完善付款回单凭证核验与本地重检（09-17-company-loan-principal-repayment）

区分正式付款回单、非最终回执与未知凭证，在核验构建、人工证据重建和最终核销时使用同一份有效依据。非最终说明、入账方向、状态矛盾及重复交易不能经人工覆盖。

正式回单无字面成功状态时，允许财务按原件实际记账支出、日期及说明提出核验，由本批次适用的确认人确认；不补造银行成功文字。旧核验可显式本地重检，新版本与审计原子保存，不重新外发 OCR，不沿用旧人工批准或改写已核销历史。

本地验证：82 个迁移、借款 HTTP 116 组、关联电脑/手机 18 组、共享回单数据库与真实认证 38 组、共享报销页面限定重验 24 项、最新回单/报销定向 292 项通过；9 个资金守卫变异均被捕获。服务端全量 4554 项通过、1 项既有可选跳过，后续合成数据及零页详情改动由最新定向验证覆盖。

本次无新增迁移，新增本地 PDF 文本解析依赖。后续对本提交运行完整 verify-candidate，实际候选与结果以本轮回执为准。

限制：独立代码复核及真实还款验收待完成；历史材料预验不证明真实还本或银行提交对应。未推送、未部署、未访问生产或写入真实业务数据。

.trellis/spec/hyb-oa/backend-fastify-prisma.md

@@ -127,6 +127,31 @@ QA script patterns over new abstractions.
 
 ### Receipt OCR Matching Service Boundary
 
+- Ordinary bank-payment evidence must retain a versioned `document` classification
+  (`bank_receipt`, `non_final`, `unknown`) in the encrypted recognition/proposal.
+  Bound local PDF inspection by input size, page count, worker memory and time;
+  unreadable text remains unknown. Preserve provider disclaimers as restrictions.
+  A title, matching fields, or absence of an extracted disclaimer is not sufficient.
+  Automatic matching needs a supported final receipt, explicit successful payment
+  and no incoming direction or conflicting document facts. Keep this gate in
+  evidence construction and final reconstruction, not the shared `matchBankSlip`
+  helper used by failed/voided/terminal-fact comparisons.
+- Manual `paymentProof` must attest a checked original and record the basis/note.
+  `booked_debit` requires a valid non-future bank booking date and an empty original
+  success status; preserve `transactionStatusRaw=null` rather than fabricate bank
+  wording. New proof always needs the batch's applicable confirmation mode.
+  Non-final disclaimers, incoming direction and known contradictory facts cannot
+  be removed by manual corrections. Manual-source evidence is not automatic OCR.
+- Old unconsumed evidence without document inspection cannot default to final.
+  Finance may explicitly POST `receipt-attachments/:attachmentId/document-check`
+  with `expectedVersion`; use the existing batch/claim/attachment locks, scope and
+  maker checks. Verify stored bytes against size/SHA, create a new version and audit
+  atomically, preserve history and never call cloud OCR. Old manual approval does
+  not transfer to the new version. Reinspect and settle under the same batch lock;
+  runtime tests must cover both orders, stale versions and audit rollback.
+  A historical OCR result with zero known pages must still expose the inspection
+  action; reject malformed/out-of-range counts without allocating from them.
+
 - Failed evidence persistence is not OCR failure. In a separate bounded transaction,
   lock the batch then conditionally update the attachment by version/SHA/processing
   and active governance predicates. Persist only allowlisted system_failed,

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -10,6 +10,17 @@
 
 ## Receipt Verification Dialog
 
+- Show document nature separately from extracted transaction status. A booked
+  official debit receipt may use the actual booking date and checked-original
+  declaration; do not ask the operator to invent a successful bank status.
+  Show that basis to the reviewer and keep save/review separate from settlement.
+  Non-final receipts or contradictory directions have no manual override.
+- Old evidence needing local document inspection exposes an explicit finance
+  action in the existing dialog; retain history and explain the need to recheck.
+  Reset document-proof choices along with corrections on refresh. Verify the
+  actual desktop/mobile proof entry, required original check, applicable reviewer,
+  final settlement and non-final refusal through the rendered dialogs.
+
 - When readiness is unmet and an active receipt has a system/key/snapshot failure,
   the batch banner must direct prerequisite repair, not an unavailable verification
   dialog. This is display only: a retained failed attachment must not block other