修正 ERP 边界与资产页面一致性（05-30-fix-erp-boundary-asset-consistency）

2026-05-30 23:06:02 +08:00
@@ -361,8 +361,9 @@ point and prevents each route from inventing a different title/action layout.
 - `个人设置` stays in the topbar account menu. Notifications stay in the topbar
  bell and notification center.
 - Finance labels should use work names such as `付款`, `应付账款` and `票据`;
-  internal platform words like `AP 运营`, `ERP 集成` and `功能开关` should be
-  hidden behind management wording or renamed for users.
+  internal platform words like `AP 运营` and `功能开关` should be hidden behind
+  management wording or renamed for users. `ERP 集成` is not a hyb-oa product
+  entry.
 - `更多` is a lightweight collapsed row for low-frequency, frozen, staged or
  occasional entries; do not add a sidebar explanation card, subtitle or
  onboarding copy around it.
@@ -652,7 +653,7 @@ screen.
 - Procurement ledgers in V1 are request, approval, attachment, light
  acceptance/archive and relation surfaces for project, contract and payment/AP
  context. Do not design `/purchase-requests` as purchase-order lifecycle,
-  inventory, three-way matching, supplier-lifecycle, tendering or ERP software.
+  inventory, three-way matching, supplier-lifecycle or tendering software.
  Approved procurement means the request was approved; it does not imply paid,
  received into inventory or converted into a fixed asset.
 - Project pages in V1 are light project ledgers for status, owner/member,
@@ -665,10 +666,11 @@ screen.
 - Finance ledgers in V1 are payment-preparation, payment-batch, receipt-audit,
  AP-status, invoice/OCR-status and agency-accounting handover summaries. Do
  not design payment, AP or invoice pages as online banking, bank-statement
-  ingestion, ERP/general-ledger, voucher-generation, auto-reconciliation, tax
-  filing or full accounting software. Real payment stays in offline banking or
-  existing finance/accounting workflows; OA records status, evidence and
-  handover summaries.
+  ingestion, general-ledger, voucher-generation, auto-reconciliation, tax filing
+  or full accounting software. Real payment stays in offline banking or existing
+  finance/accounting workflows; OA records status, evidence and handover
+  summaries. hyb-oa does not connect to ERP now and does not plan ERP
+  integration later.
 - Payment, AP and invoice pages default to task/exception visibility: `付款`
  shows review, payment-marking, receipt and exception attention before batch
  creation; `应付账款` shows pending payment, exceptions, risks and differences
@@ -710,7 +712,8 @@ subsystem.

 - The default `/assets` view answers where the asset is, who uses it, who is
  responsible for it, what state it is in and whether it needs inventory or
-  handover. Do not lead with depreciation, accounting subjects or ERP sync.
+  handover. Do not lead with depreciation, accounting subjects or external
+  finance sync.
 - Register physical items that must be returned, transferred, inventoried or
  protected, such as computers, monitors, disks, equipment and security media.
  Do not create `FA` cards for ordinary consumables.
@@ -738,9 +741,10 @@ subsystem.
 - Move depreciation, residual value, accounting subject and monthly
  depreciation voucher concepts out of the OA primary UI unless a later Trellis
  task explicitly scopes accounting-ledger work.
- Keep classification maintenance, ERP sync, raw metadata and advanced filters
-  behind management, collapsed or advanced surfaces so they do not dominate the
-  asset list/detail first screen.
+- Keep classification maintenance, raw metadata and advanced filters behind
+  management, collapsed or advanced surfaces so they do not dominate the asset
+  list/detail first screen. Do not show ERP sync state or ERP asset numbers in
+  the asset UI.
 - Mobile asset lookup should prefer QR scan and fall back to asset number or
  serial number input. Do not require heavy photo inventory unless a later task
  explicitly scopes it.
@@ -1141,9 +1145,10 @@ request, frontend click or message attempt as final business completion.
 - Enterprise WeChat owns daily HR/attendance actions: check-in, leave, missed
  punch, outing and overtime. OA shows mirror, history, exception, audit and
  emergency-takeover records for those domains.
- ERP, agency accounting, bank, OCR and Enterprise WeChat messages are external
+- Agency accounting, bank, OCR and Enterprise WeChat messages are external
  capabilities or delivery channels. They do not replace OA server-side
-  permissions or state machines.
+  permissions or state machines. ERP is outside hyb-oa's product boundary and
+  must not appear as a current or future user-facing integration.
 - Show final labels such as `已同步`, `已发送`, `已付款` and `识别完成` only when the
  relevant external system has returned a clear success acknowledgement.
 - Use in-progress labels such as `同步中`, `等待回执`, `银行处理中`, `识别中` and
@@ -1152,8 +1157,8 @@ request, frontend click or message attempt as final business completion.
  such as `银行回执未返回` or `OCR 识别失败，需重新上传 PDF`.
 - Do not expose raw external error codes, payloads, full URLs, secrets, tokens
  or debug traces to ordinary users.
- External writes, payment execution, ERP sync, Enterprise WeChat resend and OCR
-  retry must be controlled by permissions and state-driven actions.
+- External writes, payment execution, Enterprise WeChat resend and OCR retry
+  must be controlled by permissions and state-driven actions.
 - Retry confirmation should explain which object will be retried, whether it may
  send duplicate external messages, external-system impact and audit effect.
 - External sync state should not block unrelated primary flows. If it blocks a
@@ -1165,8 +1170,9 @@ request, frontend click or message attempt as final business completion.
  unless OA emergency takeover is explicitly enabled.
 - Enterprise WeChat messages carry desensitized summary and OA deeplink only;
  they do not carry sensitive attachment text or final payment/approval actions.
- If bank, ERP, agency accounting or another integration is not connected or not
-  confirmed, UI copy must not imply the capability already completed.
+- If bank, agency accounting or another enabled integration is not connected or
+  not confirmed, UI copy must not imply the capability already completed. Do not
+  use ERP as a placeholder for future integration copy.

 **Why**: External integrations are asynchronous and failure-prone. Conservative
 copy prevents users from trusting a state the system has not actually verified.
@@ -1176,7 +1182,7 @@ copy prevents users from trusting a state the system has not actually verified.
 - `cd client && npm run typecheck`
 - `cd client && npm run build`
 - Focused Playwright coverage when changing Enterprise WeChat boundary copy,
-  OCR status, bank/payment callbacks, ERP/accounting sync status, retry
+  OCR status, bank/payment callbacks, accounting handover status, retry
  controls, external failure messages or integration diagnostics.

 ## Convention: Verification And User-Testable Claims