feat: add daily manual price review workflow

.project-docs/30-worklog/current-state.md

@@ -19,6 +19,84 @@ preserves its no-formula contract. Both publishers upload new workbook and `resu
 immutable OSS adapter, while download routing retains controlled-local compatibility for historical records and keeps
 `.web-jobs` queue state local.
 
+## Runtime Recovery On 2026-08-06
+
+- Restored the local ARR login page after a reported opening failure. No Web process was listening and the retained
+  Keychain-backed 8766 launcher still passed two removed Node/artifact-tool flags. Removed only those obsolete flags,
+  then started one detached `arr2-web-8766` Screen session. `/healthz` returns 200 and root redirects to login with no
+  browser console error. No login, upload, database, Finance or object-store mutation was performed. The existing
+  reboot-persistent supervision follow-up remains open.
+
+## Deployed And Accepted On 2026-08-06
+
+- Reconciled the live migration-016 function/comment semantics without rerunning 016, created a privacy-minimized
+  pre-017 checkpoint, and ran a transaction-only up/down probe. The first probe exposed a real legacy
+  `artifact_callback`/`direct_mcp` run-constraint drift and rolled back cleanly; corrected 017 preserves that contract.
+  Formally applied migration 017 SHA-256 `22a0578e…67b5b` under an advisory lock with all original business table counts
+  unchanged. The guarded down migration SHA-256 is `9e85af0c…29101`.
+- Closed incomplete runs 61–63 through the normal repository failure transition as
+  `REVIEW_SCHEMA_MIGRATION_MISSING`, retaining all three source artifacts and adding only failure-audit events. The
+  first post-migration upload, run 64, then exposed a 16-value/15-placeholder delivery INSERT bug and closed safely as
+  `DATABASE_WRITE_FAILED`; the placeholder and a focused regression were corrected.
+- Restarted Web as PID 24225 with all six authenticated readiness flags true. A subsequent exact-hash `0805.XML`
+  upload is now run 65 / open review case `dailyreview-878e45ae132b73c131560299b3b2dcb3`: the live page shows the two
+  expected Lian Tai keys and candidate prices at `0 / 2`, while confirmation remains disabled. PostgreSQL has one open
+  revision-0 case, two unset items and one required event, with no daily XLSX, manual manifest, Finance version, run
+  outbox or new monthly event. Historical daily version 28 remains rejected and unchanged. Finance-priced finalization
+  is the remaining authorized business step.
+- Subsequent employee interactions created two independent frozen cases: run 66 stores GRP1/LBLT as `2300/0`, and
+  latest run 67 stores `200/0`. Both stopped safely as retryable `generation_failed` with no Finance version or run
+  outbox event. Diagnosis found two finalization defects: the live artifact-kind constraint omitted
+  `manual_override_json`, and the Finance-version INSERT had 21 placeholders for 20 values. Migration 018
+  (`5600d825…cd00`) was rollback-probed and formally applied as the additive artifact-kind correction; the surplus SQL
+  placeholder was removed. A real PostgreSQL outer-transaction review-to-Finance slice now reaches one active version,
+  one manual row and one commit event before rolling back to zero residue.
+- Web is now PID 26286 with all six readiness flags true. The review UI/API displays and accepts only non-negative
+  integers while preserving exact `.00` database/manifest normalization. At the finalization-repair handoff, run 67
+  was revision 2 `generation_failed`, read back as `200` and `0`, and had not been retried by that repair; run 66 held a
+  different frozen GRP1 value. That checkpoint is historical and the later browser-visible state is recorded below.
+  Historical version 28 remained rejected and unchanged at the repair checkpoint.
+- The manual-review UI follow-up is runtime-active without a Web restart because static files are read on each request.
+  `待人工处理` plus progress are one operation button that focuses/scrolls the price panel without opening the task
+  log; retryable cases omit the removed frozen-list sentence; finalization projects `日报生成中`; and the complete
+  review panel/dialog/error surface follows the Chinese/English/Thai selector. Authenticated read-only browser QA
+  verified both a retryable and an editable case. During that QA, history had advanced outside this task: jobs
+  `arrjob-e36d8c4c133b48dbb81a57a002e41d76` and `arrjob-cce736734c5e4731b733f03c4a9a3b76` displayed succeeded, while
+  `arrjob-d3bbbb435cae4559b5f69cb7ea331cee` and `arrjob-dddc27119bea43b19588c78eac087763` still displayed needs-review.
+  This UI task issued no price save, finalize/retry/cancel submission or upload, so it does not attribute those external
+  lifecycle changes to itself.
+
+## Diagnosed On 2026-08-06
+
+- Diagnosed the user's fresh post-v4 `0805.XML` upload read-only. The page shows `请求未完成`, while PostgreSQL has
+  three new v4 run/attempt shells (61–63 / 53–55) stuck `running`, three exact 948,683-byte source artifacts, no
+  delivery, Finance version or outbox event. Live database effects match 016 but migration 017 is absent: review tables
+  do not exist and lifecycle checks permit only success/failed. An isolated same-hash v4 replay plus independent
+  validation succeeds as `review_required` with exactly `LIAN TAI / LBLT / 0` and `LIAN TAI / GRP1 / 1150`. The Web
+  transaction therefore fails on the missing review table and its best-effort closure fails at the same dependency.
+  No live migration, cleanup, re-upload, review edit or business write was performed.
+- Diagnosed deployed daily job `arrjob-f1cd01f5fddd458cbdafada0ec7dd14d` read-only. A local XML with the exact logged
+  948,683-byte/SHA-256 identity reproduces the processor-3.0.0 failure: Lian Tai `LBLT + 0` and `GRP1 + 1150` are absent
+  from the frozen price reference. All 151 `validation_failed` outcomes are `BATCH_NOT_VALIDATED` fallout; they are not
+  separate source-field errors. Finance version 28 remains rejected, and no price, code, server, database or job state
+  was changed. Finance must approve the missing totals or an explicit zero-night rule before rebuild, exact replay and a
+  fresh upload.
+
+## Implemented Locally On 2026-08-06
+
+- Added the v4 `PRICE_UNMATCHED`-only manual-price-review path for the active fixed-processor/artifact-callback flow.
+  A pure missing-price result records an audited, privacy-minimized `awaiting_review` case and returns `needs_review`
+  without a daily XLSX, Finance version, rejected version, failure outbox or monthly event. Mixed errors remain failures.
+- Authenticated/CSRF review APIs and the Daily Report panel page grouped keys, candidate fixed prices, aggregate impact
+  and revision-locked non-negative integer prices (including `0`), then normalize exact `.00` storage/manifest values. Finalization freezes canonical provenance, rematerializes
+  the registered source XML and independently replays before its one atomic Finance/outbox commit. Infrastructure
+  retries retain the manifest; deterministic final errors close the review/run.
+- Migrations 017/018 and their guarded down migrations, v4 processor package/schema, trace v4 and package checksum parity were
+  locally verified. After the navigation/progress/localization follow-up, the dependency-complete `.venv` suite passes
+  393 tests with three intentional private-fixture skips; direct-MCP remains an explicit v3 no-review compatibility
+  projection. The controlled rollout and later browser-visible user activity supply live review/success state, while
+  this follow-up itself remains UI-only and produced no Finance or monthly mutation.
+
 ## Completed On 2026-08-04
 
 - Repaired deployment availability for monthly and company report artifacts. Removed the monthly Node/private-package

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,13 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-08-06 | Repair manual-review navigation/progress and add English/Thai | Merged the status chip and progress into one review action that focuses the operation panel while row clicks still own logs; removed the frozen-case sentence; set upload status to `日报生成中` before finalization; localized the complete review UI and review API errors. Live browser QA covered zh/en/th and dialog copy without submitting a business action. Full suite: 393 passed, 3 intentional skips | Current state, success criteria, module map, [UI evidence](../50-evidence/topics/2026-08-06-daily-review-ui-navigation-i18n.md), scoped planning record |
+| 2026-08-06 | Use integer review prices and repair `请求未完成` finalization | Changed review display/PATCH input to non-negative integer text while retaining canonical `.00` storage and replay. Bound the visible failure to runs 66/67, repaired a 21-placeholder/20-value Finance INSERT and the missing `manual_override_json` artifact kind through additive migration 018, then proved the full PostgreSQL finalization path in an outer rollback. Web PID 26286 is healthy; latest run 67 remains explicitly retryable with frozen `200/0` and no Finance/outbox mutation. Full suite: 387 passed, 3 intentional skips | ADR/domain/architecture/current state, migration/deployment ledgers, [repair evidence](../50-evidence/topics/2026-08-06-integer-review-finalize-repair.md), scoped planning record |
+| 2026-08-06 | Deploy migration 017 and restore live `0805.XML` manual review | Reconciled already-live 016 semantics, corrected a legacy run-constraint drift found by rollback probe, formally applied 017 with unchanged business counts, closed runs 61–63 as infrastructure failures, then fixed a 16-value/15-placeholder delivery INSERT exposed by the first acceptance upload. Restarted Web and proved run 65 opens the exact two-key review panel at revision 0 with no prices, daily XLSX, Finance version or daily-commit/monthly event. Historical version 28 remains rejected | Migration ledger, current state, [live rollout evidence](../50-evidence/topics/2026-08-06-live-daily-price-review-rollout.md), SHA-protected runtime checkpoints, scoped planning record |
+| 2026-08-06 | Diagnose fresh `0805.XML` v4 upload not entering review | Proved the exact file correctly yields independently valid v4 `review_required` with two keys, but live `booking_test` lacks migration 017 tables/states. Three new runs remain `running` after source registration because review commit and best-effort closure both depend on the missing table; no delivery, Finance or outbox fact exists. Live 016 effects are present despite the checked-in ledger saying pending. No database/runtime/business mutation was performed; 017 deployment and explicit shell cleanup require operator authorization | Current state, [live mismatch evidence](../50-evidence/topics/2026-08-06-live-0805-review-migration-mismatch.md), evidence index, stale item, scoped planning record |
+| 2026-08-06 | Restore local ARR page opening | Found no listener or Screen session and traced startup failure to the owner-local Keychain launcher passing retired Node/artifact-tool arguments. Removed only those flags, started one detached 8766 Web session, verified `/healthz` 200 and the login redirect with no browser console errors. No login, upload, database, Finance or object-store mutation occurred; reboot-persistent supervision remains open | Current state, evidence/index, scoped planning record |
+| 2026-08-06 | Implement Daily `PRICE_UNMATCHED` manual-price review | Added active processor/result v4, canonical frozen override replay, independent review/manual validation, migration 017/down, review lifecycle/repository/API/trace/UI, package parity and focused browser QA. Pure price-only output is `needs_review` without Finance/outbox; final source replay is the first Finance/monthly event boundary. The complete `.venv` suite passes 384 tests with three intentional private-fixture skips; the retired direct-MCP path is an explicit v3 no-review projection. No live database, OSS or job was mutated; deployment requires 016 → 017 backup/disposable rollback probe | ADR-006, data-flow/business rules/success criteria, deployment runbook, migration ledger, [implementation evidence](../50-evidence/topics/2026-08-06-daily-price-review-implementation.md), stale deployment item |
+| 2026-08-06 | Diagnose deployed 2026-08-05 Daily `PRICE_UNMATCHED` | Verified the Desktop XML exactly matches the logged 948,683-byte/SHA-256 identity and reproduced the failure with processor 3.0.0. The only actionable misses are Lian Tai `LBLT + 0` and `GRP1 + 1150`; all 151 validation-failed rows are atomic `BATCH_NOT_VALIDATED` fallout. Both checked-in price references are identical and lack the keys. No price, code, runtime, database or job state changed; Finance approval is required before rebuild and fresh upload | Current state, price-unmatched evidence/index, stale item, scoped planning record |
 | 2026-08-04 | Fix false monthly XLSX output-validation failure on 440-row reports | Replaced read-only workbook random-cell validation with sequential `iter_rows` scanning and changed Excel-decimal readback checks to an explicit `0.000001` tolerance. Sheet/header/dimension checks, semantic SHA-256, formula count and exact `=R[row]*C[row]*G[row]` formulas remain strict. Added a 440-row, three-date, five-sheet decimal regression; the XLSX test and 18-case monthly builder/publishing/worker/service/repository suite pass. No outbox, database or live runtime state was changed | Current state, report-artifact evidence, scoped planning record |
 | 2026-08-04 | Remove private monthly XLSX runtime and make report artifacts deployment-safe | Replaced monthly and company report builders' production path with Python/openpyxl; preserved the exact monthly `TOTAL PRICE` formula and workbook semantic checks; published new monthly/company XLSX and `result.json` artifacts through the existing OSS adapter while retaining legacy local reads; added migration 016 for OSS monthly artifacts, removed Node builders/flags, and added OSS/local download routing tests. Targeted report/deployment tests pass; the full local suite has 307 passes, 3 skips and 8 environment-only errors (`httpx`/Aliyun test setup). Docker and live OSS were intentionally not run in this development environment | Current state, architecture, deployment runbook, migration ledger, evidence/index, stale item |
 | 2026-08-03 | Make company-report XLSX generation deploy without private npm | Replaced the company-report builder's Node/private `@oai/artifact-tool` runtime dependency with Python/openpyxl workbook generation and self-validation, removed the private package dependency, enabled `--enable-company-reports` in Compose Web, and documented that only the monthly worker still needs Node/artifact-tool packaging. Focused company-report and deployment-entrypoint tests pass 19/19; no migration or live deployment was performed | Current state/history, architecture, deployment evidence/index, stale item, runbooks |