feat: add daily manual price review workflow

.project-docs/30-worklog/current-state.md

@@ -19,6 +19,84 @@ preserves its no-formula contract. Both publishers upload new workbook and `resu
 immutable OSS adapter, while download routing retains controlled-local compatibility for historical records and keeps
 `.web-jobs` queue state local.
 
+## Runtime Recovery On 2026-08-06
+
+- Restored the local ARR login page after a reported opening failure. No Web process was listening and the retained
+  Keychain-backed 8766 launcher still passed two removed Node/artifact-tool flags. Removed only those obsolete flags,
+  then started one detached `arr2-web-8766` Screen session. `/healthz` returns 200 and root redirects to login with no
+  browser console error. No login, upload, database, Finance or object-store mutation was performed. The existing
+  reboot-persistent supervision follow-up remains open.
+
+## Deployed And Accepted On 2026-08-06
+
+- Reconciled the live migration-016 function/comment semantics without rerunning 016, created a privacy-minimized
+  pre-017 checkpoint, and ran a transaction-only up/down probe. The first probe exposed a real legacy
+  `artifact_callback`/`direct_mcp` run-constraint drift and rolled back cleanly; corrected 017 preserves that contract.
+  Formally applied migration 017 SHA-256 `22a0578e…67b5b` under an advisory lock with all original business table counts
+  unchanged. The guarded down migration SHA-256 is `9e85af0c…29101`.
+- Closed incomplete runs 61–63 through the normal repository failure transition as
+  `REVIEW_SCHEMA_MIGRATION_MISSING`, retaining all three source artifacts and adding only failure-audit events. The
+  first post-migration upload, run 64, then exposed a 16-value/15-placeholder delivery INSERT bug and closed safely as
+  `DATABASE_WRITE_FAILED`; the placeholder and a focused regression were corrected.
+- Restarted Web as PID 24225 with all six authenticated readiness flags true. A subsequent exact-hash `0805.XML`
+  upload is now run 65 / open review case `dailyreview-878e45ae132b73c131560299b3b2dcb3`: the live page shows the two
+  expected Lian Tai keys and candidate prices at `0 / 2`, while confirmation remains disabled. PostgreSQL has one open
+  revision-0 case, two unset items and one required event, with no daily XLSX, manual manifest, Finance version, run
+  outbox or new monthly event. Historical daily version 28 remains rejected and unchanged. Finance-priced finalization
+  is the remaining authorized business step.
+- Subsequent employee interactions created two independent frozen cases: run 66 stores GRP1/LBLT as `2300/0`, and
+  latest run 67 stores `200/0`. Both stopped safely as retryable `generation_failed` with no Finance version or run
+  outbox event. Diagnosis found two finalization defects: the live artifact-kind constraint omitted
+  `manual_override_json`, and the Finance-version INSERT had 21 placeholders for 20 values. Migration 018
+  (`5600d825…cd00`) was rollback-probed and formally applied as the additive artifact-kind correction; the surplus SQL
+  placeholder was removed. A real PostgreSQL outer-transaction review-to-Finance slice now reaches one active version,
+  one manual row and one commit event before rolling back to zero residue.
+- Web is now PID 26286 with all six readiness flags true. The review UI/API displays and accepts only non-negative
+  integers while preserving exact `.00` database/manifest normalization. At the finalization-repair handoff, run 67
+  was revision 2 `generation_failed`, read back as `200` and `0`, and had not been retried by that repair; run 66 held a
+  different frozen GRP1 value. That checkpoint is historical and the later browser-visible state is recorded below.
+  Historical version 28 remained rejected and unchanged at the repair checkpoint.
+- The manual-review UI follow-up is runtime-active without a Web restart because static files are read on each request.
+  `待人工处理` plus progress are one operation button that focuses/scrolls the price panel without opening the task
+  log; retryable cases omit the removed frozen-list sentence; finalization projects `日报生成中`; and the complete
+  review panel/dialog/error surface follows the Chinese/English/Thai selector. Authenticated read-only browser QA
+  verified both a retryable and an editable case. During that QA, history had advanced outside this task: jobs
+  `arrjob-e36d8c4c133b48dbb81a57a002e41d76` and `arrjob-cce736734c5e4731b733f03c4a9a3b76` displayed succeeded, while
+  `arrjob-d3bbbb435cae4559b5f69cb7ea331cee` and `arrjob-dddc27119bea43b19588c78eac087763` still displayed needs-review.
+  This UI task issued no price save, finalize/retry/cancel submission or upload, so it does not attribute those external
+  lifecycle changes to itself.
+
+## Diagnosed On 2026-08-06
+
+- Diagnosed the user's fresh post-v4 `0805.XML` upload read-only. The page shows `请求未完成`, while PostgreSQL has
+  three new v4 run/attempt shells (61–63 / 53–55) stuck `running`, three exact 948,683-byte source artifacts, no
+  delivery, Finance version or outbox event. Live database effects match 016 but migration 017 is absent: review tables
+  do not exist and lifecycle checks permit only success/failed. An isolated same-hash v4 replay plus independent
+  validation succeeds as `review_required` with exactly `LIAN TAI / LBLT / 0` and `LIAN TAI / GRP1 / 1150`. The Web
+  transaction therefore fails on the missing review table and its best-effort closure fails at the same dependency.
+  No live migration, cleanup, re-upload, review edit or business write was performed.
+- Diagnosed deployed daily job `arrjob-f1cd01f5fddd458cbdafada0ec7dd14d` read-only. A local XML with the exact logged
+  948,683-byte/SHA-256 identity reproduces the processor-3.0.0 failure: Lian Tai `LBLT + 0` and `GRP1 + 1150` are absent
+  from the frozen price reference. All 151 `validation_failed` outcomes are `BATCH_NOT_VALIDATED` fallout; they are not
+  separate source-field errors. Finance version 28 remains rejected, and no price, code, server, database or job state
+  was changed. Finance must approve the missing totals or an explicit zero-night rule before rebuild, exact replay and a
+  fresh upload.
+
+## Implemented Locally On 2026-08-06
+
+- Added the v4 `PRICE_UNMATCHED`-only manual-price-review path for the active fixed-processor/artifact-callback flow.
+  A pure missing-price result records an audited, privacy-minimized `awaiting_review` case and returns `needs_review`
+  without a daily XLSX, Finance version, rejected version, failure outbox or monthly event. Mixed errors remain failures.
+- Authenticated/CSRF review APIs and the Daily Report panel page grouped keys, candidate fixed prices, aggregate impact
+  and revision-locked non-negative integer prices (including `0`), then normalize exact `.00` storage/manifest values. Finalization freezes canonical provenance, rematerializes
+  the registered source XML and independently replays before its one atomic Finance/outbox commit. Infrastructure
+  retries retain the manifest; deterministic final errors close the review/run.
+- Migrations 017/018 and their guarded down migrations, v4 processor package/schema, trace v4 and package checksum parity were
+  locally verified. After the navigation/progress/localization follow-up, the dependency-complete `.venv` suite passes
+  393 tests with three intentional private-fixture skips; direct-MCP remains an explicit v3 no-review compatibility
+  projection. The controlled rollout and later browser-visible user activity supply live review/success state, while
+  this follow-up itself remains UI-only and produced no Finance or monthly mutation.
+
 ## Completed On 2026-08-04
 
 - Repaired deployment availability for monthly and company report artifacts. Removed the monthly Node/private-package