完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/apOperations.permissions.test.js

@@ -35,7 +35,7 @@ async function buildApp(permissionCodes, enabled = true) {
   });
   app.decorate("hasPermission", (employee, permission) => hasPermission(employee.permissionCodes, permission));
   app.setErrorHandler((error, request, reply) => {
-    reply.code(error.statusCode ?? 500).send({ error: { code: error.code } });
+    reply.code(error.statusCode ?? 500).send({ error: { code: error.code, ...(error.details && Object.keys(error.details).length ? { details: error.details } : {}) } });
   });
   await app.register(apOperationsRoutes, { prefix: "/api" });
   return { app, queries };
@@ -88,10 +88,38 @@ describe("AP full-ledger permission boundary", () => {
   it("preserves feature-off refusal without querying financial data", async () => {
     const { app, queries } = await buildApp(["finance.ledger.view"], false);
     try {
-      for (const url of paths) expect((await app.inject({ method: "GET", url })).statusCode).toBe(409);
+      for (const url of paths) {
+        const response = await app.inject({ method: "GET", url });
+        expect(response.statusCode).toBe(409);
+        expect(response.json().error.details).toEqual({ featureFlag: "payment_batch_v1_disabled", reason: "flag_force_off", reasonCode: "ap_operations.disabled" });
+      }
       for (const query of queries) expect(query).not.toHaveBeenCalled();
     } finally {
       await app.close();
     }
   });
 });
+
+describe("AP direct ledger calendar boundary", () => {
+  it.each(["dateFrom", "dateTo"].flatMap((field) => ["2026-02-29", "2026-04-31", "2026-13-01"].map((date) => [field, date])))(
+    "rejects %s=%s before ledger queries", async (field, date) => {
+      const { app, queries } = await buildApp(["finance.ledger.view"]);
+      try {
+        const response = await app.inject({ method: "GET", url: `/api/ap-operations/reimbursement-ledger?${field}=${date}` });
+        expect(response.statusCode).toBe(400);
+        expect(response.json().error.code).toBe("VALID_001");
+        expect(response.json().error.details).toEqual({ formErrors: [], fieldErrors: { [field]: ["invalid_calendar_date"] }, reasonCode: "ap_operations.ledger_query_invalid" });
+        for (const query of queries) expect(query).not.toHaveBeenCalled();
+      } finally { await app.close(); }
+    },
+  );
+  it.each([["2024-02-29", "2026-04-30"], ["2026-04-30", "2024-02-29"]])(
+    "preserves UTC bounds and existing reverse-range semantics %s / %s", async (dateFrom, dateTo) => {
+      const { app } = await buildApp(["finance.ledger.view"]);
+      try {
+        expect((await app.inject({ method: "GET", url: `/api/ap-operations/reimbursement-ledger?dateFrom=${dateFrom}&dateTo=${dateTo}` })).statusCode).toBe(200);
+        expect(app.prisma.reimbursementForm.findMany).toHaveBeenCalledWith(expect.objectContaining({ where: { AND: expect.arrayContaining([{ reimbursement_date: { gte: new Date(`${dateFrom}T00:00:00.000Z`), lte: new Date(`${dateTo}T23:59:59.999Z`) } }]) } }));
+      } finally { await app.close(); }
+    },
+  );
+});