M38: record production acceptance evidence

PROJECT_STATE.md

@@ -2836,3 +2836,26 @@ evidence yet."
 - Exact next action: commit and push M37, create and verify a live PostgreSQL backup,
   deploy the committed archive, migrate to `c24f6a9d013e`, then repeat live acceptance and
   restore the public reset cooldown to 60 seconds.
+
+## M38 — production deployment and final acceptance (2026-08-10)
+
+- Pushed M33–M37 to Gitea `master` and deployed runtime commit `2681935` to Unraid at
+  `http://192.168.10.150:1236`. The verified pre-deployment custom-format backup is
+  `backups/postgres/mobilityops-20260810T211951Z.dump`; SHA-256 verification and
+  `pg_restore --list` both passed.
+- All application, database, backup and observability containers are healthy. Alembic is
+  `c24f6a9d013e (head)`, the production API returns 404 for Swagger/OpenAPI internally,
+  readiness returns 200 and the final ten-minute traceback/critical-error scan is clean.
+- Complete live Playwright acceptance passed **153/153 in 5.6 minutes** against the public
+  Unraid URL. Nginx exposes the CSP, anti-framing, MIME and referrer guards and revalidates
+  the app shell.
+- The final reset restored **2 users / 180 customers / 50 vehicles / 254 bookings / 75
+  inspections / 40 maintenance records / 33 quality issues / 20 workflow runs** and all
+  five demo scenarios report ready. The public reset cooldown was restored to 60 seconds.
+- The shared n8n at `192.168.10.150:5678` returns health 200; no bundled n8n container was
+  started. Fleet Ops reports 19 successful deliveries and zero unexpected failures; its
+  one expected failure is the labelled error-handling demo scenario. MCP Hub is operational
+  with three retained real tool calls. RAGcore is available with 11/11 verified sources in
+  the active language collection and 33/0 all-language sync evidence.
+- Exact next action: none for the locked scope; keep the public synthetic demo online and
+  monitor the existing health, backup and integration evidence surfaces.