feat: add daily manual price review workflow

.project-docs/50-evidence/evidence-index.md

@@ -4,6 +4,13 @@ Use this index for searchable, traceable evidence records.
 
 | Date | Topic | Status | Source | Detail |
 |---|---|---|---|---|
+| 2026-08-06 | Daily review navigation, progress and three-language UI | Implemented and runtime-active | [Evidence topic](topics/2026-08-06-daily-review-ui-navigation-i18n.md) | The whole needs-review status now opens/focuses the operation panel without opening logs; the unwanted retry sentence is removed; finalization sets `日报生成中` before its request; review UI/API errors are localized in Chinese, English and Thai. Live read-only browser QA and 393 tests pass; no price/finalize/cancel/upload mutation was invoked. |
+| 2026-08-06 | Integer review prices and finalization repair | Deployed repair; run-67 checkpoint is historical | [Evidence topic](topics/2026-08-06-integer-review-finalize-repair.md) | Review amounts now display/accept integers and normalize to canonical `.00`. Migration 018 fixes the omitted manual-manifest artifact kind and the Finance INSERT now has 20 binds; rollback probes, live readiness and the then-current 387-test suite passed. Run 67 was still frozen at `200/0` when that repair ended; later browser-visible lifecycle state is recorded in the UI follow-up topic. |
+| 2026-08-06 | Live Daily price-review rollout and `0805.XML` acceptance | Historical initial-review snapshot; superseded by repair topic | [Evidence topic](topics/2026-08-06-live-daily-price-review-rollout.md) | Reconciled live 016 semantics without rerunning it, corrected and applied 017 after an exact up/down rollback probe, closed runs 61–63, fixed a delivery-placeholder runtime bug, and proved run 65 reached the two-key live panel with no Finance/report/outbox effect. Later runs and current retry instructions are in the integer/finalization repair topic. |
+| 2026-08-06 | Fresh `0805.XML` did not enter v4 manual review | Historical diagnosis; resolved by live rollout | [Evidence topic](topics/2026-08-06-live-0805-review-migration-mismatch.md) | Exact-source v4 replay isolated the absent-017 failure. The authorized follow-up applied corrected 017, closed the three shells, fixed the delivery INSERT and proved a fresh run enters the two-key review; see the live rollout topic above. |
+| 2026-08-06 | Local ARR page-opening recovery | Restored locally; supervision follow-up unchanged | [Evidence topic](topics/2026-08-06-web-launcher-compatibility-recovery.md) | No ARR Web listener was present. The owner-local Keychain launcher still supplied two removed Node/artifact-tool flags; deleting only those flags restored 8766, `/healthz` 200 and the login page with no console error. No business write occurred. |
+| 2026-08-06 | Daily `PRICE_UNMATCHED` manual-price review implementation | Implemented; repair and UI follow-ups active | [Evidence topic](topics/2026-08-06-daily-price-review-implementation.md) | v4 creates a no-Finance `needs_review` receipt only for pure missing fixed-price keys, freezes a manifest, replays original XML for final success, and preserves retry/audit/privacy boundaries. Integer/finalization and navigation/i18n behavior are covered by the two newer evidence topics. |
+| 2026-08-06 | 2026-08-05 Daily `PRICE_UNMATCHED` | Historical diagnosis and frozen-case checkpoint | [Evidence topic](topics/2026-08-06-daily-price-unmatched.md) | The original v3 diagnosis isolated the two missing Lian Tai keys. Its later run-67 `200/0` generation-failed statement is a historical pre-retry snapshot; current browser-visible lifecycle changes are recorded in the UI follow-up, while rejected version 28 remains immutable in the last authoritative database audit. |
 | 2026-08-04 | Report artifact deployability repair | Implemented locally; CentOS/Docker acceptance pending operator execution | [Evidence topic](topics/2026-08-04-report-artifact-deployability.md) | Monthly XLSX now uses Python/openpyxl with exact row-relative formulas and semantic validation. New monthly/company workbook and result artifacts use the existing immutable OSS adapter; download routing supports OSS plus legacy local records, and migration 016 permits OSS monthly identities. Focused report/storage/Web/migration tests pass; Docker/real OSS were intentionally not run locally. |
 | 2026-08-04 | Deployed monthly-report download diagnosis | Superseded for implementation; optional authenticated remote capture pending | [Evidence topic](topics/2026-08-04-deployed-monthly-download-diagnosis.md) | The pre-repair Node/local-output diagnosis remains useful as historical cause evidence. The implementation now uses Python/openpyxl plus OSS-backed report identities and legacy local fallback; remote acceptance still belongs on the CentOS deployment. |
 | 2026-08-03 | Company-report openpyxl builder for deployment | Implemented; focused deployment checks pass | [Evidence topic](topics/2026-08-03-company-report-openpyxl-builder.md) | CentOS Docker build failed because public npm cannot install private `@oai/artifact-tool`. Company-report XLSX generation now runs through Python/openpyxl in Web, while monthly worker packaging remains the only Node/artifact-tool concern. Focused company-report/deployment tests pass 19/19. |

.project-docs/50-evidence/topics/2026-08-06-daily-price-review-implementation.md

@@ -0,0 +1,62 @@
+# Daily PRICE_UNMATCHED manual-price review implementation
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Implemented; integer-input/finalization repair deployed, explicit employee retry pending
+- Scope: `artifact_callback/fixed_processor` daily XML path only; legacy `direct_mcp` remains an explicit v3,
+  no-review compatibility projection
+- Confidence: High; local regression plus the later controlled migration/runtime and exact-XML initial-review acceptance agree
+- Last verified: 2026-08-06
+- Stale trigger: a later migration, processor/rule change, successful run-67 retry, or new 0805 re-upload
+
+## Implemented boundary
+
+- Active processor/result schemas are v4. A result becomes `review_required` only when its non-empty actionable error
+  set is entirely `PRICE_UNMATCHED`; it exits technically successfully with `result.json` and
+  `structured-result.json` only, no daily/exception XLSX.
+- The review result includes candidate auto-priced rows, grouped normalized `(company, Rate Code, Opera price)` issues,
+  existing fixed-price comparisons and aggregate room/room-night impact. It contains no guest name, comment or raw
+  trace in the review API/read model.
+- Staff PATCH only a verified missing key using a non-negative integer string, including `0`. ARR normalizes it to
+  exact `numeric(18,2)` and canonical `.00` manifest text. Case revision, session username, old/new price and timestamps
+  are permanently recorded without a free-form note field.
+- Finalization freezes canonical JSON bound to job/case/source SHA/business date/processor/rules/full issue key set and
+  re-materializes the registered original XML. Processor and independent validator both replay that exact manifest;
+  final retained manual rows use `pricing_method=manual_review` and `MANUAL_PRICE_APPLIED`.
+- Initial `recorded_review` creates no Finance/rejected version, download, `arr.processing_failed` or monthly event.
+  One final atomic success creates/activates Finance lineage and emits `arr.daily_version_committed`. Infrastructure
+  errors retain the frozen manifest as `generation_failed`; deterministic final errors fail the case/run.
+
+## Evidence
+
+- `.venv/bin/python -m unittest discover -s tests -p 'test_*.py' -v`: 387 passed, with three intentional skips for a
+  private acceptance fixture not bundled in the repository. This includes active v4 behavior and direct-MCP v3
+  no-review compatibility.
+- `python3 -m unittest tests.test_arr_opera_daily_ingest -v`: 14 passed, including pure-review grouping, mixed-error
+  failure, zero-price final replay and package source/archive parity.
+- `python3 -m unittest tests.test_arr_ingestion_validation -v`: 7 passed for outer review/manual independent replay.
+- `python3 -m unittest tests.test_arr_ingestion_postgres -v`: 16 passed, including source-artifact reload plan, no-Finance
+  review receipt and deterministic-final-failure audit path.
+- `python3 -m unittest tests.test_arr_programmatic -v`: 5 passed, including original-source `0.00` final replay and
+  deterministic finalization failure closure.
+- `python3 -m unittest tests.test_arr_web -v`: covers authenticated/CSRF review routes, strict integer grammar and
+  privacy-safe response shape. `tests.test_arr_web_job_trace`, `tests.test_arr_web_repository_schema` and migration
+  static tests also passed during the implementation run.
+- `shasum -a 256 -c CHECKSUMS.sha256` passes after rebuilding byte-identical `.zip`/`.skill`; archive filenames are
+  UTF-8-preserved, including `价格对照.xlsx`.
+- Browser QA used a temporary localhost fake service: logged in with test-only credentials, opened the review panel,
+  rendered candidate/impact fields, saved `0`, finalized to a successful state, and observed no browser console
+  errors. No production service, private XML, database or object storage was used.
+
+## Live follow-up
+
+- The authorized follow-up reconciled already-live 016 semantics, corrected and applied 017 after an exact up/down
+  rollback probe, fixed a delivery-placeholder defect exposed by the first real attempt, and proved run 65 reaches the
+  expected two-key initial-review state with no Finance/event change. See
+  `2026-08-06-live-daily-price-review-rollout.md`.
+- A later repair changed the operator surface to integer prices, applied additive migration 018 for the omitted
+  `manual_override_json` artifact kind, and corrected the Finance INSERT bind count. Latest run 67 remains frozen at
+  `200/0` and awaits an explicit employee retry; see `2026-08-06-integer-review-finalize-repair.md`.
+- Remaining evidence is Finance-owned finalization: verify run 67's frozen values, retry once, require 153 retained lines
+  with two `manual_review` rows and one final daily-commit/monthly event, and leave rejected version 28 unchanged.

.project-docs/50-evidence/topics/2026-08-06-daily-price-unmatched.md

@@ -0,0 +1,48 @@
+# 2026-08-05 Daily PRICE_UNMATCHED diagnosis
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Latest frozen review awaits explicit employee retry after deployed technical repair
+- Scope: Daily job `arrjob-f1cd01f5fddd458cbdafada0ec7dd14d`, rejected Finance version 28
+- Confidence: Fact for the hash-matched local replay and checked-in reference; production rule-set binary identity remains unproven because the supplied trace omits `rule_set_sha256`
+- Source: operator-supplied ARR trace, hash-matched `0805.XML`, deterministic processor 3.0.0 replay, structured failure result, fixed price-reference workbook
+- Last verified: 2026-08-06
+- Stale trigger: a successful run-67 retry, a price/rule deployment, or a fresh processing job for business date 2026-08-05
+
+## Question
+
+Why did the deployed 2026-08-05 Opera XML daily job fail with `PRICE_UNMATCHED`, and do the reported 151 validation-failed rows represent separate bad source records?
+
+## Evidence
+
+- The server trace reports source size 948,683 bytes, rejected version 28 and outcomes `199 source = 46 excluded + 151 validation_failed + 2 price_unmatched`, with no duplicates or retained output.
+- The read-only Desktop XML has the exact logged size and SHA-256. An isolated replay with checked-in processor 3.0.0 exits 2 and creates only `result.json`, `structured-result.json` and `异常清单.xlsx`.
+- The two actionable errors are:
+  - `reservation[2]`: Lian Tai + `LBLT` + Opera amount `0`; zero-night stay.
+  - `reservation[64]`: Lian Tai + `GRP1` + Opera amount `1150`; one-night stay.
+- Every one of the 151 `validation_failed` records carries `BATCH_NOT_VALIDATED`; 150 also carry `PRICE_REFERENCE_MATCHED`, and one carries the approved `ZERO_PRICE_EXCEPTION`. They are atomic batch fallout, not 151 independent field/date errors.
+- Read-only artifact-tool inspection of `arr-opera-daily-ingest/references/价格对照.xlsx` shows Lian Tai `GRP1` mappings only at Sheet1 rows 23–28 for Opera amounts `900/1200/1300/1400/1800/2400`, and Lian Tai `LBLT` mappings at rows 40/42/43 for `900/1400/2400`. Neither exact target exists.
+- Both checked-in price-reference workbooks are byte-identical at SHA-256 `123d1d1ea0e28ce481a63dfdbe4bd22b5e6069c585a8cbde4194376ed18fb0d6` and have not changed since commit `a701de9` (2026-07-29).
+- The local replay rule-set SHA is `c41257208324a43e711de13ec9776a5e6486db334757f152531bf8292a2018eb`. The server trace exposes only processor version 3.0.0, so exact production rule-set hash comparison is not available from that trace alone.
+
+## Finding
+
+The deterministic processor correctly failed under the current frozen rules because two exact normalized price keys are absent. Numeric formatting and trailing rate-code spaces are not the cause. The `总价` values cannot be inferred safely from neighboring mappings, and zero nights do not bypass price-key validation under the current approved rule.
+
+## Impact
+
+- The deployed v4 workflow created review cases instead of another rejected Finance version. Latest run 67 has a frozen
+  GRP1/LBLT manifest of `200/0` and remains retryable `generation_failed` after two repaired infrastructure defects;
+  it still has no Finance version or run outbox event. Run 66 separately retains `2300/0`, and run 65 remains unset.
+- The values apply only to their own task and do not change the fixed reference table. No automatic retry or re-upload
+  is safe because a successful final replay is the Finance/monthly commit boundary.
+- Keep rejected version 28 as immutable failure history. Only an explicitly authorized successful final replay may
+  activate Finance facts and trigger monthly processing.
+
+## Open Items
+
+- Refresh/login, open latest run 67, confirm its frozen `LBLT=0` and `GRP1=200` values are intended, then invoke its
+  retry once. Do not select run 66 accidentally because its frozen GRP1 value differs.
+- After success, verify 153 retained rows, two `manual_review` rows, one active Finance version and exactly one new
+  daily-commit/monthly event.

.project-docs/50-evidence/topics/2026-08-06-daily-review-ui-navigation-i18n.md

@@ -0,0 +1,51 @@
+# Daily Review UI Navigation, Progress And I18n
+
+Date: 2026-08-06  
+Status: implemented and runtime-active  
+Scope: authenticated desktop Daily Report UI only
+
+## Reported Problems
+
+- Clicking `待人工处理` opened the task log instead of the manual-price operation panel.
+- A retryable frozen case displayed an unwanted frozen-manifest explanation.
+- Final confirmation did not change the upload-card status from `等待人工定价` to `日报生成中` while the synchronous
+  request was running.
+- The added manual-price module was not localized with the existing Chinese/English/Thai selector.
+
+## Root Cause And Change
+
+- The history row owned the log-opening click/keyboard behavior, while only the small `复核 x / y` child button owned
+  `data-open-price-review`. The status chip therefore fell through to the row action. Status plus progress are now one
+  semantic review button; nested controls are excluded from the row keyboard handler. A successful read focuses and
+  scrolls the dedicated `daily-price-review-panel`.
+- `generation_failed` now hides the instruction node. The removed sentence is absent from HTML, JavaScript and the
+  language catalog.
+- `finalizeDailyPriceReview()` sets the upload progress component to the localized running label before awaiting the
+  finalize API. Success resolves to complete, an active server-side generation remains generating, and a returned
+  editable/retryable review resolves back to waiting for manual pricing.
+- Static and dynamic review copy, responsive `data-label` values, row states, pagination, validation/toasts, cancel
+  dialog and review API errors now have explicit Chinese, English and Thai catalog entries. Review prices use the
+  current locale's integer formatter.
+
+## Verification
+
+- `node --check arr_web/static/i18n.js` and `node --check arr_web/static/app.js` passed.
+- Focused Web/static regression passed 31/31 tests.
+- Full discovery passed 393 tests in 247.709 seconds, with three intentional skips for private Booking fixtures.
+- Authenticated browser verification on the live 8766 page proved:
+  - the needs-review status is exposed as one button with an explicit open-review accessible name;
+  - clicking it made `daily-price-review-panel` the active element, scrolled to the panel and left the task-log dialog
+    closed;
+  - the retryable instruction node was hidden and the removed sentence was not rendered;
+  - Chinese, English and Thai rendered localized title, progress, table labels, instructions, row state, save/finalize
+    controls and status-action names;
+  - both English and Thai cancellation dialogs rendered localized title, description, audit note and buttons, then
+    closed through the non-mutating return action.
+
+## Safety Boundary
+
+Browser verification issued only review-detail reads, client-side locale changes and open/close dialog actions. It did
+not edit or save a price, submit finalize/retry/cancel, upload XML, create a Finance version or trigger monthly work.
+The finalization-progress transition is covered by the source-order regression because clicking it would be a real
+business mutation. The Web process was not restarted: authenticated page reload proved the running server reads and
+serves the current static files.

.project-docs/50-evidence/topics/2026-08-06-integer-review-finalize-repair.md

@@ -0,0 +1,71 @@
+# Integer Review Prices And Finalization Repair
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Deployed and technically verified; latest employee case awaits explicit retry
+- Scope: Daily `PRICE_UNMATCHED` review UI/API, PostgreSQL finalization and local Web runtime on port 8766
+- Confidence: High; browser/database correlation, exact SQL planning, protected migration probes, a real PostgreSQL
+  rollback-only vertical slice and the full repository suite agree
+- Last verified: 2026-08-06
+- Stale trigger: a successful retry of run 67, a new `0805.XML` upload, or a later migration/runtime deployment
+
+## User-visible contract
+
+- Review prices display without trailing `.00`. The PATCH contract accepts a non-negative integer string of at most 16
+  digits, including explicit `0`; decimal input such as `0.00` is rejected.
+- The repository still stores exact `numeric(18,2)` values and the immutable manifest retains canonical two-decimal
+  text such as `0.00`. Processor arithmetic, result schemas and independent replay therefore remain unchanged.
+- `DATABASE_WRITE_FAILED` now has a specific retryable message instead of the unhelpful generic `请求未完成` copy.
+
+## Root causes and corrections
+
+- Runs 66 and 67 reached final validation but rolled back before Finance activation. The Finance-version INSERT declared
+  21 placeholders for 20 supplied dynamic values. The statement now has exactly 20 placeholders, with a regression
+  assertion and a live read-only PostgreSQL `EXPLAIN INSERT` plan.
+- A full outer-transaction probe then found an earlier live constraint failure: migration 017 referenced a manual
+  manifest artifact but omitted `manual_override_json` from `ingestion.artifacts`' allowed kinds. Migration 018 is an
+  additive, target-guarded correction that changes only this check and refuses destructive rollback after an immutable
+  manual manifest exists.
+- Migration 018 up SHA-256 is
+  `5600d82597304d66ffb4933df4b375406080484dfbc7717c360b48a9e28ccd00`; down SHA-256 is
+  `514ba908059bd8eadedd9a38da6efae85efb378ccfca0395028eae1fed22b92f`.
+
+## Protected live evidence
+
+- Pre-018 privacy-minimized checkpoint:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/manifest.json`, SHA-256
+  `fcc24362d43c5982590a6566276e6ac7d1d172da2f2f040e8e54a063ca7e2b16`.
+- Up/down outer-transaction probe:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/rollback-probe.json`, SHA-256
+  `6d7f6b29a2e2a9ac528d18159d5ee1c046e786437c3d096e0fad42e85d779190`. It restored the exact pre-state fingerprint
+  and left no committed row or schema residue.
+- Formal application evidence:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/formal-application.json`, SHA-256
+  `651dc998d471734ebfc1ebd5ba81f5a5da57942879676aa1747fe5bcb2d24d84`. Pre-existing review cases, business counts
+  and rejected Finance version 28 stayed unchanged; zero manual-manifest artifacts existed at apply time.
+- Post-018 finalization probe:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/finalization-rollback-probe.json`, SHA-256
+  `857cee393fa232ea4cbd85913f5069948246acdace6add39c019bd91787711dd`. A synthetic review was recorded, integer `0`
+  read back correctly, its manifest froze `0.00`, finalization created an active two-row version with one
+  `manual_review` row and one commit event, and the outer rollback left zero probe residue.
+
+## Runtime and remaining business boundary
+
+- Web restarted as PID 26286; anonymous `/healthz` and all six authenticated readiness checks pass. A temporary API
+  session was revoked after confirming integer read-model output.
+- Run 65 remains an unset `0/2` case. Run 66 is separately frozen at GRP1/LBLT `2300/0`. Latest run 67 is revision 2,
+  frozen at `200/0`, and remains `generation_failed`; none of these runs has a Finance version or run outbox event.
+- No finalize, cancel, upload or automatic retry was performed during the repair. After refresh/login, an employee must
+  open latest run 67, verify `200/0` are intended, and explicitly retry it once. Run 66 must not be selected by mistake.
+  Successful acceptance must then prove 153 retained rows, two `manual_review` rows, one active Finance version, a
+  matching manifest SHA and exactly one new daily-commit/monthly event while version 28 remains rejected.
+- A final explicit read-only transaction confirms the live artifact constraint includes `manual_override_json`, runs
+  65/66/67 each still have zero Finance versions and zero run outbox events, run 67 remains revision 2 at `200.00/0.00`,
+  and version 28 is rejected with no manual lineage. `/healthz` remains `ready` under listener PID 26286.
+
+## Verification
+
+- Full repository discovery: 387 tests passed; three private Booking fixture tests were intentionally skipped.
+- Focused Web/PostgreSQL/service/programmatic coverage: 52 passed. Focused migration/PostgreSQL coverage: 21 passed.
+- JavaScript/Python syntax, package checksum parity, whitespace checks and both project-document gates pass.

.project-docs/50-evidence/topics/2026-08-06-live-0805-review-migration-mismatch.md

@@ -0,0 +1,52 @@
+# Fresh 0805.XML v4 review blocked by live migration mismatch
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Historical root-cause record; resolved by the authorized live rollout
+- Scope: local authenticated 8766 Web runtime and controlled `booking_test`
+- Confidence: High; UI, PostgreSQL catalog/lifecycle, source identity, isolated processor replay and independent validator agree
+- Last verified: 2026-08-06
+
+## Observed behavior
+
+- The authenticated upload UI retained `0805.XML`, displayed `处理失败` / `请求未完成`, and showed zero August history
+  rows with no browser console error.
+- PostgreSQL contains three fresh v4 runs (61–63) and attempts (53–55), all still `running`. Each has one committed
+  private OSS source artifact but no delivery row, result identity, business date or finish timestamp.
+- All three source artifacts are 948,683 bytes and share SHA-256
+  `40a40f09dd110cc9814df3da9c747d5b08c9f8357e703fe1ea96ebf8daaeede3` with historical run 58.
+- No Finance version and no outbox event references these new runs.
+
+## Root cause
+
+- Live `booking_test` has no `ingestion.daily_review_cases`, `daily_review_items` or `daily_review_events` relations.
+  Its lifecycle checks also lack `awaiting_review`, `review_required` and delivery result `review_required`, proving 017
+  is not applied.
+- The live monthly publication validator body/comment matches migration 016's OSS-enabled definition, despite the
+  checked-in applied-migration ledger still marking 016 pending. This is a migration-ledger conflict, not proof that
+  016 must be rerun.
+- The exact local XML under active processor 4.0.0 returns technical success `review_required`, 151 candidate rows and
+  exactly two grouped keys: `LIAN TAI / LBLT / 0` and `LIAN TAI / GRP1 / 1150`. It creates only result/structured JSON.
+  The independent validator accepts this review output.
+- During live ingestion, the atomic review receipt attempts to insert the missing review case and is wrapped as
+  `DATABASE_WRITE_FAILED`; the delivery transaction rolls back. Best-effort terminalization then queries the same
+  missing review table, fails and is swallowed, leaving the registered run/attempt shells `running`. The frontend has
+  no specific translation for this code and displays generic `请求未完成`.
+
+## Safe correction boundary
+
+Do not convert or reopen runs 61–63. After operator authorization, reconcile the live 016 signature with migration
+history, back up and probe/apply 017, explicitly terminalize the three infrastructure-failed shells with audit, reload
+and verify schema-aware readiness, then perform one fresh upload for the two-key review. No migration, shell cleanup,
+re-upload, review edit/finalization, Finance change, object-store write or runtime restart was performed in this
+diagnosis.
+
+## Resolution
+
+The operator subsequently authorized the bounded correction. Migration-016 semantics were verified live and not
+rerun. A privacy-minimized checkpoint and corrected 017 up/down probe passed, then migration 017 was formally applied.
+Runs 61–63 were closed as audited `REVIEW_SCHEMA_MIGRATION_MISSING` failures. The first post-migration acceptance
+identified and safely closed a separate delivery-placeholder defect; after that one-line SQL binding fix and restart,
+run 65 entered an open two-key review case with no Finance/report/outbox effect. See
+`2026-08-06-live-daily-price-review-rollout.md` for authoritative rollout and acceptance evidence.

.project-docs/50-evidence/topics/2026-08-06-live-daily-price-review-rollout.md

@@ -0,0 +1,66 @@
+# Live Daily Price Review Rollout And `0805.XML` Acceptance
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Historical initial-review rollout; superseded for latest runtime state by the integer/finalization repair topic
+- Scope: controlled `booking_test`, local authenticated Web on port 8766, exact desktop `0805.XML`
+- Acceptance job: `arrjob-dddc27119bea43b19588c78eac087763` (run 65)
+- Review case: `dailyreview-878e45ae132b73c131560299b3b2dcb3`
+
+## Rollout evidence
+
+- The privacy-minimized pre-017 checkpoint is
+  `runtime/backups/booking_test_pre_017_20260806T192026+0800/manifest.json`, SHA-256
+  `d66cc4341db42420b9382fa78c90214f5ecb3c200062c0ac4bb8d275a7123b17`. It excludes credentials, XML bytes,
+  guest rows and raw delivery/outbox payloads.
+- The first up/down probe failed closed and rolled back because 017 had simplified the migration-010
+  `artifact_callback`/`direct_mcp` terminal constraint. Corrected up/down preserve that legacy split and add only the
+  `awaiting_review` branch. The corrected probe restores the exact pre-migration fingerprint and leaves no row/schema
+  residue; its evidence SHA-256 is `c62e07f60b4f2b481fb6fcb72a6aeaeccc3e73b87f36f87af1478f63027eb971`.
+- Live migration-016 function/comment semantics were already exact before the rollout; 016 was not rerun. Corrected
+  migration 017 SHA-256 `22a0578e8748573d29ff2c15dbc687aaea14d7dc0c34cf8fe1faa2ef56067b5b` was formally applied under an advisory lock.
+  All new relations, columns, indexes, triggers and lifecycle/pricing values passed post-commit checks while original
+  business table counts stayed unchanged. Formal evidence SHA-256 is
+  `9837fce88d5bd18ff58b5575375af9f31fec89252123b7cf44d3a3fb991bd83a`.
+- Runs 61–63 were closed through the normal repository transition as
+  `REVIEW_SCHEMA_MIGRATION_MISSING`. Their three private source artifacts remain intact; only three
+  `arr.processing_failed` audit events were added. No delivery, review case, Finance version or daily-commit event was
+  created for those shells. Cleanup evidence SHA-256 is
+  `ad0d4ce01644d6adc5e58fc0c5182240398568ed4b6546be1a3b15a4dbb273a1`.
+
+## Runtime correction and real acceptance
+
+- The first post-migration upload became run 64 and failed safely as `DATABASE_WRITE_FAILED`. Source artifact 173 and
+  failure event 45 were retained, with no delivery/review/Finance fact. Diagnosis found a 16-value/15-placeholder
+  mismatch in the newly extended `processing_deliveries` INSERT. The missing placeholder and a regression assertion
+  were added; 18 focused migration/PostgreSQL tests, compilation and whitespace checks pass, and PostgreSQL plans the
+  exact 16-parameter INSERT.
+- Final repository discovery passes all 384 tests with three intentional skips for private booking fixtures. Package
+  checksums, Python/JavaScript syntax, diff whitespace and project-document gates also pass.
+- Web was restarted as PID 24225. Authenticated health reports database, processing, monthly, download, company report
+  and company source upload readiness all true.
+- One subsequent exact-hash upload reached run 65 and automatically opened the live review panel. PostgreSQL records
+  `awaiting_review` / `review_required` / `recorded_review`, one open revision-0 case, one
+  `PRICE_REVIEW_REQUIRED` event and exactly two unset items:
+  - `LIAN TAI / GRP1 / 1150.00`, impact 1 record / 1 room / 1 room-night;
+  - `LIAN TAI / LBLT / 0.00`, impact 1 record / 1 room / 0 room-nights.
+- The page shows both fixed-price candidate lists, `复核 0 / 2`, and a disabled `确认并生成日报` button. No employee
+  price was entered and the case was not finalized or cancelled.
+- Only source XML, result JSON and structured-result JSON are registered. The run has no daily XLSX, exception XLSX,
+  manual manifest, Finance version or outbox event. Total `arr.daily_version_committed` remains 20, monthly-run count
+  remains 14, and historical daily version 28 remains rejected with no review lineage.
+- The complete acceptance snapshot is
+  `runtime/backups/booking_test_pre_017_20260806T192026+0800/live-0805-review-acceptance.json`, SHA-256
+  `a8994ada1644e039dac7ea888cdba5143bca72cbc6d47c5bf7c4e09d5d6fa315`.
+
+## Remaining boundary
+
+Finance must supply the two approved prices in the open panel. Only after both revision-locked saves should an
+authorized employee invoke finalization and verify the expected final 153 retained rows, two `manual_review` rows,
+one active Finance version and exactly one new daily-commit/monthly event. Historical version 28 must remain unchanged.
+
+This was the exact run-65 state at rollout time. Subsequent employee interactions created runs 66/67 and exposed two
+finalization defects now repaired by migration 018 plus an SQL-bind correction. Use
+`2026-08-06-integer-review-finalize-repair.md` for the current retry boundary; do not act on this historical run-65
+instruction.

.project-docs/50-evidence/topics/2026-08-06-web-launcher-compatibility-recovery.md

@@ -0,0 +1,26 @@
+# Local ARR Web launcher compatibility recovery
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Restored locally; reboot-persistent supervision remains open
+- Scope: owner-local `arr2-web-8766` launcher and local Web listener only
+- Last verified: 2026-08-06
+
+## Evidence
+
+- No process listened on local ARR ports and `screen -ls` reported no Web session, so the page could not establish a
+  connection.
+- The Keychain-backed launcher configuration check passed, but its command still supplied `--node-binary` and
+  `--artifact-tool-module`. The current `arr_web.run --help` shows neither option, and its argument parser rejects both
+  before application startup.
+- Removing only those two retired launch arguments and starting one detached `arr2-web-8766` session restored the
+  service. Local `/healthz` returned HTTP 200; root redirected to the login page, whose browser console had no warnings
+  or errors. At verification, both `127.0.0.1:8766` and the current LAN address `192.168.3.48:8766` returned root
+  redirect HTTP 303.
+
+## Boundary
+
+No login, form submission, upload, Finance/object-store/database write, processor run or monthly-worker action was
+performed. The detached Screen process is still not reboot-persistent; the existing supervision maintenance item
+continues to apply.