M24: implement privacy governance

PROJECT_STATE.md

@@ -2554,3 +2554,23 @@ evidence yet."
   disposable PostgreSQL instance produced a real dump, checksum verification passed and
   `pg_restore --list` accepted the artifact. Exact next action: implement privacy export,
   anonymisation safeguards, retention reporting and governance documentation.
+
+## M24 — executable privacy governance (2026-08-10)
+
+- Added a manager-only Privacy workspace with persisted policy metrics, customer dossier
+  export, bounded audit CSV export and irreversible customer anonymisation. Privacy is
+  localized in all three supported languages, searchable and hidden from rental staff.
+- Anonymisation is row-locked and requires the exact stable customer reference plus a
+  reason. Reserved/active bookings and bookings inside the configurable minimum retention
+  window block the action. PII is cleared while stable references and operational history
+  remain valid; repeated requests are idempotent.
+- Every export and anonymisation is audited. The anonymisation audit records state and
+  justification but deliberately never copies erased PII. Audit CSV ranges are capped at
+  90 days and a configurable maximum row count.
+- Added explicit customer anonymisation state/migration `b913a72e8c14`, a governance
+  runbook covering inventory, retention, data-subject requests, access review and incident
+  handling, plus regenerated OpenAPI.
+- Evidence: privacy API **6 passed without warnings**; ruff/mypy clean; React review led
+  to stable callback/effect dependencies and a lazy route chunk; TypeScript, lint and
+  production build pass. Exact next action: extend RAGcore corpus statistics and health
+  evidence, then run complete acceptance and deploy all production-readiness milestones.