M15: synchronize contracts and acceptance

PROJECT_STATE.md

@@ -2356,3 +2356,45 @@ evidence yet."
   execution ID visible.
 - Exact next action: regenerate the checked-in OpenAPI contract, add E2E coverage for the
   new operator workflows, document credential-safe n8n upgrades and run acceptance.
+
+## Contract and acceptance synchronization (2026-08-10)
+
+- Replaced the obsolete hand-maintained OpenAPI baseline with a deterministic snapshot
+  generated directly from the FastAPI application. The committed contract now describes
+  all 53 paths and 75 schemas, including booking lifecycle, operational users, MCP trust
+  headers and n8n execution telemetry.
+- Added browser acceptance coverage for booking creation/cancellation, user
+  creation/deactivation and vehicle maintenance/release. Existing acceptance journeys
+  now reset their own state, tolerate the configured honest knowledge provider and allow
+  the provider's bounded response window instead of depending on suite order or a demo
+  provider that is not active in production.
+- Added a credential-reference merge utility and a runbook procedure that preserves live
+  n8n credential IDs during workflow upgrades without exporting or committing secrets.
+- Hardened logout beyond browser cookie deletion: signed sessions now carry a unique
+  nonce, logout persists a token-hash denylist, expired revocations are pruned, and both
+  demo and operational authentication reject retained or copied cookies server-side.
+  Repeated live refresh/logout coverage passed **40/40**.
+- Removed a return-form initialization race: the return form now mounts only after the
+  persisted demo manifest is ready, so operator input cannot be overwritten by a late
+  manifest response. The final mobile row interaction is represented by actual link
+  semantics rather than a nested interactive table row.
+- Split frontend dependency installation from source compilation in the Docker build so
+  dependency layers are cached and reproducible. Upgraded the build toolchain to pinned
+  Vite **8.2.1** and `@vitejs/plugin-react` **6.0.5**; both the production-only and full
+  npm audits report **0 vulnerabilities**.
+- **Final acceptance evidence**: generated OpenAPI output is byte-for-byte deterministic;
+  frontend TypeScript/production build, ruff, mypy and diff checks pass; Alembic reports
+  `d1f83bc64170 (head)`; the complete backend suite passes **213 tests**; the complete
+  Playwright suite passes **144 tests in 4.8 minutes** against the deployed production
+  bundle.
+- **Live integration evidence**: a real vehicle return completed through local commit →
+  outbox → the existing central n8n → callback → heartbeat. After the final browser run,
+  Vehicle Return execution **376** is healthy, n8n is operational with zero pending
+  events, MCP Hub is reachable and operational with a real audited
+  `fleet_ops_get_operations_summary` call, and RAGcore reports available/ready.
+- **Restored hand-off state**: the synthetic reset reports all scenarios ready with 2
+  users, 180 customers, 50 vehicles, 254 bookings, 75 inspections, 40 maintenance
+  records, 33 data-quality issues and 20 workflow runs; `BK-DEMO-RETURN` is active again.
+- **Exact next action**: none for the locked PoC. All acceptance criteria are satisfied;
+  subsequent work is routine production operation, monitoring and explicitly approved
+  scope beyond this build.