleton kind and Form by `formUuid`, preserves every unmodified active child from the read-only capture, and sends the complete frozen manifest through `prepare -> verify -> activate` with `activateStagedChildren=true`. Runtime staging never rewrites local active Runtime state, and a malformed staged response fails closed. The child heads and App head therefore switch in one database transaction (`atomic_staged_children_v1`); any parent, revision, asset, or hash drift stops with zero root activation and is never refreshed or retried. An aborted Form Release is never an idempotent success: rerunning the same scoped form publish removes its aborted staged index and creates a new immutable attempt automatically, after which the whole App is retried atomically. Never work around an App failure by sequentially activating forms. `app-prepare` accepts the same overlay for a manual reviewed flow, and `app-activate <releaseId> --activate-staged-children` performs the explicit atomic activation. Calling `app-finalize` without an overlay remains a compatibility-only retrospective aggregation of already-active children. `app-rollback <releaseId> --change <change> --reason "..."` prepares the audited rollback manifest.
 
+If exact FormRelease children were already staged for the same change before a new release baseline or lease is acquired, the CLI reuses them only after checking the server's immutable, inactive, non-aborted release, exact app/form identity and content hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. Verified children are rebound to the newly owned baseline/session; local `schemaSyncedAt` is not treated as release evidence. Missing or conflicting evidence still fails closed, and neither direct schema synchronization nor early Form activation is required.
+
 For small live fixes, diagnosis, or AI command discovery, use first-class resource commands. They all accept `--profile`, `--app-type`, `--json`, `--json-file`, `--dry-run`, and write commands can use `--write-manifest` to avoid repo/platform drift:
 
 ```bash

package/lib/application-environments.js

@@ -247,6 +247,53 @@ function normalizeManagedReleaseSourceRevision(
   };
 }
 
+function normalizeReleaseSourceRevisionForBaseline(
+  target,
+  sourceBase,
+  sourceRevision,
+  options = {}
+) {
+  const revision = normalizeManagedReleaseSourceRevision(
+    target,
+    sourceRevision,
+    options
+  );
+  const expectedRepositoryId = String(
+    sourceBase?.repo || sourceBase?.repositoryId || ''
+  )
+    .trim()
+    .toLowerCase();
+  if (!expectedRepositoryId) return revision;
+  const repositoryAliases = normalizeIdentityList([
+    revision?.repo,
+    revision?.repositoryId,
+    ...(Array.isArray(revision?.repoAliases) ? revision.repoAliases : []),
+  ]);
+  if (!repositoryAliases.includes(expectedRepositoryId)) {
+    const code =
+      String(options.errorCode || '').trim() ||
+      'RELEASE_SOURCE_REPOSITORY_MISMATCH';
+    const error = new Error(
+      `${code}: 当前 Git 仓库与冻结 change baseline 仓库不一致`
+    );
+    error.code = code;
+    error.details = {
+      expectedRepositoryId,
+      repositoryAliases,
+    };
+    throw error;
+  }
+  return {
+    ...revision,
+    repo: expectedRepositoryId,
+    repositoryId: expectedRepositoryId,
+    repoAliases: normalizeIdentityList([
+      expectedRepositoryId,
+      ...repositoryAliases,
+    ]),
+  };
+}
+
 function normalizeManagedChangeSourceBase(
   target,
   sourceBase,
@@ -597,6 +644,7 @@ module.exports = {
   normalizeEnvironmentKind,
   normalizeManagedChangeSourceBase,
   normalizeManagedReleaseSourceRevision,
+  normalizeReleaseSourceRevisionForBaseline,
   normalizeSideEffectPolicyInput,
   normalizeTargetName,
   hasStateResourceMappings,

package/lib/cli.js

@@ -136,6 +136,7 @@ const {
   normalizeEnvironmentKind,
   normalizeManagedChangeSourceBase,
   normalizeManagedReleaseSourceRevision,
+  normalizeReleaseSourceRevisionForBaseline,
   readCandidate,
   readJsonInput,
   releaseExecutionPath,
@@ -3834,7 +3835,10 @@ async function release(args) {
       );
     }
     const pendingBaseline = getStoredChangeBaseline(target);
-    const newReleaseLifecycle = !stored && !pendingBaseline;
+    const newReleaseLifecycle = !existing && !pendingBaseline;
+    const reusableFormCandidates = newReleaseLifecycle
+      ? reusableStagedFormReleaseCandidates(target, changeId)
+      : [];
     const clientSessionId =
       existing?.clientSessionId ||
       (pendingBaseline?.changeId === changeId &&
@@ -3866,6 +3870,7 @@ async function release(args) {
     let frozenCapture = null;
     let releaseSessionFile = null;
     let stagedResourcesFile = null;
+    let reusedStagedFormReleases = [];
     try {
       if (flags['freeze-app-capture']) {
         frozenCapture = await fetchAppReleaseCapture(config, target, flags);
@@ -3877,9 +3882,16 @@ async function release(args) {
           frozenCapture
         );
       }
-      stagedResourcesFile = newReleaseLifecycle
-        ? initializeStagedAppReleaseResources(target, changeId)
-        : null;
+      if (newReleaseLifecycle) {
+        const initialized = await initializeNewReleaseStagedResources(
+          config,
+          target,
+          changeId,
+          reusableFormCandidates
+        );
+        stagedResourcesFile = initialized.file;
+        reusedStagedFormReleases = initialized.reused;
+      }
     } catch (error) {
       if (newReleaseLifecycle) {
         try {
@@ -3914,6 +3926,9 @@ async function release(args) {
           }
         : {}),
       ...(stagedResourcesFile ? { stagedResourcesFile } : {}),
+      ...(reusedStagedFormReleases.length > 0
+        ? { reusedStagedFormReleases }
+        : {}),
     };
     if (flags.json) return writeJson(result);
     print(
@@ -4893,14 +4908,22 @@ function writeStagedResourcesFiles(
   return path.relative(process.cwd(), file).replace(/\\/g, '/');
 }
 
-function initializeStagedAppReleaseResources(target, changeId) {
+function initializeStagedAppReleaseResources(
+  target,
+  changeId,
+  resources = [],
+  metadata = {}
+) {
   const context = currentStagedResourcesContext(target, changeId);
   return writeStagedResourcesFiles(
     changeId,
-    [],
+    Array.isArray(resources) && resources.length === 0
+      ? []
+      : normalizeStagedAppReleaseResources(resources),
     {
       ...context,
       initializedAt: new Date().toISOString(),
+      ...metadata,
     },
     target.deploymentId
   );
@@ -5083,6 +5106,278 @@ function stagedFormCode(target, resource) {
   return formUuid;
 }
 
+function reusableStagedFormReleaseCandidates(target, changeId) {
+  const normalizedChangeId = String(changeId || '').trim();
+  if (!normalizedChangeId) return [];
+  const file = stagedResourcesFileForChange(
+    normalizedChangeId,
+    target.deploymentId
+  );
+  if (!fs.existsSync(file)) return [];
+  const contextFile = stagedResourcesContextFileForChange(
+    normalizedChangeId,
+    target.deploymentId
+  );
+  if (!fs.existsSync(contextFile)) {
+    fail(
+      `FORM_RELEASE_REUSE_CONTEXT_REQUIRED: change ${normalizedChangeId} 的 staged FormRelease 缺少 context，拒绝重挂接`
+    );
+  }
+  const context = JSON.parse(fs.readFileSync(contextFile, 'utf8'));
+  const expected = {
+    contractVersion: 'staged_resources_context_v1',
+    appType: target.appType,
+    profile: target.profileName,
+    changeId: normalizedChangeId,
+    deploymentId: target.deploymentId || null,
+  };
+  for (const [field, value] of Object.entries(expected)) {
+    if ((context?.[field] ?? null) !== (value ?? null)) {
+      fail(
+        `FORM_RELEASE_REUSE_CONTEXT_MISMATCH: ${field} 不属于当前 app/profile/change/deployment，拒绝重挂接 staged FormRelease`
+      );
+    }
+  }
+  const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const resources = Array.isArray(parsed) && parsed.length === 0
+    ? []
+    : normalizeStagedAppReleaseResources(parsed);
+  let scopedForms = null;
+  try {
+    scopedForms = new Set(
+      getSddChangeScope({
+        cwd: process.cwd(),
+        configText: readWorkspaceConfigText(),
+        changeId: normalizedChangeId,
+      }).targets.forms || []
+    );
+  } catch (error) {
+    // A direct release may use --change without a local SDD record. The
+    // exact local context still supplies the app/profile/change scope, while
+    // every candidate is independently verified against immutable server data.
+    if (!/SDD 未初始化|change 不存在|ENOENT/i.test(String(error?.message || ''))) {
+      throw error;
+    }
+  }
+  return resources
+    .filter(resource => resource.kind === 'FormRelease')
+    .map(resource => {
+      const formCode = stagedFormCode(target, resource);
+      if (
+        scopedForms &&
+        (!formCode || !scopedForms.has(formCode))
+      ) {
+        fail(
+          `FORM_RELEASE_REUSE_SCOPE_MISMATCH: ${formCode || resource.identity?.formUuid || '(unknown)'} 不在 change ${normalizedChangeId} 的精确 Form 范围内`
+        );
+      }
+      return { resource, formCode };
+    });
+}
+
+function nullableReleaseId(value) {
+  const normalized = String(value || '').trim();
+  return normalized || null;
+}
+
+async function verifyReusableStagedFormRelease(
+  config,
+  target,
+  candidate
+) {
+  const resource = candidate.resource;
+  const formCode = String(candidate.formCode || '').trim();
+  const releaseId = String(resource.identity?.releaseId || '').trim();
+  const formUuid = String(resource.identity?.formUuid || '').trim();
+  const boundFormUuid = String(
+    target.bound.resources?.forms?.[formCode]?.formUuid ||
+      target.bound.resources?.formSettings?.[formCode]?.formUuid ||
+      ''
+  ).trim();
+  if (!formCode || !boundFormUuid || boundFormUuid !== formUuid) {
+    fail(
+      `FORM_RELEASE_REUSE_BINDING_MISMATCH: ${formCode || formUuid || '(unknown)'} 的本地 binding 与 staged FormRelease identity 不一致`
+    );
+  }
+  const basePath = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/forms/${encodeURIComponent(formUuid)}`;
+  const [detail, head] = await Promise.all([
+    requestWithAuth(
+      config,
+      target.profileName,
+      `${basePath}/releases/${encodeURIComponent(releaseId)}`
+    ),
+    requestWithAuth(
+      config,
+      target.profileName,
+      `${basePath}/releases/head`
+    ),
+  ]);
+  if (
+    detail?.immutable !== true ||
+    detail?.active === true ||
+    detail?.aborted === true ||
+    (Array.isArray(detail?.journal) ? detail.journal : []).some(
+      entry => entry?.action === 'abort'
+    )
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_STATE_INVALID: ${formCode} 的 FormRelease ${releaseId} 必须 immutable=true、active=false、aborted=false`
+    );
+  }
+  if (
+    String(detail?.id || '').trim() !== releaseId ||
+    String(detail?.formUuid || '').trim() !== formUuid
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_IDENTITY_MISMATCH: ${formCode} 的 releaseId/formUuid 与服务端冻结证据不一致`
+    );
+  }
+  const contentHash = String(detail?.contentHash || '')
+    .trim()
+    .toLowerCase();
+  if (
+    !/^[a-f0-9]{64}$/.test(contentHash) ||
+    contentHash !== String(resource.hash || '').trim().toLowerCase()
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_HASH_MISMATCH: ${formCode} 的 staged hash 与 immutable FormRelease 不一致`
+    );
+  }
+  const parentReleaseId = nullableReleaseId(detail?.parentReleaseId);
+  const baseRevision = Number(detail?.baseRevision);
+  if (
+    nullableReleaseId(resource.revision?.parentReleaseId) !==
+      parentReleaseId ||
+    Number(resource.revision?.baseRevision) !== baseRevision
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_REVISION_MISMATCH: ${formCode} 的 staged parent/baseRevision 与 immutable FormRelease 不一致`
+    );
+  }
+  const activeHead = head?.activeFormReleaseHead || {};
+  const currentRevision = Number(head?.revision ?? activeHead.revision);
+  if (
+    nullableReleaseId(activeHead.releaseId) !== parentReleaseId ||
+    !Number.isSafeInteger(currentRevision) ||
+    currentRevision !== baseRevision
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_PARENT_CONFLICT: ${formCode} 的 active head/revision 已变化，拒绝重挂接 staged FormRelease`
+    );
+  }
+  if (
+    !Array.isArray(detail?.resources) ||
+    detail.resources.length === 0 ||
+    detail.resources.some(item => !item?.finalizedAt)
+  ) {
+    fail(
+      `FORM_RELEASE_REUSE_RESOURCES_INVALID: ${formCode} 的 FormRelease 资源尚未全部 finalized`
+    );
+  }
+  const frozenForm = detail?.snapshotJson?.form;
+  if (!frozenForm || frozenForm.schema === undefined || !frozenForm.formType) {
+    fail(
+      `FORM_RELEASE_REUSE_SCHEMA_MISSING: ${formCode} 的 FormRelease 缺少冻结 schema/formType`
+    );
+  }
+  let frozenSchema = frozenForm.schema;
+  if (typeof frozenSchema === 'string') {
+    try {
+      frozenSchema = JSON.parse(frozenSchema);
+    } catch {
+      fail(
+        `FORM_RELEASE_REUSE_SCHEMA_INVALID: ${formCode} 的 FormRelease 冻结 schema 不是合法 JSON`
+      );
+    }
+  }
+  if (!frozenSchema || typeof frozenSchema !== 'object') {
+    fail(
+      `FORM_RELEASE_REUSE_SCHEMA_INVALID: ${formCode} 的 FormRelease 冻结 schema 无效`
+    );
+  }
+  return {
+    resource: {
+      kind: 'FormRelease',
+      identity: { releaseId, formUuid },
+      action: resource.action || 'update',
+      hash: contentHash,
+      revision: { parentReleaseId, baseRevision },
+      metadata: {
+        ...(resource.metadata || {}),
+        formCode,
+        releaseStatus: 'staged',
+      },
+    },
+    formCode,
+    formUuid,
+    releaseId,
+    contentHash,
+    baseRevision,
+    parentReleaseId,
+    formSnapshot: {
+      ...clonePlainJson(frozenForm),
+      schema: clonePlainJson(frozenSchema),
+    },
+    formType: frozenForm.formType,
+  };
+}
+
+async function resolveReusableStagedFormReleaseOverlays(
+  config,
+  target,
+  changeId,
+  options = {}
+) {
+  const requested = new Set(
+    (options.formCodes || [])
+      .map(value => String(value || '').trim())
+      .filter(Boolean)
+  );
+  const candidates = reusableStagedFormReleaseCandidates(target, changeId)
+    .filter(candidate => requested.size === 0 || requested.has(candidate.formCode));
+  const verified = [];
+  for (const candidate of candidates) {
+    verified.push(
+      await verifyReusableStagedFormRelease(config, target, candidate)
+    );
+  }
+  return new Map(verified.map(item => [item.formCode, item]));
+}
+
+async function initializeNewReleaseStagedResources(
+  config,
+  target,
+  changeId,
+  candidates
+) {
+  const verified = [];
+  for (const candidate of candidates || []) {
+    verified.push(
+      await verifyReusableStagedFormRelease(config, target, candidate)
+    );
+  }
+  const reused = verified.map(item => ({
+    formCode: item.formCode,
+    formUuid: item.formUuid,
+    releaseId: item.releaseId,
+    contentHash: item.contentHash,
+    baseRevision: item.baseRevision,
+    parentReleaseId: item.parentReleaseId,
+  }));
+  const file = initializeStagedAppReleaseResources(
+    target,
+    changeId,
+    verified.map(item => item.resource),
+    reused.length > 0
+      ? {
+          reusedStagedFormReleases: reused,
+          reusedAt: new Date().toISOString(),
+        }
+      : {}
+  );
+  return { file, reused };
+}
+
 function assertStagedAppReleaseScope(target, flags, resources) {
   const changeId = readStringFlag(flags, 'change');
   if (!changeId) {
@@ -6083,6 +6378,15 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
   const explicitLeaseId = readStringFlag(flags, 'publish-lease-id');
   const changeId = readStringFlag(flags, 'change');
   const storedLease = getStoredPublishLease(target);
+  const baselineAtStart = changeId
+    ? getStoredChangeBaseline(target)
+    : null;
+  const newReleaseLifecycle = Boolean(
+    changeId && !getUsableStoredPublishLease(target) && !baselineAtStart
+  );
+  const reusableFormCandidates = newReleaseLifecycle
+    ? reusableStagedFormReleaseCandidates(target, changeId)
+    : [];
   let acquiredByCommand = false;
   assertOrClaimWorktreeOwner({
     cwd: process.cwd(),
@@ -6152,7 +6456,41 @@ async function resolvePublishLeaseForWrite(config, target, flags = {}) {
       clearRejectedPendingBaseline(target, baseline, error);
       throw error;
     }
-    finalizeReleaseBaseline(target, baseline);
+    const finalizedBaseline = finalizeReleaseBaseline(target, baseline);
+    if (newReleaseLifecycle) {
+      try {
+        await initializeNewReleaseStagedResources(
+          config,
+          target,
+          changeId,
+          reusableFormCandidates
+        );
+      } catch (error) {
+        try {
+          await requestWithAuth(
+            config,
+            target.profileName,
+            publishLeaseApiPath(
+              target,
+              `/${encodeURIComponent(lease.leaseId)}/release`
+            ),
+            {
+              method: 'POST',
+              body: { completion: 'local-prepare-failed' },
+            }
+          );
+        } catch {
+          // Keep the staged child verification failure as the primary error.
+        }
+        clearPublishLease(target, lease.leaseId);
+        clearChangeBaseline(
+          target,
+          finalizedBaseline?.baselineId || finalizedBaseline?.id
+        );
+        releaseWorktreeOwner({ cwd: process.cwd() });
+        throw error;
+      }
+    }
   }
   if (!lease) return null;
   if (changeId && lease.changeId !== changeId) {
@@ -12635,9 +12973,34 @@ async function resource(args) {
 
   const validation = validateWorkspaceResources(manifest);
   let target = null;
+  let stagedFormBindingOverlays = new Map();
   if (!isManifestEmpty(manifest)) {
     target = getWorkspaceTarget(config, profileName, flags);
-    validateWorkspaceResourceBindings(manifest, target.bound, validation);
+    const workflowFormCodes = unique(
+      (manifest.workflows || [])
+        .map(item => item.formCode || item.form)
+        .filter(Boolean)
+    );
+    const stagedChangeId =
+      readStringFlag(flags, 'change') ||
+      getStoredChangeBaseline(target, { access: 'reconciliation-read' })
+        ?.changeId ||
+      '';
+    if (workflowFormCodes.length > 0 && stagedChangeId) {
+      stagedFormBindingOverlays =
+        await resolveReusableStagedFormReleaseOverlays(
+          config,
+          target,
+          stagedChangeId,
+          { formCodes: workflowFormCodes }
+        );
+    }
+    validateWorkspaceResourceBindings(
+      manifest,
+      target.bound,
+      validation,
+      stagedFormBindingOverlays
+    );
   }
   await validateCompiledWorkflowResources(manifest, validation);
   if (subcommand === 'validate') {
@@ -16123,7 +16486,12 @@ function validateWorkspaceResources(manifest) {
   };
 }
 
-function validateWorkspaceResourceBindings(manifest, bound, validation) {
+function validateWorkspaceResourceBindings(
+  manifest,
+  bound,
+  validation,
+  stagedFormBindingOverlays = new Map()
+) {
   for (const item of manifest.workflows || []) {
     if (!item.formCode && !item.form) continue;
     const formCode = item.formCode || item.form;
@@ -16136,14 +16504,25 @@ function validateWorkspaceResourceBindings(manifest, bound, validation) {
       continue;
     }
     const localSchemaPath = path.join(process.cwd(), 'src', 'forms', formCode, 'schema.ts');
-    if (fs.existsSync(localSchemaPath) && !formBinding.schemaSyncedAt) {
+    const stagedOverlay = stagedFormBindingOverlays.get(formCode);
+    if (
+      fs.existsSync(localSchemaPath) &&
+      !formBinding.schemaSyncedAt &&
+      !stagedOverlay
+    ) {
       validation.errors.push(
         `${resourceLabel('workflow', item)}: formCode ${formCode} 已绑定但本地 schema 尚未同步。请先运行 openxiangda workspace publish --profile <name> --form ${formCode}`
       );
     }
-    if (formBinding.formType && formBinding.formType !== 'process') {
+    if (stagedOverlay) {
+      validation.warnings.push(
+        `${resourceLabel('workflow', item)}: formCode ${formCode} 使用已验证 staged FormRelease ${stagedOverlay.releaseId} 的冻结 schema/formType`
+      );
+    }
+    const effectiveFormType = stagedOverlay?.formType || formBinding.formType;
+    if (effectiveFormType && effectiveFormType !== 'process') {
       validation.errors.push(
-        `${resourceLabel('workflow', item)}: formCode ${formCode} 当前 formType=${formBinding.formType}，流程表单需要 process`
+        `${resourceLabel('workflow', item)}: formCode ${formCode} 当前 formType=${effectiveFormType}，流程表单需要 process`
       );
     }
   }
@@ -17397,8 +17776,12 @@ async function buildResourcePlan(
   await prepareManifestJsCodeBundlesForPlan(manifest);
   const stagedLocalFormSnapshots =
     await resolveStagedLocalFormContractSnapshots(
+      config,
       target,
-      options.flags || {}
+      options.flags || {},
+      (manifest.workflows || [])
+        .map(item => item.formCode || item.form)
+        .filter(Boolean)
     );
   const [existing, formFieldContracts] = await Promise.all([
     fetchExistingResourceMaps(config, target, manifest),
@@ -17828,8 +18211,9 @@ async function ensureOwnedImmutableReleasePublishContext(
       `${releaseKind} 只接受与本地冻结基线匹配的 stored lease；外部 opaque lease 不能用于原子发布`
     );
   }
-  const sourceRevision = normalizeManagedReleaseSourceRevision(
+  const sourceRevision = normalizeReleaseSourceRevisionForBaseline(
     target,
+    baseline.sourceBase || {},
     baseline.releaseSourceRevision || {},
     { errorCode: 'RELEASE_SOURCE_REPOSITORY_MISMATCH' }
   );
@@ -26855,32 +27239,38 @@ async function runWorkspaceChildCommand(command, args, options = {}) {
 }
 
 async function resolveStagedLocalFormContractSnapshots(
+  config,
   target,
-  flags = {}
+  flags = {},
+  implicitFormCodes = []
 ) {
-  const formCodes = unique(
+  const explicitFormCodes = unique(
     String(flags['staged-form-contracts'] || '')
       .split(',')
       .map(value => value.trim())
       .filter(Boolean)
   ).sort();
+  const formCodes = unique([
+    ...explicitFormCodes,
+    ...(implicitFormCodes || [])
+      .map(value => String(value || '').trim())
+      .filter(Boolean),
+  ]).sort();
   if (formCodes.length === 0) return new Map();
   const changeId = readStringFlag(flags, 'change');
   if (!changeId) {
+    if (explicitFormCodes.length === 0) return new Map();
     fail(
       'FORM_FIELD_STAGED_CONTRACT_CHANGE_REQUIRED: --staged-form-contracts 必须与 --change 一起使用'
     );
   }
-  const context = assertStagedResourcesContext(target, changeId);
-  const file = stagedResourcesFileForChange(
-    changeId,
-    target.deploymentId
-  );
-  const resources = fs.existsSync(file)
-    ? normalizeStagedAppReleaseResources(
-        JSON.parse(fs.readFileSync(file, 'utf8'))
-      )
-    : [];
+  const stagedOverlays =
+    await resolveReusableStagedFormReleaseOverlays(
+      config,
+      target,
+      changeId,
+      { formCodes }
+    );
   const snapshots = new Map();
   for (const formCode of formCodes) {
     const formUuid = resolveManifestFormUuid(
@@ -26888,29 +27278,15 @@ async function resolveStagedLocalFormContractSnapshots(
       { formCode },
       { fallbackToCode: false }
     );
-    const staged = resources.find(
-      resource =>
-        resource.kind === 'FormRelease' &&
-        String(resource.identity?.formUuid || '').trim() === formUuid
-    );
-    if (!staged) {
+    const staged = stagedOverlays.get(formCode);
+    if (!staged || staged.formUuid !== formUuid) {
       fail(
         `FORM_FIELD_STAGED_CONTRACT_REQUIRED: ${formCode} 尚未在 change ${changeId} 的当前 deployment 中获得 verified FormRelease`
       );
     }
-    const localSchema = await loadLocalFormSchema(
-      process.cwd(),
-      formCode
-    );
-    if (!localSchema) {
-      fail(
-        `FORM_FIELD_STAGED_CONTRACT_SCHEMA_MISSING: ${formCode} 缺少本地 schema`
-      );
-    }
-    const schema = JSON.parse(localSchema.schema);
     snapshots.set(
       formUuid,
-      collectFormSnapshotFieldIds({ form: { schema } })
+      collectFormSnapshotFieldIds({ form: staged.formSnapshot })
     );
   }
   return snapshots;

package/openxiangda-skills/SKILL.md

@@ -118,7 +118,7 @@ Reviewed bundle commands may retain `<profile>` as a template. The explicit real
 
 Exact `resourceSelectors` are authoritative for supported configuration resources such as `publicAccessPolicies`. A legacy `resources=true` category marker is narrowed by those exact selectors and must not become an app-wide generic-resource release. Missing selectors, unknown resource types, wildcard `*`, deletes, and genuine app-wide resource closures remain fail closed.
 
-`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it. Optional `.git` remote suffix differences are aliases of the same repository; genuinely different remotes still fail closed.
+`release begin --change` freezes a clean committed `HEAD` only when the current branch is the authoritative default `main`/`master` and its commit exactly equals the live remote tip. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A feature worktree or unpushed main receives `RELEASE_SOURCE_MAINLINE_REQUIRED` / `RELEASE_SOURCE_MAINLINE_NOT_PUSHED`; merge, test, push, and start the one mainline release instead of forcing it. Optional `.git` remote suffix differences and other recorded repository aliases are accepted only when the frozen source-base ID intersects `releaseSourceRevision.repoAliases`; Backend, Workflow, and Root App Release writes then use the frozen canonical ID. Genuinely different identity sets still fail closed before prepare.
 
 Because promotion begins from the already-pushed authoritative mainline, `release integration-status` should pass immediately after activation. Run it, then `release end`; no post-release branch merge is required.
 
@@ -126,6 +126,8 @@ Because promotion begins from the already-pushed authoritative mainline, `releas
 
 For a whole-app release, keep changed Runtime/Page/Backend/Form children staged and run `openxiangda release app-finalize --change <change> --staged-resources-json <JSON|file> --profile <name>`. The JSON contains only changed immutable child entries; the CLI overlays Runtime/Page/Backend by singleton kind and FormRelease by `formUuid` onto one authoritative read-only capture, preserving every unmodified active child. It then performs `prepare -> verify -> activateStagedChildren=true`, switching child heads and the App head atomically (`atomic_staged_children_v1`, or `atomic_staged_children_v2` when a Backend Release v2 child is present). Never refresh or retry after a conflict. The flow requires the owned stored lease/change baseline and carries the same client session and Git lineage on every write. Omitting the overlay is compatibility-only retrospective aggregation of already-active children.
 
+When the same change already has staged FormRelease children before a fresh baseline/lease is acquired, keep them staged. The CLI may rebind each child into the new session only after server verification of immutable/inactive/non-aborted state, exact app/form identity and content hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is local cache metadata, not release evidence. Do not direct-publish or activate a Form to bypass Workflow validation; missing or conflicting staged evidence must fail closed.
+
 When a Function or Automation is selected because its TypeScript source changed, publishing is source-only by default. Backend Release v2 accepts source-backed create, source-free declarative Automation manifest create, source-only update, and manifest replacement update in one immutable child and one database transaction, so a stale member produces zero resource writes and noops do not advance versions/timestamps. A new Automation with a complete `definitionJson.version="v3"` and no `sourceFile` automatically uses manifest create without `--replace-manifest`; an incomplete definition still fails closed. `--stage-only` is fail-closed: every selected mutation must enter that child, and a missing/incompatible Backend Release API never falls back to direct writes. Online bindings, input/output contracts, metadata, trigger/view configuration, and enabled/published state remain unchanged unless exact `--replace-manifest --reason "..."` authority was provided for an existing resource.
 
 An App Function may declare metadata-only top-level `secretRefs: [{ name, required }]` only with `function_v2` + `trusted_node_v2`; source resolves values with `await ctx.secrets.get(name)` and uses `ctx.utils.http` for controlled public HTTPS. Create/rotate values through hidden TTY or `openxiangda secret ... --value-stdin --change <change> --profile <name>`. Never put values in arguments, files, manifests, state, plans, logs, errors, or chat. Secret bindings require `backend_release_v2` and whole-app `atomic_staged_children_v2`; a missing capability is fail-closed and never uses the legacy source PATCH. For whole-app activation use exact-scope `resource publish <type> --only <code> --stage-only`, then pass the returned verified `stagedResource` to `release app-finalize`; an active Backend Release is never labeled staged.

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -63,6 +63,8 @@ Function/Automation source analysis also extracts statically declared Form filte
 
 Source-triggered Function/Automation targets use Backend Release v2 when the platform exposes that capability. One child may mix source-backed create, source-free declarative Automation manifest create, source-only update, and manifest replacement update through explicit per-resource `operation/mode`; the CLI freezes the current Backend Release parent plus Git/change baseline, then runs `prepare -> verify -> activate` or stops verified for `--stage-only`. A new Automation with a complete `definitionJson.version="v3"` and no `sourceFile` automatically uses manifest create without `--replace-manifest`; an incomplete definition still fails closed. Activation CAS-checks the entire set and applies all updates in one transaction. `--stage-only` and Secret-bound Function publishing fail closed when Backend Release v2 is unavailable; compatibility fallback is limited to non-staged, non-Secret publishing after an explicit Backend head 404. Existing online bindings, contracts, metadata, trigger/view configuration, and enabled/published state remain unchanged; noops do not advance versions/timestamps. A deliberate whole-definition replacement of an existing resource requires exact `--only/--code` and `--replace-manifest --reason "<why>"`; SDD bypass does not imply replacement authority.
 
+Repository identity remains strict across immutable releases. If a clone-derived primary repository ID differs from the frozen change source base, the CLI may canonicalize Backend, Workflow, and Root App Release payloads to the frozen ID only when that ID is already present in `releaseSourceRevision.repoAliases`; no alias intersection fails with `RELEASE_SOURCE_REPOSITORY_MISMATCH` before prepare.
+
 Functions with a top-level `secretRefs` field use `backend_release_v2`, including an explicit empty list that removes bindings. This path never falls back to source PATCH. It requires the per-app Secret capability probe to grant `app_function_secrets_v1`, `trusted_node_v2`, `backend_release_v2`, and `atomic_staged_children_v2`; otherwise plan/publish fails closed.
 
 For whole-app atomic activation, publish the exact mixed Function/Automation scope with `resource publish function,automation --only function:<code>,automation:<code> --stage-only --change <change>`. This stops after Backend Release verify and returns `stagedResource` plus every handled selector; the CLI automatically merges it with other changed staged children in `.openxiangda/releases/<change>/staged-resources.json` for `release app-finalize --staged-resources-json`. A Backend Release that was already activated returns `activeResource` and must not be presented as staged.

package/openxiangda-skills/skills/openxiangda-form/SKILL.md

@@ -86,6 +86,8 @@ openxiangda resource publish form-setting --only <formCode> --change <change> --
 
 The Form resource bundle carries schema, settings, indexes, data-management, runtime-write, public-access configuration, and changed form permission groups under one CAS parent. It returns a canonical staged FormRelease and the CLI records it in the change-scoped staged-resources file. `workspace publish --form` is limited to an intentional first-time bootstrap or isolated repair outside a governed multi-resource release; it is not the normal release path.
 
+An exact staged FormRelease remains usable across a fresh release baseline/lease for the same app/profile/change/deployment only after the CLI re-verifies its immutable, inactive, non-aborted server state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. Workflow planning reads that frozen contract even when the live Form head is intentionally not activated and local `schemaSyncedAt` is absent. Never synthesize `schemaSyncedAt`, direct-publish the schema, or activate the Form early as a workaround; all conflicts fail closed.
+
 For Phase 6 React SPA workspaces, `app-workspace.config.ts` should declare
 `runtimeMode: "react-spa"`. In that mode, `workspace publish --form <code>` is
 schema-only by default: it creates/binds the form and syncs schema, but skips

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.206",
+  "version": "1.0.208",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/templates/openxiangda-react-spa/.cursor/rules/openxiangda.mdc

@@ -26,7 +26,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 - L0 read-only/docs/tests need no SDD; L1 narrow reversible fixes record exact scope without a redundant second confirmation; schema, business Functions, Automation/Workflow, permissions, auth/public access, data writes, and runtime/config are L2/L3 full-SDD work. Live evidence/archive are post-release stages.
 - Very small copy/style/binding changes may use `openxiangda sdd quick <change> ...`; quick mode records exact low-risk scope without a redundant proposal/approval loop when the user already requested it.
 - SDD is streamlined by default: approval and exact structured scope are hard gates, while unfinished task/evidence/spec prose only warns. Configure `strictDocumentation: true` only when prose must block.
-- Before platform writes, run `release begin` from a clean local main/master that exactly equals the authoritative remote tip. Feature branches and unpushed mainline commits fail before any write. After activation, run `integration-status` and `release end`; no post-release merge is needed.
+- Before platform writes, run `release begin` from a clean local main/master that exactly equals the authoritative remote tip. Feature branches and unpushed mainline commits fail before any write. A clone primary may be canonicalized to the frozen repository ID only when that ID is already in `repoAliases`; otherwise release prepare fails closed. After activation, run `integration-status` and `release end`; no post-release merge is needed.
 - Managed preproduction and production targets own independent app/resource/data identities and side-effect policy. Existing workspaces use `environment attach`; only an appType-matching legacy binding may seed preproduction and production starts empty. Never direct-publish or copy IDs across them; use `openxiangda studio` to inspect candidate, evidence, and drift state. Only an explicitly authorized commissioning reclassification may use `environment swap --reason "..." --confirm-production`; it preserves app data/Release Heads and keeps side effects restricted by default.
 - Change one target's side-effect policy only with `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`: run `--dry-run` first, add `--confirm-production` for production, and never use `environment swap` for this. Patch mode validates only supplied fields and preserves unrecognized historical fields; `--full-replace` validates the supplied complete target and intentionally removes omissions. `organizationWrites=explicit_capability_only` removes the environment deny but still requires `app:organization:manage`. Keep release hard gates to explicit scope/profile/target, authorization, clean pushed mainline, immutable identity, CAS/lease, and production confirmation; prose and human acceptance notes are advisory unless strict mode is configured.
 - Account/role/permission/RBAC/organization-account/query-param authorization work must run `openxiangda design gates --topic permissions --json`, choose `managed-platform-account`, `existing-platform-user-assignment`, `static-role-permission`, or `query-param-context`, and write the permission matrix.
@@ -34,6 +34,7 @@ This is an OpenXiangda React SPA workspace. See [AGENTS.md](mdc:AGENTS.md) for f
 - `src/resources/**` is the resource source of truth; use `validate -> plan -> publish`.
 - Select logical resource codes with `--only`, or one code with `--code`; type-wide/app-wide release requires an approved dependency closure.
 - Source-triggered Function/Automation publishing uses server-side source-field PATCH and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses Backend Release manifest create without `--replace-manifest`; replacing an existing whole manifest requires `--replace-manifest --reason "..."`. On `SOURCE_BASE_DIVERGED` or `RESOURCE_FIELD_CONFLICT`, reconcile, rebuild, and re-plan.
+- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
 - Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
 - React routes live in `src/app/router.tsx`; frontend artifacts are deployed with `openxiangda runtime deploy`.
 - Use `AttachmentField` / `ImageField` for form-context previews, and `AttachmentPreviewList` / `ImagePreviewGrid` / `useFilePreview` for standalone custom pages. Do not fake form context, import internal preview implementations, or maintain local previewable-extension lists.

package/templates/openxiangda-react-spa/.qoder/rules/openxiangda.md

@@ -30,8 +30,9 @@ This is an OpenXiangda React SPA workspace. Read [AGENTS.md](AGENTS.md) for full
 - `src/resources/**` 是工程化资源来源，正式多资源变更走 `validate -> plan -> publish`。
 - 默认按逻辑资源 code 使用 `--only` 或单资源 `--code`；全类型/全应用发布必须由批准的依赖闭包明确覆盖。
 - Function/Automation 源码触发默认走服务端 source-field PATCH，保留线上 bindings/contracts/metadata/trigger/view/enabled/published state；无源码且 `definitionJson.version="v3"` 完整的新建 Automation 自动走 manifest create，只有替换已有整包 manifest 才必须加 `--replace-manifest --reason "..."`。
+- 相同 change 的 staged FormRelease 只有经服务端重新核验 immutable/inactive/non-aborted、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才可重挂接新 baseline/session。`schemaSyncedAt` 不是发布证据；禁止伪造、直发 schema 或提前激活 Form 绕过 Workflow 校验。
 - 环境托管 `release ship --replace-manifest --reason "..."` 必须成对、reason 至少 8 字符且仅限精确 Backend selector；正式确认复用与预发完全相同的参数，不透传 Form/Workflow/Runtime/配置或全量步骤。
-- Promotion 必须持有 `release begin/end` 租约；`release begin` 只接受与权威远端 tip 完全一致的 clean main/master。feature branch 或未 push 主线在任何写入前失败。激活后直接运行 `integration-status` 和 `release end`，不再补做发布后合并。
+- Promotion 必须持有 `release begin/end` 租约；`release begin` 只接受与权威远端 tip 完全一致的 clean main/master。feature branch 或未 push 主线在任何写入前失败。clone primary 只有在冻结仓库 ID 已存在于 `repoAliases` 时才会 canonicalize；无交集在 Release prepare 前失败关闭。激活后直接运行 `integration-status` 和 `release end`，不再补做发布后合并。
 - 已有工作区通过 `environment attach` 接入环境组，旧资源映射只迁移到 appType 相同的预发 target，正式 target 必须为空。preproduction / production 分别拥有独立 appType、资源 ID、数据和副作用策略；禁止直接 `release publish`，禁止跨环境复制 ID，使用 `openxiangda studio` 查看状态。只有用户明确授权的投产前重分类可执行 `environment swap --reason "..." --confirm-production`；它不移动应用数据或 Release Head，且默认不放开副作用。
 - 单独修改某个环境的副作用策略只能使用 `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`：先执行 `--dry-run`，正式环境额外要求 `--confirm-production`，不得借用 `environment swap`。patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段。`organizationWrites=explicit_capability_only` 只解除环境级 deny，仍强制 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。
 - React SPA 路由由 `src/app/router.tsx` 管理，前端包通过 `openxiangda runtime deploy` 发布。

package/templates/openxiangda-react-spa/AGENTS.md

@@ -51,7 +51,7 @@ openxiangda studio
 openxiangda commands --json
 ```
 
-模板已停用无范围的 `pnpm deploy` 聚合入口。日常变更必须使用 `resource plan|publish <type> --only <codes>`（单资源可用 `--code <code>`）。Form bundle、Backend Release 和 Runtime 都先暂存；CLI 会按 `--change` 自动聚合 `.openxiangda/releases/<change>/staged-resources.json`，最后只由一次 Root App finalize 原子激活。Form Release 一旦 abort 绝不能作为幂等结果复用；重新执行相同精确表单发布时，CLI 会淘汰旧 staged 索引，平台会创建新的不可变 attempt，再由 Root App 一次事务重试。禁止用顺序激活多张表单绕过失败。不要使用 `workspace publish --form`、单独 `runtime activate`、`pnpm publish:all`、`pnpm openxiangda:publish` 或 `lowcode-workspace publish-all`。
+模板已停用无范围的 `pnpm deploy` 聚合入口。日常变更必须使用 `resource plan|publish <type> --only <codes>`（单资源可用 `--code <code>`）。Form bundle、Backend Release 和 Runtime 都先暂存；CLI 会按 `--change` 自动聚合 `.openxiangda/releases/<change>/staged-resources.json`，最后只由一次 Root App finalize 原子激活。Form Release 一旦 abort 绝不能作为幂等结果复用；重新执行相同精确表单发布时，CLI 会淘汰旧 staged 索引，平台会创建新的不可变 attempt，再由 Root App 一次事务重试。相同 change 的既有 staged FormRelease 只有在 CLI 重新核验服务端不可变状态、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 和当前 Form Head 后，才可重挂接到新的 baseline/session；`schemaSyncedAt` 只是本地缓存元数据。禁止伪造它、提前激活 Form 或用顺序激活多张表单绕过失败。不要使用 `workspace publish --form`、单独 `runtime activate`、`pnpm publish:all`、`pnpm openxiangda:publish` 或 `lowcode-workspace publish-all`。
 
 工作区一旦通过 `environment init` 登记，或通过 `environment attach` 接入已有环境组，`release publish` 即不再是入口。日常使用两段式 `release ship`：第一次冻结不可变 candidate 并只部署到 preproduction，停止在 `awaiting_production_confirmation`；确认预发结果后，第二次命令提供 `--confirm-production`，把同一 candidate 晋级 production，不会重新构建。真实人工验收是默认建议，可用可选的 `--acceptance-note` 留痕；但用户明确授权的低风险或紧急发布不受僵硬审批门禁阻塞。两套环境的 appType、资源 ID、数据和副作用策略完全独立；旧单目标资源映射只允许迁移到 appType 相同的预发 target，正式 target 必须为空。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单独调整某个环境的副作用策略时，先运行 `environment policy update <kind|id> ... --dry-run` 查看差异，再按 CAS revision 写入；patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段。不得借用 swap，正式写入另需 `--confirm-production`。`organizationWrites=explicit_capability_only` 仍强制 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。`openxiangda studio` 提供仅本机访问的开发者页面，用于查看绑定、漂移、候选、部署、证据和下一安全动作。
 
@@ -82,7 +82,7 @@ App Function 第三方凭据只能在 Function manifest 顶层声明 `secretRefs
 
 `openxiangda runtime deploy --no-activate` 会构建并上传不可变预览版本；发布前先提交所有可能进入构建的源码/配置。所有 Runtime deploy（包括 `--no-activate`）都会先获取应用发布 lease，并在任何构建和上传前冻结 clean `HEAD` 与当前 active Runtime 父血缘；旧分支返回 `RUNTIME_SOURCE_BASE_DIVERGED`，不能先上传旧 preview 再激活。`openspec/` SDD 证据和生成/状态目录不算源码 dirty。仅审批的回退可使用 `--allow-runtime-rollback --reason "至少 8 个字符"`；`--no-build` 不会跳过守卫。不要手工修改 `dist/index.html`。
 
-Function/Automation 走 Backend Release v2；同一个 child 可以混合源码 create、无 `sourceFile` 的完整 v3 声明式 Automation manifest create、source-only update 与显式 manifest replacement，并对整个集合做 CAS。声明式 create 自动选路且不需要 `--replace-manifest`；替换已有资源才需要该显式授权。正式多资源发布必须使用 canonical 精确 selector 和 `--stage-only`。`release begin` 只接受与权威远端默认主分支完全一致的 clean HEAD；feature branch 或未 push 的 main 会在任何平台写入前失败。成功激活后主线证据天然成立，不再补做发布后合并。
+Function/Automation 走 Backend Release v2；同一个 child 可以混合源码 create、无 `sourceFile` 的完整 v3 声明式 Automation manifest create、source-only update 与显式 manifest replacement，并对整个集合做 CAS。声明式 create 自动选路且不需要 `--replace-manifest`；替换已有资源才需要该显式授权。正式多资源发布必须使用 canonical 精确 selector 和 `--stage-only`。`release begin` 只接受与权威远端默认主分支完全一致的 clean HEAD；feature branch 或未 push 的 main 会在任何平台写入前失败。clone primary 与冻结仓库 ID 不同时，只有该冻结 ID 已存在于 `repoAliases` 才会统一用于 Backend/Workflow/Root App Release；无交集继续失败关闭。成功激活后主线证据天然成立，不再补做发布后合并。
 
 ## 应用结构
 

package/templates/sy-lowcode-app-workspace/.cursor/rules/openxiangda.mdc

@@ -30,8 +30,9 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. See [AGEN
 - Very small copy/style/binding changes may use `openxiangda sdd quick <change> ...`; quick mode is limited to an exact low-risk scope and does not add a redundant proposal/approval loop when the user already requested that exact edit.
 - SDD is streamlined by default: approval and exact structured scope are hard gates, while unfinished task/evidence/spec prose only warns. Use `strictDocumentation: true` only when prose must block.
 - Source-triggered Function/Automation publishing uses server-side source-field PATCH by default and preserves online bindings, contracts, metadata, trigger/view configuration, and enabled/published state. A new source-free Automation with a complete `definitionJson.version="v3"` automatically uses manifest create; replacing an existing whole manifest requires exact `--only/--code` plus `--replace-manifest --reason "..."`.
+- A staged FormRelease for the same change may be rebound to a fresh baseline/session only after server verification of immutable/inactive/non-aborted state, identity/hash, frozen schema/formType, finalized resources, parent/base revision, and current Form head. `schemaSyncedAt` is not release evidence; never synthesize it, direct-publish the schema, or activate the Form early to bypass Workflow validation.
 - Managed `release ship --replace-manifest --reason "..."` requires the pair, reason length >= 8, and exact Backend selectors; production confirmation repeats the exact preproduction pair, with no forwarding to Form/Workflow/Runtime/config/all stages.
-- Before platform writes, run `release begin` only from clean main/master exactly equal to the authoritative remote tip. Feature branches and unpushed mainline commits fail before writes. After activation, run `integration-status` and `release end`; no post-release merge is needed.
+- Before platform writes, run `release begin` only from clean main/master exactly equal to the authoritative remote tip. Feature branches and unpushed mainline commits fail before writes. A clone primary may be canonicalized to the frozen repository ID only when that ID is already in `repoAliases`; otherwise release prepare fails closed. After activation, run `integration-status` and `release end`; no post-release merge is needed.
 - Environment-managed workspaces never publish directly. Existing workspaces use `environment attach`; only an appType-matching legacy binding may seed preproduction and production starts empty. Run `release candidate`, `release deploy --environment preproduction`, `release test`, then promote that same candidate with `release promote --environment production --confirm-production`. Keep app/resource/data IDs isolated and inspect state with `openxiangda studio`. Only an explicitly authorized commissioning reclassification may use `environment swap --reason "..." --confirm-production`; it preserves app data/Release Heads and keeps side effects restricted by default.
 - Change one target's side-effect policy only with `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`: run `--dry-run` first, add `--confirm-production` for production, and never use `environment swap` for this. Patch mode validates only supplied fields and preserves unrecognized historical fields; `--full-replace` validates the supplied complete target and intentionally removes omissions. `organizationWrites=explicit_capability_only` removes the environment deny but still requires `app:organization:manage`. Keep release hard gates to explicit scope/profile/target, authorization, clean pushed mainline, immutable identity, CAS/lease, and production confirmation; prose and human acceptance notes are advisory unless strict mode is configured.
 - Routine edits should plan and publish exact change targets: `workspace plan --profile <name> --change <change> --changed`, then `workspace publish --profile <name> --change <change> --only pages/a,forms/b --dry-run`.

package/templates/sy-lowcode-app-workspace/.qoder/rules/openxiangda.md

@@ -30,8 +30,9 @@ This is a `sy-lowcode-app-workspace` managed by the `openxiangda` CLI. Read [AGE
 - 极小的文案、样式、绑定修正可使用 `openxiangda sdd quick <change> ...`，但必须限制在精确的低风险范围内；用户已明确要求该小改时不再重复 propose/approve。
 - SDD 默认 streamlined：approval 与结构化精确范围是硬门禁，未完成的 task/evidence/spec 文案只告警；只有 `strictDocumentation: true` 才阻断。
 - Function/Automation 源码触发默认走服务端 source-field PATCH，保留线上 bindings/contracts/metadata/trigger/view/enabled/published state；无源码且 `definitionJson.version="v3"` 完整的新建 Automation 自动走 manifest create，只有替换已有整包 manifest 才必须精确 `--only/--code` 并加 `--replace-manifest --reason "..."`。
+- 相同 change 的 staged FormRelease 只有经服务端重新核验 immutable/inactive/non-aborted、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才可重挂接新 baseline/session。`schemaSyncedAt` 不是发布证据；禁止伪造、直发 schema 或提前激活 Form 绕过 Workflow 校验。
 - 环境托管 `release ship --replace-manifest --reason "..."` 必须成对、reason 至少 8 字符且仅限精确 Backend selector；正式确认复用与预发完全相同的参数，不透传 Form/Workflow/Runtime/配置或全量步骤。
-- 写入平台前只从与权威远端 tip 完全一致的 clean main/master 执行 `release begin`。feature branch 或未 push 主线在任何写入前失败；激活后直接运行 `integration-status` 和 `release end`，无需发布后再合并。
+- 写入平台前只从与权威远端 tip 完全一致的 clean main/master 执行 `release begin`。feature branch 或未 push 主线在任何写入前失败；clone primary 只有在冻结仓库 ID 已存在于 `repoAliases` 时才会 canonicalize，无交集在 Release prepare 前失败关闭；激活后直接运行 `integration-status` 和 `release end`，无需发布后再合并。
 - 环境托管工作区禁止直发：已有工作区先用 `environment attach` 接入，旧映射只能迁移到 appType 相同的预发 target，正式 target 必须为空。然后执行 `release candidate`、`release deploy --environment preproduction`、`release test`，最后将同一 candidate 用 `release promote --environment production --confirm-production` 晋级。两套环境的 appType、资源 ID 和数据不可互拷；用 `openxiangda studio` 查看状态。只有用户明确授权的投产前重分类可执行 `environment swap --reason "..." --confirm-production`；它不移动应用数据或 Release Head，且默认不放开副作用。
 - 单独修改某个环境的副作用策略只能使用 `environment policy update <preproduction|production> --side-effect-policy-json <JSON|file> --reason "..."`：先执行 `--dry-run`，正式环境额外要求 `--confirm-production`，不得借用 `environment swap`。patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段。`organizationWrites=explicit_capability_only` 只解除环境级 deny，仍强制 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。
 - 单文件改动默认按 change 和逻辑目标发布：先 `workspace plan --profile <name> --change <change> --changed`，再 `workspace publish --profile <name> --change <change> --only pages/a,forms/b --dry-run`。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -55,7 +55,8 @@
 - ✅ 发现平台缺陷、能力缺口、规则不清、反复 workaround、AI 不确定点、用户可见体验问题时，主动 `openxiangda feedback submit --yes`；发送后告诉用户反馈内容和 fingerprint。
 - ✅ 正式多资源开发优先写 `src/resources/**` 后执行 `openxiangda resource validate|plan|publish <type> --only <codes>`；单资源可用 `--code <code>`。直接 CLI 写平台资源时先 `--dry-run`，需要避免漂移就加 `--write-manifest`。
 - ✅ `resource plan` 与 publish dry-run 严格只允许 GET/HEAD；遇到 `READ_ONLY_AUTH_REQUIRED` 时先执行 `openxiangda auth refresh --profile <name>` 或重新登录，不得在 plan 内自动 POST 刷新 token。
-- ✅ Function/Automation 使用 Backend Release v2；正式多资源发布用精确 `--only/--code` 加 `--stage-only` 暂存，同一 child 可混合源码 create、无 `sourceFile` 的完整 v3 声明式 Automation manifest create、source-only update 和显式 manifest replacement，再由 Root App finalize 原子激活。声明式 create 自动选路；替换已有资源的整包 manifest 才需要另加 `--replace-manifest --reason "..."`。
+- ✅ Function/Automation 使用 Backend Release v2；正式多资源发布用精确 `--only/--code` 加 `--stage-only` 暂存，同一 child 可混合源码 create、无 `sourceFile` 的完整 v3 声明式 Automation manifest create、source-only update 和显式 manifest replacement，再由 Root App finalize 原子激活。声明式 create 自动选路；替换已有资源的整包 manifest 才需要另加 `--replace-manifest --reason "..."`。clone primary 与冻结仓库 ID 不同时，只有冻结 ID 已存在于 `repoAliases` 才会统一用于 Backend/Workflow/Root App Release；无交集继续失败关闭。
+- ✅ 相同 change 已有 staged FormRelease 时，不要直发 schema、伪造 `schemaSyncedAt` 或提前激活 Form。CLI 只在重新核验服务端不可变状态、identity/hash、冻结 schema/formType、finalized 资源、parent/base revision 与当前 Form Head 后，才将 child 重挂接到新的 baseline/session；冲突继续失败关闭。
 - ✅ 未登记环境的旧工作区，正式 promotion 先聚合 mainline bundle 并 commit/push，再运行 `release publish --change <id> --profile <name>`。
 - ✅ 已通过 `environment init` 登记或 `environment attach` 接入的工作区默认使用两段式 `release ship`。第一次命令只冻结 candidate 并部署 preproduction，停止等待正式晋级确认；确认预发结果后，另一次命令提供 `--confirm-production`，即可晋级同一 candidate。人工验收是默认建议，可用可选的 `--acceptance-note` 留痕，但不是所有低风险或紧急发布的硬审批门禁。preproduction / production 的 appType、资源 ID、数据和副作用策略完全隔离，严禁跨环境复制 ID 或直接 `release publish`。旧单目标映射只允许按相同 appType 迁移到预发。仅在用户明确授权的投产前重分类中使用 `environment swap --reason "..." --confirm-production` 原子交换两个既有应用的环境角色；数据和 Release Head 不移动，副作用默认不放开。单环境副作用策略用 `environment policy update <kind|id> ... --dry-run` 预览后按 revision CAS 写入，禁止借用 swap；patch 只校验本次提交字段并原样保留未知历史字段，`--full-replace` 才按完整目标删除遗漏字段，正式写入需 `--confirm-production`，且 `organizationWrites=explicit_capability_only` 不绕过 `app:organization:manage`。发布硬门禁只保留明确 scope/profile/target、权限、干净且已推送主线、不可变版本、CAS/租约与生产确认；文案和人工验收说明默认是建议，只有显式 strict 模式才阻断。
 - ✅ 只有已审计目标早已进入权威主线、线上却由多次历史 lineage 组成且无法对应单一 Git 基线时，第一次 `release ship` 才可增加 `--adopt-online-baseline --adoption-reason "..."`；仅允许精确非删除 selectors，冻结 Head、change/lease、服务端 CAS、staged children 与单次 App finalize 仍是硬门禁。