Carry actual flow state and freeze callback round identity

Local review candidate only. Explicitly selected inherited prerequisites and prior repair patches; unrelated WIP and independent MQ fixes are excluded. No push or deployment authorized.

.gitea/workflows/build.yml

@@ -16,6 +16,10 @@ on:
         description: '构建前清空 maven m2 缓存'
         required: false
         default: 'false'
+      tests_only:
+        description: '只验证测试和 JAR，不构建推送镜像或通知建档'
+        required: false
+        default: 'true'
 
 jobs:
   build-push:
@@ -36,6 +40,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git clone --depth 1 --branch main "http://x-access-token:${GITHUB_TOKEN}@gitea.yunhaixingtong.com/${{ github.repository }}.git" /tmp/src
+          git -C /tmp/src fetch --depth 1 origin "$GITHUB_SHA"
+          git -C /tmp/src checkout --detach FETCH_HEAD
           cp -a /tmp/src/. .
           rm -rf /tmp/src
           # 取提交备注首行，脱去换行/双引号/反斜杠（避免破坏 webhook JSON），截断到 200 字符
@@ -64,6 +70,7 @@ jobs:
           # GITHUB_RUN_ID 实例级唯一，再拼时间戳兜底。
           BUILD_CONTAINER="mavenbuild-${GITHUB_RUN_ID:-0}-$(date +%s)"
           echo "BUILD_CONTAINER=${BUILD_CONTAINER}"
+          trap 'docker rm -f "$BUILD_CONTAINER" >/dev/null 2>&1 || true' EXIT
           docker rm -f "$BUILD_CONTAINER" 2>/dev/null || true
           docker run -d --name "$BUILD_CONTAINER" \
             --network infra-infra-net \
@@ -71,13 +78,33 @@ jobs:
             -w /build maven:3.6.3-jdk-8 sleep 3600
           docker cp "${PWD}/." "$BUILD_CONTAINER":/build/
           docker exec "$BUILD_CONTAINER" sh -c "printf '%s' '<settings><profiles><profile><id>nexus-repo</id><repositories><repository><id>nexus-internal</id><url>http://nexus:8081/repository/maven-public/</url><releases><enabled>true</enabled></releases><snapshots><enabled>true</enabled><updatePolicy>always</updatePolicy></snapshots></repository></repositories></profile></profiles><activeProfiles><activeProfile>nexus-repo</activeProfile></activeProfiles></settings>' > /root/.m2/settings.xml"
-          docker exec "$BUILD_CONTAINER" sh -c 'cd /build && mvn -B -DskipTests clean package'
+          # 为真实 MySQL 测试创建本次 job 独占的临时数据库；不映射宿主端口、不连接业务库。
+          DB_CONTAINER="${BUILD_CONTAINER}-db"
+          trap 'docker rm -f "$BUILD_CONTAINER" "$DB_CONTAINER" >/dev/null 2>&1 || true' EXIT
+          export MYSQL_ROOT_PASSWORD=$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')
+          export MYSQL_PASSWORD=$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')
+          docker create --name "$DB_CONTAINER" --network infra-infra-net \
+            -e MYSQL_DATABASE=flowcenter_ci -e MYSQL_USER=flow_ci \
+            -e MYSQL_PASSWORD -e MYSQL_ROOT_PASSWORD mysql:8.0 --skip-log-bin >/dev/null
+          docker cp "${PWD}/ci/flow-test-schema.sql" "$DB_CONTAINER":/docker-entrypoint-initdb.d/001-schema.sql
+          docker start "$DB_CONTAINER" >/dev/null
+          ready=0
+          for n in $(seq 1 60); do
+            if docker exec "$DB_CONTAINER" sh -c 'MYSQL_PWD="$MYSQL_PASSWORD" mysql -h127.0.0.1 -u"$MYSQL_USER" "$MYSQL_DATABASE" -Nse "SELECT 1" >/dev/null 2>&1'; then ready=1; break; fi
+            sleep 2
+          done
+          [ "$ready" -eq 1 ] || { echo 'Isolated CI MySQL did not become ready' >&2; exit 1; }
+          export CI_TEST_DB_URL="jdbc:mysql://${DB_CONTAINER}:3306/flowcenter_ci?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true"
+          export CI_TEST_DB_USER=flow_ci CI_TEST_DB_PASSWORD="$MYSQL_PASSWORD"
+          docker exec -e CI_TEST_DB_URL -e CI_TEST_DB_USER -e CI_TEST_DB_PASSWORD \
+            "$BUILD_CONTAINER" sh -c 'cd /build && sh ci/test-gate.sh clean package'
           docker exec "$BUILD_CONTAINER" sh -c 'cd /build/target && cp *.jar app.jar'
           mkdir -p "${PWD}/target"
           docker cp "$BUILD_CONTAINER":/build/target/app.jar "${PWD}/target/app.jar"
           docker rm -f "$BUILD_CONTAINER"
 
       - name: 构建并推送镜像
+        if: ${{ inputs.tests_only != 'true' }}
         run: |
           set -e
           TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
@@ -88,6 +115,7 @@ jobs:
 
       # 通知 projman：webhook 收到后只建档 Release(status=pending)，部署由运维在 DeployTab 手动触发（App.deployMode=manual）
       - name: 通知 projman 建档（部署由运维手动触发）
+        if: ${{ inputs.tests_only != 'true' }}
         run: |
           curl -sS -X POST "http://192.168.10.160:8090/projman/api/deploy/webhook" \
             -H "Content-Type: application/json" \