M44: harden release integrity and assurance

docs/19-visual-product-roadmap.md

@@ -1,5 +1,9 @@
 # MobilityOps visual product roadmap
 
+> Status (2026-08-21): R0–R6 have been implemented. The observations below are the
+> historical baseline that drove those changes, not a description of the current UI.
+> Current release evidence lives in `artifacts/final-acceptance/summary.md`.
+
 ## Purpose
 
 This roadmap turns the visual audit of the deployed MobilityOps PoC into an

docs/demo-release/demo-runbook.md

@@ -48,34 +48,25 @@ disabled entirely via `DEMO_ALLOW_RESET=false` if an environment must not be reb
 ## Redeploying to Unraid
 
 ```bash
-# From a clean local checkout on the target branch/commit:
+# From a clean local checkout on the exact commit:
 git archive --format=tar.gz -o /tmp/mobilityops-source.tar.gz HEAD
-scp /tmp/mobilityops-source.tar.gz unraid:/mnt/user/appdata/mobilityops/.deploy/source-<short-sha>.tar.gz
-ssh unraid "cd /mnt/user/appdata/mobilityops \
-  && tar -xzf .deploy/source-<short-sha>.tar.gz \
-  && echo <full-sha> > .deploy/source-revision"
-
-# Rebuild only what changed (api and/or web); db is never rebuilt:
-ssh unraid "cd /mnt/user/appdata/mobilityops \
-  && docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d api web"
-
-# Confirm migrations and reseed:
-ssh unraid "cd /mnt/user/appdata/mobilityops \
-  && docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec -T api python -m alembic current \
-  && docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec -T api python -m app.cli seed --reset"
+sha256sum /tmp/mobilityops-source.tar.gz
+scp /tmp/mobilityops-source.tar.gz unraid:/mnt/user/appdata/mobilityops/.deploy/
+ssh unraid "/mnt/user/appdata/mobilityops/deploy/unraid/deploy-release.sh \
+  /mnt/user/appdata/mobilityops/.deploy/mobilityops-source.tar.gz \
+  <archive-sha256> <full-git-sha>"
 ```
 
-Extraction preserves the server's existing `.env` and named volumes (Postgres data, n8n
-data) — the tarball never contains `.env` since it's gitignored. Never edit source
-directly on the server; never deploy uncommitted changes.
+The deployer verifies the archive checksum, extracts into a new commit-named release
+directory, builds revision-labelled immutable images, promotes without reseeding, and
+checks application, backup and observability health. Reset demo data only as a separate,
+deliberate demo-preparation action.
 
 ## Rollback
 
-`.deploy/source-revision` on the server records exactly which commit is live. Prior
-source tarballs remain in `.deploy/` for rollback: extract an earlier
-`source-<short-sha>.tar.gz`, update `source-revision` to match, and re-run the rebuild
-step above. Database rollback is out of scope for this demo (migrations are additive;
-there has been no destructive migration on this branch).
+`.deploy/source-revision` and `.deploy/release-history.log` record the live commit and
+image tags. A failed readiness check automatically restores the previous image IDs.
+Database rollback remains a separate, explicitly guarded restore operation.
 
 ## Server safety (Unraid)
 
@@ -89,9 +80,9 @@ guessed RAGcore/MCP URLs. PostgreSQL is never exposed externally.
 
 - **A scenario shows "Niet beschikbaar" on `/scenarios`**: it has already been resolved
   since the last reset (expected once you've worked through it) — reset to restore it.
-- **Knowledge question returns "insufficient evidence"**: check the question is in
-  English and close to one of the suggested phrasings — the demo knowledge base is
-  English-only (see `demo-guide.md`).
+- **Knowledge question returns "insufficient evidence"**: use a suggested question in
+  NL, EN or FR and inspect provider health/citations; the adapter refuses ungrounded
+  answers when RAGcore is slow, unavailable or lacks evidence.
 - **n8n shows a failed delivery that isn't the seeded demo one**: check `/automation`'s
   filter and retry — bounded retries mean it should self-heal within
   `n8n_max_attempts` attempts, or can be retried manually by an Operations Manager.