fix: 加固日历日期与动态错误合同（09-05-error-explainability-payment-readiness，09-08-reimbursement-payment-closeout）

.trellis/spec/hyb-oa/backend-fastify-prisma.md

@@ -18,6 +18,16 @@ QA script patterns over new abstractions.
 
 ## Common Checks
 
+### Calendar Date Inputs
+
+- For reimbursement, payment-batch, travel-request and asset date-only input schemas,
+  combine the YYYY-MM-DD shape with isValidDateOnlyString. Reject calendar overflow
+  before persistence; a regex alone accepts February 30 and JavaScript normalizes it.
+- Keep optional and nullable wrappers outside the string validator. Validate leap-day,
+  month-end, invalid month and empty/null boundaries without changing stored historical dates.
+- parseDateOnlyString retains its legacy conversion contract for unaudited consumers;
+  it is not validation. Do not claim the shared parser or other domains are all hardened.
+
 ### Payment Account And Invoice Read Errors
 
 - Payment-account maintenance and invoice-pool read validation use registered

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -23,6 +23,12 @@
 
 ## Source Of Truth
 
+- Reminder cooldown hints render server UTC timestamps in Asia/Shanghai with an
+  explicit Beijing-time label and second precision. Reuse formatDisplayDateTime's
+  opt-in includeSeconds; existing callers retain minute precision. Both registered
+  reason and legacy details paths reject malformed/non-finite timestamps without
+  reflecting arbitrary values. Cover a UTC-to-Beijing cross-year case.
+
 Frontend visual and interaction design uses the installed `frontend-design`
 skill as the primary design authority. `docs/产品设计规则.md` remains a product
 experience and business-boundary fact source, not a visual, brand or aesthetic