fix: tolerate spreadsheet decimal roundoff

.project-docs/30-worklog/current-state.md

@@ -27,6 +27,11 @@ immutable OSS adapter, while download routing retains controlled-local compatibi
   identities while preserving historical local rows. Local fake-object-store, builder, publisher, download-router and
   migration tests pass; the development machine has no Docker, so CentOS image/Compose acceptance is explicitly handed
   to the operator. No live report or business data was changed.
+- Fixed the reported `MONTHLY_REPORT_OUTPUT_VALIDATION_FAILED` false negative for the 2026-08-03 440-row monthly
+  workbook. `_validate_workbook` now scans read-only sheets sequentially with `iter_rows` and compares Excel-decimal
+  readback values within `0.000001`; sheet order, headers, dimensions, semantic identity, formula count and exact
+  `=R[row]*C[row]*G[row]` formulas remain strict. A 440-row/five-sheet decimal regression and the 18-case monthly
+  builder/publishing/worker/service/repository suite pass. The dead/pending outbox events were not modified.
 
 ## Completed On 2026-08-03
 

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,7 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-08-04 | Fix false monthly XLSX output-validation failure on 440-row reports | Replaced read-only workbook random-cell validation with sequential `iter_rows` scanning and changed Excel-decimal readback checks to an explicit `0.000001` tolerance. Sheet/header/dimension checks, semantic SHA-256, formula count and exact `=R[row]*C[row]*G[row]` formulas remain strict. Added a 440-row, three-date, five-sheet decimal regression; the XLSX test and 18-case monthly builder/publishing/worker/service/repository suite pass. No outbox, database or live runtime state was changed | Current state, report-artifact evidence, scoped planning record |
 | 2026-08-04 | Remove private monthly XLSX runtime and make report artifacts deployment-safe | Replaced monthly and company report builders' production path with Python/openpyxl; preserved the exact monthly `TOTAL PRICE` formula and workbook semantic checks; published new monthly/company XLSX and `result.json` artifacts through the existing OSS adapter while retaining legacy local reads; added migration 016 for OSS monthly artifacts, removed Node builders/flags, and added OSS/local download routing tests. Targeted report/deployment tests pass; the full local suite has 307 passes, 3 skips and 8 environment-only errors (`httpx`/Aliyun test setup). Docker and live OSS were intentionally not run in this development environment | Current state, architecture, deployment runbook, migration ledger, evidence/index, stale item |
 | 2026-08-03 | Make company-report XLSX generation deploy without private npm | Replaced the company-report builder's Node/private `@oai/artifact-tool` runtime dependency with Python/openpyxl workbook generation and self-validation, removed the private package dependency, enabled `--enable-company-reports` in Compose Web, and documented that only the monthly worker still needs Node/artifact-tool packaging. Focused company-report and deployment-entrypoint tests pass 19/19; no migration or live deployment was performed | Current state/history, architecture, deployment evidence/index, stale item, runbooks |
 | 2026-08-03 | Execute controlled fix and live-accept 2026-08 `01-10` company report | With explicit confirmation, stopped only the stale PID 11176 and started new listener PID 54127 through the existing Keychain-backed launcher. One authorized job `05cc547d…` succeeded 5/5 with row counts `54/18/7/1/15`, captured active Booking batch-7 source metadata, reused the existing version/artifact identities, and passed five HTTP download/hash checks. Logout and temporary-file cleanup completed; no Booking/Finance source or fact mutation occurred | Current state, runtime evidence/index, stale item, commitments, scoped planning record |

.project-docs/50-evidence/topics/2026-08-04-report-artifact-deployability.md

@@ -27,6 +27,20 @@
 - The Docker root dependency chain now installs `openpyxl==3.1.5` through `requirements-monthly-reports.txt`; no
   separate npm or Codex-runtime bootstrap is needed.
 
+## Follow-up: 2026-08-03 monthly validation failure
+
+- Operator-provided production evidence showed a 440-row, multi-sheet 2026-08-03 workbook whose sheet names and
+  channel counts matched, and which passed manual validation when reopened non-read-only with numeric tolerance. The
+  worker nevertheless emitted `MONTHLY_REPORT_OUTPUT_VALIDATION_FAILED`; outbox event 31 became `dead` and event 30
+  remained pending/retrying. This isolates the failure to the workbook-validation implementation rather than
+  container, worker startup, database or OSS publication.
+- `_validate_workbook` no longer calls `worksheet.cell(row, column)` on a `read_only=True` workbook. It consumes each
+  sheet header and data row in order with `iter_rows`, rejects missing/extra rows or columns, and keeps strict formula
+  and semantic checks. Excel-decimal values now use a finite-Decimal absolute tolerance of `0.000001`.
+- Regression coverage builds 440 rows across all five standard sheets over three daily versions, with decimal rate and
+  price values plus KB rows. The builder validates 440 formulas successfully; the dedicated XLSX class passes 2/2 and
+  the monthly builder/publishing/worker/service/repository slice passes 18/18.
+
 ## Verification
 
 - Targeted report/web/storage/migration suite: 41 tests passed; builder/company integration slice: 15 tests passed