Fix production ARR reads and add audited source field review

.project-docs/30-worklog/tasks/20261008-production-review-9e7b.md

@@ -0,0 +1,76 @@
+# Task: 修复生产取数并接入字段人工完善
+
+## Identity
+
+- Task ID: 20261008-production-review-9e7b
+- Mode: Feature
+- Branch: codex/arr-production-review
+- Worktree: /Users/chillishark/.codex/worktrees/arr-production-review
+- Base commit: 2417b1a41c851dd4d6df90703950ca90013a202f
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- 修复生产 OHIP 查询、环境内任务恢复及接口字段人工完善；保留 XML 和原筛选、定价、日报/月报规则。
+
+## Intent And Constraints
+
+- 用户授权修复并继续 2026-10-07 验证，已允许多个子智能体；仅此日期真实调用。原始数据不可变，人工修改留痕，完整采集和最终独立校验通过后才可提交 Finance/月报。未知主工作区改动不采用。
+
+## Outcome
+
+- Production direct reads now omit unsupported server sorting and use the platform's working GET `getProfiles` query. Original acquisition order, complete paging/recheck and response identity checks remain enforced. Legacy collection keeps its original sorting default.
+- Added source-field completion before deterministic processing: only candidate records' unresolved/invalid fields may be edited; optional absence requires an explicit decision. Original bytes are retained, revisioned decisions record the authenticated actor, and confirmation freezes a derived source. The same download request resumes from its saved acquisition without querying OHIP again. Existing price review, Finance validation, daily generation and monthly outbox behavior remain in use; XML processing is retained.
+- Browser recovery is scoped to this service/source context and user, preventing an old sandbox request from restoring into the production instance. Lost save/finalize responses, concurrent revisions and interrupted confirmation recover without a second processing intent.
+- Updated the existing local service at `http://127.0.0.1:8875/` to run this isolated checkout, retaining hotel57106, credentials, private database and output storage. Previous private launcher/config/plist were backed up before restart. No production deployment, remote push or integration into the unowned dirty primary checkout occurred.
+- Reused the complete, immutable real 2026-10-07 capture; verified all531 inventory files and both original hashes before importing into request `45e0e20ee75a46e098a0e32d650133a9`. Import made zero new Oracle calls. The live task is `needs_data_review`, no processing job exists, and it has26 unresolved fields across19 rows:1 room,18 block codes and7 package lists. No real business values were supplied or implicitly confirmed; no real daily/monthly was generated.
+
+## Verification
+
+- Python regression:185 tests passed with real disposable local PostgreSQL enabled and no skips across source review, direct processing, queue/runtime, local wrappers, Postgres integration, existing price review, OHIP acquisition/profile/collection. A subsequent review-suite run passed22 tests after atomic-publication recovery changes; the additional initial-publication crash recovery test passed separately (186 distinct Python tests in total).
+- JavaScript regression:25 tests passed; `node --check arr_web/static/app.js` and `git diff --check` passed. Shell browser automation was not used.
+- Saved production capture:176 recorded successful reads,58 ordered records, complete collection. Offline reader replay matched all recorded method/path/body requests and preserved fields/order. Actual source review reproduced19 affected rows/26 fields without changing the original source.
+- Local authenticated API: service and hotel context ready; latest task date2026-10-07, `needs_data_review`, `job_id=null`, `pending_count=26`, `can_finalize=false`.
+- CUA browser verification on the updated service: authenticated page shows date2026-10-07,26 field rows,0/26 confirmed, disabled generation button and original XML upload. Reload restored the same pending review. A fresh tab was needed because the old tab's browser-control connection timed out; the new result tab is retained as a deliverable. Screenshot contains the visible task and review context, no guest names.
+- Private evidence only (excluded from Git): `/Users/chillishark/Library/Application Support/ARR2.0/production-validation-20261007/compatible-day-d45e0fd2/capture`, `field-review-page-20261008.png`; saved-capture import receipt in production instance `processing/requests/45e0e20ee75a46e098a0e32d650133a9/saved-capture-import.json`. Capture manifest SHA256 `bcfeb6390fc553754b917f9c935a532916e6bd10d4e95ee43450895e760cd9fc`, original data SHA256 `805799ba2f3edd7f1cf18c14e5304908061d6194a241c5fc255192728b7f388a`.
+- Project documentation ownership drift check passed for this task; primary checkout's pre-existing documentation changes remain untouched.
+
+## Follow-ups
+
+- Staff must supply/confirm the26 actual field decisions and complete any subsequent existing price review before the real10/7 daily/monthly result can be verified. The room gap belongs to a cancelled reservation retained by the existing rules; no synthetic room or new status-based exclusion was introduced. Any proposed change to cancellation/no-show eligibility requires a separate business decision.
+- Integration owner should promote the accepted behavior and production compatibility evidence, then integrate this branch into the primary project. Keep this checkout while the local service runs from it. It is manually created, not eligible for automatic skill-managed retirement.
+- Production deployment/configuration and remote publishing are separate follow-ups. This turn only activated the local instance against the existing production read service.
+
+## Promotion Candidates
+
+- Update canonical current-state/data-flow/success-criteria with the separate upstream source-field review and its boundary with the existing price-only processor/Finance review. Preserve ADR-006's original scope; decide whether an additional ADR is appropriate at integration.
+- Promote the four supported direct search parameters, GET profile lookup compatibility, service-context browser recovery and immutable original/manual decision audit into integration-owned documentation.
+- Record that real10/7 acquisition is complete but its daily/monthly acceptance awaits staff decisions. Avoid claiming successful report generation from synthetic regression evidence.
+
+## Concurrent Task Gate
+
+- Passed: task_context.py start exited 0; status verified task ID, feature mode, branch and absolute worktree.
+- Base: 2417b1a41c851dd4d6df90703950ca90013a202f (non-overwriting legacy documentation bootstrap on ad2c592).
+- Other local owners: none. Primary checkout has unowned documentation changes, retained untouched.
+- Isolated linked checkout created manually for legacy bootstrap; not eligible for automatic managed retirement.
+
+## Project Context Loaded
+
+Read: memory-index, project-positioning, current-state latest September sections, decision-index, ADR-004/006/007, system-overview, module-map, data-flow, business-rules, success-criteria, evidence-index, reflection-index, commitments, stale-items, read-before-coding.
+
+- Goal: direct OHIP data and manual XML use shared deterministic rules and verified Finance/outbox/monthly.
+- Focus: production search/profile compatibility, scoped client recovery and source-field completion before processing.
+- Constraints: retain original source/order, reject incomplete collection, audit manual data changes, preserve existing price review and XML behavior. No credential or hotel routing changes.
+- Decisions: ADR-007 direct JSON; ADR-006 remains price-only for processor/Finance review. User now explicitly authorizes a separate upstream source-field review.
+- Evidence: private real 10/7 capture has 58 rows, complete acquisition with gaps; current page task accidentally restored old 9/15 sandbox request then failed502.
+- Stale docs: September live-query/delegation restrictions superseded by current explicit production verification and multi-agent consent. Current local production uses hotel57106 and separate private state.
+- Modules: integrations/ohip, arr_web downloads/direct executor/UI, targeted tests.
+- Gate: Passed.
+
+## Plan
+
+1. Production reader compatibility, preserving strict response identity and collection recheck.
+2. Durable revisioned field review before handoff; required candidate gaps only; immutable derived source and audit; same-request continuation.
+3. Authenticated review UI and context-scoped recovery.
+4. Synthetic regression and saved real 10/7 validation; activate local service safely and leave actual unresolved business values for user.