docs(access): record real source calibration

vehicle-data-platform/docs/frontend-production-readiness.md

@@ -144,6 +144,8 @@ Logout previously removed only the bearer token. TanStack Query's inactive query
 
 Authentication is now a hard browser-data boundary. Login, explicit logout and any authenticated API 401 cancel in-flight queries and clear both query and mutation caches before the next session renders. The session-validation endpoint is excluded from the global 401 event so an invalid token remains a local login error, and 403 remains an authorization result rather than terminating a valid session. The API already sends `Cache-Control: no-store`, so protected responses are also excluded from the HTTP cache.
 
+The access-management workspace no longer invents a three-protocol expectation for every vehicle. Canonical protocol columns remain as comparison slots, but an absent slot is neutral “no source” evidence; only `actualProtocols` contributes to source health. Master-data gaps are an independent queue, so missing OEM/provider records remain filterable even when the same vehicle is offline or has no source. Production release `real-source-access-final-20260716181005` retained the 1,024-vehicle identity total, returned zero non-empty expected/missing protocol arrays, and exposed all 356 master-data maintenance vehicles.
+
 Component tests prove that login and logout remove prior query and mutation entries, logout aborts an in-flight protected read, and a protected 401 returns the application to the login screen without retaining the active result. API tests separately prove that `/api/v2/session` 401 does not recursively trigger global logout. This follows TanStack Query's documented `cancelQueries` and `clear` lifecycle controls and OWASP's requirement to clear client-side state after logout; Auth0 likewise treats local application-session termination as an explicit part of logout:
 
 - <https://tanstack.com/query/v4/docs/reference/QueryClient>

vehicle-data-platform/docs/vehicle-data-platform-meeting-todo.md

@@ -346,6 +346,20 @@
 
 状态：`进行中`
 
+已上线的平台校准（release `real-source-access-final-20260716181005`）：
+
+- 移除“每辆车应接 GB32960 / JT808 / YUTONG_MQTT 三协议”的无业务依据推断。全部 1,024 辆的 `expectedProtocols` 与 `missingProtocols` 均为空；缺席协议只显示“当前未发现来源”，不再作为异常。
+- 接入健康只基于真实来源计算：生产真实分布为 295 辆无来源、289 辆单来源、440 辆双来源；没有车辆真实同时接入三协议。
+- 接入管理、全局监控和车辆查询继续使用同一 1,024 辆主车辆口径，同协议多终端不会重复计车。
+- 资料缺失与在线健康拆为独立维度；“资料待维护”可一次筛出全部 356 辆，其中 252 辆缺车辆品牌、106 辆缺 JT808 提供方。车辆即使同时离线或无来源也不会从该队列漏掉。
+- 提供方优先使用实时快照平台名，缺失时回退当前选中位置来源的 `source_code`；仍无法识别时保留“接入方未维护”，不伪造名称。
+- 页面、详情和 CSV 统一改为“真实来源”口径；单一 JT808 在线且资料完整的车辆可判为正常，不再因不存在的 32960/宇通来源显示“接入不完整”。
+- Go 全量测试、现行前端 49 个文件/254 项测试和生产构建通过。生产 50 辆列表 20 次请求中位约 48ms、P95 约 53ms，三个服务均 active。
+
+剩余业务资料依赖：
+
+- 252 辆缺失品牌和 106 辆缺失 JT808 提供方需要业务/运维提供权威映射后补齐；会议中也确认当前品牌资料暂不准确。平台已形成完整待处理队列，但不会根据车牌、终端或位置猜测品牌。
+
 目标：
 
 - 运维补齐 JT808 各品牌/提供方资料。