Automatically resume empty saved source reviews

.project-docs/30-worklog/tasks/20261008-production-review-9e7b.md

@@ -330,3 +330,16 @@ Read: memory-index, project-positioning, current-state latest September sections
 - Authenticated existing request04df0edb6743fbaa576d25063008c127 remains `needs_data_review`, job_id=null; source acquisition is complete106/106/100%. Review revision4 is editing, pending_count=0,total_count=0,can_finalize=true, with18 cancellations and11 PM exclusions. No user field input is still required. `DataFieldReviews.prepare` explicitly retains reanalyzed/status-evidence legacy reviews until finalized even when all gaps disappear; ordinary new complete input without those legacy interpretation checkpoints skips manual review. DirectARRExecutor returns needs_data_review until this retained review has a frozen payload. This is a legacy confirmation hold, not an additional field/rule failure or unfinished acquisition.
 - Outcome/boundaries: explain that corrected optional association interpretation and approved exclusions cleared the historical issues, but the old task deliberately retained its final continue/generate action. The empty panel currently misrepresents that action as manual checking. Its enabled “确认并生成日报” continues the same saved request/source without refetching; subsequent shared processing may still identify price review if required. No Oracle request, actual review/value/finalization, job generation, report/monthly mutation, UI/code change, restart or primary edit performed. No test run needed for read-only diagnosis. Documentation structure/ownership/whitespace gates apply.
 - Product follow-up/promotion candidate: integration-owned product flow should distinguish a legacy0-item ready-to-continue state from actual pending field/price issues, rather than showing an empty manual-check table. Current user question establishes confusion, not authorization to silently finalize an existing saved-source interpretation or auto-generate a report. Preserve original task/audit and use existing explicit continue control until the intended transition is changed.
+
+
+## Same-task Follow-up: Automatically Continue Empty Legacy Reviews
+
+- User explicitly authorizes fixing the empty9/17 manual-check hold and carrying out the fix. This supersedes the preceding read-only question's no-finalization boundary for9/17 and the product behavior for0-item source reviews; it does not authorize invented prices, bypassing pending issues, changing shared classification/pricing or resetting published reports. Concurrent Task Gate Passed for resumed20261008-production-review-9e7b/feature/codex/owned checkout/codex/arr-production-review/base2417b1a, no peers, initially clean. Project Context Loaded: retained required memory/positioning/current-state/ADR004/006/007/architecture/domain/evidence/reflection/commitments/stale context, refreshed entry/planning/task records and inspected current source-review/executor/queue contracts. Canonical memory remains stale/integration-owned; the new direct user authorization governs this narrowly scoped continuation. Planning Gate Passed.
+- Goal/plan: a validated0-item legacy source review must freeze its audited derived source and continue the same saved request automatically, rather than showing an empty human-check table. Preserve explicit final confirmation for genuine human decisions and keep all unresolved source/price items pending. Add a narrowly guarded automatic freeze/continuation path with system actor, durable retry/restart recovery and no mutation on ordinary GET reads; resume already stranded0-item tasks on safe service startup without a new source query. Regression-check no issues versus saved-but-confirmable manual decisions, source context/integrity failure, crash/retry and independent days. Safely back up/restart the local instance only with no active tasks; verify the actual9/17 progresses using saved data, retains audit/exclusions and stops at any genuine price review. No real price entry, source modification, reset/reprocess of completed10/7, new Oracle acquisition, schema change or primary-checkout edit. Update operational handoff, preserve before/after evidence and publish the completed fix to the already authorized repository.
+
+- Implementation: source-review recovery recomputes current shared rules under the existing revision lock, requires total_count=0/pending_count=0/can_finalize and collected source status, verifies exact request/context/checkpoint/original hash, then uses the existing durable freeze with actor `system:arr-empty-source-review`. Frozen audit preserves source interpretations, original observations and prior decisions, including historical decisions on now-excluded records. A real nonempty manual list still requires explicit final confirmation even when all entries are saved. Ordinary GET reads do not initiate a freeze; the worker checks stranded reviews on startup, resumes the same request with compare-and-set, isolates invalid reviews and reuses a completed freeze after interrupted queue publication. Missing/changed collection checkpoints cannot cause refetching. Ordinary complete input still skips source review. No business processing/price/schema/config identity changed.
+- Frontend: a strictly matched0-item source-review state keeps polling the original request with GET only; processing, real price-review and terminal transitions clear the obsolete empty source panel. No client-side confirmation or value submission was added. Updated direct-entry and release handoff guides.
+- Regression evidence:89 Python cases passed across new recovery, existing source/direct executor, queue, cancellation and PM suites, with disposable PostgreSQL enabled. The final checkpoint guard added1 case; all16 recovery cases were rerun and passed after it, for90 distinct backend cases (not105). Root separately passed13 existing static UI cases and all88 JavaScript cases. Coverage includes nonempty-but-fully-saved manual lists, unresolved/failed/ambiguous source, excluded historical decisions, integrity/context/checkpoint conflicts, interrupted freeze/queue update, startup without browser access, repeated restart and exactly one synthetic Finance version. Node syntax, Git whitespace, project-doc structure and ownership checks passed. No synthetic regression used the private real database or Oracle.
+- Actual activation on2026-10-09 local time: queue had0 active tasks, service was stopped gracefully and PostgreSQL exit confirmed before a cold backup of the private instance to `ARR2.0/empty-review-service-backup-20261008-160608` (only runtime dependencies and prior nested backups excluded). Restarted the existing8875 LaunchAgent from this owned checkout. Same9/17 request04df0edb6743fbaa576d25063008c127 moved automatically from needs_data_review to needs_review, attempts1→2, with acquisition106/106 unchanged. Source revision4→5 is finalized, exactly one system finalization event; original source, prior events and decisions are unchanged. Shared processor4.4.0 created jobarrbatch-2651d152601cc7955e587459c5fc0e2b271f12b16e5d7707 and stopped at exactly1 real price item: HONGTAI/LBKB/Opera1000,2 records/2 rooms/4 room-nights. Reference candidate Opera900→1800 does not match1000 and was not applied. Actual price is still null, case0/1 open, no9/17 Finance version or report published. This supersedes the earlier9/17 explicit-continuation-only state in this task's historical sections.
+- Preservation evidence: all3669 original source files byte/hash-identical; full9/15 source review and9/16 price review identical; all other5 queue rows/IDs unchanged; published10/7 trace identical apart from its per-read refreshed_at timestamp. No new Oracle acquisition or invented/changed price. Private before/after, cold-backup metadata and screenshot are in `production-validation-20261007/empty-review-auto-{before-20261008,after-20261009,backup}.json` and `empty-review-auto-local-20261009.png`, excluded from Git. Browser verified9/17 now opens the genuine price review, both other dates remain available, manual input blank and generation disabled; retained result tab12. Existing user tabs were not reloaded and no actual save/finalize button was clicked.
+- Integration/promotion: promote automatic0-item continuation and the separation of completed acquisition versus pending price decision to canonical product/data-flow/current-state at the integration gate; canonical files remain untouched in this feature task. Keep the owned worktree/service running. Real9/17 completion remains intentionally pending the user's nightly processing price; separately deferred universal XML/API population alignment and production deployment are not claimed resolved. Push this narrow fix to the already authorized arr0918/main without rewriting history.