docs: record web credential rotation

.project-docs/30-worklog/current-state.md

@@ -14,6 +14,14 @@ workbook needs those facts.
 
 ## Completed On 2026-07-31
 
+- Rotated both ARR Web operator credential values in separate macOS Keychain items without recording either value in
+  source, launcher arguments, logs or project memory. The exact port-8766 listener was stopped by controlled SIGINT and replaced at
+  15:30 +08 under one detached `arr2-web-8766` Screen session. Live acceptance rejects the prior pair, accepts the new
+  pair, verifies hardened cookie/session/CSRF/logout, desktop/H5, anonymous route boundaries, all six detailed readiness
+  flags and loopback/LAN health. Two read-only snapshots stayed at 30 daily jobs, 4 monthly versions and 4 company jobs;
+  the newest business records predate the restart, so no business write occurred. Nine focused auth/deployment tests and
+  credential-literal scans of the workspace, launcher, state logs and process list pass. The requested password still
+  matches the username, so the distinct high-entropy password follow-up remains open.
 - Simplified the three company-channel generation cards by removing the visible `第一期`/`第二期`/`第三期`
   labels and making the C/O ranges the primary card values: `C/O:01-10`, `C/O:11-20` and a month-aware final range
   (`C/O:21-30` for 30-day months or `C/O:21-31` for 31-day months).
@@ -182,7 +190,8 @@ workbook needs those facts.
   remains separate.
 - ARR2 Web is active on all local interfaces at port 8766 under detached Screen session `arr2-web-8766`. The current
   trusted-Wi-Fi entry is `http://192.168.3.48:8766/`; anonymous root redirects to login and `/login` plus `/healthz`
-  return HTTP 200. The current process restarted at 2026-07-31 14:36:45 +08 and loads the Booking bulk-review
+  return HTTP 200. The current process restarted at 2026-07-31 15:30:04 +08 after a Keychain-only credential rotation
+  and loads the Booking bulk-review
   composition; the public health check returns `ready`.
   Authenticated acceptance reports database, processing, monthly reports, downloads, company reports and company-source
   upload ready. At the earlier 11:30 acceptance the draft endpoint returned no open draft; this later UI task did not
@@ -190,7 +199,7 @@ workbook needs those facts.
   401 rather than transport-level 501. Migrations 014/015 are live and the current pointer selects batch 1; no persistent
   Booking write was performed. Legacy port 8765 remains closed; the mode-0700 launcher keeps secrets outside the repository.
 - The active ARR2 analytics API on port 8766 returns 417 rooms because the known one-row fixture remains current.
-- Live pagination acceptance on port 8766 currently reports 24 daily jobs, 4 monthly versions and 3 company jobs. All
+- Live pagination acceptance on port 8766 currently reports 30 daily jobs, 4 monthly versions and 4 company jobs. All
   three render page 1/1 with correct disabled boundary controls; a 390-pixel viewport has no horizontal overflow.
 - Migration 013 is live in `booking_test`: 25 total processing runs, zero falsely backfilled upload filenames and a
   validated constraint. A rolled-back Unicode-basename probe proved history/trace return the upload name while the
@@ -256,7 +265,12 @@ workbook needs those facts.
   task-log dialog focus restoration, zero horizontal overflow and zero browser warnings/errors.
 - Live login activation passed anonymous root/API rejection, exact credential login, hardened cookie/session/CSRF,
   authenticated desktop/H5/history reads, all five readiness flags, logout revocation and loopback/LAN health. Read-only
-  totals remained 24 daily jobs, 4 monthly versions and 3 company jobs; no upload, report job or worker was started.
+  totals at initial activation were 24 daily jobs, 4 monthly versions and 3 company jobs; no upload, report job or worker
+  was started.
+- The 2026-07-31 credential rotation passes prior-pair rejection, new-pair login, hardened cookie/session/CSRF, logout
+  revocation, desktop/H5 and all six current detailed readiness flags. Two read-only snapshots remained 30 daily jobs,
+  4 monthly versions and 4 company jobs, with their latest creation times before the 15:30 restart. No upload, report
+  generation, Booking activation or monthly worker action occurred.
 - Booking extraction runtime acceptance passed authenticated health/source-draft reads, clean logout, anonymous
   PATCH/DELETE application routing and direct read-only repository access. At that probe all relevant readiness flags
   were true, source batch 1 remained current and no draft existed. A later operator upload created one reviewing draft;
@@ -297,13 +311,14 @@ workbook needs those facts.
 - Live authentication/readiness is accepted, but no business mutation was authorized for this activation. One no-PII
   upload should still confirm migration-013 filename provenance after restart, and one controlled company-report job
   should confirm processor 1.2.0 produces all five downloads.
-- The operator-selected Web password satisfies the enforced length but should be rotated to a distinct high-entropy
+- The latest operator-selected Web credentials were rotated on 2026-07-31, but the password still matches the username.
-  value in Keychain, followed by one controlled Web restart.
+  Rotate it again to a distinct high-entropy value in Keychain, followed by one controlled Web restart.
 - The workstation runs Web and worker as separate processes. The checked-in Compose image intentionally does not claim
   to run the worker because it does not package the workstation-only artifact-tool module; a production image/process
   manager must supply Node/artifact-tool and the shared output volume before enabling that service.
 - A formally controlled no-PII server acceptance run remains appropriate after that deployment packaging is complete.
-- ARR2.0 intentionally has no copied Git history; version-control initialization/review remains independent.
+- ARR2.0 now has Git metadata; `main` tracks `origin/main`. Runtime credential values remain outside Git and project
+  files.
 
 ## Last Updated
 

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,7 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-07-31 | Rotate the ARR Web login credentials | Updated the two existing macOS Keychain-backed runtime values without storing them in source or process arguments, normalized the password item's account metadata and performed one controlled port-8766 restart under detached Screen. The prior pair returns 401, the new pair passes session/cookie/CSRF/logout plus desktop/H5 and all six readiness flags, and loopback/current LAN health return 200. Two read-only snapshots stayed at 30 daily jobs, 4 monthly versions and 4 company jobs; latest business records predate restart, nine focused tests pass and literal/process scans are clean. The requested password still equals the username, so the strength follow-up remains open | Current state/history, login-runtime evidence/index, stale items, commitments, scoped planning record |
 | 2026-07-31 | Allow early company-channel report generation and rename period states | Removed the old time-release gate from company-channel generation. Current-month incomplete periods now generate from the current committed Finance snapshot with the existing fixed C/O cutoff; historical months can rerun, while future months remain blocked. Replaced the permission-oriented state copy with `周期未结束` / `周期已结束` and added a confirmation warning that later data requires rerun. `node --check`, Python compilation, HTML parsing, 28 focused tests and the project-venv full discovery of 348 tests with 10 skips pass; no report or business data was generated | Business rules, current state/history, evidence topic/index, scoped planning record |
 | 2026-07-31 | Simplify company-channel period card labels | Removed the visible `第一期`/`第二期`/`第三期` copy and changed the three card headlines to `C/O:01-10`, `C/O:11-20`, plus a month-aware final range (`C/O:21-30` or `C/O:21-31`). Release status and opening time remain visible; internal period keys and generation requests are unchanged. JavaScript/HTML checks, 28 focused tests, 348-test discovery and isolated 1280×720/390×844 browser QA pass with no overflow or page-console warnings | Current state/history, module map, company-period evidence/index |
 | 2026-07-31 | Simplify company report result details | Collapsed duplicate review problems by type/code/period; replaced the user-facing `版本` column with `生成时间` from job completion time, with creation-time fallback. Internal `version_no` API data remains unchanged. JavaScript/HTML checks, 28 focused tests and targeted deduplication execution pass | Current state/history, module map, company-period evidence/index |

.project-docs/50-evidence/evidence-index.md

@@ -20,7 +20,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-07-31 | Booking manual-review schema audit | Superseded implementation snapshot; audit-depth finding remains active | [Evidence topic](topics/2026-07-31-booking-manual-review-schema-audit.md) | The audit correctly found a PATCH/DELETE transport gap, which the later extraction-program implementation repaired. Its live-schema facts and reviewer/reason/revision-history gap remain valid. |
 | 2026-07-31 | Booking import dimensions and live database inventory | Booking findings active; Finance counts superseded by later live recheck | [Evidence topic](topics/2026-07-31-booking-import-dimensions-and-live-database.md) | The 867-row/348-code Booking inventory and normalized intake model remain valid. Its 417-row Finance count is a historical snapshot; the later read-only release recheck found 986 current supported-company facts. |
 | 2026-07-30 | Daily page visual polish | Active | [Evidence topic](topics/2026-07-30-daily-page-visual-polish.md) | The daily surface now preserves workspace-title hierarchy, exposes task log as a real button and centers a simplified upload station with a compact action. Thirty-three focused tests and four responsive live widths passed without overflow or browser issues. |
-| 2026-07-30 | Web login runtime mismatch | Resolved; authenticated runtime active | [Evidence topic](topics/2026-07-30-web-login-runtime-mismatch.md) | Keychain-backed login is active under detached Screen on `*:8766`. The live gateway is reduced to one ARR heading plus `username`/`password` fields while preserving auth behavior; 33 focused tests and two responsive browser widths pass. DHCP moved the current LAN entry back to `.48` on 2026-07-31; credential hardening and reboot-persistent supervision remain follow-ups. |
+| 2026-07-30 | Web login runtime mismatch | Resolved; authenticated runtime active | [Evidence topic](topics/2026-07-30-web-login-runtime-mismatch.md) | Keychain-backed login is active under detached Screen on `*:8766`. A 2026-07-31 Keychain-only rotation and controlled restart reject the prior pair, accept the new pair and pass session/readiness/logout plus loopback/LAN checks without business writes. DHCP has the current LAN entry at `.48`; the password is still not distinct from the username, and reboot-persistent supervision remains open. |
 | 2026-07-30 | Daily upload filename provenance | Implemented/migrated; post-restart write acceptance pending | [Evidence topic](topics/2026-07-30-daily-upload-filename-provenance.md) | Migration 013 separates `processing_runs.uploaded_filename` from canonical artifact `source.xml`; history/trace use only the upload provenance and old rows render unknown. The authenticated runtime is active; one controlled no-PII upload remains to verify the live write path. |
 | 2026-07-30 | Task-log relocation and daily-only scope | Historical before-state; superseded by the 2026-07-31 upload interaction update | [Evidence topic](topics/2026-07-30-task-log-relocation-and-scope.md) | The desktop header opens the black task console as a native modal, and history selection still reveals the matching job. The earlier upload-triggered opening is superseded; query inspection still proves both history and trace roots are limited to `pipeline_type = 'opera_daily'`. |
 | 2026-07-30 | Company-report path and July month-end readiness | Historical pre-change readiness snapshot; current generation rule superseded | [Evidence topic](topics/2026-07-30-company-report-path-and-month-end-readiness.md) | Missing/unmatched Group Codes leave Booking Room blank and current July projection previews valid 5/5. The topic records the prior July completion boundary and the remaining acceptance work; current-month incomplete periods are now also generatable, with rerun after completion when needed. |

.project-docs/50-evidence/topics/2026-07-30-web-login-runtime-mismatch.md

@@ -28,6 +28,11 @@ The login change was nevertheless relevant to recovery: current source intention
 separate macOS Keychain item and a credential-free local launcher restored the prior controlled database, OSS,
 processing, monthly and company-report inputs. Detached Screen session `arr2-web-8766` owns the sole `*:8766` listener.
 
+On 2026-07-31 the operator requested a credential rotation. Both values were replaced through interactive no-echo
+Keychain input, the password item was rebuilt under stable non-credential account metadata, and the credential-free
+launcher remained valid. A controlled restart replaced only the resolved Web listener and recreated the same detached
+Screen topology; no credential value is recorded here.
+
 ## Completed Source Implementation
 
 - `arr_web.auth` validates runtime `ARR_WEB_USERNAME` / `ARR_WEB_PASSWORD` with constant-time comparison and a bounded
@@ -60,8 +65,14 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
   welcome/access introduction and support disclaimers. The live gateway now presents one `ARR Report` heading, the
   `username` and `password` fields, password visibility and the existing submit/error states. Thirty-three focused
   Web/auth/UI tests pass; browser checks at 390x844 and 1280x720 have no horizontal overflow or console warnings/errors.
-- Read-only totals remained 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload, company-report job,
+- The credential-rotation acceptance rejects the prior pair and accepts the new pair, then verifies anonymous root/API
-  monthly worker or other business mutation was started during activation.
+  boundaries, hardened cookie/session/CSRF, desktop/H5, logout revocation, all six current detailed readiness flags and
+  loopback plus `192.168.3.48` health. Two read-only snapshots remained 30 daily jobs, 4 monthly versions and 4 company
+  jobs; latest creation times predate the 15:30 +08 restart. Nine focused auth/deployment tests pass, and literal scans
+  of the workspace, launcher, state logs and process list are clean.
+- The initial activation totals were 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload,
+  company-report generation, Booking activation, monthly worker or other business mutation was started by either
+  activation or rotation acceptance.
 
 ## Activation Result and Operating Boundary
 
@@ -70,8 +81,9 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
   values. Its `--check` mode validates required private inputs without printing them.
 - The active Screen session is detached but not a reboot-persistent process manager. A future controlled restart should
   validate the launcher, stop the exact 8766 listener and start one `screen -dmS arr2-web-8766` session.
-- Credential rotation to a password distinct from the public username is recommended. Update the Keychain item and
+- The latest requested values were rotated successfully, but the password still matches the username. A future
-  restart once; never commit the value or put it in process arguments.
+  strength rotation should use a distinct high-entropy password, update only Keychain and restart once; never commit the
+  value or put it in process arguments.
 
 Live login/readiness is complete. A no-PII upload-filename check and one released 5/5 company-report job remain separate
 business-mutation acceptance work.

.project-docs/80-commitments/commitments.md

@@ -9,7 +9,7 @@ No timed or externally delegated commitment is currently active.
 - The Booking extraction/review program is source-complete, migrated and transaction-tested against live PostgreSQL with
   an outer rollback. One operator-authorized real upload/edit/delete/activate flow remains open product acceptance work;
   this record is not authorization to change the current Booking source.
-- Rotate the Web password to a value distinct from the public username, update only the existing Keychain item and
+- The 2026-07-31 Keychain-only credential rotation and controlled restart/login/logout check are complete, but the new
-  perform one controlled restart/login/logout check.
+  password still matches the username. Rotate it again to a distinct high-entropy value when the operator chooses one.
 - Package Node/artifact-tool and a shared output volume into the eventual production worker runtime.
 - Run one controlled no-PII XML vertical slice on the eventual ARR2.0 server deployment.

.project-docs/90-maintenance/stale-items.md

@@ -9,7 +9,7 @@
 | 2026-07-31 | Booking Excel current-source runtime acceptance | Current port 8766 loads the review composition with all readiness flags true; migrations 014/015 are recorded and `booking.current_source_batch` still selects Markdown batch 1. A 14:14 +08 read-only recheck found no reviewing draft; the prior draft is no longer an active task-creation blocker and did not switch the current source. The Markdown five-workbook baseline has been frozen with exact hashes | Run one Markdown-backed five-company Web job after the July period completes if a final-period snapshot is desired, then verify downloads. Keep any later complete-workbook activation operator-authorized, then compare its five overlapping Group Codes with the frozen baseline |
 | 2026-07-31 | Booking Group Code uniqueness invariant | Current views globally merge the same Group Code across worksheets. The fixture has 23 codes shared by `DY-AI-Easy-KB` and `LIANTAI-FIT`; none is used by current Finance, so current output is unaffected but real-source semantics are not confirmed | Confirm whether those rows are intentionally additive. If Group Code can vary by channel or stay segment, add explicit business dimensions to the Excel contract, schema and report join before real imports |
 | 2026-07-30 | Port-8766 business acceptance / supervision | Authenticated Web on `*:8766` now loads Booking review and all readiness flags are true; the detached Screen session is not reboot-persistent. July month-end completion is 2026-08-01 00:00 Bangkok | Run one controlled real review flow plus one company-report job/all five downloads, preferably after the period completes for a final snapshot; separately choose a managed reboot-persistent supervisor that can access the Desktop-hosted project |
-| 2026-07-30 | Web credential strength | The operator-selected password satisfies the enforced minimum length but is not distinct from the public username | Rotate the password to a distinct high-entropy value in the existing Keychain item, then perform one controlled Web restart and login/logout check |
+| 2026-07-31 | Web credential strength | The requested Keychain-only rotation and controlled restart passed, but the newly selected password still satisfies only the minimum-length rule and remains identical to the username | When the operator chooses a distinct high-entropy password, update only the existing Keychain item and repeat the controlled Web restart/login/logout check |
 | 2026-07-30 | `booking_test` current Finance projection | The earlier 417-row snapshot included accepted run `mvp-v1-fixture-20260727` from `synthetic.xml`/`local_fixture`. A 2026-07-31 14:17 read-only company-report recheck found 986 current supported-company facts, so the old 416/417 remediation target is no longer a complete description of current Finance state | Re-audit current daily-version pins and source provenance before any fixture retirement; require explicit authorization for version changes, then verify the clean target and watermark |
 | 2026-07-30 | Channel BI refresh lifecycle | Analytics loads only at boot/month change/first tab entry; successful XML upload and later BI-tab entries do not reload it. The original 308-versus-417 observation is historical, and the current company projection has since advanced to 986 supported-company facts | Refresh analytics after successful upload and on visible BI-tab entry, with non-overlap/error handling and focused frontend coverage |
 | 2026-07-30 | Channel BI KPI label | The card labeled `公司数` renders worksheet-level `channel_count`; LianTai GROUP/FIT are two channels, so six does not mean six companies | Decide whether to relabel it `渠道/子表数` or implement an explicit five-company aggregation |