feat: add public h5 dashboard and publish traceability

.project-docs/30-worklog/current-state.md

@@ -10,7 +10,38 @@ download identity.
 The company-channel detail generator now separates generation permission from calendar completeness: a current-month
 or historical C/O period can be generated from the current committed Finance snapshot, while future report months stay
 blocked. A not-yet-ended period keeps its fixed C/O cutoff and must be rerun after later source facts arrive if the final
-workbook needs those facts.
+workbook needs those facts. Duplicate publication of the same semantic snapshot is idempotent: the first validated
+archive/result pair remains authoritative even if a retry rebuilds different XLSX bytes.
+
+## Completed On 2026-08-03
+
+- Made the mobile H5 dashboard publicly readable without weakening the desktop/operator boundary. Anonymous users can
+  load `/h5`, its H5 assets and purpose-built `/api/public/h5/months` plus `/api/public/h5/analytics` aggregate routes;
+  the public projection omits source hashes and operational metadata. Generic analytics, legacy H5 APIs, desktop pages,
+  detailed health, jobs/traces, downloads and all write paths remain authenticated. H5 keeps optional authenticated
+  logout, uses no-detail `/healthz` for its connection indicator, and 71 `test_arr_web*` tests plus syntax checks pass.
+  No live service restart or public deployment was performed.
+- Clarified ARR trace semantics for internet-facing deployment. `artifact_callback` traces now expose additive
+  `execution_scope=arr_runtime`, `processor_mode=fixed_processor` and `remote_dispatch=none`; legacy `direct_mcp`
+  traces identify remote Agent/MCP delivery. User-visible messages no longer call ARR output “本地处理”, and the
+  queued downstream message explicitly says Finance database commit is complete while the outbox waits for its
+  consumer. Persisted `local-...` delivery keys and existing trace fields remain unchanged. Trace/Web tests (27) plus
+  Python/JavaScript syntax and diff checks pass; no live task or business data was mutated.
+- Fixed company-report duplicate publication. A retry now validates the existing archive/result pair against the
+  deterministic reservation and builder `semantic_sha256`, verifies the archive hash against the result JSON, and
+  reuses the first successful artifact metadata instead of comparing the new XLSX binary SHA. Partial, corrupt or
+  semantically conflicting pairs fail closed; an existing `current` file is not overwritten, while a missing one can be
+  repaired from the authoritative archive. First-publication rollback behavior and monthly publication code are
+  unchanged. Publisher tests pass 6/6, company-report tests pass 32 with five optional ArtifactTool skips, Web
+  company/trace tests pass 13/13 and Python compilation is clean. No live report rerun or business-data mutation was
+  performed; the historical 2026-07 `11-20` retry remains to be rerun as a separate acceptance action.
+- Added Booking Excel to company-report traceability. New report jobs persist a safe source summary captured server-side
+  at submission (batch id, filename, activation time and counts); the company page now shows the active source, job
+  detail shows the submission-time source, and history adds a source column. Re-uploading the same active workbook is
+  treated as an informational refresh that keeps the existing source and report history; it does not re-extract or
+  auto-generate a report. Historical jobs without source metadata remain readable and show that the source was not
+  recorded. Full discovery passes 360 tests with 10 optional skips; no live upload, activation, report generation or
+  service restart was performed because the available browser session was unauthenticated.
 
 ## Completed On 2026-08-02
 
@@ -318,6 +349,10 @@ workbook needs those facts.
 - Booking review persistence passed a real-PostgreSQL transaction-only vertical slice: draft creation exposed two items
   with one pending, edit confirmed the pending item, activation produced one source row with quantity three, and the outer
   rollback restored batch 1 with no synthetic draft, source or artifact residue.
+- A 2026-08-03 diagnosis reproduced the 2026-07 `11-20` company-report retry failure: all five companies failed at
+  `publish` after an earlier same-period success because repeated XLSX builds had identical semantic SHA-256 values but
+  different binary SHA-256 values. Publisher idempotency now reuses a complete matching archive/result pair and fails
+  closed on partial or conflicting state; the historical retry still needs a deliberate live rerun.
 - Isolated authenticated browser checks covered the upload-first desktop flow, editable review table, fixed-company text
   and responsive 375/390-pixel layouts with no horizontal overflow or console errors.
 
@@ -351,4 +386,4 @@ workbook needs those facts.
 
 ## Last Updated
 
-2026-07-31
+2026-08-03