docs(access): record real source calibration

vehicle-data-platform/docs/frontend-production-readiness.md

@@ -144,6 +144,8 @@ Logout previously removed only the bearer token. TanStack Query's inactive query
 
 Authentication is now a hard browser-data boundary. Login, explicit logout and any authenticated API 401 cancel in-flight queries and clear both query and mutation caches before the next session renders. The session-validation endpoint is excluded from the global 401 event so an invalid token remains a local login error, and 403 remains an authorization result rather than terminating a valid session. The API already sends `Cache-Control: no-store`, so protected responses are also excluded from the HTTP cache.
 
+The access-management workspace no longer invents a three-protocol expectation for every vehicle. Canonical protocol columns remain as comparison slots, but an absent slot is neutral “no source” evidence; only `actualProtocols` contributes to source health. Master-data gaps are an independent queue, so missing OEM/provider records remain filterable even when the same vehicle is offline or has no source. Production release `real-source-access-final-20260716181005` retained the 1,024-vehicle identity total, returned zero non-empty expected/missing protocol arrays, and exposed all 356 master-data maintenance vehicles.
+
 Component tests prove that login and logout remove prior query and mutation entries, logout aborts an in-flight protected read, and a protected 401 returns the application to the login screen without retaining the active result. API tests separately prove that `/api/v2/session` 401 does not recursively trigger global logout. This follows TanStack Query's documented `cancelQueries` and `clear` lifecycle controls and OWASP's requirement to clear client-side state after logout; Auth0 likewise treats local application-session termination as an explicit part of logout:
 
 - <https://tanstack.com/query/v4/docs/reference/QueryClient>