记录live OCR样票捕获约束（07-28-travel-reimbursement-guide）

.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md

@@ -291,6 +291,10 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
 - Never output recognized identifiers, dates, amounts, buyer/seller/passenger
   names, provider messages, raw response or input bytes. Field presence is a
   boolean; errors are bounded stable codes.
+- The JSON summary is the primary evidence even when the probe exits non-zero.
+  Shell callers must capture and persist the bounded stdout summary before
+  interpreting the exit status; do not let `set -e` discard a valid HOLD
+  summary held only in a command-substitution variable.
 - A PASS proves the direct provider/normalization path only. It does not prove
   OA upload, queue, persistence, duplicate detection, binding or reimbursement
   submission.
@@ -329,6 +333,8 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
   assert serialized output contains only booleans and safe metadata.
 - CLI test pipes one synthetic PDF over stdin with credentials absent and
   asserts one parseable redacted error object with empty stderr.
+- Caller capture test asserts a redacted HOLD JSON remains available when the
+  probe exits `1`; no provider retry may be inferred solely from lost stdout.
 - Before deployment run `node --check`, the focused tests, full backend tests,
   sensitive-content scan, task validation and Trellis governance.
 
@@ -348,6 +354,9 @@ node scripts/qa/check-ocr-provider-samples.mjs \
   --alias=SAMPLE-PDF-TRAIN < <authorized-single-sample.pdf>
 ```
 
+The caller records stdout before applying the exit-code gate; it never uses a
+`set -e` assignment whose non-zero status exits before the JSON is emitted.
+
 ## Scenario: Payment Batch Receipt Attention Count
 
 ### 1. Scope / Trigger