增加铁路OCR金额字段安全诊断（07-28-travel-reimbursement-guide）

.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md

@@ -273,7 +273,8 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
   imageBase64, sourceMimeType: "application/pdf" })`.
 - Output: one JSON object containing only `alias`, `provider`, `status`,
   `transportMode`, `elapsedMs`, safe document category/subtype/count,
-  per-field hit booleans, missing field names and a bounded error code.
+  per-field hit booleans, missing field names, an optional railway amount-field
+  boolean diagnostic and a bounded error code.
 
 ### 3. Contracts
 
@@ -291,6 +292,12 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
 - Never output recognized identifiers, dates, amounts, buyer/seller/passenger
   names, provider messages, raw response or input bytes. Field presence is a
   boolean; errors are bounded stable codes.
+- When a railway result lacks `totalAmount`, the adapter may expose an
+  ephemeral diagnostic for the documented Tencent `Total` and `Fare` fields.
+  It contains only presence, string/number type, non-empty and current-parser
+  acceptance booleans. The live runner re-allowlists those booleans; the
+  persistence sanitizer must drop the complete diagnostic object before every
+  cache or database write.
 - The JSON summary is the primary evidence even when the probe exits non-zero.
   Shell callers must capture and persist the bounded stdout summary before
   interpreting the exit status; do not let `set -e` discard a valid HOLD
@@ -331,6 +338,9 @@ await prisma.ocrResult.create({ data: { result_json: persisted } });
   the provider mock is called.
 - Privacy tests seed raw provider and recognizable normalized markers, then
   assert serialized output contains only booleans and safe metadata.
+- Railway amount-diagnostic tests cover absent, present-but-unparseable and
+  parseable fields, assert source values never reach stdout, and assert
+  `sanitizeOcrResultForPersistence` removes diagnostics completely.
 - CLI test pipes one synthetic PDF over stdin with credentials absent and
   asserts one parseable redacted error object with empty stderr.
 - Caller capture test asserts a redacted HOLD JSON remains available when the