M55: restore private RAGcore routing

PROJECT_STATE.md

@@ -1,5 +1,26 @@
 # Project state
 
+## M55 — restore private cross-project RAGcore routing (2026-08-24)
+
+- M54 promoted successfully as `81e3fd63bdbcb2e9c4ae1d709ea46f40537b6f62`, with two
+  API and two web replicas, exact OCI revision labels, Alembic `4f2b9c8d7e61 (head)` and
+  healthy public/loopback readiness. The live browser canary then proved that all core routes
+  worked but RAGcore degraded honestly to unavailable in both browsers.
+- The failure was infrastructure routing, not answer validation: the existing healthy
+  RAGcore app now publishes host port 1237 on loopback only, while Fleet Ops still targeted
+  the host LAN address and received TCP `connection refused` from inside its container.
+- Extended the start-first deployer with a validated optional `RAGCORE_DOCKER_NETWORK`.
+  Candidate APIs join that pre-existing network and take the non-secret `RAGCORE_BASE_URL`
+  from the authoritative server `.env`; all secrets still come from the serving API's
+  resolved environment and are never printed. The hosted configuration can now use the
+  private `ragcore-app:8080` alias without exposing RAGcore on the LAN.
+- Validation: Alpine `sh -n` passed for the deployer; base/Unraid Compose config, source
+  budgets and `git diff --check` pass. M54's complete **331 backend / 171 Playwright** gates
+  remain applicable because M55 changes deployment topology and documentation only.
+- Exact next action: commit/push M55, safely update the two non-secret RAGcore routing keys
+  in the server `.env`, take a fresh verified backup, deploy the exact M55 archive and repeat
+  the four Chromium/Firefox live acceptance checks.
+
 ## M54 — full logic, resilience and recruiter upgrade (2026-08-23, local candidate)
 
 - Replaced the static Engineering architecture row with an interactive, keyboard-operable