收口(08-11-internal-oa-finance-backoffice-positioning-and-navigation-reduction): 延期导航减法并固化最小验证

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -2037,6 +2037,9 @@ node scripts/qa/payment-batch-flag-snapshot.mjs restore --snapshot-file "$REPORT
 - Readback equals the PRE snapshot -> classify as not applied and stop. A later attempt requires a fresh approval/version lock unless the original approval explicitly defines another attempt.
 - Partial or mixed readback -> return `STOP_FOR_MANUAL_DECISION`, record a contract/product finding and stop. Do not continue POST, auto-rollback or conceal a broken atomicity contract with manual repair.
 - Execute an approved rollback only after the forward result is known and a defined POST acceptance condition actually fails. Capture rollback response, final readback and audit deltas separately from the forward evidence.
+- Make POST validation proportional to the changed dependency graph and failure cost. A reversible, zero-use feature flag with statically verified soft consumers does not justify probing unrelated domains merely because they are available.
+- For a confirmed low-risk, reversible configuration state, a POST witness failure defaults to preserving the applied state for read-only diagnosis. Rollback requires evidence of a real product regression, not merely a runner assertion, stale error accumulator or probe-contract mismatch.
+- Every HTTP probe must use the real route query contract. Page-error evidence must be sliced from immediately before one navigation until that navigation completes; errors accumulated during login, PRE or earlier pages cannot fail a later page witness.
 
 ### 4. Validation & Error Matrix
 
@@ -2046,6 +2049,7 @@ node scripts/qa/payment-batch-flag-snapshot.mjs restore --snapshot-file "$REPORT
 - All targets at PRE -> stop with zero compensating writes.
 - Some targets changed -> `STOP_FOR_MANUAL_DECISION`; stop, preserve evidence and request an explicit human decision. Neither continue nor rollback is automatically correct.
 - Readback itself fails -> state remains unknown; stop with zero further mutation.
+- Expected POST is confirmed and the only witness fails -> preserve the applied state, open a fresh read-only context and classify the witness. Confirmed product regression may enter an explicitly approved rollback; runner/probe defect must not.
 
 ### 5. Good/Base/Bad Cases
 
@@ -2053,6 +2057,7 @@ node scripts/qa/payment-batch-flag-snapshot.mjs restore --snapshot-file "$REPORT
 - Base: the batch response and observer agree, readback confirms the expected state, and the audit delta matches target count.
 - Bad: treat a page-only counter as authoritative for a context request and immediately restore the PRE values before checking current versions.
 - Bad: call rollback because it is pre-authorized while the forward result is still unknown.
+- Bad: add unrelated domain probes to a three-flag soft-disable, send unsupported query parameters, or let errors from an earlier page fail the current Portal witness.
 
 ### 6. Tests Required
 
@@ -2060,6 +2065,8 @@ node scripts/qa/payment-batch-flag-snapshot.mjs restore --snapshot-file "$REPORT
 - Cases for response success/counter agreement, response missing with POST state, response missing with PRE state, readback failure and partial/mixed state.
 - Assert mutation ordering: forward at most once -> uncertain readback/audit only -> either POST verification or stop -> rollback at most once only after a concrete approved acceptance failure.
 - Assert final evidence reconciles response count, readback versions, global audit delta and per-target changelog delta; no one source may silently override contradictions.
+- Derive every probe path/query from the actual route/client contract. For browser witnesses, reset or snapshot the page-error index before each navigation and assert only the new slice.
+- For low-risk reversible changes, test that a witness failure preserves POST state for diagnosis and that rollback is unreachable until a fresh read-only check confirms product regression.
 
 ### 7. Wrong vs Correct
 
@@ -2077,7 +2084,9 @@ forward response/counter disagree -> APPLY_UNCERTAIN
 -> GET every target version and state -> reconcile audit/changelog
 -> expected POST means continue verification
 -> PRE means stop
--> rollback only after a real approved POST failure
+-> minimal dependency-matched witness
+-> witness failure preserves state for fresh read-only diagnosis
+-> rollback only after confirmed product regression and explicit approval
 ```
 
 ## Scenario: Unique Production Administrator Break-Glass Reset