docs(state): record Batch 2 completion

PROJECT_STATE.md

@@ -357,3 +357,37 @@ any change at `docs/functional-completion/server-baseline.md`.
   actual deployment, not just localhost.
 - Exact next action: Batch 2 — authoritative return-preview endpoint shared with commit,
   and expose `before`/`after` on the audit API + UI.
+
+### Batch 2 — complete (commits `f521295`, `7e34f55`)
+
+- Added `evaluate_return()` (pure, no writes) in `returns.py`, extracted from what
+  `register_vehicle_return` already computed inline; `register_vehicle_return` now calls
+  it instead of duplicating the logic. New non-mutating `POST
+  /api/v1/bookings/{ref}/return-preview` uses the same function, so preview and commit
+  cannot drift.
+- Fixed a real defect this surfaced: `ReturnForm.tsx`'s review step guessed the outcome
+  client-side and got the domain rule wrong — it said damage/technical-warning routes to
+  `maintenance` (actual rule: `blocked`) and the no-contradiction case becomes
+  `available` (actual rule: always `cleaning` first, `maintenance` only past the service
+  threshold). The review step now calls `/return-preview` and renders the server's
+  `resulting_vehicle_status` + `status_reason` verbatim.
+- Result screen now distinguishes local commit success from n8n delivery ("queued... not
+  yet confirmed" instead of implying both succeeded) and links to any created
+  data-quality issue for Operations Manager.
+- Exposed `before`/`after` on `AuditEventOut` (the DB columns already existed but were
+  never serialized) plus a resolved `entity_ref`/`entity_link` for vehicle/booking/
+  data-quality-issue entities. `Audit.tsx` now shows a human-readable change summary per
+  row with raw JSON behind a `<details>` disclosure instead of always-visible JSON.
+- New regression coverage: backend — preview performs no writes (asserted via audit/
+  outbox row counts before vs. after), detects odometer regression, detects service-due,
+  detects next-booking risk, requires an active booking, and matches the commit result;
+  audit — before/after and entity link exposed for both `return_registered` and
+  `vehicle_status_changed`. Frontend — preview correctly reports `blocked` (not
+  `maintenance`) for damage, commit request only fires after confirm (updated to also
+  assert exactly one preview call), audit page shows before/after and a safe link.
+- Local evidence: `pytest` 81 passed, `ruff check .` clean, `mypy app` 0 issues/44 files,
+  `npx tsc -b` clean, `npm run build` clean, `npx playwright test` **27 passed**, stable
+  across two repeated full-suite runs.
+- Deployed to Unraid and re-verified; demo data reset afterward.
+- Exact next action: Batch 3 — data-quality workbench (typed snapshots, bounded
+  resolution flows for all 5 rule types, manual scan UI).