# Integer Review Prices And Finalization Repair

## Metadata

- Date: 2026-08-06
- Status: Deployed and technically verified; latest employee case awaits explicit retry
- Scope: Daily `PRICE_UNMATCHED` review UI/API, PostgreSQL finalization and local Web runtime on port 8766
- Confidence: High; browser/database correlation, exact SQL planning, protected migration probes, a real PostgreSQL
  rollback-only vertical slice and the full repository suite agree
- Last verified: 2026-08-06
- Stale trigger: a successful retry of run 67, a new `0805.XML` upload, or a later migration/runtime deployment

## User-visible contract

- Review prices display without trailing `.00`. The PATCH contract accepts a non-negative integer string of at most 16
  digits, including explicit `0`; decimal input such as `0.00` is rejected.
- The repository still stores exact `numeric(18,2)` values and the immutable manifest retains canonical two-decimal
  text such as `0.00`. Processor arithmetic, result schemas and independent replay therefore remain unchanged.
- `DATABASE_WRITE_FAILED` now has a specific retryable message instead of the unhelpful generic `请求未完成` copy.

## Root causes and corrections

- Runs 66 and 67 reached final validation but rolled back before Finance activation. The Finance-version INSERT declared
  21 placeholders for 20 supplied dynamic values. The statement now has exactly 20 placeholders, with a regression
  assertion and a live read-only PostgreSQL `EXPLAIN INSERT` plan.
- A full outer-transaction probe then found an earlier live constraint failure: migration 017 referenced a manual
  manifest artifact but omitted `manual_override_json` from `ingestion.artifacts`' allowed kinds. Migration 018 is an
  additive, target-guarded correction that changes only this check and refuses destructive rollback after an immutable
  manual manifest exists.
- Migration 018 up SHA-256 is
  `5600d82597304d66ffb4933df4b375406080484dfbc7717c360b48a9e28ccd00`; down SHA-256 is
  `514ba908059bd8eadedd9a38da6efae85efb378ccfca0395028eae1fed22b92f`.

## Protected live evidence

- Pre-018 privacy-minimized checkpoint:
  `runtime/backups/booking_test_pre_018_20260806T210250+0800/manifest.json`, SHA-256
  `fcc24362d43c5982590a6566276e6ac7d1d172da2f2f040e8e54a063ca7e2b16`.
- Up/down outer-transaction probe:
  `runtime/backups/booking_test_pre_018_20260806T210250+0800/rollback-probe.json`, SHA-256
  `6d7f6b29a2e2a9ac528d18159d5ee1c046e786437c3d096e0fad42e85d779190`. It restored the exact pre-state fingerprint
  and left no committed row or schema residue.
- Formal application evidence:
  `runtime/backups/booking_test_pre_018_20260806T210250+0800/formal-application.json`, SHA-256
  `651dc998d471734ebfc1ebd5ba81f5a5da57942879676aa1747fe5bcb2d24d84`. Pre-existing review cases, business counts
  and rejected Finance version 28 stayed unchanged; zero manual-manifest artifacts existed at apply time.
- Post-018 finalization probe:
  `runtime/backups/booking_test_pre_018_20260806T210250+0800/finalization-rollback-probe.json`, SHA-256
  `857cee393fa232ea4cbd85913f5069948246acdace6add39c019bd91787711dd`. A synthetic review was recorded, integer `0`
  read back correctly, its manifest froze `0.00`, finalization created an active two-row version with one
  `manual_review` row and one commit event, and the outer rollback left zero probe residue.

## Runtime and remaining business boundary

- Web restarted as PID 26286; anonymous `/healthz` and all six authenticated readiness checks pass. A temporary API
  session was revoked after confirming integer read-model output.
- Run 65 remains an unset `0/2` case. Run 66 is separately frozen at GRP1/LBLT `2300/0`. Latest run 67 is revision 2,
  frozen at `200/0`, and remains `generation_failed`; none of these runs has a Finance version or run outbox event.
- No finalize, cancel, upload or automatic retry was performed during the repair. After refresh/login, an employee must
  open latest run 67, verify `200/0` are intended, and explicitly retry it once. Run 66 must not be selected by mistake.
  Successful acceptance must then prove 153 retained rows, two `manual_review` rows, one active Finance version, a
  matching manifest SHA and exactly one new daily-commit/monthly event while version 28 remains rejected.
- A final explicit read-only transaction confirms the live artifact constraint includes `manual_override_json`, runs
  65/66/67 each still have zero Finance versions and zero run outbox events, run 67 remains revision 2 at `200.00/0.00`,
  and version 28 is rejected with no manual lineage. `/healthz` remains `ready` under listener PID 26286.

## Verification

- Full repository discovery: 387 tests passed; three private Booking fixture tests were intentionally skipped.
- Focused Web/PostgreSQL/service/programmatic coverage: 52 passed. Focused migration/PostgreSQL coverage: 21 passed.
- JavaScript/Python syntax, package checksum parity, whitespace checks and both project-document gates pass.