M44: harden release integrity and assurance

deploy/unraid/README.md

@@ -17,8 +17,9 @@ existing shared n8n remains available on its established port 5678.
 
 Create `.env` from `.env.example`, replace every placeholder secret, set
 `MOBILITYOPS_ENV=production`, set both public URLs to
-`https://fleetops.itworx.tech`, set `SESSION_COOKIE_SECURE=true`, and retain
-`KNOWLEDGE_PROVIDER=demo` while RAGcore is not available. The internal `1236` listener is
+`https://fleetops.itworx.tech`, set `SESSION_COOKIE_SECURE=true`, and configure
+`KNOWLEDGE_PROVIDER=ragcore` only after the RAGcore health and source inventory checks pass.
+The internal `1236` listener is
 an upstream for the TLS proxy, not a user-facing URL.
 
 ```bash
@@ -26,11 +27,16 @@ cd /mnt/user/appdata/mobilityops
 ./deploy/unraid/configure-env.sh \
   https://fleetops.itworx.tech \
   https://n8n.itworx.tech/webhook/mobilityops-return
-docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d db api web backup
-docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
-  python -m app.cli seed --reset
+git archive --format=tar.gz -o /tmp/mobilityops-source.tar.gz HEAD
+sha256sum /tmp/mobilityops-source.tar.gz
+# Copy the archive and run deploy-release.sh with its SHA-256 and full Git SHA.
 ```
 
+`deploy-release.sh` stages a clean, commit-named release, builds OCI-labelled immutable
+API/web images, promotes without a seed/reset, and verifies migrations, readiness,
+backups and observability. Run `python -m app.cli seed --reset` only for initial setup or
+an explicit synthetic-demo reset; it is never part of a routine deployment.
+
 Migrations run automatically in the API entrypoint. Import and publish the MobilityOps
 workflow into the existing n8n container:
 
@@ -57,17 +63,21 @@ docker logs --tail=200 n8n
 ## Backup and restore
 
 The `backup` service creates a backup immediately and then every 24 hours. Every dump is
-validated with `pg_restore --list`, receives a SHA-256 sidecar and is retained for 30 days
-with at least seven copies protected from pruning. Its healthcheck becomes unhealthy when
-no successful backup has been recorded for 26 hours. Configure
+checked by SHA-256 and `pg_restore --list`; at least weekly the newest dump is also restored
+into a disposable database and its migration revision and core table counts are verified.
+Backups are retained for 30 days with at least seven copies protected from pruning. Its
+healthcheck becomes unhealthy when the daily backup or eight-day restore-drill SLA is missed. Configure
 `BACKUP_SECONDARY_DESTINATION=/offsite` plus an independently mounted
 `MOBILITYOPS_BACKUP_SECONDARY_DIR` for a second copy.
 
-Create an additional on-demand backup or verify the newest scheduled backup:
+Create an additional on-demand backup, verify the newest backup, or execute the isolated
+restore drill:
 
 ```bash
 ./deploy/unraid/backup-postgres.sh
 ./deploy/unraid/verify-postgres-backups.sh
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec -T backup \
+  /opt/mobilityops/restore-drill-postgres.sh /backups/<backup>.dump
 ```
 
 A restore is deliberately guarded and creates an additional safety backup before