收口(07-28-travel-reimbursement-guide): 完成腾讯OCR费用告警闭环

.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md

@@ -267,6 +267,84 @@ toNumberString(info?.Total ?? info?.Fare);
 toNumberString(info?.Total) ?? toNumberString(info?.Fare);
 ```
 
+## Scenario: Tencent OCR Cost Safety Gate
+
+### 1. Scope / Trigger
+
+- Trigger: enabling or re-enabling production Tencent OCR, rotating its cloud
+  identity, or changing the product/region used by `RecognizeGeneralInvoice`.
+- Purpose: prove that a working API cannot silently become an unbounded paid
+  integration after its free resource package is exhausted.
+
+### 2. Signatures
+
+- Runtime provider remains `OCR_PROVIDER=tencent` and calls only
+  `ocr:RecognizeGeneralInvoice` in the approved mainland-China region.
+- Tencent Cloud console evidence is limited to three booleans: the matching
+  monthly free package is active, postpaid usage is disabled, and a cost or
+  balance alert is enabled.
+- Provider exhaustion continues to surface as the existing bounded terminal
+  resource-package error; it must not switch provider or billing mode.
+
+### 3. Contracts
+
+- Confirm the free package against the actual cloud account, product edition
+  and region before production enablement. Documentation or an earlier account
+  snapshot is not current evidence.
+- Disable postpaid usage so package exhaustion fails closed. Never enable
+  postpaid merely to make a live probe pass.
+- Enable at least one cost or balance alert as a secondary control. Threshold,
+  recipients, account balance and console screenshots are restricted account
+  data and do not belong in Trellis, repository docs or chat.
+- Console authentication and changes are performed by an authorized account
+  owner. Automation may record only the user's explicit redacted confirmation;
+  it must not retain login QR codes, cookies, tokens or account pages.
+
+### 4. Validation & Error Matrix
+
+- Free package missing, wrong edition or wrong region -> do not enable Tencent
+  OCR; keep real invoice upload gated until the account state is corrected.
+- Postpaid enabled or unknown -> cost gate fails; do not treat API success as
+  production readiness.
+- Alert absent -> OCR may remain technically functional, but task closeout and
+  cost-safety acceptance remain incomplete.
+- Package exhausted -> terminal OCR failure with no automatic paid fallback,
+  provider switch or repeated blind retry.
+
+### 5. Good/Base/Bad Cases
+
+- Good: current account shows the matching free package, postpaid disabled and
+  an enabled alert; the task stores only those redacted state conclusions.
+- Base: provider is temporarily disabled while an account owner fixes one
+  missing cost control.
+- Bad: infer billing safety from a successful sample call, save a console
+  screenshot with account data, or turn on postpaid to avoid an exhaustion
+  error.
+
+### 6. Tests Required
+
+- Before first enablement or a product/region change, obtain authorized manual
+  console confirmation of all three booleans.
+- Adapter tests keep resource-package exhaustion and arrears/charge-state
+  errors terminal and assert no retry or provider fallback.
+- Run sensitive-content scanning after recording the confirmation; no account,
+  threshold, recipient, balance, QR code, cookie or token may appear.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```text
+sample OCR succeeded -> billing is safe -> close the task
+```
+
+#### Correct
+
+```text
+matching free package active + postpaid disabled + alert enabled
+-> record redacted booleans -> allow/continue production Tencent OCR
+```
+
 ## Scenario: Live OCR Sample Stdin Probe
 
 ### 1. Scope / Trigger