feat: sync latest ARR implementation

.project-docs/30-worklog/current-state.md

@@ -2,51 +2,309 @@
 
 ## Current Focus
 
-The controlled public-deployment source snapshot is published on `main` at `https://git.nianxx.cn/shiyuyun/wyndham-ARR.git`; initial deployment commit `a701de9` contains the verified source snapshot. The Dockerfile default Web CMD and Compose Web command now both explicitly enable `--enable-processing`; Compose additionally uses `--secure-cookies`, while Caddy remains the documented public listener and MCP retains its independent bearer and exact Host allowlist. Direct source CLI execution remains fail-closed. The current suite passes 260 tests with 2 environment skips plus deployment-entry static assertions. No public-server runtime has been verified from this workspace.
+ARR2.0 owns the deterministic XML-to-Finance path and the complete post-commit monthly publication path. The user
+uploads XML once. After an accepted Finance commit, a dedicated worker consumes the durable outbox event, derives the
+month and “更新至” watermark from committed `ARRIVAL` facts, publishes a validated workbook, and records a durable
+download identity.
 
-## Recently Completed
+The company-channel detail generator now separates generation permission from calendar completeness: a current-month
+or historical C/O period can be generated from the current committed Finance snapshot, while future report months stay
+blocked. A not-yet-ended period keeps its fixed C/O cutoff and must be rerun after later source facts arrive if the final
+workbook needs those facts.
 
-- 2026-07-29: Fixed the direct Docker-image launch path so its default Web CMD explicitly includes `--enable-processing`, matching Compose, and published code commit `ad3d987`. The controlled local launchd script was also updated and restarted: PID 50730 reports both database and processing ready, and a browser DOM check confirms the XML chooser is enabled. Added a regression test that opens only XML processing mutations; all 260 tests pass with 2 artifact-tool skips. Source CLI defaults and the runtime readiness gate remain fail-closed.
-- 2026-07-29: Published the deployment-ready snapshot to the empty self-hosted repository as `main`, established upstream tracking and verified that the remote branch contains initial commit `a701de9`.
-- 2026-07-29: Added a Linux Dockerfile, Compose, Caddy TLS boundary, production env example and deployment runbook. The Web health gate requires both `database_ready` and `processing_ready`; the production command opens XML processing without changing the source default.
-- 2026-07-29: Added opt-in HTTPS `Secure` session cookies, made the booking fixture root portable, removed local paths/test endpoints/temporary tunnel names from the publishable snapshot, and verified 271 final candidate files (about 2.0 MiB) contain no detected secrets, symlinks or files larger than 1 MiB.
-- 2026-07-29: Ran the complete Python suite in a dependency-complete Python 3.12 environment: 259 tests passed and 2 were skipped. Compose YAML, JSON contracts and controlled package checksums also passed static validation.
-- 2026-07-29: Restarted the controlled MCP and fixed-domain ngrok sessions. An initial authenticated 421 exposed a preserved public Host; the MCP was safely restarted with an exact loopback/public Host allowlist, after which public initialize and tools-list both returned 200.
-- 2026-07-29: Reverified gateway 1.0.1, protocol 2025-11-25, one tool, 2195-byte advertised schema, and zero `$ref`/`$defs`/`$id` keys without invoking the business tool.
-- 2026-07-29: Diagnosed the SuperAgent MCP `failed` state: ports 8890/4040 have no listeners, the old temporary PIDs are gone, TLS remains valid, and the public `/mcp` request is rejected by ngrok as an offline endpoint before reaching ARR authentication or MCP protocol handling.
-- 2026-07-29: Started a controlled upload-capable Web instance on `127.0.0.1:8766` and submitted one no-PII XML through the real page.
-- 2026-07-29: Confirmed job `arrjob-fdc2c1a0695c41b3b372a52033b2f567` reached SuperAgent run `7e1ad2fe-cb59-4d04-b92c-9f09d98f4ef8`; remote status was `success`, but MCP submission and all `2038-01-19` Finance facts remained absent.
-- 2026-07-29: Safely terminalized the failed test as `PROCESSING_RESULT_MISSING`, revoked its unconsumed grant, verified zero business writes, and stopped port 8766.
-- 2026-07-29: Confirmed that XML upload is the only required user action; successful structured-data commit must automatically trigger monthly processing.
-- 2026-07-29: Confirmed that `TOTAL PRICE` is required and must be an Excel formula equal to `REAL PRICE × NIGHTS × NO_OF_ROOMS`.
-- 2026-07-29: Initialized `.project-docs` and recorded the correction in ADR-001.
+## Completed On 2026-07-31
 
-## In Progress
+- Simplified the three company-channel generation cards by removing the visible `第一期`/`第二期`/`第三期`
+  labels and making the C/O ranges the primary card values: `C/O:01-10`, `C/O:11-20` and a month-aware final range
+  (`C/O:21-30` for 30-day months or `C/O:21-31` for 31-day months).
+  Completion-state chips (`周期未结束` / `周期已结束`) and Bangkok completion times remain, while the underlying period
+  keys and generation payload are unchanged. An incomplete period is now still generatable; future months remain blocked.
+  JavaScript/HTML checks, 28 focused Web/company tests, 348-test discovery and isolated 1280x720/390x844 browser QA
+  pass with no overflow or page-console warnings. The shared port-8766 service was restarted at 14:36:45 +08 and
+  its `/healthz` endpoint returns `ready`.
+- Simplified company report results for end users: duplicate review problems are collapsed by type/code/period so a
+  repeated `同房型存在不同静态价格，需人工复核` item appears once per company and period. Replaced the internal
+  `版本`/`version_no` display with `生成时间`, using the completed job time and falling back to its created time;
+  API version metadata remains intact. JavaScript/HTML checks, 28 focused Web/company tests and targeted deduplication
+  execution pass.
+- Rebuilt the company-channel report setup as a dense four-card desktop row: `上传 Excel 报表` followed by the first,
+  second and third C/O periods. The `报表月份` picker is a compact visually unlabeled control in the large setup
+  card's upper-right corner, and all period CTAs now read `生成` with responsive card-sized widths. Replaced the
+  browser-native generation confirm with an in-page accessible dialog showing month/period context; cancel, backdrop
+  and Escape dismiss without submitting, while explicit confirmation preserves the existing payload, generation polling
+  and business behavior. JavaScript/HTML checks, 28 focused Web/company tests, 348-test discovery and isolated
+  1280x720/390x844 browser QA pass with no overflow or console warnings; the shared port-8766 service was restarted at
+  14:36:45 +08 and its `/healthz` endpoint returns `ready`.
+- Rebalanced the company-channel setup surface for the current Finance workflow. The fixed five-company scope now sits
+  beside `公司渠道明细` as pale helper text, the Excel upload action is bounded to a 760px desktop rail and remains
+  full-width/single-column on mobile, and `刷新任务` exposes a read-only scope tooltip. `报表月份` remains the C/O
+  report-month selector because it drives period completeness state, history filtering and the generation payload; no report,
+  upload or database behavior changed. JavaScript/HTML checks, 28 focused Web/company tests, 348-test discovery and
+  isolated 1280x720/390x844 browser QA pass with no overflow or console warnings. Port 8766 was not mutated by QA.
+- Compressed the daily overview row to a compact equal-height desktop treatment. The upload card now uses a horizontal
+  icon-and-copy dropzone, reduced heading/footer spacing and smaller controls, while the three KPI cards stretch to the
+  same row height. Mobile upload layout remains unchanged. JavaScript syntax and 20 focused Web/static/trace tests pass;
+  no upload, API or processing behavior changed.
+- Refined the company-channel generation controls for dense Finance use. The three period CTAs are now compact
+  104–124px actions centered inside each card, while `提取并核对` uses the same 42px button family and is centered
+  inside the upload action column on desktop and mobile. Labels remain single-line, upload/report behavior is
+  unchanged, 28 focused Web/company tests and the 348-test discovery pass, and the restarted port-8766 service is
+  healthy at 13:37:49 +08.
+- Restored equal card heights across the daily overview row. The ARR.XML upload panel and the three KPI cards now
+  stretch to the same grid-row height, with KPI content centered inside each card; mobile stacking remains unchanged.
+  JavaScript syntax and 20 focused Web/static/trace tests pass; no upload, API or processing behavior changed.
+- Reverted the KPI width shrink after clarification. The three daily cards now retain their original grid-column widths,
+  while their height is content-sized and vertically centered in the upload module's shared desktop row. JavaScript
+  syntax and 20 focused Web/static/trace tests pass; no upload, API or processing behavior changed.
+- Centered the shortened daily KPI cards within the upload module's shared desktop grid row, preserving their widths,
+  270px height and mobile content-sized fallback. JavaScript syntax and 20 focused Web/static/trace tests pass; no
+  upload, API or processing behavior changed.
+- Tightened the three daily KPI cards so they no longer inherit the upload panel's full grid-row height. The desktop
+  cards keep their existing widths and data hierarchy, use a compact 270px height with smaller decorative rings, and
+  return to content-sized cards on narrow screens. JavaScript syntax and 20 focused Web/static/trace tests pass; no
+  upload, API or processing behavior changed.
+- Recomposed the daily overview into one desktop row containing the ARR.XML upload station plus the ARRIVAL DATE,
+  processing-duration and NO. OF ROOM cards. Removed the duplicate top `Daily Report` heading and `THIS MONTH` eyebrow,
+  renamed the daily-history heading to `Daily Report`, and kept the upload request, inline progress estimate and
+  on-demand task-log behavior unchanged. JavaScript syntax and 20 focused Web/static/trace tests pass; no API or
+  processing behavior changed.
+- Updated the daily XML upload surface so submitting ARR.XML stays on the daily page instead of opening the task-log
+  dialog automatically. The upload card now shows a compact stage-based estimate for upload, fixed processing,
+  validation and database commit, finalizing at 100% on success and retaining an inline error state on failure. The
+  header task-log button and daily-history row actions still open the existing trace dialog on demand. JavaScript
+  syntax and 15 focused Web/static/trace tests pass; no API or processing behavior changed.
+- Simplified the desktop monthly page into a single six-column download table. The redundant standard-monthly heading,
+  `VERSION HISTORY`/version-record copy, visible monthly `版本` column and C/O-period footer note are removed; the
+  navigation label is now `月报`; the list is identified by a compact `月报处理` heading. The visible `更新至` cell reads the explicit `max_arrival_date` API field, which is
+  backed by the published run's `as_of_date` (the maximum included `ARRIVAL`) while retaining the legacy field and
+  version ordering for compatibility. The remaining panel uses a compact live-status toolbar and responsive table
+  spacing; focused Web/schema/task-log tests and JavaScript/Python syntax checks pass. No report or business data changed.
+- Froze the Markdown-backed July company-channel baseline before any Booking Excel activation. The read-only,
+  non-publishing package binds the exact `RES_COMMENT_TYPE_OF_ROOM.md` hash to accepted Booking batch 1, five pinned
+  Finance daily versions, processor 1.2.0/rule identity and five generated XLSX files. All 314 output rows independently
+  match the Markdown-derived Booking Room expectation; 27 are filled and 287 are correctly blank. The builder reopened
+  and exact-value checked every workbook, rendered all 15 sheets, and the retained SHA-256 inventory verifies every
+  package file. One reviewing Excel draft remained separate; the current Booking pointer and room-item counts were
+  unchanged.
+- Refined the Booking record-extraction review surface for dense operator work. The page now renders 50 records at a
+  time, supports individual and all-visible selection, and deletes 1-50 unique selected records through one bounded
+  atomic backend operation. Single and batch delete share a count-aware in-page dialog; cancel, backdrop and explicit
+  Escape handling never submit and restore focus. The separate accepted-source status/summary is removed; the open
+  review now identifies its own extraction records with the validated uploaded workbook filename directly below
+  `Booking记录提取`, wrapping fully on narrow screens. The requested review/upload helper copy is removed. Isolated authenticated browser QA covered one/two/50-row
+  selection plus 390×844 layout without calling delete; the full suite passes 346 tests with 10 expected optional skips.
+- Implemented the deterministic Booking Excel extraction program requested for raw Tour Code/`โรงแรม` workbooks.
+  It applies physically-last-row replacement/cancellation, splits bracketed room items, normalizes agreed TWN/DBL
+  variants, preserves quantities on unknown labels, and routes unknown/unbracketed room names to editable/deletable
+  pending records. The supplied workbook replays to 26 Tour Codes, 37 items and 7 pending items; `LLT260715AC` becomes
+  `TWN/12 + DBL/9`, while `LT260715LD` becomes `U-TWN/17 + pending/2`. Durable review/activation, paged desktop UI and
+  bounded GET/POST/PATCH/DELETE transport are present. A real-PostgreSQL transaction probe created a two-item draft,
+  corrected its pending item, atomically activated one three-room source row and then rolled the outer transaction back;
+  source batch 1, zero drafts and zero synthetic artifacts were restored. No persistent Booking/report business write
+  was performed.
+- Confirmed end-to-end readiness boundaries. The company-channel processor already reads current Booking views at report
+  generation; a live read-only July snapshot produced valid 5/5 results from 417 Finance facts and 27 matched Booking
+  Group Codes, with missing/unmatched Booking Room blank. The expanded Booking/company/real-XLSX suite passed 55/55.
+  The controlled real-PostgreSQL draft/edit/activation path passed inside an outer rollback. July `21-month-end` does not open until
+  2026-08-01 00:00 Bangkok, and a shared-database test workbook must be a deliberate complete replacement.
+- Audited Booking parser 2.0's human-review requirements across the live schema, current source and active Web process.
+  During the audit, concurrent work applied migrations 014/015: the live database now has a current-source pointer plus
+  empty draft/item tables supporting basic confirmed/pending/deleted latest-state editing. It still lacks actor, reason
+  and revision history. Its earlier GET/POST-only transport finding was subsequently repaired with PATCH/DELETE handlers
+  and real socket coverage; real PostgreSQL write/rollback acceptance now passes. The audit itself made no persistent
+  database/runtime/business-data mutation.
+- Completed a privacy-minimized, read-only Booking dimension/database audit. `Group Code + room type + quantity` is the
+  sufficient normalized allocation model for current data, whose nonblank codes do not cross stay/company/channel;
+  missing/unmatched enrichment is blank as designed. Its initial parser/importer snapshot was superseded by the dedicated
+  manual-review audit above; migrations 014/015 are formally applied and the transaction boundary is verified, while the
+  first operator-authorized real workbook activation remains incomplete.
+  No business data changed by this audit.
+- Reduced the ARR login gateway to one clear brand statement and one form. The old workflow marketing copy, numbered
+  steps, repeated welcome/access copy and help/footer disclaimers are removed; the remaining field labels are
+  `username` and `password`. Existing password visibility, loading/error, safe-return and authentication behavior is
+  unchanged. Thirty-three focused Web/auth/UI tests pass, and live 390x844 plus 1280x720 checks show no horizontal
+  overflow or browser warnings/errors.
 
-- No local repository publication work remains. Runtime deployment, DNS/Secret injection and SuperAgent stable-domain rebinding belong to the user's public server environment.
+## Completed On 2026-07-30
 
-## Next Recommended Steps
+- Added application-owned Finance login across desktop, H5, APIs, uploads, traces and downloads. Runtime credentials are
+  required, login attempts are bounded, random server-side sessions retain hardened cookies/CSRF, logout revokes the
+  session, and only login assets plus no-detail `/healthz` remain anonymous. Caddy now owns HTTPS only.
+- Added a responsive ARR login gateway and desktop/H5 logout/session-expiry behavior. The live source passed wrong and
+  correct login, password visibility, safe `/`/`/h5` return, both logout paths, zero-console-error checks and
+  375/768/1024/1440 no-overflow verification.
+- Added and applied additive migration 013. New uploads store the validated browser XML basename on
+  `ingestion.processing_runs`, while private source artifacts and processor input remain canonical `source.xml`.
+  Daily history and task trace read only the new provenance; pre-013 rows render `—`.
+- Added and applied additive migration 012. The `reporting` schema stores monthly versions, Finance daily-version
+  lineage, channel row-count manifests and two artifact references without duplicating business/guest rows.
+- Replaced in-memory monthly identities with database IDs, sequential versions, canonical snapshot hashes, atomic
+  activation/supersession, persisted failures and idempotent published-snapshot replay.
+- Made the report's `as_of_date` equal the greatest `ARRIVAL` actually included in its snapshot. XML filenames and the
+  wall clock are ignored.
+- Added a standalone `monthly_reports.worker` process with leases, `FOR UPDATE SKIP LOCKED`, expired-lease reclaim,
+  bounded retry/backoff and dead-letter behavior.
+- Made outbox acknowledgement conditional on a registered active/superseded report and both workbook/result artifacts.
+- Replaced the synthetic monthly list and unavailable download resolver with `reporting.monthly_runs` reads and
+  confined path/size/SHA-256 checked downloads.
+- Removed month/cutoff/manual-generation controls from the primary page. The guarded POST route remains only as a
+  controlled recovery surface when explicitly enabled.
+- Changed every XLSX data-row `TOTAL PRICE` cell to the exact row-relative `=R[row]*C[row]*G[row]` formula and validates
+  the complete formula matrix again after reopening the workbook.
+- Removed the monthly refresh control. The visible monthly tab now performs one non-overlapping list read every four
+  seconds, stops while hidden/inactive, reloads immediately when restored, and preserves the last good list during a
+  transient background failure.
+- The desktop and H5 headers use the plain `ARR Report` identity with no decorative icon. The daily content heading is
+  `Daily Report`; the duplicated daily/monthly explanatory copy has been removed without changing automatic publishing.
+- The desktop header utility formerly labeled `手机看板` is now `任务日志` and opens the existing black task console in
+  a native modal. The console no longer occupies the daily-processing layout; upload completion and daily-history row
+  activation open the selected job directly. `/h5` remains available by direct URL. Both history and trace SQL are
+  explicitly limited to `pipeline_type = 'opera_daily'`, so this is a one-daily-job processing trace rather than a
+  global server, monthly-run or company-report log.
+- Refined the daily desktop surface after visual review. `ARR Report` remains the dominant workspace title while
+  `Daily Report` is smaller; `任务日志` is a compact outlined button at the adjacent status-label size; the upload
+  station is centered and responsive; decorative `01 / UPLOAD` and `本月留痕` labels are gone; and `开始处理` is a
+  compact right-aligned action. No upload, API, route or trace behavior changed.
+- Daily, monthly and selected-month company histories use 50 records per page. Each footer shows the exact monthly
+  total, current visible range, page number and previous/next controls; counts and rows are read from one database
+  snapshot or coordinator lock. Channel BI remains an aggregate view rather than a paginated detail list.
 
-1. Redeploy the latest repository image using `deploy/README.md`, inject real Secrets only on the server, and require the public Web health response to report `database_ready=true` and `processing_ready=true`; any platform override of Docker CMD must retain `--enable-processing`.
-2. Rebind SuperAgent to `https://<MCP_PUBLIC_HOST>/mcp`, rediscover exactly `arr_submit_processing_result`, save/publish the new Agent version, and stop relying on the temporary ngrok endpoint.
-3. Rerun the vertical slice with a fresh no-PII XML and require a `committed`/`already_committed` receipt plus matching Finance version, current pointer and fact rows.
-4. In separately authorized implementation work, add the automatic post-commit monthly dispatch and required `TOTAL PRICE` formula behavior.
+## Live Acceptance
 
-## Open Questions / Blockers
+- Five `arr.daily_version_committed` events have produced July publications: one is the earlier database acceptance
+  fixture `mvp-v1-fixture-20260727`; four are real 07-20/07-21/07-22/07-23 uploads.
+- Report ID 4/version 4 is active for 2026-07 with `as_of_date=2026-07-27`, 417 rows and six channels; V03/V02/V01 are
+  superseded. Its persisted date equals max current `ARRIVAL` structurally, but that maximum comes from the fixture.
+- The superseded V03 workbook has 308 authorized `TOTAL PRICE` formulas and zero mismatches. Its 40,635 bytes and SHA-256
+  `494fb78283f68cb7bffce2501b3531613c494d148a56a7ccc8d2aabe46b1e29c` match the registered artifact.
+- Earlier browser/access-log verification showed V03/V02/V01 downloads and repeated monthly API reads at the
+  four-second cadence. The current API now lists V04 active above those versions; ARR2 Web remains green and the worker
+  remains separate.
+- ARR2 Web is active on all local interfaces at port 8766 under detached Screen session `arr2-web-8766`. The current
+  trusted-Wi-Fi entry is `http://192.168.3.48:8766/`; anonymous root redirects to login and `/login` plus `/healthz`
+  return HTTP 200. The current process restarted at 2026-07-31 14:36:45 +08 and loads the Booking bulk-review
+  composition; the public health check returns `ready`.
+  Authenticated acceptance reports database, processing, monthly reports, downloads, company reports and company-source
+  upload ready. At the earlier 11:30 acceptance the draft endpoint returned no open draft; this later UI task did not
+  authenticate against, inspect or mutate the shared draft contents. Anonymous PATCH/DELETE reach the application auth gate and return JSON
+  401 rather than transport-level 501. Migrations 014/015 are live and the current pointer selects batch 1; no persistent
+  Booking write was performed. Legacy port 8765 remains closed; the mode-0700 launcher keeps secrets outside the repository.
+- The active ARR2 analytics API on port 8766 returns 417 rooms because the known one-row fixture remains current.
+- Live pagination acceptance on port 8766 currently reports 24 daily jobs, 4 monthly versions and 3 company jobs. All
+  three render page 1/1 with correct disabled boundary controls; a 390-pixel viewport has no horizontal overflow.
+- Migration 013 is live in `booking_test`: 25 total processing runs, zero falsely backfilled upload filenames and a
+  validated constraint. A rolled-back Unicode-basename probe proved history/trace return the upload name while the
+  artifact remains `source.xml`.
+- The pre-012 privacy-minimized metadata checkpoint is
+  `runtime/backups/booking_test_pre_012_20260730T151922+0800/manifest.json`, SHA-256
+  `230206eb074fd5877132744eb592b3dc6cd6638d12a3dd4d71a8101a9bd2998e`.
 
-- Docker and Caddy are not installed in this workspace, so image build, Compose runtime, DNS, ACME issuance and public HTTP checks must be performed on the deployment server.
-- SuperAgent administration requires the user's authenticated platform session; its stale MCP configuration must be replaced with the new stable public MCP domain after deployment.
-- The restored ngrok/MCP sessions remain temporary and are not the formal deployment target.
-- `ProcessingRunner.poll()` can emit `delivery_missing`, but the PostgreSQL state adapter has no matching status mapping. The live run therefore required a guarded manual terminalization transaction.
-- The exact automatic monthly dispatch mechanism and business-time/cutoff derivation policy still require implementation design; neither is a user input.
+## Active Data-Quality Incident
 
-## Risky Areas
+- The company-report cutoff-10 and cutoff-20 Web jobs both completed 5/5 with valid zero-row workbooks because every
+  current supported-company fact has C/O in the 21-to-month-end period. Processor 1.2.0 implements the final
+  user-confirmed fallback: no Group Code leaves both `RES_COMMENT`/`Booking Room` blank; a present Group Code that
+  cannot resolve in Booking remains visible while only `Booking Room` is blank. A repeatable-read July 31 preview is
+  now valid 5/5: LianTai 138 rows/122 blank Booking Rooms, QBD 139/128, DY-AI-Easy-KB 1/1, FengRun 33/33 and HanaTour
+  3/3. No report or business-data mutation was performed. The active port-8766 runtime now loads the current processor
+  and reports company-report readiness true; one controlled 5/5 Web job remains a separate acceptance action, with a
+  post-completion rerun recommended if later source facts should be reflected.
+- Finance current version 2 is `synthetic.xml` from provider `local_fixture`; it adds 1 room, 3 room-nights, 5,400
+  revenue and a synthetic room type to Channel BI and all July monthly publications.
+- V01's legitimate operational source is exactly 119 rows with `ARRIVAL=2026-07-21`; its persisted lineage and
+  hash-matched workbook also contain the one-row 07-27 fixture, which is why the stored report says 120 rows and
+  `as_of_date=2026-07-27`. This is contaminated content, not a metadata-only date error.
+- Excluding the fixture leaves the verified four-day business total of 416 rows/rooms, 853 room-nights and 1,451,350
+  revenue through ARRIVAL 2026-07-23. Hash matching and isolated replay prove the accepted file mapping is
+  07-20=100, 07-21=119, 07-22=88 and 07-23=109; the user's total was right but the 07-20/07-22 labels were reversed.
+- No database repair was performed during diagnosis. The fixture should be retired from the current projection without
+  deleting immutable history, followed by a clean July republication and live API verification.
+- An already-open Channel BI view does not refresh after upload or subsequent tab entry, so it can remain at the old
+  308 value even though the API is 417. This frontend freshness gap is separate from the one-row fixture contamination.
+- The BI `公司数` card actually counts worksheet channels; LianTai GROUP/FIT are separate, so six channel keys can still
+  correspond to five top-level companies.
 
-- A SuperAgent run reporting `success` is not business success; only an MCP receipt and committed database facts qualify.
-- Enabling upload on the current all-interface 8765 listener without a confirmed authentication boundary would expose a mutation endpoint.
-- Committing `deploy/.env.production`, publishing 8765/8890 directly, omitting TLS/Basic Auth, or reusing the MCP/SuperAgent/HMAC credentials would break the deployment boundary.
-- Triggering before commit, duplicate trigger delivery, deriving the wrong reporting period, or replacing formulas with cached/static amounts.
+## Verification Status
+
+- Migration 012 passed transaction-only up/down probes, including a synthetic active publication followed by rollback.
+- The 38-test monthly/migration/Web regression set passed, including real XLSX build/reopen checks.
+- A clean full-suite rerun with the optional ARR1 compatibility dependency installed passed 291 tests in 108.2 seconds
+  with 7 explained environment/fixture skips and no failures or errors.
+- The automatic-list follow-up passed 18 focused Web/schema tests, JavaScript syntax checking and a clean 291-test full
+  discovery in 110.8 seconds with the same 7 explained environment/fixture skips.
+- The post-update BI diagnosis passed 24 focused analytics/contracts/Web tests and reconciled both live Web APIs against
+  a repeatable-read, read-only database snapshot.
+- Hash-matched local source inspection and isolated deterministic replay reproduced `0720.XML=100` and `0722.XML=88`;
+  the 07-23 accepted run was traced to its 16:12:27 commit and 109 retained rooms.
+- The final scoped company/Booking/report suite ran 32 tests successfully with three expected private-fixture skips; it
+  included real XLSX export, value verification after reopen, rendering and the dedicated no-Group-Code path. Four Web
+  company-task coordinator tests also passed.
+- The 50-row pagination follow-up passed JavaScript syntax, 29 focused Web/repository tests and the complete 305-test
+  discovery with 10 existing environment-dependent skips. Live desktop and 390-pixel checks confirmed all three
+  totals/ranges and boundary-button states.
+- The upload-filename change passed 69 focused tests, JavaScript/Python syntax checks and a clean 312-test full
+  discovery in 99.280 seconds with 10 environment/fixture skips.
+- The application-login change passed a 33-test focused auth/Web/company/deployment set after final compatibility edits,
+  JavaScript/Python syntax checks, Ruby static Compose parsing and the clean 317-test full discovery in 97.311 seconds
+  with 10 environment/fixture skips. Docker is not installed locally, so live `docker compose config` was not claimed.
+- The expanded absent-or-unmatched company-report fallback passed a 37-test
+  company/Booking/real-XLSX/Web-coordinator suite with three expected private-fixture skips and no failures; the current
+  controlled July 31 projection previewed valid 5/5. A separate non-publishing real-data vertical slice built, reopened,
+  value-checked and rendered all five actual workbooks in a temporary directory.
+- The daily visual-polish follow-up passed JavaScript syntax and 33 authenticated Web/auth/daily-visual/task-log tests.
+  Live 375/768/1024/1440 checks confirmed the corrected title hierarchy, centered upload geometry, compact actions,
+  task-log dialog focus restoration, zero horizontal overflow and zero browser warnings/errors.
+- Live login activation passed anonymous root/API rejection, exact credential login, hardened cookie/session/CSRF,
+  authenticated desktop/H5/history reads, all five readiness flags, logout revocation and loopback/LAN health. Read-only
+  totals remained 24 daily jobs, 4 monthly versions and 3 company jobs; no upload, report job or worker was started.
+- Booking extraction runtime acceptance passed authenticated health/source-draft reads, clean logout, anonymous
+  PATCH/DELETE application routing and direct read-only repository access. At that probe all relevant readiness flags
+  were true, source batch 1 remained current and no draft existed. A later operator upload created one reviewing draft;
+  the Markdown baseline freeze proved it remained isolated and did not change batch 1. A 2026-07-31 14:14 +08 live
+  read-only recheck found no reviewing draft and still found Markdown batch 1 current with 867 rows, six worksheets and
+  348 Group Codes, so the draft blocker is currently clear without any Booking source switch.
+- The same live recheck found that the current July company-report projection has advanced beyond the frozen
+  five-version baseline: 986 supported-company Finance facts now all have C/O dates from July 21 through July 30.
+  Read-only processor 1.2.0 output remains valid 5/5 with 598 rows, 224 filled Booking Rooms and 374 blanks. The earlier
+ 314-row package remains correct for its pinned snapshot; it is not the expected row count for this later live
+  projection. The first two July periods can now be generated from the current snapshot before their calendar
+  completion; any later Finance facts within the fixed C/O ranges require a rerun.
+- Final post-change discovery ran 343 tests in 102.451 seconds: all passed, with 10 explained optional
+  renderer/private-fixture skips. JavaScript syntax, Python compilation, supplied-workbook replay and the 17 focused
+  parser/review/coordinator/router/socket tests are also green.
+- Booking review persistence passed a real-PostgreSQL transaction-only vertical slice: draft creation exposed two items
+  with one pending, edit confirmed the pending item, activation produced one source row with quantity three, and the outer
+  rollback restored batch 1 with no synthetic draft, source or artifact residue.
+- Isolated authenticated browser checks covered the upload-first desktop flow, editable review table, fixed-company text
+  and responsive 375/390-pixel layouts with no horizontal overflow or console errors.
+
+## Remaining Deployment Work
+
+- Perform the first operator-authorized real workbook upload/review/activation, then run one controlled five-company
+  report and verify all five downloads. The database transaction boundary is accepted, but this task intentionally did not
+  replace the current business Booking source. Because activation replaces the whole source, supply a complete workbook
+  and restoration plan.
+- Decide whether Booking confirmation is a simple single-operator correction loop or an auditable approval workflow;
+  add actor/reason/revision history and stronger declarative DB transitions if audit-grade confirmation is required.
+- Upload one controlled raw Tour Code/`โรงแรม` workbook, review/activate it, confirm
+  replacement semantics and run one controlled company report. A period may be generated before its Bangkok completion
+  boundary, but rerun it after completion if the source snapshot changes; the currently open July periods contain zero
+  rows and cannot prove populated Booking Room. Before real use, confirm whether 23 fixture Group Codes shared by
+  `DY-AI-Easy-KB` and `LIANTAI-FIT` are intentionally additive; the current view merges them globally.
+- The prior 8766 outage and credential gate are resolved. The current Web process is a detached local Screen session,
+  not a reboot-persistent service; `/Users/chillishark/.local/bin/arr2-web-8766 --check` validates its private route and
+  Keychain inputs without printing them before a controlled restart.
+- Live authentication/readiness is accepted, but no business mutation was authorized for this activation. One no-PII
+  upload should still confirm migration-013 filename provenance after restart, and one controlled company-report job
+  should confirm processor 1.2.0 produces all five downloads.
+- The operator-selected Web password satisfies the enforced length but should be rotated to a distinct high-entropy
+  value in Keychain, followed by one controlled Web restart.
+- The workstation runs Web and worker as separate processes. The checked-in Compose image intentionally does not claim
+  to run the worker because it does not package the workstation-only artifact-tool module; a production image/process
+  manager must supply Node/artifact-tool and the shared output volume before enabling that service.
+- A formally controlled no-PII server acceptance run remains appropriate after that deployment packaging is complete.
+- ARR2.0 intentionally has no copied Git history; version-control initialization/review remains independent.
 
 ## Last Updated
 
-2026-07-29
+2026-07-31