M47: record final production acceptance

PROJECT_STATE.md

@@ -1,5 +1,25 @@
 # Project state
 
+## M47 — final production acceptance evidence (2026-08-21)
+
+- Promoted immutable M46 revision `95c91797fa2c599443d69d9c96d83a85ee0711f7`
+  from checksum-verified archive
+  `559b035b4f563d7580926c1193a579f3bd43ba791fcad2110d241dbc68b1126f`
+  after creating production backup `mobilityops-20260821T164628Z.dump`.
+- The API and web OCI labels plus `.deploy/source-revision` all matched M46. API, web,
+  PostgreSQL, backup and Alertmanager were healthy; Prometheus and Grafana were running;
+  public readiness reported `ready/database up`; Alembic reported `4f2b9c8d7e61 (head)`.
+- Trivy 0.70 scanned the exact production API and web images with fixed findings enabled:
+  both reported zero HIGH/CRITICAL vulnerabilities. Prometheus scraped the protected API
+  target successfully with an empty error and Alertmanager exposed the active watchdog.
+- The first post-promotion Firefox pass encountered one transient module fetch error while
+  every asset and Chromium request was returning HTTP 200. Direct asset verification was
+  HTTP 200 with immutable caching; an immediate clean rerun passed **4/4** in Chromium and
+  Firefox, including HTTPS readiness, all operator routes and a real grounded RAGcore answer.
+- Exact next action: commit/push this evidence-only milestone, deploy that exact revision
+  (application bytes are unchanged from accepted M46), verify revision/readiness, tag the
+  accepted PoC release and leave the repository synchronized and clean.
+
 ## M46 — refresh vulnerable web runtime base (2026-08-21)
 
 - The production image gate found fixed HIGH/CRITICAL Alpine vulnerabilities in the

artifacts/final-acceptance/summary.md

@@ -21,6 +21,19 @@ in `PROJECT_STATE.md`.
 - Operations: Prometheus/Alertmanager configuration validation passed, including the
   watchdog and authenticated n8n receiver route.
 
+## 2026-08-21 production verification
+
+- Immutable application revision `95c91797fa2c599443d69d9c96d83a85ee0711f7` was promoted
+  from a checksum-verified source archive after a fresh production backup.
+- Source revision and both OCI revision labels matched. Public readiness was green,
+  Alembic was at head, all health-gated services were healthy and persisted demo data was
+  retained without a deployment reset.
+- Trivy found zero fixed HIGH/CRITICAL vulnerabilities in each exact production image.
+- Prometheus successfully scraped the bearer-protected API target, Alertmanager carried
+  the active delivery watchdog, and the authenticated n8n alert receiver remained active.
+- The final non-destructive HTTPS canary passed **4/4** across Chromium and Firefox,
+  including the core operator routes and a grounded answer from the real knowledge stack.
+
 ## Evidence boundary
 
 The complete local suite uses the deterministic provider and an isolated database so it is