修复部署复检链路（05-31-deploy-unified-list-detail-reimbursement-public-check）

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -168,5 +168,98 @@ await expect(
   page.getByRole("link", { name: "工作台", exact: true })
     .or(page.getByRole("link", { name: "Portal", exact: true }))
     .first(),
-).toBeVisible();
+  ).toBeVisible();
+```
+
+## Scenario: Trial Run Runtime Navigation Baseline
+
+### 1. Scope / Trigger
+
+- Trigger: changing sidebar grouping, workspace module visibility defaults,
+  `server/src/services/workspaceSettings.js`, or
+  `server/src/scripts/smoke-trialrun-runtime.js`.
+- Purpose: keep deployment smoke aligned with the current small-team navigation
+  model instead of blocking deployment on retired menu assumptions.
+
+### 2. Signatures
+
+- Runtime smoke command inside deployment:
+  `docker compose exec -T server node src/scripts/smoke-trialrun-runtime.js`
+- Source of truth for sidebar grouping:
+  `server/src/services/workspaceSettings.js`
+- Runtime smoke assertion file:
+  `server/src/scripts/smoke-trialrun-runtime.js`
+
+### 3. Contracts
+
+- Runtime smoke must distinguish primary sidebar entries from collapsed
+  `更多` entries.
+- Core day-to-day ledgers such as `报销`, `采购申请`, `合同台账`, `项目` and
+  `资产` are expected in `main` when the active role has access.
+- Low-frequency entries such as `周报` and `公告` may be enabled but should be
+  checked in `backup` / `更多`, not forced into `main`.
+- `待办` follows the current workspace and role-aware navigation baseline; do
+  not move it between `main`, `backup` or hidden as part of a deployment-smoke
+  fix unless a product task explicitly changes that rule.
+- Management pages should remain represented by the single `管理` entry unless
+  a current task explicitly changes the management navigation model.
+
+### 4. Validation & Error Matrix
+
+- Core ledger missing from `main` -> runtime smoke fails with
+  `系统导航 main 缺少 <key> 入口`.
+- `周报` or `公告` missing from `backup` while enabled -> runtime smoke fails
+  with `系统导航 backup 缺少 <key> 入口`.
+- Management children are hidden behind `管理`, but smoke still expects
+  `workspace`, `people`, `featureFlags` or `auditLogs` in `admin` -> update the
+  smoke baseline; do not re-expand the sidebar for the smoke.
+- `systemSettings` missing from `admin` -> runtime smoke fails because the
+  management entry is no longer reachable.
+
+### 5. Good/Base/Bad Cases
+
+- Good: `main` includes `portal`, `reimbursements`, `purchaseRequests`,
+  `contractsRegistry`, `projects` and `assets`; `backup` includes
+  `weeklyReports` and `announcements`; `admin` includes `systemSettings`.
+- Base: `待办` is in `main` for a configured admin/owner trial account; smoke
+  accepts it there because it follows the current workspace baseline.
+- Bad: smoke expects `weeklyReports` in `main` after the sidebar rule moved
+  low-frequency modules to `更多`.
+- Bad: smoke expects every management child as a sidebar row after the product
+  rule consolidated management into one `管理` entry.
+
+### 6. Tests Required
+
+- Run `node --check server/src/scripts/smoke-trialrun-runtime.js` after editing
+  runtime smoke.
+- Run `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` for public deployment so the
+  remote runtime smoke validates the actual workspace and feature-flag state.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```js
+const REQUIRED_MAIN_NAV_KEYS = [
+  "portal",
+  "reimbursements",
+  "weeklyReports",
+  "announcements",
+];
+const REQUIRED_ADMIN_NAV_KEYS = ["workspace", "people", "featureFlags"];
+```
+
+#### Correct
+
+```js
+const REQUIRED_MAIN_NAV_KEYS = [
+  "portal",
+  "reimbursements",
+  "purchaseRequests",
+  "contractsRegistry",
+  "projects",
+  "assets",
+];
+const REQUIRED_BACKUP_NAV_KEYS = ["weeklyReports", "announcements"];
+const REQUIRED_ADMIN_NAV_KEYS = ["systemSettings"];
 ```