完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

scripts/qa/tests/full-local-environment.test.mjs

@@ -13,7 +13,7 @@ function receipt() {
     schemaVersion: 1, profile: "isolated-online-v1", policyDigest: "policy",
     supervisorObservation: { source: "live-supervisor-unix-ipc", sampledAt: "2026-09-07T00:00:00Z", namespace: "parent" },
     namespace: { inheritedRunner: "parent", ownedChild: "child", runnerCreated: true, currentMatchesOwnedChild: true, topologyMatched: true },
-    nativeOnlineProbe: { valid: true, online: true, browserNamespace: "child", browserMatchesOwnedChild: true, noNavigatorOverride: true },
+    nativeOnlineProbe: { valid: true, online: true, browserNamespace: "child", browserMatchesOwnedChild: true, noNavigatorOverride: true, engines: ["chromium", "webkit"].map(name => ({ name, version: "synthetic", online: true, valid: true, noNavigatorOverride: true, browserNamespace: "child", browserMatchesOwnedChild: true })) },
     bootstrapObservation: {
       valid: true, observationPoint: "guest-entry-black-box", freshContext: true, initialSessionHint: false,
       listenerBeforeNavigation: true, noRouteMocks: true, loginFormVisible: true, refreshRequestCount: 0, loginRequestCount: 0,
@@ -66,13 +66,21 @@ test("缺 context 不接受 GATE_PASSED 或已有 true", () => {
   assert.deepEqual(validateEnvironmentFacts(context, facts), []);
   for (const key of Object.keys(facts)) assert.ok(validateEnvironmentFacts(context, { ...facts, [key]: null }).length, key);
 });
-test("拓扑只接纳 owned veth 且禁止默认出口", () => {
+test("拓扑只接纳同 namespace 内部 veth 默认路由，拒绝外部对端和网关", () => {
   const addresses = [{ ifname: "lo" }, ...["qaonline", "qapeer"].map((ifname, index) => ({ ifname, flags: ["UP"], operstate: "UP", addr_info: [{ local: `192.0.2.${index + 1}`, prefixlen: 30 }] }))];
-  assert.equal(topologyMatches(addresses, [], []), true);
-  assert.equal(topologyMatches(addresses, [{ dst: "default" }], []), false);
-  assert.equal(topologyMatches(addresses, [], [{ gateway: "::1" }]), false);
-  assert.equal(topologyMatches([...addresses, { ifname: "eth0" }], [], []), false);
-  assert.equal(topologyMatches(addresses.slice(0, 2), [], []), false);
+  const links = [{ifname:"lo",ifindex:1},{ifname:"qaonline",ifindex:2,link:"qapeer",linkinfo:{info_kind:"veth"}},{ifname:"qapeer",ifindex:3,link:"qaonline",linkinfo:{info_kind:"veth"}}];
+  const routes = [{dst:"default",dev:"qaonline",scope:"link"}];
+  assert.equal(topologyMatches(addresses, routes, [], links), true);
+  for(const mutate of [
+    f=>{f.routes=[];}, f=>{f.routes.push(f.routes[0]);}, f=>{f.routes[0].gateway="192.0.2.2";},
+    f=>{f.routes[0].dev="eth0";}, f=>{f.routes[0].scope="global";}, f=>{f.routes[0].multipath=[];},
+    f=>{f.ipv6=[{dst:"default",dev:"qaonline"}];}, f=>{f.addresses.push({ifname:"eth0"});},
+    f=>{f.links[1].link_netnsid=0;}, f=>{f.links[1].link="outside";}, f=>{f.links[1].linkinfo.info_kind="bridge";},
+    f=>{f.links[1].master="outside";}, f=>{f.links.pop();}, f=>{f.links=undefined;},
+  ]) {
+    const f=structuredClone({addresses,links,routes,ipv6:[]});mutate(f);
+    assert.equal(topologyMatches(f.addresses,f.routes,f.ipv6,f.links),false);
+  }
 });
 
 for (const mismatch of [false, true]) test(`namespace 创建失败不降级，清理须匹配 owner：mismatch=${mismatch}`, context => {