部署优化

.project-docs/50-evidence/evidence-index.md

@@ -4,6 +4,7 @@ Use this index for searchable, traceable evidence records.
 
 | Date | Topic | Status | Source | Detail |
 |---|---|---|---|---|
+| 2026-08-03 | Company-report openpyxl builder for deployment | Implemented; focused deployment checks pass | [Evidence topic](topics/2026-08-03-company-report-openpyxl-builder.md) | CentOS Docker build failed because public npm cannot install private `@oai/artifact-tool`. Company-report XLSX generation now runs through Python/openpyxl in Web, while monthly worker packaging remains the only Node/artifact-tool concern. Focused company-report/deployment tests pass 19/19. |
 | 2026-08-03 | Booking source and company-report retry semantics | Source contract confirmed; reuse visibility gap identified; live acceptance pending restart | [Evidence topic](topics/2026-08-03-company-report-retry-semantics.md) | Byte-identical XLSX uploads reuse the activated source; same rows with different file bytes are new drafts. Same report snapshots reuse complete publication pairs, changed Finance/Booking pins create new versions, and an activated subset changes Booking detail coverage while retaining Finance rows. The current API/UI do not expose whether a retry reused an existing artifact. |
 | 2026-08-03 | Company-report retry after reported 8766 restart | Resolved by controlled listener replacement and live 5/5 rerun | [Evidence topic](topics/2026-08-03-company-source-runtime-diagnosis.md) | PID 11176 was replaced by PID 54127. Job `05cc547d…` succeeded all five August `01-10` companies, reused the prior version/artifact identities, and all five authenticated downloads returned hash-matching 200 responses. No Booking/Finance source or fact changed. |
 | 2026-08-03 | Remove redundant company-report Excel provenance module | Implemented; Web/company checks pass | [Evidence topic](topics/2026-08-03-company-report-status-copy-fix.md) | The job-detail source card and history source column are removed because reports consume the Booking database snapshot; upload/review source UI and server-side provenance remain available. |

.project-docs/50-evidence/topics/2026-08-03-company-report-openpyxl-builder.md

@@ -0,0 +1,33 @@
+# Company-Report Openpyxl Builder
+
+Date: 2026-08-03
+
+## Finding
+
+The CentOS test-server Docker build failed at `npm --prefix company_reports/xlsx install` because
+`@oai/artifact-tool@2.8.33` is not available from the public npm registry. This is a packaging/runtime dependency
+failure, not a database, migration or Docker memory issue.
+
+## Change
+
+- `company_reports.publishing.ArtifactToolBuilder` now builds official company-channel workbooks with Python/openpyxl.
+- The builder writes the three expected sheets, preserves the existing headers/styles, escapes text that could be
+  interpreted as formulas, reopens the saved workbook and validates sheet names, dimensions, headers, row values and
+  zero formula cells.
+- Blank cells read back from Excel as `None` are normalized to the business-empty string during validation.
+- `company_reports/xlsx/package.json` no longer declares the private `@oai/artifact-tool` dependency.
+- `compose.yaml` enables `--enable-company-reports` for Web. IP/HTTP test overrides should keep that flag but omit
+  `--secure-cookies`.
+
+## Verification
+
+- Watched the new builder test fail against the old Node/private-runtime implementation with
+  `BuildError('the XLSX builder runtime is unavailable')`.
+- Focused verification passed:
+  `python -m unittest tests.test_company_reports_publishing tests.test_company_reports_integration tests.test_company_reports_acceptance tests.test_company_reports_service tests.test_deployment_entrypoints`
+  with 19 tests passing.
+
+## Remaining Boundaries
+
+The monthly worker still uses its separate Node/artifact-tool workbook builder. This change makes company-channel detail
+Excel generation deployable in the Web image; it does not package or supervise the monthly worker.