docs(state): record Batch 1 completion and server verification

PROJECT_STATE.md

@@ -320,3 +320,40 @@ None. External service credentials may be absent; use the documented demo/degrad
 - Exact next action: hand off `design/mobilityops-premium-ui` for review. The final code,
   shared-n8n topology and evidence are committed, pushed and deployed; do not merge master
   automatically.
+
+## Functional completion pass (branch `feat/mobilityops-functional-completion`)
+
+Branched from `design/mobilityops-premium-ui` @ `54dc952`. Full audit at
+`docs/functional-completion/current-functional-audit.md`; server baseline captured before
+any change at `docs/functional-completion/server-baseline.md`.
+
+### Batch 1 — complete (commits `938a739`..`bdc58f3`)
+
+- Fixed the two confirmed list-rendering defects: Vehicles and Bookings both computed a
+  filtered/paginated result but rendered the raw unfiltered array in the table body.
+- Added server-backed session lifecycle: `GET /api/v1/demo/session` (Cache-Control:
+  no-store — a cached 200 was making logout intermittently fail to redirect in e2e
+  testing), `POST /api/v1/demo/logout`. `AuthContext` now verifies against the server on
+  every mount instead of trusting `sessionStorage`, and a central 401 listener on the API
+  client clears auth state from any endpoint.
+- Enforced the brief's role matrix: data-quality (list/detail/defer/reject) and the audit
+  trail were reachable by Rental Employee with no gate beyond authentication (confirmed
+  live via curl before the fix). Both are now `require_operations_manager`-gated
+  server-side, with matching nav-hiding and a restricted-message fallback for direct URL
+  access, and the dashboard no longer links into those areas for that role.
+- Discovered and fixed a latent e2e-suite bug while testing against the real server: all
+  three spec files hardcoded `http://localhost:8128` for their demo-reset helpers, so
+  pointing the suite at Unraid via `MOBILITYOPS_PUBLIC_URL` silently kept resetting the
+  *local* dev database instead. Switched to relative paths so the configured `baseURL` is
+  honoured.
+- Local evidence: `pytest` 75 passed, `ruff check .` clean, `mypy app` 0 issues/44 files,
+  `npx tsc -b` clean, `npm run build` clean, `npx playwright test` **25 passed** (up from
+  19 — 6 new tests this batch), stable across three repeated full-suite runs.
+- Deployed to Unraid (`.deploy/source-revision` = `bdc58f396e99caaf6ef657bb110b479981cc7793`,
+  matches `git rev-parse HEAD` on the feature branch), migrations unchanged at
+  `e7b08389f47f (head)` (no schema change this batch), demo reset run. Re-verified live:
+  role-gate curl checks (403/200/401 as expected) and the full 25-test Playwright suite
+  run with `MOBILITYOPS_PUBLIC_URL=http://192.168.10.150:1236` — **25 passed** against the
+  actual deployment, not just localhost.
+- Exact next action: Batch 2 — authoritative return-preview endpoint shared with commit,
+  and expose `before`/`after` on the audit API + UI.