完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/attendance.test.js

@@ -443,3 +443,45 @@ describe("attendance unified routes", () => {
     );
   });
 });
+
+describe("unified attendance month guards", () => {
+  it.each(["2026-00", "2026-13", "2026-1", ""])("rejects month=%s before business reads or sync", async (month) => {
+    const { app, prisma } = buildApp();
+    const fetchSpy = vi.fn(() => { throw new Error("no external access in month tests"); });
+    global.fetch = fetchSpy;
+    try {
+      const response = await app.inject({ method: "GET", url: `/api/attendance/monthly?month=${month}` });
+      expect(response.statusCode).toBe(400);
+      expect(response.json().error.code).toBe("VALID_001");
+      expect(response.json().error.details.reasonCode).toBe(["2026-00", "2026-13"].includes(month) ? "attendance.month_invalid" : "attendance.month_query_invalid");
+      if (["2026-00", "2026-13"].includes(month)) expect(response.json().error.details).toEqual({ month: "invalid", reasonCode: "attendance.month_invalid" });
+      for (const [name, group] of Object.entries(prisma)) {
+        if (name === "featureFlag") continue;
+        if (typeof group === "function") expect(group).not.toHaveBeenCalled();
+        else for (const fn of Object.values(group)) expect(fn).not.toHaveBeenCalled();
+      }
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally { global.fetch = originalFetch; await app.close(); }
+  });
+
+  it.each(["2024-01", "2024-02", "2024-12"])("keeps the selected valid month %s", async (month) => {
+    const { app, prisma } = buildApp();
+    try {
+      const response = await app.inject({ method: "GET", url: `/api/attendance/monthly?month=${month}` });
+      expect(response.statusCode).toBe(200);
+      expect(response.json().data.month).toBe(month);
+      expect(prisma.wecomCheckinRecord.findMany).toHaveBeenCalledOnce();
+    } finally { await app.close(); }
+  });
+
+  it("keeps the omitted month default in the configured timezone", async () => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+    vi.setSystemTime(new Date("2024-02-29T17:00:00.000Z"));
+    const { app } = buildApp({ employees: [] });
+    try {
+      const response = await app.inject({ method: "GET", url: "/api/attendance/monthly" });
+      expect(response.statusCode).toBe(200);
+      expect(response.json().data.month).toBe("2024-03");
+    } finally { vi.useRealTimers(); await app.close(); }
+  });
+});