docs: record web credential rotation

.project-docs/90-maintenance/stale-items.md

@@ -9,7 +9,7 @@
 | 2026-07-31 | Booking Excel current-source runtime acceptance | Current port 8766 loads the review composition with all readiness flags true; migrations 014/015 are recorded and `booking.current_source_batch` still selects Markdown batch 1. A 14:14 +08 read-only recheck found no reviewing draft; the prior draft is no longer an active task-creation blocker and did not switch the current source. The Markdown five-workbook baseline has been frozen with exact hashes | Run one Markdown-backed five-company Web job after the July period completes if a final-period snapshot is desired, then verify downloads. Keep any later complete-workbook activation operator-authorized, then compare its five overlapping Group Codes with the frozen baseline |
 | 2026-07-31 | Booking Group Code uniqueness invariant | Current views globally merge the same Group Code across worksheets. The fixture has 23 codes shared by `DY-AI-Easy-KB` and `LIANTAI-FIT`; none is used by current Finance, so current output is unaffected but real-source semantics are not confirmed | Confirm whether those rows are intentionally additive. If Group Code can vary by channel or stay segment, add explicit business dimensions to the Excel contract, schema and report join before real imports |
 | 2026-07-30 | Port-8766 business acceptance / supervision | Authenticated Web on `*:8766` now loads Booking review and all readiness flags are true; the detached Screen session is not reboot-persistent. July month-end completion is 2026-08-01 00:00 Bangkok | Run one controlled real review flow plus one company-report job/all five downloads, preferably after the period completes for a final snapshot; separately choose a managed reboot-persistent supervisor that can access the Desktop-hosted project |
-| 2026-07-30 | Web credential strength | The operator-selected password satisfies the enforced minimum length but is not distinct from the public username | Rotate the password to a distinct high-entropy value in the existing Keychain item, then perform one controlled Web restart and login/logout check |
+| 2026-07-31 | Web credential strength | The requested Keychain-only rotation and controlled restart passed, but the newly selected password still satisfies only the minimum-length rule and remains identical to the username | When the operator chooses a distinct high-entropy password, update only the existing Keychain item and repeat the controlled Web restart/login/logout check |
 | 2026-07-30 | `booking_test` current Finance projection | The earlier 417-row snapshot included accepted run `mvp-v1-fixture-20260727` from `synthetic.xml`/`local_fixture`. A 2026-07-31 14:17 read-only company-report recheck found 986 current supported-company facts, so the old 416/417 remediation target is no longer a complete description of current Finance state | Re-audit current daily-version pins and source provenance before any fixture retirement; require explicit authorization for version changes, then verify the clean target and watermark |
 | 2026-07-30 | Channel BI refresh lifecycle | Analytics loads only at boot/month change/first tab entry; successful XML upload and later BI-tab entries do not reload it. The original 308-versus-417 observation is historical, and the current company projection has since advanced to 986 supported-company facts | Refresh analytics after successful upload and on visible BI-tab entry, with non-overlap/error handling and focused frontend coverage |
 | 2026-07-30 | Channel BI KPI label | The card labeled `公司数` renders worksheet-level `channel_count`; LianTai GROUP/FIT are two channels, so six does not mean six companies | Decide whether to relabel it `渠道/子表数` or implement an explicit five-company aggregation |