feat: add daily manual price review workflow

.project-docs/50-evidence/topics/2026-08-06-integer-review-finalize-repair.md

@@ -0,0 +1,71 @@
+# Integer Review Prices And Finalization Repair
+
+## Metadata
+
+- Date: 2026-08-06
+- Status: Deployed and technically verified; latest employee case awaits explicit retry
+- Scope: Daily `PRICE_UNMATCHED` review UI/API, PostgreSQL finalization and local Web runtime on port 8766
+- Confidence: High; browser/database correlation, exact SQL planning, protected migration probes, a real PostgreSQL
+  rollback-only vertical slice and the full repository suite agree
+- Last verified: 2026-08-06
+- Stale trigger: a successful retry of run 67, a new `0805.XML` upload, or a later migration/runtime deployment
+
+## User-visible contract
+
+- Review prices display without trailing `.00`. The PATCH contract accepts a non-negative integer string of at most 16
+  digits, including explicit `0`; decimal input such as `0.00` is rejected.
+- The repository still stores exact `numeric(18,2)` values and the immutable manifest retains canonical two-decimal
+  text such as `0.00`. Processor arithmetic, result schemas and independent replay therefore remain unchanged.
+- `DATABASE_WRITE_FAILED` now has a specific retryable message instead of the unhelpful generic `请求未完成` copy.
+
+## Root causes and corrections
+
+- Runs 66 and 67 reached final validation but rolled back before Finance activation. The Finance-version INSERT declared
+  21 placeholders for 20 supplied dynamic values. The statement now has exactly 20 placeholders, with a regression
+  assertion and a live read-only PostgreSQL `EXPLAIN INSERT` plan.
+- A full outer-transaction probe then found an earlier live constraint failure: migration 017 referenced a manual
+  manifest artifact but omitted `manual_override_json` from `ingestion.artifacts`' allowed kinds. Migration 018 is an
+  additive, target-guarded correction that changes only this check and refuses destructive rollback after an immutable
+  manual manifest exists.
+- Migration 018 up SHA-256 is
+  `5600d82597304d66ffb4933df4b375406080484dfbc7717c360b48a9e28ccd00`; down SHA-256 is
+  `514ba908059bd8eadedd9a38da6efae85efb378ccfca0395028eae1fed22b92f`.
+
+## Protected live evidence
+
+- Pre-018 privacy-minimized checkpoint:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/manifest.json`, SHA-256
+  `fcc24362d43c5982590a6566276e6ac7d1d172da2f2f040e8e54a063ca7e2b16`.
+- Up/down outer-transaction probe:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/rollback-probe.json`, SHA-256
+  `6d7f6b29a2e2a9ac528d18159d5ee1c046e786437c3d096e0fad42e85d779190`. It restored the exact pre-state fingerprint
+  and left no committed row or schema residue.
+- Formal application evidence:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/formal-application.json`, SHA-256
+  `651dc998d471734ebfc1ebd5ba81f5a5da57942879676aa1747fe5bcb2d24d84`. Pre-existing review cases, business counts
+  and rejected Finance version 28 stayed unchanged; zero manual-manifest artifacts existed at apply time.
+- Post-018 finalization probe:
+  `runtime/backups/booking_test_pre_018_20260806T210250+0800/finalization-rollback-probe.json`, SHA-256
+  `857cee393fa232ea4cbd85913f5069948246acdace6add39c019bd91787711dd`. A synthetic review was recorded, integer `0`
+  read back correctly, its manifest froze `0.00`, finalization created an active two-row version with one
+  `manual_review` row and one commit event, and the outer rollback left zero probe residue.
+
+## Runtime and remaining business boundary
+
+- Web restarted as PID 26286; anonymous `/healthz` and all six authenticated readiness checks pass. A temporary API
+  session was revoked after confirming integer read-model output.
+- Run 65 remains an unset `0/2` case. Run 66 is separately frozen at GRP1/LBLT `2300/0`. Latest run 67 is revision 2,
+  frozen at `200/0`, and remains `generation_failed`; none of these runs has a Finance version or run outbox event.
+- No finalize, cancel, upload or automatic retry was performed during the repair. After refresh/login, an employee must
+  open latest run 67, verify `200/0` are intended, and explicitly retry it once. Run 66 must not be selected by mistake.
+  Successful acceptance must then prove 153 retained rows, two `manual_review` rows, one active Finance version, a
+  matching manifest SHA and exactly one new daily-commit/monthly event while version 28 remains rejected.
+- A final explicit read-only transaction confirms the live artifact constraint includes `manual_override_json`, runs
+  65/66/67 each still have zero Finance versions and zero run outbox events, run 67 remains revision 2 at `200.00/0.00`,
+  and version 28 is rejected with no manual lineage. `/healthz` remains `ready` under listener PID 26286.
+
+## Verification
+
+- Full repository discovery: 387 tests passed; three private Booking fixture tests were intentionally skipped.
+- Focused Web/PostgreSQL/service/programmatic coverage: 52 passed. Focused migration/PostgreSQL coverage: 21 passed.
+- JavaScript/Python syntax, package checksum parity, whitespace checks and both project-document gates pass.