M35: harden the shared public demo

PROJECT_STATE.md

@@ -2775,3 +2775,21 @@ evidence yet."
   direct invalid-state writes were rejected by their named constraints; Ruff passed.
 - Exact next action: serialize and rate-limit shared demo reset, add production web guards
   and cache MCP reachability evidence.
+
+## M35 — shared public demo and edge hardening (2026-08-10)
+
+- Demo resets now use a non-blocking process guard plus a PostgreSQL transaction advisory
+  lock, and enforce a configurable post-success cooldown with a standards-based
+  `Retry-After`. Test deployments explicitly disable only the cooldown, never locking.
+- Nginx rate-limits public demo login/reset endpoints and adds CSP, anti-framing, MIME,
+  referrer and browser capability headers. Hashed assets receive long-lived caching while
+  the application shell is revalidated. Production FastAPI deployments no longer expose
+  Swagger, ReDoc or OpenAPI routes.
+- MCP Hub reachability probes are synchronized and cached for 60 seconds, removing a
+  remote network call from every Integration Management page load while retaining honest
+  failure evidence.
+- Validation: authentication/reset suite **15 passed**; Ruff and mypy passed across 58
+  source files; production web image built and `nginx -t` passed; production API docs-off
+  assertion passed.
+- Exact next action: improve mobile Data Quality operations, technical evidence labels,
+  RAG scope clarity and sticky resolution actions.