M52: activate verified OneDrive backups

PROJECT_STATE.md

@@ -1,5 +1,21 @@
 # Project state
 
+## M52 — activate verified ITWorx OneDrive backup (2026-08-21)
+
+- Authorized the `onedrive` rclone remote against the owner's ITWorx Microsoft 365
+  account and stored its renewable OAuth state only in the untracked server secret
+  directory with mode `0600`; no token or OneDrive content entered Git.
+- The first real activation exposed two release defects: the standalone reachability
+  command did not select the mounted rclone config, and the new off-site/refresh scripts
+  lacked executable Git modes. The config path is now explicit and all entry-point scripts
+  are tracked as executable.
+- Production completed a real upload/download/checksum cycle for
+  `mobilityops-20260821T202052Z.dump` and a disposable PostgreSQL restore drill at Alembic
+  `4f2b9c8d7e61` with restored counts `2 users / 50 vehicles / 254 bookings / 239 audit
+  events`. The off-site worker is healthy and writes to `onedrive:FleetOps/backups`.
+- Exact next action: commit and push M52, deploy that exact revision, and reconfirm the
+  off-site worker plus public application readiness after promotion.
+
 ## M51 — zero-error production rollout evidence (2026-08-21)
 
 - The rejected M49 candidate proved rollback isolation: production remained on M48 and

deploy/unraid/configure-onedrive-backup.sh

@@ -20,7 +20,8 @@ docker build --build-arg "VCS_REF=$revision" --tag "$image" \
 echo "Configure Microsoft OneDrive as remote '$remote'; OAuth opens in your browser."
 docker run --rm -it --entrypoint rclone -v "$config_dir:/config/rclone" "$image" config
 chmod 600 "$config_dir/rclone.conf"
-docker run --rm --entrypoint rclone -v "$config_dir:/config/rclone" "$image" lsd "$remote:"
+docker run --rm --entrypoint rclone -v "$config_dir:/config/rclone" "$image" \
+  --config /config/rclone/rclone.conf lsd "$remote:"
 
 history="$(tail -n 1 "$root/.deploy/release-history.log")"
 # shellcheck disable=SC2086