完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/wecomAuth.test.js

@@ -216,7 +216,7 @@ describe("wecom auth routes R27", () => {
       url: "/api/auth/wecom/login?entrySource=pc_qr&mode=onboard&returnTo=%2Fportal",
     });
     expect(unsupported.statusCode).toBe(400);
-    expect(unsupported.json().error.details).toEqual({ entrySource: "unsupported_for_mode" });
+    expect(unsupported.json().error.details).toEqual({ entrySource: "unsupported_for_mode", reasonCode: "wecom.pc_mode_unsupported" });
     await app.close();
   });
 
@@ -1185,3 +1185,33 @@ describe("wecom auth routes R27", () => {
     await app.close();
   });
 });
+
+describe("wecom validation reasons without provider access", () => {
+  it.each([
+    ["POST", "/wecom/js-sdk-signature", {}, "wecom.signature_url_invalid"],
+    ["POST", "/wecom/js-sdk-signature", { url: "not-a-url" }, "wecom.signature_url_invalid"],
+    ["POST", "/wecom/js-sdk-signature", { url: "file:///synthetic" }, "wecom.signature_url_invalid"],
+    ["POST", "/wecom/js-sdk-signature", { url: "https://oa.hyinda.com/path#fragment" }, "wecom.signature_url_invalid"],
+    ["POST", "/wecom/js-sdk-signature", { url: "https://synthetic:[email protected]/path" }, "wecom.signature_url_invalid"],
+    ["GET", "/wecom/login?mode=bad", undefined, "wecom.login_query_invalid"],
+    ["GET", "/wecom/login?mode=bind&entrySource=pc_qr", undefined, "wecom.pc_mode_unsupported"],
+    ["GET", "/wecom/login?mode=onboard&entrySource=pc_qr", undefined, "wecom.pc_mode_unsupported"],
+    ["POST", "/wecom/bind", { returnTo: 1 }, "wecom.bind_input_invalid"],
+  ])("explains %s %s before fetch/cookies/writes", async (method, path, payload, reason) => {
+    global.fetch = vi.fn().mockRejectedValue(new Error("unexpected_network")); const prisma = buildPrisma(); const app = await buildApp({ prisma });
+    try { const r = await app.inject({ method, url: `/api/auth${path}`, payload, headers: { authorization: "Bearer synthetic" } }); expect(r.statusCode).toBe(400); expect(r.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode: reason } }); expect(r.headers["set-cookie"]).toBeUndefined(); expect(global.fetch).not.toHaveBeenCalled(); expect(prisma.wecomIdentityBinding.upsert).not.toHaveBeenCalled(); expect(prisma.auditLog.create).not.toHaveBeenCalled(); } finally { await app.close(); }
+  });
+  it("explains missing entry configuration without reflecting it or fetching", async () => { global.fetch = vi.fn(); const app = await buildApp({ config: { wecomCorpId: "" } }); try { const r = await app.inject({ url: "/api/auth/wecom/login" }); expect(r.statusCode).toBe(409); expect(r.json().error.details).toMatchObject({ wecom: "missing_required_config", reasonCode: "wecom.entry_config_incomplete" }); expect(r.headers["set-cookie"]).toBeUndefined(); expect(global.fetch).not.toHaveBeenCalled(); } finally { await app.close(); } });
+});
+
+it("explains missing synthetic auth credential only at callback token exchange", async () => {
+  global.fetch = vi.fn().mockRejectedValue(new Error("unexpected_network"));
+  const prisma = buildPrisma(); const app = await buildApp({ prisma, config: { wecomAgentSecret: "" } });
+  try {
+    expect((await app.inject({ url: "/api/auth/wecom/login" })).statusCode).toBe(302);
+    const state = signPayload({ exp: Date.now() + 60_000, nonce: "synthetic", returnTo: "/portal", mode: "login" }, JWT_SECRET);
+    const r = await app.inject({ url: `/api/auth/wecom/callback?state=${encodeURIComponent(state)}&code=synthetic` });
+    expect(r.statusCode).toBe(409); expect(r.json().error.details).toEqual({ wecom: "missing_agent_secret", reasonCode: "wecom.auth_config_incomplete" });
+    expect(global.fetch).not.toHaveBeenCalled(); expect(prisma.wecomIdentityBinding.findUnique).not.toHaveBeenCalled(); expect(prisma.wecomIdentityBinding.upsert).not.toHaveBeenCalled(); expect(prisma.auditLog.create).not.toHaveBeenCalled();
+  } finally { await app.close(); }
+});