docs(mirror): /club RUNTIME VALIDATED on retail FIFA 17

docs/PROJECT_STATE.md

@@ -92,6 +92,18 @@ Last compiled from repository evidence during context initialization.
   drops). **The only remaining gate is the live retail FIFA A/B** (no FIFA client in the
   build env; runbook `openfut-utas-host/README.md`). See the vault UTAS Endpoint Map +
   Known Issues (incl. "identity resolution is NOT authorization" for later mutations).
+  **Slice 6 (2026-08-11): `/club` RUNTIME VALIDATED on retail FIFA 17** — operator-assisted
+  live A/B (`.105` client → `.120` backend via a source-scoped NAT redirect into a staged
+  `36abd4b` Core + `openfut-utas-host`). Every checkpoint passed on the real client:
+  transport, per-route Python fallback, Python-negative `/club`, Core `X-OpenFUT-Game`
+  scoping, real card + persistent owned-item identity (incl. the two-copy fixture),
+  no-filter/Gold/position/nation/league/team/combined-AND filtering, retail pagination
+  with no amplification, card selection, identity stability across relaunch, Python
+  rollback, and Rust re-enable (identity store byte-identical across the cycle, 0
+  reallocation). Live findings: the retail client steps `start += 10` with `count=11`
+  (sometimes bulk `count=100`) — Core honours `offset` and terminates; the My Club UI
+  nests team under league; the "~1900" club counter is Python `userMassInfo`, not `/club`.
+  Remaining is operational only (promote the staged stack to a durable deployment).
 
 ## Stubbed / planned