M49: record resilience production acceptance

artifacts/final-acceptance/summary.md

@@ -7,7 +7,7 @@ in `PROJECT_STATE.md`.
 ## 2026-08-21 release candidate
 
 - Backend: **271/271** tests passed against an isolated clean PostgreSQL database.
-- Browser acceptance: **155/155** Chromium tests passed in 4.6 minutes.
+- Browser acceptance: **155/155** Chromium tests passed in 6.0 minutes.
 - Live-safe browser canary: **4/4** passed across Chromium and Firefox against the local
   deployed stack; unlike the acceptance suite, it never resets or mutates demo records.
 - Accessibility: the principal login, dashboard, data-quality, knowledge, automation and
@@ -34,6 +34,28 @@ in `PROJECT_STATE.md`.
 - The final non-destructive HTTPS canary passed **4/4** across Chromium and Firefox,
   including the core operator routes and a grounded answer from the real knowledge stack.
 
+## 2026-08-21 resilience upgrade verification
+
+- Immutable revision `00191e9b54ee6b961648a6e02abbb3a57957dba0` was promoted from a
+  checksum-verified archive after a verified production dump. A stable gateway now routes
+  to two revision-specific API and two web replicas; stateful services are no longer
+  restarted by routine application releases.
+- Moving host port 1236 from the legacy web container to the gateway was a one-time
+  migration hand-off and produced 14 failures across 1,200 rapid probes. Future releases
+  do not move that port; their acceptance gate is the zero-error versioned gateway reload.
+- The versioned gateway switch sustained **300/300** local rollout probes without an error.
+  Production's non-destructive Chromium/Firefox canary passed **4/4**, and 360 authenticated
+  concurrent reads returned zero errors at p95 **137.2 ms**.
+- PostgreSQL, backup, Prometheus, Alertmanager, Grafana and the gateway all reported healthy;
+  Alembic was at head, the protected Prometheus target was present, and backup plus real
+  restore-drill evidence remained current.
+- Trivy 0.74 found zero fixed HIGH/CRITICAL vulnerabilities in the exact production API,
+  web and gateway images. The separately built rclone/PostgreSQL backup-tools image is also
+  clean after rebuilding rclone 1.75.0 with Go 1.26.6.
+- The OneDrive worker is deployed as an opt-in profile but is not represented as active:
+  it requires the owner's one-time interactive Microsoft OAuth authorization. Until that
+  happens, verified local backups remain the active recovery source.
+
 ## Evidence boundary
 
 The complete local suite uses the deterministic provider and an isolated database so it is