完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/scripts/regression-im-notifier.sh

@@ -701,12 +701,14 @@ assert_status "$test_status" "200" "test channel by id" "$TMP_DIR/channel-test.j
 assert_jq "$TMP_DIR/channel-test.json" '.data.testResult.ok == true and .data.testResult.code == "mock_sent" and .data.testResult.retryable == false' "test channel endpoint mock sent"
 
 echo "[8/10] create encrypted secret channel and verify masked read model"
-SECRET_CHANNEL_ID="$(create_channel "$FINANCE_MGR_TOKEN" "IM Secret ${RUN_SUFFIX}" "mock" "" "secret-${RUN_SUFFIX}" "$TMP_DIR/create-secret-channel.json")"
+SECRET_CHANNEL_ID="$(create_channel "$FINANCE_MGR_TOKEN" "IM Secret ${RUN_SUFFIX}" "wecom_webhook" "http://127.0.0.1:9/wecom" "secret-${RUN_SUFFIX}" "$TMP_DIR/create-secret-channel.json")"
 track_regression_channel "$SECRET_CHANNEL_ID"
 assert_jq "$TMP_DIR/create-secret-channel.json" '.data.channel.configJson.secretConfigured == true and (.data.channel.configJson.secretMasked | type == "string") and (.data.channel.configJson | has("secret") | not)' "create channel masks secret on read"
+query_channel_secret_state "$SECRET_CHANNEL_ID" > "$TMP_DIR/secret-channel-storage.json"
+assert_jq "$TMP_DIR/secret-channel-storage.json" '.hasSecret == false and .hasSecretEncrypted == true' "channel stores only encrypted secret"
 secret_test_status="$(api_json_auth POST "$BASE_URL/api/notifications/channels/$SECRET_CHANNEL_ID/test" "$FINANCE_MGR_TOKEN" "$TMP_DIR/secret-channel-test.json" '{}')"
 assert_status "$secret_test_status" "200" "test encrypted channel by id" "$TMP_DIR/secret-channel-test.json"
-assert_jq "$TMP_DIR/secret-channel-test.json" '.data.testResult.ok == true and .data.testResult.code == "mock_sent" and .data.channel.configJson.secretConfigured == true' "encrypted secret channel test still works"
+assert_jq "$TMP_DIR/secret-channel-test.json" '.data.testResult.ok == false and .data.testResult.code == "wecom_network_error" and .data.testResult.retryable == true and .data.channel.configJson.secretConfigured == true' "encrypted secret channel follows loopback provider failure path"
 
 echo "[9/10] migrate legacy plain secret channel to encrypted storage and keep test path working"
 LEGACY_CHANNEL_ID="$(create_legacy_secret_channel "IM Legacy ${RUN_SUFFIX}" "http://127.0.0.1:9/wecom" "legacy-${RUN_SUFFIX}")"