M41: harden trust boundaries and delivery

docs/11-n8n-integration.md

@@ -20,10 +20,6 @@ The canonical, live-validated definition is `n8n/workflows/fleet-ops-vehicle-ret
 
 ## Second live workflow: scheduled quality scan
 
-RAGcore is not connected in this environment, so the originally sketched "knowledge sync"
-workflow below remains deferred (see "Deferred: knowledge sync"). The second implemented
-workflow does not depend on RAGcore or MCP Hub, so it is not blocked by them.
-
 Input: hourly schedule trigger, or a manual trigger for on-demand testing.
 
 Steps:
@@ -45,16 +41,15 @@ workflow (see `deploy/unraid/setup-scheduled-scan.sh` and `docs/17-runbook.md`).
 active on the live instance; a fresh import ships inactive until credentials are wired up
 and it is deliberately published.
 
-## RAGcore procedure sync (in progress)
+## RAGcore procedure sync
 
-RAGcore is now reachable in this environment; a live inspection of its real contract is
-recorded in `docs/live-ai-integration/n8n-current-state.md`. Workflow 3, "Fleet Ops —
-RAGcore Procedure Sync", is being built against that real contract (not the sketch
-originally in this section) — see `n8n/workflows/MANIFEST.md` for current status.
+Workflow 3, "Fleet Ops — RAGcore Procedure Sync", is published and active against the
+live RAGcore contract. See `n8n/workflows/MANIFEST.md` for its bounded upload contract,
+credentials and live validation evidence.
 
-## Workflow error handler (in progress)
+## Workflow error handler
 
-Workflow 4, "Fleet Ops — Workflow Error Handler", is a central technical workflow attached
+Workflow 4, "Fleet Ops — Workflow Error Handler", is active and attached
 to workflows 1-3 via n8n's per-workflow "Error Workflow" setting, reporting bounded,
 secret-free failure details to Fleet Ops. See `n8n/workflows/MANIFEST.md` for status.