docs: record web credential rotation

.project-docs/30-worklog/current-state.md

@@ -14,6 +14,14 @@ workbook needs those facts.
 
 ## Completed On 2026-07-31
 
+- Rotated both ARR Web operator credential values in separate macOS Keychain items without recording either value in
+  source, launcher arguments, logs or project memory. The exact port-8766 listener was stopped by controlled SIGINT and replaced at
+  15:30 +08 under one detached `arr2-web-8766` Screen session. Live acceptance rejects the prior pair, accepts the new
+  pair, verifies hardened cookie/session/CSRF/logout, desktop/H5, anonymous route boundaries, all six detailed readiness
+  flags and loopback/LAN health. Two read-only snapshots stayed at 30 daily jobs, 4 monthly versions and 4 company jobs;
+  the newest business records predate the restart, so no business write occurred. Nine focused auth/deployment tests and
+  credential-literal scans of the workspace, launcher, state logs and process list pass. The requested password still
+  matches the username, so the distinct high-entropy password follow-up remains open.
 - Simplified the three company-channel generation cards by removing the visible `第一期`/`第二期`/`第三期`
   labels and making the C/O ranges the primary card values: `C/O:01-10`, `C/O:11-20` and a month-aware final range
   (`C/O:21-30` for 30-day months or `C/O:21-31` for 31-day months).
@@ -182,7 +190,8 @@ workbook needs those facts.
   remains separate.
 - ARR2 Web is active on all local interfaces at port 8766 under detached Screen session `arr2-web-8766`. The current
   trusted-Wi-Fi entry is `http://192.168.3.48:8766/`; anonymous root redirects to login and `/login` plus `/healthz`
-  return HTTP 200. The current process restarted at 2026-07-31 14:36:45 +08 and loads the Booking bulk-review
+  return HTTP 200. The current process restarted at 2026-07-31 15:30:04 +08 after a Keychain-only credential rotation
+  and loads the Booking bulk-review
   composition; the public health check returns `ready`.
   Authenticated acceptance reports database, processing, monthly reports, downloads, company reports and company-source
   upload ready. At the earlier 11:30 acceptance the draft endpoint returned no open draft; this later UI task did not
@@ -190,7 +199,7 @@ workbook needs those facts.
   401 rather than transport-level 501. Migrations 014/015 are live and the current pointer selects batch 1; no persistent
   Booking write was performed. Legacy port 8765 remains closed; the mode-0700 launcher keeps secrets outside the repository.
 - The active ARR2 analytics API on port 8766 returns 417 rooms because the known one-row fixture remains current.
-- Live pagination acceptance on port 8766 currently reports 24 daily jobs, 4 monthly versions and 3 company jobs. All
+- Live pagination acceptance on port 8766 currently reports 30 daily jobs, 4 monthly versions and 4 company jobs. All
   three render page 1/1 with correct disabled boundary controls; a 390-pixel viewport has no horizontal overflow.
 - Migration 013 is live in `booking_test`: 25 total processing runs, zero falsely backfilled upload filenames and a
   validated constraint. A rolled-back Unicode-basename probe proved history/trace return the upload name while the
@@ -256,7 +265,12 @@ workbook needs those facts.
   task-log dialog focus restoration, zero horizontal overflow and zero browser warnings/errors.
 - Live login activation passed anonymous root/API rejection, exact credential login, hardened cookie/session/CSRF,
   authenticated desktop/H5/history reads, all five readiness flags, logout revocation and loopback/LAN health. Read-only
-  totals remained 24 daily jobs, 4 monthly versions and 3 company jobs; no upload, report job or worker was started.
+  totals at initial activation were 24 daily jobs, 4 monthly versions and 3 company jobs; no upload, report job or worker
+  was started.
+- The 2026-07-31 credential rotation passes prior-pair rejection, new-pair login, hardened cookie/session/CSRF, logout
+  revocation, desktop/H5 and all six current detailed readiness flags. Two read-only snapshots remained 30 daily jobs,
+  4 monthly versions and 4 company jobs, with their latest creation times before the 15:30 restart. No upload, report
+  generation, Booking activation or monthly worker action occurred.
 - Booking extraction runtime acceptance passed authenticated health/source-draft reads, clean logout, anonymous
   PATCH/DELETE application routing and direct read-only repository access. At that probe all relevant readiness flags
   were true, source batch 1 remained current and no draft existed. A later operator upload created one reviewing draft;
@@ -297,13 +311,14 @@ workbook needs those facts.
 - Live authentication/readiness is accepted, but no business mutation was authorized for this activation. One no-PII
   upload should still confirm migration-013 filename provenance after restart, and one controlled company-report job
   should confirm processor 1.2.0 produces all five downloads.
-- The operator-selected Web password satisfies the enforced length but should be rotated to a distinct high-entropy
-  value in Keychain, followed by one controlled Web restart.
+- The latest operator-selected Web credentials were rotated on 2026-07-31, but the password still matches the username.
+  Rotate it again to a distinct high-entropy value in Keychain, followed by one controlled Web restart.
 - The workstation runs Web and worker as separate processes. The checked-in Compose image intentionally does not claim
   to run the worker because it does not package the workstation-only artifact-tool module; a production image/process
   manager must supply Node/artifact-tool and the shared output volume before enabling that service.
 - A formally controlled no-PII server acceptance run remains appropriate after that deployment packaging is complete.
-- ARR2.0 intentionally has no copied Git history; version-control initialization/review remains independent.
+- ARR2.0 now has Git metadata; `main` tracks `origin/main`. Runtime credential values remain outside Git and project
+  files.
 
 ## Last Updated