diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md
index f844844..3e34623 100644
--- a/PROJECT_STATE.md
+++ b/PROJECT_STATE.md
@@ -1,5 +1,40 @@
 # Project state
 
+## M40 — publish and redeploy M39 (2026-08-17)
+
+- Published three validated commits to Gitea `master`: the backend dependency and secret
+  CI gates (`6859249`, `a9f48d6`) plus the complete M39 hardening milestone (`ae39a89`).
+  A fresh fetch confirmed local `HEAD` and `origin/master` both resolved to
+  `ae39a8947fff1ec1b60116556ed411567b11f0d2` before deployment.
+- Local validation used freshly rebuilt API/web images: isolated PostgreSQL backend suite
+  **261 passed** (one Alembic configuration deprecation warning), Ruff clean, mypy clean
+  across 59 source files, frontend lint and production build clean, full and production
+  npm audits at **0 vulnerabilities**, Trivy/secret scan clean, and Playwright
+  **153/153 passed in 3.1 minutes**.
+- Created and verified the pre-deployment custom-format backup
+  `backups/postgres/mobilityops-20260817T011857Z.dump`; checksum verification and
+  `pg_restore --list` both passed. The committed source archive matched locally and on
+  Unraid at SHA-256 `473293921717b7f1363689f4a152493797778ceb91f284cc21b5b68600803de6`.
+- Deployed the exact committed archive to `/mnt/user/appdata/mobilityops`, preserving
+  `.env`, `.deploy`, volumes and the central n8n. API/web were rebuilt and recreated;
+  PostgreSQL data remained on its named volume. Production secrets were verified as
+  non-empty/non-placeholder without exposing their values. Readiness is `ready`, API,
+  database, web and backup are healthy, and Alembic is `0a4c1d2e3f5b (head)`.
+- Live Playwright acceptance completed **152/153** on the first pass. The sole failure was
+  the expected honest degradation path: one RAGcore request exhausted both bounded 5 s
+  calls (`/v1/answers` then `/v1/search`) and rendered “knowledge service unavailable”
+  while returning HTTP 200 and leaving operations unaffected. The complete guided-demo
+  test passed on immediate focused rerun in **11.3 s**. The final API/web critical-log
+  scan is clean.
+- Final hand-off state: all five synthetic scenarios are ready; reset cooldown is restored
+  to 60 seconds; RAGcore and MCP Hub report operational. Central n8n is healthy and all
+  four Fleet Ops workflows are active. Its aggregate state is temporarily `degraded`
+  solely because the hourly quality-scan heartbeat is stale; there are zero unexpected
+  delivery failures and the one failed outbox row is the labelled demo scenario.
+- Exact next action: no code or deployment work remains. Confirm the next scheduled
+  quality-scan heartbeat clears the temporary stale n8n state; investigate the central
+  workflow scheduler only if it does not.
+
 ## M39 — Hardening review (2026-08-16)
 
 Full-repository audit (backend, frontend, infra, docs) followed by targeted fixes. Every