记录live OCR样票捕获约束（07-28-travel-reimbursement-guide）

.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md

@@ -291,6 +291,10 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
 - Never output recognized identifiers, dates, amounts, buyer/seller/passenger
   names, provider messages, raw response or input bytes. Field presence is a
   boolean; errors are bounded stable codes.
+- The JSON summary is the primary evidence even when the probe exits non-zero.
+  Shell callers must capture and persist the bounded stdout summary before
+  interpreting the exit status; do not let `set -e` discard a valid HOLD
+  summary held only in a command-substitution variable.
 - A PASS proves the direct provider/normalization path only. It does not prove
   OA upload, queue, persistence, duplicate detection, binding or reimbursement
   submission.
@@ -329,6 +333,8 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
   assert serialized output contains only booleans and safe metadata.
 - CLI test pipes one synthetic PDF over stdin with credentials absent and
   asserts one parseable redacted error object with empty stderr.
+- Caller capture test asserts a redacted HOLD JSON remains available when the
+  probe exits `1`; no provider retry may be inferred solely from lost stdout.
 - Before deployment run `node --check`, the focused tests, full backend tests,
   sensitive-content scan, task validation and Trellis governance.
 
@@ -348,6 +354,9 @@ node scripts/qa/check-ocr-provider-samples.mjs \
   --alias=SAMPLE-PDF-TRAIN < <authorized-single-sample.pdf>
 ```
 
+The caller records stdout before applying the exit-code gate; it never uses a
+`set -e` assignment whose non-zero status exits before the JSON is emitted.
+
 ## Scenario: Payment Batch Receipt Attention Count
 
 ### 1. Scope / Trigger

.trellis/tasks/07-28-travel-reimbursement-guide/implement.md

@@ -79,6 +79,13 @@
 - 部署后受控自动备份和新鲜度检查均成功，未调用真实 OCR 样票。
 - 真实住宿和铁路样票验收仍等待单独调用授权；在两类样票通过前，不通知员工上传真实票据。
 
+## 2026-07-29 授权样票验收尝试
+
+- 已匿名选择铁路 PDF 并执行最多一次 provider 调用，但外层 shell 在探针非零退出时提前终止，未保留已生成的脱敏 JSON，因此本次不能作为 PASS 或可解释 provider 终态证据。
+- 按“第一份未取得明确 PASS 即停止”约束，未调用住宿样票，也未重试铁路样票。
+- 空 stdin 捕获自检证明修正后的调用方式可在 provider 调用前保留 `HOLD/sample_empty` 摘要；该自检未消耗 OCR 次数。
+- 本次没有创建 OA 发票、附件或数据库记录；真实样票仍未验收通过，员工上传门禁保持关闭。
+
 ## 风险文件与操作
 
 - 生产环境文件：包含 Secret，只允许用户现场静默输入；不得由补丁、聊天或命令参数传入。