归档 Wave4-5 前端体验任务（05-29-frontend-ux-wave4-5-finance-admin-refresh）

2026-05-29 09:38:49 +08:00
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Verify changed pages follow frontend-design plus shared finance/admin surface conventions"}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Verify Trellis flow, approvals and task evidence are complete"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Verify evidence paths and summaries avoid sensitive data and absolute local paths"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Verify admin/finance evidence does not expose secrets, full accounts, payloads or sensitive business content"}
+{"file": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/scope-audit.md", "reason": "Verify implementation matches the agreed Wave4 refresh and Wave5 gap-fill boundary"}
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Wave4-5 frontend design authority, shared finance/admin surface conventions and verification requirements"}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task contract, approval and commit boundaries for non-trivial implementation"}
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "Public deployment and live readiness gates if the frontend changes are released"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Finance/admin pages include payment, export, audit and WeCom-related privacy boundaries"}
+{"file": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/scope-audit.md", "reason": "Task-specific scope audit distinguishing historical Wave4 from current Wave5 gaps"}
@@ -0,0 +1,137 @@
+# Implementation Plan
+
+## Current Decision
+
+This task completes the remaining frontend wave work by combining:
+
+1. Wave4 finance/operations refresh after the newer Wave0-3 baseline.
+2. Wave5 admin/config gap fill for pages that were not fully covered by the historical Wave4 task.
+
+It is not a blank rebuild of finance/admin pages.
+
+## Recommended Implementation Order
+
+1. Baseline audit:
+   - Compare current finance/admin pages against `frontend-design`, Wave0-3 shell/header conventions and historical Wave4 classes.
+   - Identify pages that need code changes versus pages that only need test coverage.
+2. Wave5 gap pages:
+   - `ApprovalRulesPage`
+   - `PeoplePage`
+   - `OrganizationPage`
+   - `WorkspaceSetupPage`
+3. Wave4 refresh pages:
+   - `PaymentBatchesPage`
+   - `ApOperationsPage`
+   - `InvoicePoolPage`
+4. Regression surfaces:
+   - `UserManagementPage`
+   - `MasterDataPage`
+   - `NotificationChannelsPage`
+   - `SystemSettingsPage`
+   - `FeatureFlagsPage`
+   - `WorkflowDefinitionsPage`
+   - `AuditLogsPage`
+5. Test baseline:
+   - Extend or replace the existing focused Wave4 Playwright spec so it covers Wave4 plus Wave5 gaps.
+   - Keep public deployment gated by explicit approval.
+
+## Guardrails
+
+- No backend, schema, permission, payment-state, approval-rule semantic, WeCom or env changes.
+- Do not remove existing business actions.
+- Payment, export, sync, enable/disable and config-publish actions keep original confirmation and permission behavior.
+- Do not add a new design language; reuse existing finance/admin/ops classes.
+- Do not claim user-test readiness until public deployment and public checks pass.
+
+## Local Verification Plan
+
+```bash
+cd client && npm run typecheck
+cd client && npm run build
+cd client && npx playwright test tests/e2e/pc-finance-admin-visual-wave4.spec.ts --workers=1 --reporter=list
+node scripts/qa/check-ui-design-rules.mjs --strict
+python3 ./.trellis/scripts/task.py validate 05-29-frontend-ux-wave4-5-finance-admin-refresh
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Completed Implementation
+
+2026-05-29:
+
+- Refreshed `ApprovalRulesPage` with Wave5 admin summary metrics, a command-oriented creation panel and a cleaner rule-list surface.
+- Refreshed `PeoplePage` to use the shared workspace/header baseline, finance/admin metrics, WeCom HR command surface, filter panel, batch-action panel and focused table container.
+- Refreshed `OrganizationPage` to use the shared management shell, organization summary metrics and admin command panels while keeping hierarchy readability.
+- Refreshed `WorkspaceSetupPage` to use the shared management shell, module visibility metrics, role preset tiles and a focused module table with Chinese visibility labels.
+- Extended `client/tests/e2e/pc-finance-admin-visual-wave4.spec.ts` from historical Wave4 coverage to Wave4-5 coverage.
+- Kept Wave4 finance pages on the existing approved surface; no backend or business-state changes were made.
+
+## Local Verification Result
+
+- `cd client && npm run typecheck` passed.
+- `cd client && npx playwright test tests/e2e/pc-finance-admin-visual-wave4.spec.ts --workers=1 --reporter=list` passed: 3 tests.
+- `cd client && npm run build` passed.
+- `node scripts/qa/check-ui-design-rules.mjs --strict` passed with 0 findings.
+- `python3 ./.trellis/scripts/task.py validate 05-29-frontend-ux-wave4-5-finance-admin-refresh` passed.
+- `node scripts/qa/check-trellis-governance.mjs` passed after task metadata was completed.
+- `git diff --check` passed.
+
+## Spec Update Decision
+
+No `.trellis/spec/` update is needed for this implementation. The task applied existing frontend conventions (`ListWorkspace`, `WorkspaceHeader`, `finance-status-strip`, `admin-command-panel`, `PrimaryTable`) and did not introduce a new reusable frontend contract, API signature, env key, schema, permission rule or deployment behavior.
+
+## Deployment Plan
+
+Only after explicit approval:
+
+```bash
+SYNC_ENV=0 LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash deploy/trialrun/deploy.sh
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh
+OAOPS1_REPORT_DIR=.trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-<date>-wave4-5-public \
+  LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-oa-real-use-daily.sh
+```
+
+## Deployment Result
+
+2026-05-29 user-approved public deployment completed.
+
+- Deployed commit: `bfb1cb6 完成 Wave4-5 财务与管理页刷新（05-29-frontend-ux-wave4-5-finance-admin-refresh）`.
+- Deploy command used `SYNC_ENV=0`, so the remote `.env` was not overwritten.
+- Deploy script passed env contract, remote build, seed/config, seed/trialrun, `/ready`, external dependency smoke, runtime smoke and public bundle copy scan.
+- Remote migrations had no pending migration.
+- Deploy rsync reported a non-fatal warning for an old non-empty artifacts directory; deployment continued and runtime checks passed.
+- Automatic deploy-time live smoke was skipped because the deploy shell did not include the full live smoke variables; manual postdeploy checks below covered it.
+
+## Postdeploy Verification Result
+
+Final passing evidence is stored under:
+
+`research/postdeploy-20260529-wave4-5-public-rerun/`
+
+- `run-live-smoke-readiness.sh`: `PASS`.
+  - `/ready` passed.
+  - Public bundle copy scan passed with 0 findings.
+  - Live smoke Playwright passed: 3 tests.
+  - Live OCR sample passed: 1 test. The sample produced the expected duplicate/same-invoice style OCR outcome for the already-used sample file.
+  - Pending OCR scan skipped because the local command environment did not include `DATABASE_URL`.
+- `run-oa-real-use-daily.sh`: `PASS_OA_REAL_USE_DAILY_READY`, `findingCount=0`.
+  - `public-ready`: PASS.
+  - `live-smoke-env`: PASS.
+  - `live-readiness`: PASS.
+  - `oa-only-smoke-readiness`: PASS.
+  - `live-feature-flags`: PASS.
+  - `authenticated-readonly-probe`: PASS.
+  - `mobile-entry-matrix`: PASS.
+  - `wecom-rendering-matrix`: PASS.
+  - `wecom-entry`: PASS.
+  - `report-privacy-smoke`: PASS.
+
+## Report Privacy Fix
+
+The first OAOPS1 run failed only at `report-privacy-smoke` because the live smoke env report emitted secret-looking env key names as boolean presence fields. It did not expose actual secret values.
+
+`scripts/qa/check-live-smoke-env.mjs` now emits safe readiness labels such as `adminCredentialReady`, `employeeCredentialReady`, `managerCredentialReady` and `financeCredentialReady` instead of raw env key names containing password-like words. The rerun passed privacy smoke.
+
+## Spec Update Expectation
+
+Only update `.trellis/spec/` if implementation introduces a reusable frontend convention beyond the existing finance/admin surfaces. If the task only applies existing conventions, record that no spec update is needed.
@@ -0,0 +1,181 @@
+# 前端体验 Wave4-5 财务与管理页刷新
+
+## Goal
+
+在 Wave0-3 新全局体验基线已完成并部署后，继续完成剩余前端任务：复审 Wave4 财务/运营页，并补齐 Wave5 管理配置页缺口，让财务、管理员和负责人在低频但高风险页面中仍看到统一、克制、可扫描、可操作的 OA 工作界面。
+
+## What I Already Know
+
+- 用户要求“继续完成所有任务”，上下文指向 Wave4 和 Wave5 未完全按新基线收口。
+- 历史任务 `05-27-pc-finance-admin-visual-wave4` 已完成并部署验证过，覆盖付款批次、AP、票据池和部分 C 类管理页。
+- 历史 Wave4 发生在最新 Wave0-3 新基线之前，因此本任务不是从零重做，而是做“新基线后的复审 + 缺口补齐”。
+- Wave5 原计划为 `admin-config`；当前没有独立 Wave5 任务，且一部分管理页已被历史 Wave4 合并覆盖。
+- `frontend-design` skill 是视觉与交互裁决来源；Trellis、隐私、部署和真实业务边界仍按项目 specs 和 docs 执行。
+- 面向用户可测试的页面改动，只有部署和公网检查通过后才能告知用户测试。
+
+## Product Direction
+
+- Tone：quiet finance/admin command surface，克制、紧凑、风险清晰。
+- 财务页优先回答：待处理是什么、异常在哪里、下一步动作是什么、是否会产生付款/导出/审计后果。
+- 管理页优先回答：当前配置状态是什么、改动影响范围是什么、危险动作如何确认和追溯。
+- 不做营销式页面、不新增装饰 hero、不降低高密信息页的扫描效率。
+
+## Scope
+
+### Wave4 Refresh：财务与运营页
+
+复审并必要调整：
+
+- `/payment-batches`
+- `/ap-operations`
+- `/invoice-pool`
+
+目标：
+
+- 对齐 Wave0-3 的 shell、header、command surface、状态摘要和表格/列表密度。
+- 保留现有付款批次、复核、回单、导出、票据上传、票据绑定、OCR/验真、风险提示和错误处理。
+- 不新增真实支付渠道，不改变付款状态机，不写 ERP。
+
+### Wave5 Gap Fill：管理配置页
+
+优先补齐尚未完全纳入新基线或历史 Wave4 覆盖不足的页面：
+
+- `/system/approval-rules`
+- `/people`
+- `/organization`
+- `/system/workspace`
+
+同步复审已覆盖但需要防回退的页面：
+
+- `/system/users`
+- `/system/master-data`
+- `/system/notification-channels`
+- `/system/settings`
+- `/system/feature-flags`
+- `/system/workflow-definitions`
+- `/audit-logs`
+
+目标：
+
+- 管理配置页统一 `ListWorkspace`/`WorkspaceHeader`、状态摘要、命令区、主表格/主列表和危险操作层级。
+- 降低解释性文案，但保留配置影响、权限、审计、不可逆动作和外部集成边界提示。
+- 组织/人员页面避免“普通资料浏览”和“管理配置”风格割裂。
+
+## Requirements
+
+### R1. Wave4 不重复重写
+
+- 历史 Wave4 已通过的财务页只做 gap-driven refresh。
+- 不为了视觉统一改动 API、状态机、权限或付款动作。
+- 若页面已符合新基线，只更新测试覆盖或验收记录，不强行改代码。
+
+### R2. Wave5 管理配置补齐
+
+- 审批规则页面必须突出规则数量、启用状态、匹配顺序、影响范围和“只影响新单据”的边界。
+- 人员/组织/工作区页面必须对齐管理页骨架，减少独立 `card-std` 拼接感。
+- 配置、导出、同步、停用、启用、写入企业微信或影响导航的动作必须保留原确认、权限和错误提示。
+
+### R3. 视觉与交互一致性
+
+- 复用 `finance-status-strip`、`finance-metric-card`、`finance-command-panel`、`admin-command-panel`、`admin-tile-grid`、`ops-table-focus` 等现有共享类。
+- 不新增一套新的页面局部设计系统。
+- 按 `frontend-design` 做实际页面质量判断，避免啰嗦、按钮挤压、说明堆叠和风格漂移。
+
+### R4. 验证与发布
+
+- 本地必须通过 typecheck/build、UI design rules、focused Playwright、Trellis governance 和 `git diff --check`。
+- Focused Playwright 必须覆盖 Wave4 财务页和 Wave5 管理缺口页。
+- 部署给用户测试前必须跑部署脚本、公网 readiness 和 OAOPS1 只读巡检。
+
+## Acceptance Criteria
+
+- [x] Wave4 财务/运营页完成新基线复审；必要改动已实施，未发现回退。
+- [x] Wave5 管理配置缺口页完成统一骨架、状态摘要、命令区和主内容收敛。
+- [x] 历史 Wave4 覆盖页完成防回退视觉/交互检查。
+- [x] 没有改变后端 API、权限模型、付款状态机、审批规则语义、数据库 schema、企业微信配置或公网真实数据。
+- [x] `cd client && npm run typecheck` 通过。
+- [x] `cd client && npm run build` 通过。
+- [x] Focused Playwright 覆盖 Wave4-5 页面并通过。
+- [x] `node scripts/qa/check-ui-design-rules.mjs --strict` 通过。
+- [x] `python3 ./.trellis/scripts/task.py validate 05-29-frontend-ux-wave4-5-finance-admin-refresh` 通过。
+- [x] `node scripts/qa/check-trellis-governance.mjs` 和 `git diff --check` 通过。
+- [x] 若部署给用户测试，已完成公网部署与公网检查并记录证据。
+
+## Implementation Result
+
+2026-05-29 本地实施完成：
+
+- Wave5 缺口页完成新基线补齐：
+  - `/system/approval-rules` 新增规则状态摘要、创建命令区和规则列表命令区，突出启用数、优先级和“只影响新单据”边界。
+  - `/people` 迁移到 `ListWorkspace`/`WorkspaceHeader`，新增人员状态摘要、企微 HR 主数据命令区、筛选命令区、批量动作区和 `PrimaryTable`。
+  - `/organization` 迁移到统一管理骨架，新增组织摘要、部门命令面板和统一组织节点卡片。
+  - `/system/workspace` 迁移到统一管理骨架，新增模块显隐摘要、工作区基线面板、角色预设卡片和模块显隐主表。
+- Wave4 财务/运营页未重写业务结构，继续复用历史已通过的财务 surface，并通过 focused Playwright 防回退。
+- Focused Playwright 扩展到 Wave4-5 页面：付款批次、AP、票据池、审批规则、人员、组织、工作区、用户、主数据、通知渠道、系统设置、功能开关、流程定义、审计日志。
+- 本轮没有改后端、数据库、权限、审批规则语义、付款状态机、企业微信配置、SMTP 或生产配置。
+
+2026-05-29 公网部署与只读巡检完成：
+
+- 部署代码：`bfb1cb6 完成 Wave4-5 财务与管理页刷新（05-29-frontend-ux-wave4-5-finance-admin-refresh）`。
+- 部署方式：`SYNC_ENV=0 LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash deploy/trialrun/deploy.sh`，未同步覆盖远端 `.env`。
+- 部署脚本完成 `/ready`、外部依赖 smoke、runtime smoke、公网 bundle 文案扫描；远端迁移无待执行项。
+- 首次 OAOPS1 发现报告隐私巡检误报，原因是环境检查报告输出了含凭据含义的原始 env key 名作为“字段名存在=true”标签，不含真实密钥或密码。
+- 已将 `scripts/qa/check-live-smoke-env.mjs` 的报告输出改为业务安全标签，如 `adminCredentialReady`、`employeeCredentialReady`，不再把敏感 env key 名写入证据报告。
+- 复跑公网 readiness：`PASS`；`/ready`、公网 bundle 文案扫描、live smoke 3 项、真实 OCR 样本复核通过；pending OCR 因本地命令未带 `DATABASE_URL` 按设计跳过。
+- 复跑 OAOPS1：`PASS_OA_REAL_USE_DAILY_READY`，`findingCount=0`；public-ready、live-smoke-env、live-readiness、oa-only-smoke-readiness、feature flags、authenticated readonly probe、mobile entry、WeCom rendering、WeCom entry、report privacy smoke 全部通过。
+- 证据目录：`research/postdeploy-20260529-wave4-5-public-rerun/`。
+
+## Test Plan
+
+```bash
+cd client && npm run typecheck
+cd client && npm run build
+cd client && npx playwright test tests/e2e/pc-finance-admin-visual-wave4.spec.ts --workers=1 --reporter=list
+node scripts/qa/check-ui-design-rules.mjs --strict
+python3 ./.trellis/scripts/task.py validate 05-29-frontend-ux-wave4-5-finance-admin-refresh
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+Deployment gate, only after approval:
+
+```bash
+SYNC_ENV=0 LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash deploy/trialrun/deploy.sh
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh
+OAOPS1_REPORT_DIR=.trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-<date>-wave4-5-public \
+  LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-oa-real-use-daily.sh
+```
+
+## Out Of Scope
+
+- 不新增真实付款渠道、ERP 写入、企业微信写入、数据库迁移或生产配置变更。
+- 不新增通用文件中心。
+- 不恢复差旅主线能力。
+- 不把移动端改造成完整 PC 管理后台。
+- 不删除已有业务能力；如发现业务流程缺陷，记录为后续业务流程任务。
+
+## Research References
+
+- `research/scope-audit.md` — Wave4 历史覆盖、Wave5 缺口和本任务页面清单。
+- `.trellis/tasks/archive/2026-05/05-27-pc-finance-admin-visual-wave4/` — 历史 Wave4 范围、实现和部署证据。
+- `.trellis/tasks/archive/2026-05/05-28-frontend-ux-redesign/` — Wave0-2 新基线和 Wave3-5 后续计划。
+- `.trellis/tasks/archive/2026-05/05-28-frontend-ux-wave3-business-mobile/` — 最新 Wave3 refresh 和部署证据。
+
+## Technical Notes
+
+- 重点代码区域：
+  - `client/src/pages/PaymentBatchesPage.tsx`
+  - `client/src/pages/ApOperationsPage.tsx`
+  - `client/src/pages/InvoicePoolPage.tsx`
+  - `client/src/pages/ApprovalRulesPage.tsx`
+  - `client/src/pages/PeoplePage.tsx`
+  - `client/src/pages/OrganizationPage.tsx`
+  - `client/src/pages/WorkspaceSetupPage.tsx`
+  - `client/src/pages/UserManagementPage.tsx`
+  - `client/src/pages/MasterDataPage.tsx`
+  - `client/src/pages/NotificationChannelsPage.tsx`
+  - `client/src/pages/SystemSettingsPage.tsx`
+  - `client/src/pages/FeatureFlagsPage.tsx`
+  - `client/src/pages/WorkflowDefinitionsPage.tsx`
+  - `client/src/pages/AuditLogsPage.tsx`
+  - `client/tests/e2e/pc-finance-admin-visual-wave4.spec.ts`
@@ -0,0 +1,46 @@
+{
+  "checkedAt": "2026-05-29T01:27:15.005Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": true,
+  "liveSmoke": {
+    "adminCredentialReady": true,
+    "employeeCredentialReady": true
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": true,
+    "managerCredentialReady": true,
+    "financeCredentialReady": true
+  },
+  "liveOcrReady": true,
+  "liveOcr": {
+    "userReady": true,
+    "invoiceSampleReady": true,
+    "invoiceFileProvided": true,
+    "invoiceFileReady": true,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": true
+  },
+  "missing": [],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}
@@ -0,0 +1,7 @@
+
+Running 1 test using 1 worker
+
+[live-ocr] {"alias":"SAMPLE-PDF-001","status":"ocr_failed","durationMs":922,"transport":"ui","timings":{"uploadMs":922,"terminalWaitMs":0},"reasonCategory":"duplicate_or_same_invoice","fieldHits":{"invoiceId":false,"invoiceCodeOrNumber":false,"sellerName":false,"totalAmount":false,"invoiceDate":false}}
+  ✓  1 tests/e2e/manual/live-invoice-ocr.spec.ts:8:1 › 手工 live 腾讯 OCR 辅助复核：真实 VAT 发票上传后进入可处理状态 (6.8s)
+
+  1 passed (11.0s)
@@ -0,0 +1,14 @@
+>>> 探活 live /ready: https://oa.hyinda.com/ready
+>>> 执行 live smoke Playwright
+
+> [email protected] test:e2e:live
+> playwright test tests/e2e/live-smoke.spec.ts
+
+
+Running 3 tests using 1 worker
+
+  ✓  1 tests/e2e/live-smoke.spec.ts:43:3 › live smoke › 公网基础探活与企微配置状态 (2.9s)
+  ✓  2 tests/e2e/live-smoke.spec.ts:64:3 › live smoke › 管理员只读网页 smoke (11.7s)
+  ✓  3 tests/e2e/live-smoke.spec.ts:106:3 › live smoke › 员工只读网页 smoke (10.8s)
+
+  3 passed (29.4s)
@@ -0,0 +1 @@
+[pending-ocr][SKIP] missing DATABASE_URL
@@ -0,0 +1 @@
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0
@@ -0,0 +1,12 @@
+{
+  "issueId": null,
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "bfb1cb6",
+  "checkedAt": "2026-05-29T01:28:07.869Z",
+  "status": "PASS",
+  "mode": "live-smoke-readiness",
+  "reportDir": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/live-smoke-readiness",
+  "reportRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/live-smoke-readiness",
+  "groups": null,
+  "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。"
+}
@@ -0,0 +1,129 @@
+{
+  "mode": "oaops1-authenticated-readonly-probe",
+  "status": "PASS",
+  "baseUrl": "https://oa.hyinda.com",
+  "checkedAt": "2026-05-29T01:31:32.486Z",
+  "readOnly": true,
+  "duplicateRoleChecks": "employee/finance/payment/AP are covered by oa-only-smoke-readiness to avoid repeated login throttling",
+  "roles": {
+    "admin": {
+      "status": "PASS",
+      "reason": null,
+      "maskedIdentifier": "sm***om"
+    }
+  },
+  "checks": [
+    {
+      "id": "portal",
+      "role": "admin",
+      "path": "/api/portal/home",
+      "domain": "portal",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {}
+    },
+    {
+      "id": "workflow-tasks",
+      "role": "admin",
+      "path": "/api/workflow/tasks?page=1&pageSize=5",
+      "domain": "approval",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 0,
+        "total": 0
+      }
+    },
+    {
+      "id": "reimbursements",
+      "role": "admin",
+      "path": "/api/reimbursements?page=1&pageSize=5",
+      "domain": "reimbursement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 33
+      }
+    },
+    {
+      "id": "reimbursement-summary",
+      "role": "admin",
+      "path": "/api/reimbursements/stats/summary",
+      "domain": "reimbursement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "totalCount": 33,
+        "avgProcessingDays": 0
+      }
+    },
+    {
+      "id": "invoice-pool",
+      "role": "admin",
+      "path": "/api/invoice-pool?page=1&pageSize=5",
+      "domain": "invoice_ocr",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 46
+      }
+    },
+    {
+      "id": "purchase-requests",
+      "role": "admin",
+      "path": "/api/purchase-requests?page=1&pageSize=5",
+      "domain": "procurement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 0,
+        "total": 0
+      }
+    },
+    {
+      "id": "contracts-registry",
+      "role": "admin",
+      "path": "/api/contracts-registry",
+      "domain": "contracts",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 6,
+        "total": null
+      }
+    },
+    {
+      "id": "projects",
+      "role": "admin",
+      "path": "/api/projects?page=1&pageSize=5",
+      "domain": "projects",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 4,
+        "total": null
+      }
+    },
+    {
+      "id": "audit-logs",
+      "role": "admin",
+      "path": "/api/audit-logs?page=1&pageSize=5",
+      "domain": "audit",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 2235
+      }
+    }
+  ],
+  "boundaries": {
+    "noBusinessWrites": true,
+    "noExportsByDefault": true,
+    "noFileUploads": true,
+    "noWeComWrites": true,
+    "noRealPaymentExecution": true
+  }
+}
@@ -0,0 +1,129 @@
+{
+  "mode": "oaops1-authenticated-readonly-probe",
+  "status": "PASS",
+  "baseUrl": "https://oa.hyinda.com",
+  "checkedAt": "2026-05-29T01:31:32.486Z",
+  "readOnly": true,
+  "duplicateRoleChecks": "employee/finance/payment/AP are covered by oa-only-smoke-readiness to avoid repeated login throttling",
+  "roles": {
+    "admin": {
+      "status": "PASS",
+      "reason": null,
+      "maskedIdentifier": "sm***om"
+    }
+  },
+  "checks": [
+    {
+      "id": "portal",
+      "role": "admin",
+      "path": "/api/portal/home",
+      "domain": "portal",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {}
+    },
+    {
+      "id": "workflow-tasks",
+      "role": "admin",
+      "path": "/api/workflow/tasks?page=1&pageSize=5",
+      "domain": "approval",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 0,
+        "total": 0
+      }
+    },
+    {
+      "id": "reimbursements",
+      "role": "admin",
+      "path": "/api/reimbursements?page=1&pageSize=5",
+      "domain": "reimbursement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 33
+      }
+    },
+    {
+      "id": "reimbursement-summary",
+      "role": "admin",
+      "path": "/api/reimbursements/stats/summary",
+      "domain": "reimbursement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "totalCount": 33,
+        "avgProcessingDays": 0
+      }
+    },
+    {
+      "id": "invoice-pool",
+      "role": "admin",
+      "path": "/api/invoice-pool?page=1&pageSize=5",
+      "domain": "invoice_ocr",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 46
+      }
+    },
+    {
+      "id": "purchase-requests",
+      "role": "admin",
+      "path": "/api/purchase-requests?page=1&pageSize=5",
+      "domain": "procurement",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 0,
+        "total": 0
+      }
+    },
+    {
+      "id": "contracts-registry",
+      "role": "admin",
+      "path": "/api/contracts-registry",
+      "domain": "contracts",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 6,
+        "total": null
+      }
+    },
+    {
+      "id": "projects",
+      "role": "admin",
+      "path": "/api/projects?page=1&pageSize=5",
+      "domain": "projects",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 4,
+        "total": null
+      }
+    },
+    {
+      "id": "audit-logs",
+      "role": "admin",
+      "path": "/api/audit-logs?page=1&pageSize=5",
+      "domain": "audit",
+      "status": "PASS",
+      "httpStatus": 200,
+      "summary": {
+        "itemCount": 5,
+        "total": 2235
+      }
+    }
+  ],
+  "boundaries": {
+    "noBusinessWrites": true,
+    "noExportsByDefault": true,
+    "noFileUploads": true,
+    "noWeComWrites": true,
+    "noRealPaymentExecution": true
+  }
+}
@@ -0,0 +1,9 @@
+{
+  "name": "authenticated-readonly-probe",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/authenticated-readonly-probe.log",
+  "checkedAt": "2026-05-29T01:31:32.564Z"
+}
@@ -0,0 +1,64 @@
+{
+  "checkedAt": "2026-05-29T01:30:25.816Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "status": "PASS",
+  "readOnly": true,
+  "results": [
+    {
+      "flagKey": "payment_batch_v1",
+      "expectedState": "force_on",
+      "status": "PASS",
+      "item": {
+        "flagKey": "payment_batch_v1",
+        "overrideMode": "force_on",
+        "rolloutType": "global",
+        "version": 17,
+        "envEnabled": true,
+        "effectiveEnabled": true,
+        "effectiveReason": "flag_force_on_global"
+      }
+    },
+    {
+      "flagKey": "erp_sync",
+      "expectedState": "force_off",
+      "status": "PASS",
+      "item": {
+        "flagKey": "erp_sync",
+        "overrideMode": "force_off",
+        "rolloutType": "global",
+        "version": 2,
+        "envEnabled": true,
+        "effectiveEnabled": false,
+        "effectiveReason": "flag_force_off"
+      }
+    },
+    {
+      "flagKey": "attendance_v1",
+      "expectedState": "disabled",
+      "status": "PASS",
+      "item": {
+        "flagKey": "attendance_v1",
+        "overrideMode": "force_on",
+        "rolloutType": "global",
+        "version": 86,
+        "envEnabled": false,
+        "effectiveEnabled": false,
+        "effectiveReason": "env_hard_off"
+      }
+    },
+    {
+      "flagKey": "attendance_unified_v1",
+      "expectedState": "enabled",
+      "status": "PASS",
+      "item": {
+        "flagKey": "attendance_unified_v1",
+        "overrideMode": "force_on",
+        "rolloutType": "global",
+        "version": 84,
+        "envEnabled": true,
+        "effectiveEnabled": true,
+        "effectiveReason": "flag_force_on_global"
+      }
+    }
+  ]
+}
@@ -0,0 +1,9 @@
+{
+  "name": "live-feature-flags",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-feature-flags.log",
+  "checkedAt": "2026-05-29T01:30:25.887Z"
+}
@@ -0,0 +1,45 @@
+>>> [live-readiness] 环境与公网入口检查
+[live-smoke-env] base=https://oa.hyinda.com
+[live-smoke-env] publicReady=true status=200
+[live-smoke-env] wecom=ready entry=true oauth=true
+[live-smoke-env] authCapabilities=true emailDelivery=true
+[live-smoke-env] liveSmokeReady=true
+[live-smoke-env] liveOcrReady=true
+>>> [live-readiness] /ready: https://oa.hyinda.com
+>>> [live-readiness] 公网资源文案扫描
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0
+>>> [live-readiness] pending OCR 扫描
+[pending-ocr][SKIP] missing DATABASE_URL
+>>> [live-readiness] 执行公网 live smoke
+>>> 探活 live /ready: https://oa.hyinda.com/ready
+>>> 执行 live smoke Playwright
+
+> [email protected] test:e2e:live
+> playwright test tests/e2e/live-smoke.spec.ts
+
+
+Running 3 tests using 1 worker
+
+(node:81586) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+(node:81586) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓  1 tests/e2e/live-smoke.spec.ts:43:3 › live smoke › 公网基础探活与企微配置状态 (2.6s)
+  ✓  2 tests/e2e/live-smoke.spec.ts:64:3 › live smoke › 管理员只读网页 smoke (11.7s)
+  ✓  3 tests/e2e/live-smoke.spec.ts:106:3 › live smoke › 员工只读网页 smoke (10.4s)
+
+  3 passed (28.3s)
+>>> [live-readiness] 执行真实 OCR 样本复核
+
+Running 1 test using 1 worker
+
+(node:82388) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+(node:82388) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+[live-ocr] {"alias":"SAMPLE-PDF-001","status":"ocr_failed","durationMs":657,"transport":"ui","timings":{"uploadMs":658,"terminalWaitMs":0},"reasonCategory":"duplicate_or_same_invoice","fieldHits":{"invoiceId":false,"invoiceCodeOrNumber":false,"sellerName":false,"totalAmount":false,"invoiceDate":false}}
+  ✓  1 tests/e2e/manual/live-invoice-ocr.spec.ts:8:1 › 手工 live 腾讯 OCR 辅助复核：真实 VAT 发票上传后进入可处理状态 (6.6s)
+
+  1 passed (10.2s)
+[live-readiness][PASS] readiness 检查完成
+[live-readiness] report=.trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-readiness
@@ -0,0 +1,9 @@
+{
+  "name": "live-readiness",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-readiness.log",
+  "checkedAt": "2026-05-29T01:29:14.867Z"
+}
@@ -0,0 +1,46 @@
+{
+  "checkedAt": "2026-05-29T01:28:22.362Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": true,
+  "liveSmoke": {
+    "adminCredentialReady": true,
+    "employeeCredentialReady": true
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": true,
+    "managerCredentialReady": true,
+    "financeCredentialReady": true
+  },
+  "liveOcrReady": true,
+  "liveOcr": {
+    "userReady": true,
+    "invoiceSampleReady": true,
+    "invoiceFileProvided": true,
+    "invoiceFileReady": true,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": true
+  },
+  "missing": [],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}
@@ -0,0 +1,9 @@
+{
+  "name": "live-smoke-env",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-env.log",
+  "checkedAt": "2026-05-29T01:28:22.439Z"
+}
@@ -0,0 +1,46 @@
+{
+  "checkedAt": "2026-05-29T01:28:22.930Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": true,
+  "liveSmoke": {
+    "adminCredentialReady": true,
+    "employeeCredentialReady": true
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": true,
+    "managerCredentialReady": true,
+    "financeCredentialReady": true
+  },
+  "liveOcrReady": true,
+  "liveOcr": {
+    "userReady": true,
+    "invoiceSampleReady": true,
+    "invoiceFileProvided": true,
+    "invoiceFileReady": true,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": true
+  },
+  "missing": [],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}
@@ -0,0 +1,7 @@
+
+Running 1 test using 1 worker
+
+[live-ocr] {"alias":"SAMPLE-PDF-001","status":"ocr_failed","durationMs":657,"transport":"ui","timings":{"uploadMs":658,"terminalWaitMs":0},"reasonCategory":"duplicate_or_same_invoice","fieldHits":{"invoiceId":false,"invoiceCodeOrNumber":false,"sellerName":false,"totalAmount":false,"invoiceDate":false}}
+  ✓  1 tests/e2e/manual/live-invoice-ocr.spec.ts:8:1 › 手工 live 腾讯 OCR 辅助复核：真实 VAT 发票上传后进入可处理状态 (6.6s)
+
+  1 passed (10.2s)
@@ -0,0 +1,14 @@
+>>> 探活 live /ready: https://oa.hyinda.com/ready
+>>> 执行 live smoke Playwright
+
+> [email protected] test:e2e:live
+> playwright test tests/e2e/live-smoke.spec.ts
+
+
+Running 3 tests using 1 worker
+
+  ✓  1 tests/e2e/live-smoke.spec.ts:43:3 › live smoke › 公网基础探活与企微配置状态 (2.6s)
+  ✓  2 tests/e2e/live-smoke.spec.ts:64:3 › live smoke › 管理员只读网页 smoke (11.7s)
+  ✓  3 tests/e2e/live-smoke.spec.ts:106:3 › live smoke › 员工只读网页 smoke (10.4s)
+
+  3 passed (28.3s)
@@ -0,0 +1 @@
+[pending-ocr][SKIP] missing DATABASE_URL
@@ -0,0 +1 @@
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0
@@ -0,0 +1,12 @@
+{
+  "issueId": "OAOPS1",
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "bfb1cb6",
+  "checkedAt": "2026-05-29T01:29:14.797Z",
+  "status": "PASS",
+  "mode": "live-smoke-readiness",
+  "reportDir": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-readiness",
+  "reportRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-readiness",
+  "groups": null,
+  "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。"
+}
@@ -0,0 +1,20 @@
+# OAOPS1 每日人工收口清单
+
+## 员工
+- 真实报销：上传 PDF 发票，补充必要附件，提交 OA 审批。
+- 采购/费用：在 OA 创建申请，关联项目；如涉及合同，关联或补录合同台账。
+- 合同：只录入合同摘要、编号、负责人、项目、金额、线下归档位置；涉密合同正文、敏感报价和成本细节不上传公网 OA。
+
+## 审批人
+- 从 OA 待办进入详情，确认报销、采购、合同或项目上下文后再审批。
+- 退回时写清需要补充的材料，避免线下口头说明替代系统记录。
+
+## 出纳/财务
+- 审批通过后创建付款批次，线下银行渠道付款。
+- 上传银行回单附件后再在 OA 标记已付款。
+- 每日抽查 AP 台账、报销导出、票据状态和付款批次状态。
+
+## 管理员
+- 查看本报告 summary.json 和人工问题登记。
+- 阻断项当天建修复 Issue CSV 或暂停对应流程；非阻断体验问题进入反馈池。
+- 确认 payment_batch_v1=force_on，erp_sync=force_off；图片 OCR、预算、ERP、银行流水导入、真实支付直连继续冻结。
@@ -0,0 +1,10 @@
+
+Running 1 test using 1 worker
+
+(node:86699) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+(node:86699) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓  1 tests/e2e/r124-mobile-entry-matrix.spec.ts:486:3 › R124 企业微信移动入口矩阵 › 底部入口、我的二级入口、PDF 上传和草稿删除不回退到 PC 体验 (14.1s)
+
+  1 passed (17.8s)
@@ -0,0 +1,9 @@
+{
+  "name": "mobile-entry-matrix",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/mobile-entry-matrix.log",
+  "checkedAt": "2026-05-29T01:31:56.368Z"
+}
@@ -0,0 +1,392 @@
+{
+  "issueId": "OSMOKE1",
+  "mode": "oa-only-smoke-readiness",
+  "status": "PASS_OA_ONLY_SMOKE_READY",
+  "conclusion": "PASS_OA_ONLY_SMOKE_READY",
+  "baseUrl": "https://oa.hyinda.com",
+  "checkedAt": "2026-05-29T01:29:19.810Z",
+  "businessReadOnly": true,
+  "readOnlyNote": "performs login/readiness probes only; no business data writes and no WeCom writes",
+  "privacy": "role/masked identifier/status/counts only; no password/token/secret/full email/full phone",
+  "targets": [
+    {
+      "key": "admin",
+      "expectedRoles": [
+        "admin",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "admin",
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "assets",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 7,
+            "total": null
+          }
+        },
+        {
+          "id": "users",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 13
+          }
+        }
+      ],
+      "actualRoles": [
+        "admin",
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "employee",
+      "expectedRoles": [
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "my-assets",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 0,
+            "total": null
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "manager",
+      "expectedRoles": [
+        "manager",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "manager"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "workflow",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 1
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "manager"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "ceo",
+      "expectedRoles": [
+        "ceo",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "ceo",
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "dashboard",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "totalCount": 33,
+            "paidCount": 8,
+            "reviewingCount": 3
+          }
+        }
+      ],
+      "actualRoles": [
+        "ceo",
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "finance",
+      "expectedRoles": [
+        "finance",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "finance"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "payment-batches",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 9,
+            "total": null
+          }
+        },
+        {
+          "id": "ap-ledger",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 33
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "finance"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "finance_mgr",
+      "expectedRoles": [
+        "finance",
+        "finance_mgr",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "finance",
+              "finance_mgr"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "payment-batches",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 9,
+            "total": null
+          }
+        },
+        {
+          "id": "ap-ledger",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 33
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "finance",
+        "finance_mgr"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "hr",
+      "expectedRoles": [
+        "hr",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "hr"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "wecom-archive",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 9
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "hr"
+      ],
+      "missingRoles": []
+    }
+  ],
+  "findings": [],
+  "boundaries": {
+    "noBusinessWrites": true,
+    "noWeComWrites": true,
+    "noPasswordOutput": true,
+    "noRealEmployeeIdentifiers": true
+  }
+}
+[oa-only-smoke-readiness] report=.trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/oa-only-smoke-readiness/summary.json
@@ -0,0 +1,9 @@
+{
+  "name": "oa-only-smoke-readiness",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/oa-only-smoke-readiness.log",
+  "checkedAt": "2026-05-29T01:29:19.941Z"
+}
@@ -0,0 +1,391 @@
+{
+  "issueId": "OSMOKE1",
+  "mode": "oa-only-smoke-readiness",
+  "status": "PASS_OA_ONLY_SMOKE_READY",
+  "conclusion": "PASS_OA_ONLY_SMOKE_READY",
+  "baseUrl": "https://oa.hyinda.com",
+  "checkedAt": "2026-05-29T01:29:19.810Z",
+  "businessReadOnly": true,
+  "readOnlyNote": "performs login/readiness probes only; no business data writes and no WeCom writes",
+  "privacy": "role/masked identifier/status/counts only; no password/token/secret/full email/full phone",
+  "targets": [
+    {
+      "key": "admin",
+      "expectedRoles": [
+        "admin",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "admin",
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "assets",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 7,
+            "total": null
+          }
+        },
+        {
+          "id": "users",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 13
+          }
+        }
+      ],
+      "actualRoles": [
+        "admin",
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "employee",
+      "expectedRoles": [
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "my-assets",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 0,
+            "total": null
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "manager",
+      "expectedRoles": [
+        "manager",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "manager"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "workflow",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 1
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "manager"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "ceo",
+      "expectedRoles": [
+        "ceo",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "ceo",
+              "employee"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "dashboard",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "totalCount": 33,
+            "paidCount": 8,
+            "reviewingCount": 3
+          }
+        }
+      ],
+      "actualRoles": [
+        "ceo",
+        "employee"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "finance",
+      "expectedRoles": [
+        "finance",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "finance"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "payment-batches",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 9,
+            "total": null
+          }
+        },
+        {
+          "id": "ap-ledger",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 33
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "finance"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "finance_mgr",
+      "expectedRoles": [
+        "finance",
+        "finance_mgr",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "finance",
+              "finance_mgr"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "payment-batches",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 9,
+            "total": null
+          }
+        },
+        {
+          "id": "ap-ledger",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 33
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "finance",
+        "finance_mgr"
+      ],
+      "missingRoles": []
+    },
+    {
+      "key": "hr",
+      "expectedRoles": [
+        "hr",
+        "employee"
+      ],
+      "maskedIdentifier": "sm***@***.com",
+      "login": {
+        "status": "PASS",
+        "reason": null,
+        "code": null
+      },
+      "roleMatch": "PASS",
+      "probes": [
+        {
+          "id": "me",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "status": "active",
+            "notificationPushEnabled": true,
+            "roleCodes": [
+              "employee",
+              "hr"
+            ]
+          }
+        },
+        {
+          "id": "portal",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {}
+        },
+        {
+          "id": "wecom-archive",
+          "status": "PASS",
+          "httpStatus": 200,
+          "summary": {
+            "itemCount": 1,
+            "total": 9
+          }
+        }
+      ],
+      "actualRoles": [
+        "employee",
+        "hr"
+      ],
+      "missingRoles": []
+    }
+  ],
+  "findings": [],
+  "boundaries": {
+    "noBusinessWrites": true,
+    "noWeComWrites": true,
+    "noPasswordOutput": true,
+    "noRealEmployeeIdentifiers": true
+  }
+}
@@ -0,0 +1 @@
+{"requestId":"983ef37c-e6ec-4907-af6e-d31449e08e29","data":{"ok":true}}
@@ -0,0 +1,9 @@
+{
+  "name": "public-ready",
+  "status": "PASS",
+  "kind": "required",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/public-ready.log",
+  "checkedAt": "2026-05-29T01:28:21.869Z"
+}
@@ -0,0 +1,9 @@
+{
+  "name": "report-privacy-smoke",
+  "status": "PASS",
+  "kind": "required",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/report-privacy-smoke.log",
+  "checkedAt": "2026-05-29T01:33:22.341Z"
+}
@@ -0,0 +1,294 @@
+{
+  "issueId": "OAOPS1",
+  "mode": "oa-real-use-daily",
+  "status": "PASS_OA_REAL_USE_DAILY_READY",
+  "conclusion": "PASS_OA_REAL_USE_DAILY_READY",
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "bfb1cb6",
+  "checkedAt": "2026-05-29T01:33:22.264Z",
+  "reportRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily",
+  "window": {
+    "durationDays": 7,
+    "scope": "small-team-all-employees",
+    "realBusinessDataAllowed": true,
+    "fixPolicy": "blocking_same_day_issue_contract_nonblocking_feedback_pool"
+  },
+  "oaPrimaryDomains": [
+    "reimbursement_pdf_ocr",
+    "approval_tasks",
+    "procurement_expense",
+    "contracts_registry",
+    "projects",
+    "payment_batches",
+    "bank_receipt_attachments",
+    "ap_accounting_handoff",
+    "mobile_wecom_entry",
+    "audit"
+  ],
+  "frozenItems": [
+    "image_ocr",
+    "complex_bpm",
+    "budget_control",
+    "erp_write",
+    "bank_statement_import",
+    "real_payment_provider",
+    "wecom_hr_deep_mirror",
+    "emergency_takeover",
+    "recovery_writeback",
+    "ruleops"
+  ],
+  "boundaries": {
+    "defaultReadOnlyAutomation": true,
+    "manualRealBusinessWritesOnly": true,
+    "paymentBatchExpected": "force_on",
+    "erpExpected": "force_off",
+    "actualPaymentChannel": "offline_bank_channel",
+    "contractSensitiveFiles": "do_not_upload_confidential_body_sensitive_quote_cost_detail_to_public_oa"
+  },
+  "childReports": {
+    "liveReadiness": {
+      "status": "PASS",
+      "reportRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-readiness/summary.json",
+      "findingCount": 0,
+      "openCount": 0
+    },
+    "oaOnlySmokeReadiness": {
+      "status": "PASS_OA_ONLY_SMOKE_READY",
+      "reportRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/oa-only-smoke-readiness/summary.json",
+      "findingCount": 0,
+      "openCount": 0
+    }
+  },
+  "steps": {
+    "public-ready": {
+      "name": "public-ready",
+      "status": "PASS",
+      "kind": "required",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/public-ready.log",
+      "checkedAt": "2026-05-29T01:28:21.869Z"
+    },
+    "live-smoke-env": {
+      "name": "live-smoke-env",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-smoke-env.log",
+      "checkedAt": "2026-05-29T01:28:22.439Z"
+    },
+    "live-readiness": {
+      "name": "live-readiness",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-readiness.log",
+      "checkedAt": "2026-05-29T01:29:14.867Z"
+    },
+    "oa-only-smoke-readiness": {
+      "name": "oa-only-smoke-readiness",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/oa-only-smoke-readiness.log",
+      "checkedAt": "2026-05-29T01:29:19.941Z"
+    },
+    "live-feature-flags": {
+      "name": "live-feature-flags",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/live-feature-flags.log",
+      "checkedAt": "2026-05-29T01:30:25.887Z"
+    },
+    "authenticated-readonly-probe": {
+      "name": "authenticated-readonly-probe",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/authenticated-readonly-probe.log",
+      "checkedAt": "2026-05-29T01:31:32.564Z"
+    },
+    "mobile-entry-matrix": {
+      "name": "mobile-entry-matrix",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/mobile-entry-matrix.log",
+      "checkedAt": "2026-05-29T01:31:56.368Z"
+    },
+    "wecom-rendering-matrix": {
+      "name": "wecom-rendering-matrix",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/wecom-rendering-matrix.log",
+      "checkedAt": "2026-05-29T01:33:07.280Z"
+    },
+    "wecom-entry": {
+      "name": "wecom-entry",
+      "status": "PASS",
+      "kind": "finding_allowed",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/wecom-entry.log",
+      "checkedAt": "2026-05-29T01:33:22.015Z"
+    },
+    "report-privacy-smoke": {
+      "name": "report-privacy-smoke",
+      "status": "PASS",
+      "kind": "required",
+      "code": 0,
+      "detail": "ok",
+      "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/report-privacy-smoke.log",
+      "checkedAt": "2026-05-29T01:33:22.191Z"
+    }
+  },
+  "readonlyProbe": {
+    "mode": "oaops1-authenticated-readonly-probe",
+    "status": "PASS",
+    "baseUrl": "https://oa.hyinda.com",
+    "checkedAt": "2026-05-29T01:31:32.486Z",
+    "readOnly": true,
+    "duplicateRoleChecks": "employee/finance/payment/AP are covered by oa-only-smoke-readiness to avoid repeated login throttling",
+    "roles": {
+      "admin": {
+        "status": "PASS",
+        "reason": null,
+        "maskedIdentifier": "sm***om"
+      }
+    },
+    "checks": [
+      {
+        "id": "portal",
+        "role": "admin",
+        "path": "/api/portal/home",
+        "domain": "portal",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {}
+      },
+      {
+        "id": "workflow-tasks",
+        "role": "admin",
+        "path": "/api/workflow/tasks?page=1&pageSize=5",
+        "domain": "approval",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 0,
+          "total": 0
+        }
+      },
+      {
+        "id": "reimbursements",
+        "role": "admin",
+        "path": "/api/reimbursements?page=1&pageSize=5",
+        "domain": "reimbursement",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 5,
+          "total": 33
+        }
+      },
+      {
+        "id": "reimbursement-summary",
+        "role": "admin",
+        "path": "/api/reimbursements/stats/summary",
+        "domain": "reimbursement",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "totalCount": 33,
+          "avgProcessingDays": 0
+        }
+      },
+      {
+        "id": "invoice-pool",
+        "role": "admin",
+        "path": "/api/invoice-pool?page=1&pageSize=5",
+        "domain": "invoice_ocr",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 5,
+          "total": 46
+        }
+      },
+      {
+        "id": "purchase-requests",
+        "role": "admin",
+        "path": "/api/purchase-requests?page=1&pageSize=5",
+        "domain": "procurement",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 0,
+          "total": 0
+        }
+      },
+      {
+        "id": "contracts-registry",
+        "role": "admin",
+        "path": "/api/contracts-registry",
+        "domain": "contracts",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 6,
+          "total": null
+        }
+      },
+      {
+        "id": "projects",
+        "role": "admin",
+        "path": "/api/projects?page=1&pageSize=5",
+        "domain": "projects",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 4,
+          "total": null
+        }
+      },
+      {
+        "id": "audit-logs",
+        "role": "admin",
+        "path": "/api/audit-logs?page=1&pageSize=5",
+        "domain": "audit",
+        "status": "PASS",
+        "httpStatus": 200,
+        "summary": {
+          "itemCount": 5,
+          "total": 2235
+        }
+      }
+    ],
+    "boundaries": {
+      "noBusinessWrites": true,
+      "noExportsByDefault": true,
+      "noFileUploads": true,
+      "noWeComWrites": true,
+      "noRealPaymentExecution": true
+    }
+  },
+  "findingCount": 0,
+  "findings": [],
+  "manualGates": {
+    "dailyCloseout": "管理员每日查看 summary.json 和 manual-gates.md，阻断即修，非阻断入反馈池。",
+    "day7Closeout": [
+      "A：接受 PASS_OA_REAL_USE_READY，进入下一轮体验/效率优化。",
+      "B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
+      "C：暂停真实使用扩展，先做整改。"
+    ]
+  },
+  "privacy": "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full external ids/full invoice image/full bank receipt/full contract body/raw payload"
+}
@@ -0,0 +1,24 @@
+[oaops1] loaded masked live smoke env file
+>>> [oaops1] public-ready
+[oaops1][PASS] public-ready
+>>> [oaops1] live-smoke-env
+[oaops1][PASS] live-smoke-env
+>>> [oaops1] live-readiness
+[oaops1][PASS] live-readiness
+>>> [oaops1] oa-only-smoke-readiness
+[oaops1][PASS] oa-only-smoke-readiness
+[oaops1] login cooldown 65s before live-feature-flags
+>>> [oaops1] live-feature-flags
+[oaops1][PASS] live-feature-flags
+[oaops1] login cooldown 65s before authenticated-readonly-probe
+>>> [oaops1] authenticated-readonly-probe
+[oaops1][PASS] authenticated-readonly-probe
+>>> [oaops1] mobile-entry-matrix
+[oaops1][PASS] mobile-entry-matrix
+>>> [oaops1] wecom-rendering-matrix
+[oaops1][PASS] wecom-rendering-matrix
+>>> [oaops1] wecom-entry
+[oaops1][PASS] wecom-entry
+[oaops1][PASS] report-privacy-smoke
+[oaops1][PASS] report-privacy-smoke
+[oaops1] report=.trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily
@@ -0,0 +1,11 @@
+
+Running 2 tests using 1 worker
+
+(node:89063) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+(node:89063) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓  1 tests/e2e/wecom-entry.spec.ts:56:1 › E2E 企微入口：普通浏览器下只提示企业微信工作台打开 (2.9s)
+  ✓  2 tests/e2e/wecom-entry.spec.ts:66:1 › E2E 企微入口：企业微信场景优先显示企微 CTA，并展示未绑定提示 (2.5s)
+
+  2 passed (9.1s)
@@ -0,0 +1,9 @@
+{
+  "name": "wecom-entry",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/wecom-entry.log",
+  "checkedAt": "2026-05-29T01:33:22.015Z"
+}
@@ -0,0 +1,17 @@
+
+Running 8 tests using 1 worker
+
+(node:87388) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+(node:87388) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set.
+(Use `node --trace-warnings ...` to show where the warning was created)
+  ✓  1 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 320 iPhone 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.9s)
+  ✓  2 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 360 Android 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.5s)
+  ✓  3 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 375 iPhone 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.5s)
+  ✓  4 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 390 iPhone12 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.7s)
+  ✓  5 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 393 Android 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.5s)
+  ✓  6 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 414 iPhone 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (7.5s)
+  ✓  7 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:588:7 › WCM6 企业微信多手机移动渲染稳定化 › 430 iPhone 企业微信 › 核心移动入口使用 SVG 图标且跨视口不挤压 (8.0s)
+  ✓  8 tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts:604:5 › WCM6 企业微信多手机移动渲染稳定化 › 390 iPhone12 企业微信 字体失败 › Material Symbols 字体失败时核心移动入口仍稳定 (7.1s)
+
+  8 passed (1.1m)
@@ -0,0 +1,9 @@
+{
+  "name": "wecom-rendering-matrix",
+  "status": "PASS",
+  "kind": "finding_allowed",
+  "code": 0,
+  "detail": "ok",
+  "logRef": ".trellis/tasks/05-29-frontend-ux-wave4-5-finance-admin-refresh/research/postdeploy-20260529-wave4-5-public-rerun/oa-real-use-daily/wecom-rendering-matrix.log",
+  "checkedAt": "2026-05-29T01:33:07.280Z"
+}
@@ -0,0 +1,65 @@
+# Wave4-5 Scope Audit
+
+## Summary
+
+Historical Wave4 is complete, deployed and archived, but it predates the latest Wave0-3 refresh line. The remaining work should not redo the whole finance/admin surface. It should validate the historical Wave4 pages against the new baseline and fill the missing Wave5 admin/config pages.
+
+## Historical Wave4 Covered
+
+Task: `.trellis/tasks/archive/2026-05/05-27-pc-finance-admin-visual-wave4/`
+
+Covered pages:
+
+- `/payment-batches`
+- `/ap-operations`
+- `/invoice-pool`
+- `/system/users`
+- `/system/master-data`
+- `/system/notification-channels`
+- `/system/settings`
+- `/system/feature-flags`
+- `/system/workflow-definitions`
+- `/audit-logs`
+
+Evidence:
+
+- Local typecheck/build/focused Playwright/design rules/Trellis governance passed.
+- Deployed commit `c5eb27e` passed public deploy checks and Wave4 public visual smoke.
+- OAOPS1 postdeploy Wave4 read-only巡检 later recorded `PASS_OA_REAL_USE_DAILY_READY`.
+
+## Current New Baseline
+
+Wave0-2 task established the new global shell, navigation, page header, list/detail surface and high-frequency core pages. Wave3 then refreshed business detail and mobile key pages against that new baseline and passed public checks on 2026-05-29.
+
+Therefore the next work should be a new-baseline refresh, not a full redesign.
+
+## Gap Pages For Wave5
+
+The following pages are active management/config pages but were not first-class targets in historical Wave4:
+
+- `/system/approval-rules` — currently uses `ListWorkspace`/`WorkspaceHeader`, but still has a large create form and rule table that should be brought into admin command/status patterns.
+- `/people` — people and HR master operation surface still uses older `PageHeader`/card/table style; it has high-risk actions including export, batch disable/enable, manager/department transfer and WeCom HR master sync.
+- `/organization` — still uses older `PageHeader` and standalone cards; should align with management overview style while preserving hierarchy readability.
+- `/system/workspace` — still uses older `PageHeader` and cards; affects navigation visibility and small-team workspace setup, so it belongs in Wave5 admin-config.
+
+Secondary watchlist:
+
+- `/system/departments`
+- `/system/expense-standards`
+- `/system/integrations/erp`
+- `/system/cutover`
+
+These are lower priority unless the initial implementation finds visible inconsistency or existing focused tests already cover them cheaply.
+
+## Recommended Task Boundary
+
+Do in this task:
+
+- Refresh the four Wave5 gap pages.
+- Re-run/extend focused Wave4 visual tests to cover both historical Wave4 pages and new Wave5 gap pages.
+- Touch Wave4 finance pages only if the test/audit finds current new-baseline gaps.
+
+Do not do in this task:
+
+- Backend workflow, approval semantics, permission, payment state machine, database migration or Enterprise WeChat write changes.
+- Real payment, ERP write, production config mutation or real business data automation.
@@ -0,0 +1,26 @@
+{
+  "id": "frontend-ux-wave4-5-finance-admin-refresh",
+  "name": "frontend-ux-wave4-5-finance-admin-refresh",
+  "title": "前端体验 Wave4-5 财务与管理页刷新",
+  "description": "在 Wave0-3 新基线后复审财务/运营页并补齐管理配置页体验缺口。",
+  "status": "completed",
+  "dev_type": null,
+  "scope": "client frontend finance admin ux",
+  "package": null,
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-29",
+  "completedAt": "2026-05-29",
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
				`@@ -0,0 +1 @@`
				`[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0`
				`@@ -0,0 +1 @@`
				`{"requestId":"983ef37c-e6ec-4907-af6e-d31449e08e29","data":{"ok":true}}`