M56: make RAGcore sync fail closed

PROJECT_STATE.md

@@ -1,5 +1,26 @@
 # Project state
 
+## M56 — make RAGcore procedure sync fail closed (2026-08-24)
+
+- M55 restored private connectivity and RAGcore became reachable/ready from both Fleet Ops
+  API replicas. The repeated live canary then returned honest `insufficient` answers because
+  source-filtered search found no documents, while unfiltered search proved the procedure
+  text itself was indexed under unrelated legacy/upload identities.
+- The active n8n workflow had drifted onto `Fleet Ops Service Token` for the RAGcore upload
+  node instead of the existing `RAGcore Sync Token`. Its summary counted every body without
+  an `error` property as synced, so RAGcore Problem responses were falsely reported as 33
+  successes. No unsafe relaxation of Fleet Ops citation validation was made.
+- The committed workflow now sends the documented stable identity tuple (`source_id`,
+  `external_id`, `locale`), uses the dedicated sync credential by name and counts success
+  only when RAGcore returns a real `AcceptedJob` (`job_id` plus `status_url`). The contract
+  checker enforces all three invariants to prevent recurrence.
+- Validation: workflow JSON parses with the expected credential/fields, `git diff --check`
+  is clean and the OpenAPI/event/MCP/n8n synchronization gate passes against the current
+  source tree.
+- Exact next action: commit/push M56, import the exact workflow while binding the existing
+  RAGcore credential ID without exposing it, publish/execute it, verify all 33 stable source
+  documents through RAGcore and rerun the four live Chromium/Firefox acceptance checks.
+
 ## M55 — restore private cross-project RAGcore routing (2026-08-24)
 
 - M54 promoted successfully as `81e3fd63bdbcb2e9c4ae1d709ea46f40537b6f62`, with two