docs: record web credential rotation

.project-docs/50-evidence/evidence-index.md

@@ -20,7 +20,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-07-31 | Booking manual-review schema audit | Superseded implementation snapshot; audit-depth finding remains active | [Evidence topic](topics/2026-07-31-booking-manual-review-schema-audit.md) | The audit correctly found a PATCH/DELETE transport gap, which the later extraction-program implementation repaired. Its live-schema facts and reviewer/reason/revision-history gap remain valid. |
 | 2026-07-31 | Booking import dimensions and live database inventory | Booking findings active; Finance counts superseded by later live recheck | [Evidence topic](topics/2026-07-31-booking-import-dimensions-and-live-database.md) | The 867-row/348-code Booking inventory and normalized intake model remain valid. Its 417-row Finance count is a historical snapshot; the later read-only release recheck found 986 current supported-company facts. |
 | 2026-07-30 | Daily page visual polish | Active | [Evidence topic](topics/2026-07-30-daily-page-visual-polish.md) | The daily surface now preserves workspace-title hierarchy, exposes task log as a real button and centers a simplified upload station with a compact action. Thirty-three focused tests and four responsive live widths passed without overflow or browser issues. |
-| 2026-07-30 | Web login runtime mismatch | Resolved; authenticated runtime active | [Evidence topic](topics/2026-07-30-web-login-runtime-mismatch.md) | Keychain-backed login is active under detached Screen on `*:8766`. The live gateway is reduced to one ARR heading plus `username`/`password` fields while preserving auth behavior; 33 focused tests and two responsive browser widths pass. DHCP moved the current LAN entry back to `.48` on 2026-07-31; credential hardening and reboot-persistent supervision remain follow-ups. |
+| 2026-07-30 | Web login runtime mismatch | Resolved; authenticated runtime active | [Evidence topic](topics/2026-07-30-web-login-runtime-mismatch.md) | Keychain-backed login is active under detached Screen on `*:8766`. A 2026-07-31 Keychain-only rotation and controlled restart reject the prior pair, accept the new pair and pass session/readiness/logout plus loopback/LAN checks without business writes. DHCP has the current LAN entry at `.48`; the password is still not distinct from the username, and reboot-persistent supervision remains open. |
 | 2026-07-30 | Daily upload filename provenance | Implemented/migrated; post-restart write acceptance pending | [Evidence topic](topics/2026-07-30-daily-upload-filename-provenance.md) | Migration 013 separates `processing_runs.uploaded_filename` from canonical artifact `source.xml`; history/trace use only the upload provenance and old rows render unknown. The authenticated runtime is active; one controlled no-PII upload remains to verify the live write path. |
 | 2026-07-30 | Task-log relocation and daily-only scope | Historical before-state; superseded by the 2026-07-31 upload interaction update | [Evidence topic](topics/2026-07-30-task-log-relocation-and-scope.md) | The desktop header opens the black task console as a native modal, and history selection still reveals the matching job. The earlier upload-triggered opening is superseded; query inspection still proves both history and trace roots are limited to `pipeline_type = 'opera_daily'`. |
 | 2026-07-30 | Company-report path and July month-end readiness | Historical pre-change readiness snapshot; current generation rule superseded | [Evidence topic](topics/2026-07-30-company-report-path-and-month-end-readiness.md) | Missing/unmatched Group Codes leave Booking Room blank and current July projection previews valid 5/5. The topic records the prior July completion boundary and the remaining acceptance work; current-month incomplete periods are now also generatable, with rerun after completion when needed. |

.project-docs/50-evidence/topics/2026-07-30-web-login-runtime-mismatch.md

@@ -28,6 +28,11 @@ The login change was nevertheless relevant to recovery: current source intention
 separate macOS Keychain item and a credential-free local launcher restored the prior controlled database, OSS,
 processing, monthly and company-report inputs. Detached Screen session `arr2-web-8766` owns the sole `*:8766` listener.
 
+On 2026-07-31 the operator requested a credential rotation. Both values were replaced through interactive no-echo
+Keychain input, the password item was rebuilt under stable non-credential account metadata, and the credential-free
+launcher remained valid. A controlled restart replaced only the resolved Web listener and recreated the same detached
+Screen topology; no credential value is recorded here.
+
 ## Completed Source Implementation
 
 - `arr_web.auth` validates runtime `ARR_WEB_USERNAME` / `ARR_WEB_PASSWORD` with constant-time comparison and a bounded
@@ -60,8 +65,14 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
   welcome/access introduction and support disclaimers. The live gateway now presents one `ARR Report` heading, the
   `username` and `password` fields, password visibility and the existing submit/error states. Thirty-three focused
   Web/auth/UI tests pass; browser checks at 390x844 and 1280x720 have no horizontal overflow or console warnings/errors.
-- Read-only totals remained 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload, company-report job,
-  monthly worker or other business mutation was started during activation.
+- The credential-rotation acceptance rejects the prior pair and accepts the new pair, then verifies anonymous root/API
+  boundaries, hardened cookie/session/CSRF, desktop/H5, logout revocation, all six current detailed readiness flags and
+  loopback plus `192.168.3.48` health. Two read-only snapshots remained 30 daily jobs, 4 monthly versions and 4 company
+  jobs; latest creation times predate the 15:30 +08 restart. Nine focused auth/deployment tests pass, and literal scans
+  of the workspace, launcher, state logs and process list are clean.
+- The initial activation totals were 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload,
+  company-report generation, Booking activation, monthly worker or other business mutation was started by either
+  activation or rotation acceptance.
 
 ## Activation Result and Operating Boundary
 
@@ -70,8 +81,9 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
   values. Its `--check` mode validates required private inputs without printing them.
 - The active Screen session is detached but not a reboot-persistent process manager. A future controlled restart should
   validate the launcher, stop the exact 8766 listener and start one `screen -dmS arr2-web-8766` session.
-- Credential rotation to a password distinct from the public username is recommended. Update the Keychain item and
-  restart once; never commit the value or put it in process arguments.
+- The latest requested values were rotated successfully, but the password still matches the username. A future
+  strength rotation should use a distinct high-entropy password, update only Keychain and restart once; never commit the
+  value or put it in process arguments.
 
 Live login/readiness is complete. A no-PII upload-filename check and one released 5/5 company-report job remain separate
 business-mutation acceptance work.