Exclude cancelled reservations before ARR field review

.project-docs/30-worklog/tasks/20261008-production-review-9e7b.md

@@ -12,7 +12,7 @@
 
 ## Scope
 
-- 修复生产 OHIP 查询、环境内任务恢复及接口字段人工完善；保留 XML 和原筛选、定价、日报/月报规则。
+- 修复生产 OHIP 查询、环境内任务恢复及接口字段人工完善；保留 XML、原费率筛选、定价、日报/月报规则，并落实用户确认的取消预订排除规则。
 
 ## Intent And Constraints
 
@@ -24,7 +24,7 @@
 - Added source-field completion before deterministic processing: only candidate records' unresolved/invalid fields may be edited. Normal optional block/package omission is now recognized under the narrow Oracle association policy described below; unresolved, failed or contradictory evidence still needs resolution. Original bytes are retained, revisioned staff decisions record the authenticated actor, and confirmation freezes a derived source. The same download request resumes from its saved acquisition without querying OHIP again. Existing price review, Finance validation, daily generation and monthly outbox behavior remain in use; XML processing is retained.
 - Browser recovery is scoped to this service/source context and user, preventing an old sandbox request from restoring into the production instance. Lost save/finalize responses, concurrent revisions and interrupted confirmation recover without a second processing intent.
 - Updated the existing local service at `http://127.0.0.1:8875/` to run this isolated checkout, retaining hotel57106, credentials, private database and output storage. Previous private launcher/config/plist were backed up before restart. No production deployment, remote push or integration into the unowned dirty primary checkout occurred.
-- Reused the complete, immutable real 2026-10-07 capture; verified all531 capture files and both original hashes before importing into request `45e0e20ee75a46e098a0e32d650133a9`. Its initial26 source decisions were1 room,18 block codes and7 package lists. The optional-association follow-up below reinterpreted only corroborated normal omissions, preserving all original bytes and staff decisions. Current live review is revision1 with only1 unresolved required room; no processing job, staff confirmations or real daily/monthly exist. Import and reanalysis made zero new Oracle calls.
+- Reused the complete, immutable real 2026-10-07 capture; verified all531 capture files and both original hashes before importing into request `45e0e20ee75a46e098a0e32d650133a9`. Its initial26 source decisions were1 room,18 block codes and7 package lists. The optional-association follow-up below reinterpreted only corroborated normal omissions, preserving all original bytes and staff decisions. The later approved cancellation follow-up supersedes this pending-room state: the source review is finalized revision4 with zero field decisions, and the same10/7 request has entered the existing two-key price review. No real daily/monthly exists yet. Import, reanalysis and cancellation-scope continuation made zero new Oracle calls.
 
 ## Verification
 
@@ -38,7 +38,7 @@
 
 ## Follow-ups
 
-- The user explicitly deferred API/XML population alignment. That issue remains separate and must not block fixing normal optional omission or be represented as resolved by this change. The remaining10/7 room belongs to confirmation300007418, a Cancelled/unassigned source reservation; do not invent a room or silently exclude the reservation. Real report acceptance still requires resolving the actual remaining input and, when resumed by the user, the desired source selection/text mappings. Existing price review and real daily/monthly acceptance remain pending.
+- The user explicitly deferred API/XML population alignment. That issue remains separate and must not block fixing normal optional omission or be represented as resolved by this change. The user has now explicitly approved cancellation exclusion, so300007418 no longer requires a room.10/7 awaits only two existing manual-price keys (LIAN TAI/WHO1/Opera0 and QBD/GRPA3/Opera0); each affects one record/three nights. Do not choose a price, equate an Oracle0 with the processed price, or claim final daily/monthly acceptance. Source population/text alignment remains separately deferred.9/17 has received saved-status evidence but its old optional-source gaps were not reinterpreted this turn;30 active source decisions remain.
 - Integration owner should promote the accepted behavior and production compatibility evidence, then integrate this branch into the primary project. Keep this checkout while the local service runs from it. It is manually created, not eligible for automatic skill-managed retirement.
 - Production deployment/configuration and remote publishing are separate follow-ups. This turn only activated the local instance against the existing production read service.
 
@@ -155,3 +155,37 @@ Read: memory-index, project-positioning, current-state latest September sections
 - Independent saved-evidence recheck: confirmation300007418/internal5131529 has no roomId in first/final search, detail roomStay/currentRoomInfo or arrival-day rate segments. Room calendar returned HTTP200 with empty roomCalendar and no associated room/history. `PM` is a room type, not a usable room number. Both search/detail show Cancelled and rateGL2200KR in the original whitelist. Existing capture cannot legitimately supply a room; cancellation is not asserted as the cause of missing data. No new Oracle call occurred.
 - Verification:46 JavaScript tests passed, including failure/conflict precedence for room issues, pending dates/drafts, explicit finalization and uncertain request recovery; node syntax and Git whitespace checks passed. CUA refreshed the live page and verified the new explanation for300007418,0/1 confirmed and disabled report generation. Selecting10/6 enabled download without submitting; returning to10/7 restored the same item. No new task or actual download was started. Authenticated local read confirms revision1/pending1/job=null; original source SHA remains805799ba2f3edd7f1cf18c14e5304908061d6194a241c5fc255192728b7f388a. Static assets were served immediately; no service restart was needed.
 - Private screenshot: `/Users/chillishark/Library/Application Support/ARR2.0/production-validation-20261007/room-missing-in-scope-20261008.png`. Result tab retained as deliverable. No real source/manual decision was changed and no real daily/monthly generated. Follow-up remains a verified room value or a separately requested business-rule/source-scope decision; do not invent a room, silently drop a candidate or call the report complete. Promote the more precise explanation to canonical product documentation at integration if useful.
+
+## Same-task Follow-up: Cancelled and Unassigned Is Not a Room-completion Task
+
+- User challenges the direction: a cancelled/unassigned reservation reasonably has no room. The previous repeated instruction to obtain/fill a real room was not an adequate product resolution. Original code's required-room validation explains the technical block but does not establish that the expanded API population should be subjected to an impossible business completion step. Do not invent a room or assume cancellation universally removes historical room assignments.
+- Concurrent gate resumed the same owned feature task/worktree/branch successfully with no peers; retained project context applies. Planning gate Passed for read-only current-query/capture scope analysis, not approval to add a status exclusion. The user had earlier deferred broad XML/API population alignment; this challenge authorizes investigating the immediate cancellation/room contradiction, not silently adopting a universal new status filter.
+- Current search passes only arrivalStartDate/arrivalEndDate/limit/offset. Saved actual result contains6 Cancelled rows;2 are in the rate whitelist. Confirmation300007418 is the only whitelisted cancelled/unassigned row; confirmation300755329 is whitelisted Cancelled but retains a valid room. Total58 source rows/40 rate candidates. Excluding only the row that causes a room error would be an arbitrary pass-making rule; a consistent proposed Cancelled exclusion affects2 rate candidates, not only1.
+- Independent Oracle contract check confirms arrival dates, reservationStatuses, actualArrivals, expectedArrivals and dayOfArrivalCancels are separate parameters. The latter is only arrival-day cancellations, not a general exclude-cancelled switch. Saved production data proves this particular date-only request returned Cancelled; do not assert an undocumented universal API default or infer RES_DETAIL equivalence/CheckedOut-only selection. Official references: https://raw.githubusercontent.com/oracle/hospitality-api-docs/main/rest-api-specs/property/v1/rsv.json and https://docs.oracle.com/cd/E98457_01/opera_5_6_core_help/res_detail_help.htm.
+- Product proposal made concrete from saved evidence: preserve all original58 source rows and their audit, but exclude cancelled reservations from daily candidates if the user selects that new reporting policy. Under the captured10/7 rate selection it affects2 of40 candidates. No claim is made that the remaining daily/monthly already passes pricing or full acceptance.
+- Asked one business-scope clarification with the concrete2-row impact and reason: original code does not filter status, so the user must establish whether Cancelled belongs in the daily report. Options are exclude Cancelled while retaining original data, or retain current scope and leave10/7 unresolved. This is a business requirement, not a new skill/security permission requirement. While pending, no dependent status-filter implementation, real data edits, new Oracle reads, review finalization or report generation are authorized by elapsed time.
+- Verification: read original source contract/current parameter sheet, inspect saved request and all58 captured reservation statuses, join them by typed Reservation ID to the unchanged reanalyzed data and original rate whitelist; independent official-document check. No program/business code or service change. Earlier in-scope missing-room copy is not a completed solution to this user objection; do not present it as such.
+- Follow-up/promotion candidate: once the reporting scope is established, implement the selected consistent status policy before room completion, with explicit excluded-row lineage and unchanged source bytes. Separate entity eligibility from mandatory-field validation and distinguish cancelled with retained room from cancelled without room; neither may be guessed from the room field alone. Broad remaining XML/API report equivalence stays a distinct deferred issue.
+
+
+## Same-task Follow-up: Approved Cancellation Exclusion
+
+- User explicitly selected “日报排除已取消预订” on 2026-10-08 after the scope explanation. This supersedes only the prior lack of a cancellation filter; no NoShow/actual-arrival/CheckedOut-only or broad XML/API population alignment is authorized.
+- Concurrent Task Gate passed: same task/feature/codex, owned worktree and branch match; base2417b1a; no peers or overlaps. Primary unknown dirty documentation remains untouched.
+- Project Context Loaded: retained task record, read-before-planning/planning-gate, memory-index, project-positioning, current-state, decision-index, ADR006/007, system-overview/module-map/data-flow, business-rules/success-criteria, evidence/reflection/commitments/stale indexes. Goal remains two input paths sharing deterministic Finance/monthly logic. Accepted new cancellation exclusion overrides the old status-blind classification only; preserve raw rows, rate/price/date/dedup rules and audited staff changes. Canonical September deployment/delegation restrictions are stale where October explicit production/multi-agent authorization applies. Gate Passed.
+- Plan: carry verified reservation status from OHIP; use one cancellation predicate before field validation for both input paths; independently record excluded_cancelled without mislabelling rate exclusions; update schemas/Finance forward migration; append saved-status interpretation to pending reviews without changing source bytes or staff decisions; explicitly migrate only unprocessed local tasks to the new rule identity with backups and receipt; replay saved10/7 without Oracle calls, validate and activate local service.
+- Boundary: ambiguous XML short codes such as CA are not guessed as cancellation. Clearly identified Cancelled/CXL values may be excluded; missing/unknown/conflicting evidence keeps existing behavior. Broad source-population alignment remains deferred.
+
+
+### Approved Cancellation Exclusion — Outcome and Verification
+
+- Implemented processor4.3.0 for XML4/OHIP5: exclude explicit cancellations before missing-rate, required business values, pricing and room/date deduplication. Source rows remain in the structured audit under `excluded_cancelled` with exactly `RESERVATION_CANCELLED_EXCLUDED` and null price/channel facts. Rate exclusions keep their separate count. Unknown/missing/conflicting status remains governed by existing validation; no new NoShow or CheckedOut-only rule. Frozen legacy direct-MCP3 keeps its old scope.
+- OHIP acquisition carries the verified `reservation_status` outside the15 business fields. Internal saved-status interpretation verifies every original capture file, request/response identity, both complete search rounds, sequence and search/detail status/version agreement, then appends immutable evidence to the derived source. There is no HTTP mutation route for statuses. Original acquisition bytes, source reanalysis and staff decisions remain intact; cancelled-row historical decisions stay audited but are no longer editable or blocking.
+- Finance keeps schema4/5 compatibility by processor identity, adds forward migration020 with a separate nonnegative cancellation count and balanced total/outcome constraints, and checks020 before enabling either processing path. Old rows receive0 without changing released facts; rollback rejects existing cancellation facts. No old migration was edited.
+- UI shows the cancellation count and retains original-data notice. Removed review items clear obsolete unsaved drafts; edits still in the review are preserved. Both processor distribution packages were rebuilt byte-identically to source (SHA256 `2017aaa192571f8e2869ede0a1e86310e6d05cdf517f53e94b17a0a9359bc3ba`).
+- Verification:23 processor/XML/schema/package regressions passed;14 saved-status evidence tests passed;5 cancellation-review tests passed;114 review/source/direct processing/local wrapper regressions passed with disposable real PostgreSQL, no skipped checks. Two grouped root test commands also named a nonexistent runtime module and ended with import errors; no actual loaded test failed, and the intended `test_arr_direct_runtime` plus cancellation-review/status suite was subsequently run correctly:21 tests passed. Finance agent ran62 distinct scoped tests in batches, including019→020 migration preservation, restricted-role/constraint checks, XML and JSON cancellation handling, failed-batch audit, monthly formulas and no-reacquisition retry.48 JavaScript tests and syntax/whitespace checks passed. Counts overlap and must not be added as distinct coverage.
+- Local activation: verified queue idle, stopped LaunchAgent and private PostgreSQL, made a cold full backup outside the live root, and dry-ran an explicit policy-pin upgrade on copied pending state. Only unprocessed/unfrozen tasks were eligible. The durable intent records every parent/new file hash and target policy; previous revisions, source bytes and receipts are retained. Old optional-source receipt was separately rebound under the new context; no staff decision changed. Both10/7 and9/17 received statuses from their existing complete captures. Migration020 applied only to the owned private local database, Finance version count stayed0; updated private launcher and restarted8875.
+- Actual10/7 result:58 original rows;6 cancellations excluded (2 were among prior40 rate candidates),14 non-whitelist exclusions,0 duplicates,36 controlled candidates and2 unmatched-price rows. Source review pending0/finalized revision4 with0 manual field decisions. Authenticated browser explicitly continued the original request to the existing `needs_review` state; price items are LIAN TAI/WHO1/Opera0 and QBD/GRPA3/Opera0, each1 record/3 nights. No price was entered and no real daily/monthly was committed. The user chose to enter these two prices directly in the page; it is left open at the price-review panel for that action. No price value was supplied to the agent, so it cannot finalize pricing. Generating the actual report remains dependent on the user's saved price decision.
+- Actual9/17 maintenance result:18 raw cancellations excluded from review; active decisions38→30, original unchanged, revision2. Its prior optional source omissions remain a separate pending follow-up, and this date was not submitted/processed or refetched.
+- Private evidence: cold backup `/Users/chillishark/Library/Application Support/ARR2.0/policy43-service-backup-20261008-121313`; live `policy43-upgrade-intent.json`, `policy43-upgrade-completed.json`, `policy43-activation.json`; dry run `production-validation-20261007/policy43-dryrun-da8e24ea`; private executable `upgrade_cancelled_scope.py`. Browser screenshots `cancelled-scope-no-room-review-20261008.png` and `cancelled-scope-price-review-20261008.png`. The authenticated result tab is retained. No credential/environment/grant change, Oracle business read, production deployment, remote push or primary-checkout integration occurred.
+- Promotion candidate: update canonical source-selection/business-rules/current-state with user-approved cancellation exclusion and processor4.3/020 requirements, retaining the deferred broad population alignment. Human confirmation for the cancellation policy is satisfied by this conversation; integration ownership is still required for canonical writes.