M49: record resilience production acceptance

PROJECT_STATE.md

@@ -1,5 +1,28 @@
 # Project state
 
+## M49 — M48 production acceptance evidence (2026-08-21)
+
+- Pushed M48 revision `00191e9b54ee6b961648a6e02abbb3a57957dba0` and promoted its
+  checksum-verified archive (`9421429ccfec8a91cef482472edf9e7f2047df447f4b612c90d247ca1c21a669`)
+  after creating and verifying `mobilityops-20260821T201820Z.dump`.
+- Production now has a healthy stable gateway, exactly two revision-labelled API replicas
+  and two web replicas. The database stayed running; backup, Prometheus, Alertmanager and
+  Grafana were explicitly refreshed and all report healthy. Alembic is
+  `4f2b9c8d7e61 (head)`, Prometheus sees its API target and backup/restore markers exist.
+- The one-time hand-off of host port 1236 from the former web container to the new gateway
+  caused 14 failures in 1,200 rapid probes. This bounded migration interruption cannot recur:
+  subsequent releases keep the gateway running and atomically reload versioned upstreams.
+- Live non-destructive acceptance passed **4/4** in Chromium and Firefox, including the
+  real grounded knowledge path. The authenticated production read-load gate passed
+  **360/360** at concurrency 18 with p95 **137.2 ms** and max **211.4 ms**.
+- Trivy 0.74 reports zero fixed HIGH/CRITICAL findings for the exact production API, web
+  and gateway images. TLS is valid through 2026-11-03 and a 14-day horizon check passes;
+  all MobilityOps containers had zero traceback/uncaught/panic/fatal/emergency log hits.
+- Exact next action: commit/push this evidence-only M49 revision, deploy it through the now
+  established start-first gateway while probing continuously, verify exact revision and
+  tag `v1.1.0-poc`. OneDrive remains intentionally disabled until the owner completes the
+  one-time interactive Microsoft OAuth authorization.
+
 ## M48 — resilient synthetic-demo operations (2026-08-21)
 
 - Replaced routine Compose recreation with a stable Nginx gateway and a two-API/two-web

artifacts/final-acceptance/summary.md

@@ -7,7 +7,7 @@ in `PROJECT_STATE.md`.
 ## 2026-08-21 release candidate
 
 - Backend: **271/271** tests passed against an isolated clean PostgreSQL database.
-- Browser acceptance: **155/155** Chromium tests passed in 4.6 minutes.
+- Browser acceptance: **155/155** Chromium tests passed in 6.0 minutes.
 - Live-safe browser canary: **4/4** passed across Chromium and Firefox against the local
   deployed stack; unlike the acceptance suite, it never resets or mutates demo records.
 - Accessibility: the principal login, dashboard, data-quality, knowledge, automation and
@@ -34,6 +34,28 @@ in `PROJECT_STATE.md`.
 - The final non-destructive HTTPS canary passed **4/4** across Chromium and Firefox,
   including the core operator routes and a grounded answer from the real knowledge stack.
 
+## 2026-08-21 resilience upgrade verification
+
+- Immutable revision `00191e9b54ee6b961648a6e02abbb3a57957dba0` was promoted from a
+  checksum-verified archive after a verified production dump. A stable gateway now routes
+  to two revision-specific API and two web replicas; stateful services are no longer
+  restarted by routine application releases.
+- Moving host port 1236 from the legacy web container to the gateway was a one-time
+  migration hand-off and produced 14 failures across 1,200 rapid probes. Future releases
+  do not move that port; their acceptance gate is the zero-error versioned gateway reload.
+- The versioned gateway switch sustained **300/300** local rollout probes without an error.
+  Production's non-destructive Chromium/Firefox canary passed **4/4**, and 360 authenticated
+  concurrent reads returned zero errors at p95 **137.2 ms**.
+- PostgreSQL, backup, Prometheus, Alertmanager, Grafana and the gateway all reported healthy;
+  Alembic was at head, the protected Prometheus target was present, and backup plus real
+  restore-drill evidence remained current.
+- Trivy 0.74 found zero fixed HIGH/CRITICAL vulnerabilities in the exact production API,
+  web and gateway images. The separately built rclone/PostgreSQL backup-tools image is also
+  clean after rebuilding rclone 1.75.0 with Go 1.26.6.
+- The OneDrive worker is deployed as an opt-in profile but is not represented as active:
+  it requires the owner's one-time interactive Microsoft OAuth authorization. Until that
+  happens, verified local backups remain the active recovery source.
+
 ## Evidence boundary
 
 The complete local suite uses the deterministic provider and an isolated database so it is