完成杨俊报销就绪配置与企微边界记录（07-27-yang-jun-reimbursement-readiness）

.trellis/spec/hyb-oa/wecom-boundary.md

@@ -41,6 +41,91 @@ or administration workflow has already migrated.
   rule, applicant-visible mobile submission page and actual post-submission
   approval chain; API template metadata alone is insufficient.
 
+## Scenario: WeCom Member Data Is A Read-Only Source For OA
+
+### 1. Scope / Trigger
+
+- Trigger: importing directory members, changing OA employee/profile or manager
+  routes, enabling directory sync, or adding any WeCom member create/update/disable
+  call.
+- Purpose: keep WeCom as the member-account fact source and prevent an ordinary
+  OA account-management action from unexpectedly changing the real WeCom directory.
+
+### 2. Signatures
+
+- Approved inbound CLI: `npm run import:wecom-directory-export -- --input=-
+  --dry-run|--apply`; apply retains its existing dual gate and writes OA only.
+- OA workflow manager field: `Employee.direct_manager_id`; it is not the WeCom
+  directory supervisor field.
+- Outbound safety gates: `WECOM_CONTACT_SYNC_ENABLED=false` and effective feature
+  flag `hr_wecom_directory_sync_v1=force_off` for formal internal operation.
+- Existing outbound API family `/cgi-bin/user/create|update` and disable payloads
+  remain unavailable to ordinary OA user/manager maintenance.
+
+### 3. Contracts
+
+- A directory export or approved read API may create/update the minimum OA
+  employee mirror and `WecomIdentityBinding`; it must not create, update or
+  disable the WeCom member.
+- WeCom name, department, supervisor, phone, email and active state are edited by
+  the member in an allowed WeCom surface or by a WeCom administrator. OA learns
+  later changes through another approved inbound read/import.
+- Setting `direct_manager_id` changes only OA workflow routing. It does not imply
+  or trigger a WeCom supervisor update.
+- An OA account route may record a skipped directory-sync run while the outbound
+  gate is disabled, but it must stop before token acquisition or an external
+  member-write request. The skipped state is evidence of zero external writes.
+- Any future reverse member sync requires a separate Trellis task, per-field
+  side-effect design, dry-run, explicit production approval and rollback. It may
+  not be introduced as an implicit side effect of an existing OA route.
+
+### 4. Validation & Error Matrix
+
+- Import input conflicts or is ambiguous -> block the OA write; never merge or
+  repair the WeCom member automatically.
+- OA manager/profile action with outbound gate disabled -> OA transaction may
+  succeed, outbound sync is `skipped`, zero WeCom access-token/member-write calls.
+- Effective outbound flag unexpectedly enabled during ordinary internal operation
+  -> deployment/operation finding; do not exercise the write path to diagnose it.
+- A requested WeCom profile change -> direct the member or WeCom administrator to
+  WeCom; do not patch the OA mirror and push it outward.
+
+### 5. Good/Base/Bad Cases
+
+- Good: administrator exports one existing member, OA imports one `employee`
+  account and identity binding, then sets an OA-only manager while outbound sync
+  remains skipped.
+- Base: a member later changes phone/email in WeCom; OA keeps the previous mirror
+  until the next approved inbound refresh.
+- Bad: `POST /api/users/batch/set-manager` silently calls `/cgi-bin/user/update`,
+  or OA profile editing becomes a back door for changing the WeCom directory.
+
+### 6. Tests Required
+
+- Directory-export tests prove stdin-only parsing, dual apply gate, employee-only
+  role and no outbound client invocation.
+- User manager/profile route tests assert an effective disabled outbound gate
+  produces `skipped` before token acquisition/fetch while preserving OA audit.
+- Env/feature-contract checks keep the formal default off and reject a production
+  claim that relies on an unapproved reverse-sync flag.
+- A separately proposed reverse-sync task must add mocked API payload assertions,
+  negative permission/conflict cases and explicit live approval evidence.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```text
+OA set-manager/profile update -> WeCom /user/update -> real member changed
+```
+
+#### Correct
+
+```text
+WeCom member/admin edits source data -> approved inbound read/import -> OA mirror
+OA direct_manager_id update -> OA workflow only; outbound member sync skipped
+```
+
 ## Scenario: Compensatory Leave Is A WeCom Leave Category
 
 ### 1. Scope / Trigger