M54: harden operations and demo resilience

PROJECT_STATE.md

@@ -1,5 +1,63 @@
 # Project state
 
+## M54 — full logic, resilience and recruiter upgrade (2026-08-23, local candidate)
+
+- Replaced the static Engineering architecture row with an interactive, keyboard-operable
+  five-step system flow. It exposes the user-intent, local-transaction and recoverable-edge
+  boundaries, marks the post-commit outbox hand-off and explains persisted evidence for
+  each selected step. Dashboard recovery is abortable/retryable and mobile actions retain
+  a full-width 44 px target.
+- Tightened operational invariants around bookings, returns and data quality. New bookings
+  cannot pre-confirm requirements; customer tombstones are rejected; employee vehicle views
+  never load manager-only quality evidence. DQ-03 now uses actual inspection chronology,
+  appends concurrent evidence, supports partial correction, synchronizes booking/inspection/
+  vehicle readings and suppresses only the exact source fingerprint explicitly retained by
+  a manager. Resolver/return lock order is covered by a real two-session deadlock regression.
+- Split the oversized data-quality service into focused common/odometer/duplicate-scan
+  modules while preserving its public API. The seed generator now reproduces all seven
+  committed CSV files byte-for-byte and authored inspection/maintenance evidence matches
+  the structured runtime facts.
+- Made demo reset atomic across requests and replicas: all SQLAlchemy transactions take the
+  shared side of a PostgreSQL advisory barrier, reset takes the exclusive side, a separate
+  non-blocking replica guard rejects competing resets and the database audit timestamp is
+  the authoritative cooldown. An integrity failure rolls the complete reset back.
+- Hardened external contracts. n8n callbacks bind event plus correlation IDs under row locks;
+  dispatcher success requires an exact event acknowledgement and execution ID; a per-claim
+  lease token prevents late workers overwriting a reclaim/callback. RAGcore responses are
+  accepted as grounded only with valid response UUIDs, managed provenance, local excerpt
+  validation and claim-to-citation bindings. Unconfigured/unverified integrations no longer
+  inherit a historical green state.
+- Closed frontend lifecycle and timing races: guide target searches cancel on close and
+  restore focus, final progress is completable, reset clears progress only after commit,
+  guided entry waits for a retryable manifest, session/status loads do not block each other,
+  latest-request-wins guards stale filters, Brussels DST gaps are rejected and maintenance
+  dates are browser-timezone independent. Ctrl/Cmd+K registers before paint in capture phase.
+  All new error codes and states have NL/EN/FR parity.
+- Validation evidence:
+  - isolated PostgreSQL backend suite: **331 passed in 94.19 s**;
+  - DQ-03 edge/concurrency suite: **44/44 passed**; combined RAG/dispatcher/DQ suite:
+    **121/121 passed**;
+  - Ruff clean; mypy clean across **62 source files**;
+  - frontend TypeScript/ESLint, production build, source and bundle budgets passed;
+  - OpenAPI, event, MCP and n8n contracts synchronized; production npm audit reports
+    **0 vulnerabilities**;
+  - guarded source sizes: data-quality service **799/900 lines**, main CSS
+    **76,342/78,000 bytes**, architecture CSS **8,057/9,000 bytes**;
+  - the previously intermittent global-search shortcut passed **10/10** consecutive
+    release-container repetitions after its lifecycle fix;
+  - final uninterrupted Playwright release run: **171/171 passed in 6.9 min**;
+  - in-app inspection of login, Dashboard and Engineering at desktop and 390×844 found
+    zero horizontal overflow, no alert/console errors and the intended one-column mobile flow.
+- Final local reset restored **2 users / 180 customers / 50 vehicles / 254 bookings / 75
+  inspections / 40 maintenance records / 33 DQ issues / 20 workflow runs** with all five
+  synthetic scenarios ready. API/database readiness is green and the final API/web log scan
+  contains no traceback, critical, unhandled, panic, fatal or emergency hit.
+- Local Compose `db`, `api` and rebuilt `web` services run the candidate at
+  `http://localhost:1228`. Production and its data were not changed during validation.
+  Explicit release authority was granted on 2026-08-24.
+- Exact next action: create and push the coherent M54 commit, take and verify a production
+  backup, then promote that exact revision through the established start-first deployer.
+
 ## M52 — activate verified ITWorx OneDrive backup (2026-08-21)
 
 - Authorized the `onedrive` rclone remote against the owner's ITWorx Microsoft 365