完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/payroll.exports.test.js

@@ -166,3 +166,18 @@ describe("payroll export routes", () => {
     await app.close();
   });
 });
+
+describe("payroll export month guards", () => {
+  it.each(["csv", "xlsx"].flatMap((format) => ["2026-00", "2026-13", "2026-1", ""].map((month) => [format, month])))("rejects %s month=%s before reads/audit", async (format, month) => {
+    const { app } = await buildApp();
+    try {
+      const response = await app.inject({ method: "GET", url: `/api/exports/payslips?format=${format}&month=${month}` });
+      expect(response.statusCode).toBe(400);
+      expect(response.json().error.code).toBe("VALID_001");
+      expect(response.json().error.details.reasonCode).toBe((["2026-00", "2026-13"].includes(month) ? "payroll.month_invalid" : "payroll.export_query_invalid"));
+      if (["2026-00", "2026-13"].includes(month)) expect(response.json().error.details).toEqual({ month: "invalid_month", reasonCode: "payroll.month_invalid" });
+      expect(app.prisma.payslip.findMany).not.toHaveBeenCalled();
+      expect(app.prisma.auditLog.create).not.toHaveBeenCalled();
+    } finally { await app.close(); }
+  });
+});