修复移动验收门禁漂移（07-27-yang-jun-reimbursement-readiness）

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -2053,3 +2053,57 @@ hierarchy without turning every page into a bespoke Tailwind card system.
 - Focused Playwright coverage for changed finance/admin pages. The Wave4
   baseline test is `client/tests/e2e/pc-finance-admin-visual-wave4.spec.ts`.
 - UI design rules check when changing these shared classes.
+
+## Scenario: Frontend Acceptance Spec Gate Registration
+
+### 1. Scope / Trigger
+
+- Trigger: a frontend E2E spec is treated as a current acceptance contract rather than historical evidence or a manual-only diagnostic.
+
+### 2. Signatures
+
+- Manifest entry: `scripts/qa/route-manifest.json` → `acceptanceSpecs[]`.
+- Executable gate: `bash scripts/qa/run-local-candidate.sh list|focused|full`.
+
+### 3. Contracts
+
+- A current acceptance spec must be referenced by an executed gate; merely existing under `client/tests/e2e/` is not coverage.
+- `list` must resolve the spec, while `focused` or `full` must execute it and reject failed or skipped acceptance results.
+- DOM discovery may be dynamic to avoid duplicating selectors, but the expected business set, order or invariant must remain explicit. Never accept whatever the page happens to render.
+- Historical or unowned specs must be deliberately classified for later connection or deletion; do not silently present them as active coverage.
+
+### 4. Validation & Error Matrix
+
+- Manifest entry missing or invalid → flow-coverage gate fails.
+- Acceptance spec skipped, failed or timed out → local-candidate result gate fails.
+- Dynamic collection with no fixed expectation → review failure even if the test is green.
+- Gate fixture cannot execute a newly called child script → fixture test fails and the child script must be added through command discovery or explicit setup.
+
+### 5. Good/Base/Bad Cases
+
+- Good: discover current action tiles from the grid, then assert the fixed role-specific key/label set and layout invariants.
+- Base: a stable single control uses a direct `data-testid` assertion and is listed in `acceptanceSpecs`.
+- Bad: count whatever matching nodes exist, assert only their individual dimensions, and leave the spec outside every runner.
+
+### 6. Tests Required
+
+- `node --test scripts/qa/tests/check-flow-coverage.test.mjs scripts/qa/tests/check-minimal-profile.test.mjs scripts/qa/tests/verify-local-candidate-results.test.mjs`.
+- `bash scripts/qa/run-local-candidate.sh list` must list the spec.
+- `bash scripts/qa/run-local-candidate.sh focused` or `full` must finish with zero failed/skipped acceptance tests.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```ts
+const actions = collectVisibleActions();
+for (const action of actions) expect(action.height).toBeGreaterThanOrEqual(44);
+```
+
+#### Correct
+
+```ts
+const actions = collectVisibleActions();
+expect(actions.map(({ key, label }) => ({ key, label }))).toEqual(EXPECTED_ACTIONS);
+for (const action of actions) expect(action.height).toBeGreaterThanOrEqual(44);
+```