docs: harden internal semantic doc state

PROJECT_STATE.md

@@ -32,7 +32,9 @@
   schema-v3 migration messaging, Qdrant collection ownership, Qdrant backup/restore safety, and
   the absence of active external vector/embedding operator bindings from current manuals.
 
-## Unified deployment release gate — Task 13 (2026-08-05)
+## Historical snapshots and archived reference notes
+
+### Historical snapshot — Unified deployment release gate, Task 13 (2026-08-05)
 
 - **Release coverage.** `scripts/unified-deployment-smoke.sh` gates the two-service render/build,
   frontend-to-core routing, embedded pinned Pi, Git registry bootstrap, offline recreation, valid
@@ -80,7 +82,7 @@
   resource could be created, so authenticated workspace/fail-closed session behavior remains an
   explicit release gate. Native Windows PowerShell/Docker execution also remains pending.
 
-## Portable deployment decoupling — LIVE 2026-08-05
+### Historical snapshot — Portable deployment decoupling (superseded 2026-08-08)
 
 - **Mandatory stack.** The supported Compose stack is exactly `frontend` plus `core`; use the
   base file with `deploy/compose.local.yaml`, or with `deploy/compose.server.yaml` plus the
@@ -107,7 +109,7 @@
   and optional overrides, while the category-based coupling scan covers runtime, Docker smoke,
   install, operator, and positive deployment-test contracts and propagates scanner errors.
 
-## Portable Git workspace registry — source integration (2026-08-04)
+### Historical snapshot — Portable Git workspace registry, pre-schema-v3 (superseded 2026-08-08)
 
 - **Source of truth and scope.** The canonical workspace repository is a generic Git remote,
   configured only by `THT_WORKSPACE_GIT_REMOTE` and `THT_WORKSPACE_GIT_BRANCH` (there is no
@@ -140,7 +142,7 @@
   harness run remains a release command for the deployment environment; the earlier local
   long-running harness run was intentionally cancelled before it produced a final result.
 
-## Session summary redesign — LIVE 2026-07-23
+### Historical snapshot — Session summary redesign (2026-07-23)
 
 - Session documents are projected at read time in outcome-first order: original question,
   final SQL, persisted data preview, revised question, assumptions, one memory list, then
@@ -163,7 +165,7 @@
   `sha256:8311ca1308b459ece7236bf143da7b1a226ff4082fed924e1b5a207c24b6ca29`
   is running. Frontend and `/api/health` both returned HTTP 200.
 
-## Local Pi user auth + startup failure handling — LIVE 2026-07-21
+### Historical snapshot — Local Pi user auth + startup failure handling (2026-07-21)
 
 - The PSD Docker profile now bind-mounts the configurable host `PI_AUTH_FILE` read-only at
   `/home/thoth/.pi/agent/auth.json`; on this Mac it resolves to the real user profile
@@ -185,7 +187,7 @@
   `a390c8b8-0a91-4a37-967b-ce7ff9be9797`, `a2f974b2-4c48-4967-b4b6-afdbc2b2d541`, and
   `f66e1959-3c71-4b10-8aa1-606992046b7e` (API delete 204, subsequent lookup 404 for each).
 
-## User-owned sessions cutover — prepared, manual gate pending (2026-07-16)
+### Historical snapshot — User-owned sessions cutover (2026-07-16)
 
 - **Target contract:** the public server runs `AUTH_MODE=upstream` with Task 4 portal identity
   forwarding and Task 5 principal enforcement deployed together. Its session source of truth is
@@ -207,7 +209,7 @@
   release; never re-enable filesystem persistence, restore the archive into production, or
   dual-write during rollback.
 
-## Historical deployment — Docker locale (Profile A, co-located) — superseded 2026-08-05
+### Historical snapshot — Docker locale deployment, Profile A (superseded 2026-08-05)
 
 ThothII gira in Docker sul server co-locato, **embedded nel portale omics_portal** a `https://aritmolab.policlinicosandonato.it/datamart-builder` (backend invisibile, tutto same-origin via nginx del portale).