diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md
index 8961a65..d1820a6 100644
--- a/PROJECT_STATE.md
+++ b/PROJECT_STATE.md
@@ -2257,3 +2257,18 @@ evidence yet."
 - **Deployment**: committed and pushed as `0ef4a6fa98e6e4b4f73b0bcaa2581ecc82fbbc51`
   (`UX: paginate booking operations`), deployed to Unraid; `.deploy/source-revision`
   matches that commit.
+
+## Operational-mode foundation (2026-08-10)
+
+- Added a non-demo operational mode with email/password login, scrypt password hashes,
+  an explicitly configured first Operations Manager and database-backed active-user
+  revalidation on every operational request. Demo mode remains the default and retains
+  its deterministic reset semantics; outside demo mode, demo login/manifest/reset are
+  unavailable and demo-only controls are hidden in the UI.
+- Added migration `b7c7b536df85`, production environment guidance in `.env.example` and
+  `docs/17-runbook.md`, and focused authentication contract tests. Also normalized the
+  return response through its declared schema so preview and committed return risks use
+  identical UTC serialization.
+- Evidence: local web build, ruff and mypy clean; deployed Unraid Compose test suite
+  **195 passed**. API/web/db healthy, deterministic demo seed restored. Live source
+  revision: `948d5eb6a60a138dcfc539fd9e36f885200190de`.