部署优化

.project-docs/30-worklog/current-state.md

@@ -13,8 +13,19 @@ blocked. A not-yet-ended period keeps its fixed C/O cutoff and must be rerun aft
 workbook needs those facts. Duplicate publication of the same semantic snapshot is idempotent: the first validated
 archive/result pair remains authoritative even if a retry rebuilds different XLSX bytes.
 
+Company-channel XLSX generation is now Web-container deployable without the private `@oai/artifact-tool` npm package:
+`company_reports.publishing.ArtifactToolBuilder` builds and reopens workbooks with Python/openpyxl, validates sheet
+names/headers/row counts/no-formulas, and treats blank Excel cells as business-empty strings. Node/artifact-tool remains
+only a monthly-worker packaging concern.
+
 ## Completed On 2026-08-03
 
+- Removed the private npm dependency from the company-channel report deployment path after CentOS Docker build failed
+  with `@oai/artifact-tool` 404. The company workbook builder now uses Python/openpyxl inside Web, keeps formula-injection
+  text escaping, produces no preview PNGs, and validates regenerated workbooks after saving. `compose.yaml` starts Web
+  with `--enable-company-reports`; HTTP/IP test overrides must keep that flag while omitting `--secure-cookies`.
+  Focused company-report and deployment-entrypoint tests pass 19/19. No database migration or live server deployment was
+  performed from this workstation.
 - Made the mobile H5 dashboard publicly readable without weakening the desktop/operator boundary. Anonymous users can
   load `/h5`, its H5 assets and purpose-built `/api/public/h5/months` plus `/api/public/h5/analytics` aggregate routes;
   the public projection omits source hashes and operational metadata. Generic analytics, legacy H5 APIs, desktop pages,
@@ -439,9 +450,10 @@ archive/result pair remains authoritative even if a retry rebuilds different XLS
   detached and are not reboot-persistent.
 - The latest operator-selected Web credentials were rotated on 2026-07-31, but the password still matches the username.
   Rotate it again to a distinct high-entropy value in Keychain, followed by one controlled Web restart.
-- The workstation runs Web and worker as separate processes. The checked-in Compose image intentionally does not claim
-  to run the worker because it does not package the workstation-only artifact-tool module; a production image/process
-  manager must supply Node/artifact-tool and the shared output volume before enabling that service.
+- The workstation runs Web and worker as separate processes. The checked-in Compose image now supports company-channel
+  XLSX generation through Python/openpyxl in Web, but intentionally does not claim to run the monthly worker because it
+  does not package the workstation-only monthly artifact-tool module; a production image/process manager must supply
+  Node/artifact-tool and the shared output volume before enabling that monthly service.
 - A formally controlled no-PII server acceptance run remains appropriate after that deployment packaging is complete.
 - ARR2.0 now has Git metadata; `main` tracks `origin/main`. Runtime credential values remain outside Git and project
   files.