修复非参与人报销只读边界（08-28-reimbursement-nonparticipant-readonly-projection）

.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md

@@ -14,6 +14,22 @@ duplicate detection or attachment behavior.
 - Reimbursement flow tests should cover upload/OCR, duplicate handling,
   submission, approval, payment batch, receipt attachment and AP export when the
   Trellis task scope touches those areas.
+- Reimbursement object maintenance is limited to the form owner or submitter
+  while the status permits editing. `expense.view_all`, an admin role and an
+  approval assignment grant read or workflow-specific abilities only; they do
+  not authorize editing another employee's form, items, attachments, project
+  link, submission, or reimbursement invoice binding/unbinding.
+- PC and mobile reimbursement details must project the same boundary. A
+  nonparticipant remains able to read the detail and permitted originals or
+  merged materials, but sees a clearly labeled read-only view with no owner
+  maintenance actions. Bound-invoice helper text must describe facts (for
+  example `已关联` / `未关联`) rather than advertise removal or internal
+  auto-matching behavior to a viewer who cannot perform it.
+- Reimbursement precheck exposes budget, expense-standard and risk information,
+  so it is an object read even though it uses POST. Resolve the target form and
+  require the same own-or-`expense.view_all` guard as reimbursement detail reads
+  before invoking the precheck service; an ordinary nonparticipant must receive
+  403 without service-side evaluation.
 
 ## Scenario: OCR Disabled Without Mock Data