docs: finalize P2 manuals, project state, and install-doc service contract

PROJECT_STATE.md

@@ -3,6 +3,30 @@
 > Starting-point snapshot for new sessions. Last updated: 2026-08-10 (final verification).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
+### P2 host preprocessing CLI — implementation complete, automated PASS, manual PENDING (2026-08-11)
+
+- **Scope:** P2 (PRD D2, based on the P1.1 registry contract): the installed native `thothctl`
+  binary is the only host interface for workspace preprocessing. Commands: `workspace inspect`,
+  `preprocess dwh`, `schema suggest-fks`, `schema check`, `index-schema`, `preprocess evidence`,
+  `preprocess run`, with the exact grammar, file-ingress bounds, result contract and exit codes in
+  `docs/contracts/workspace-preprocessing-cli.md`.
+- **Operator:** `workspace-maintenance` is a profile-gated Compose service sharing the core image,
+  with no Pi auth/state, no backend/Pi/frontend listener, no Git credentials, and a compiled Node
+  entrypoint (`backend/src/workspace-maintenance.ts`) driving the existing harness engine through
+  pristine JSON machine interfaces (`schema_cmd.py`, `vector_cmd.py`, `preprocess_cmd.py`).
+- **Boundaries honored:** FK review is digest-bound (candidate digest == persisted artifact; a
+  review accepted for the same candidate content counts); Qdrant collections are never created by
+  the product path (`require_existing` + pre-provisioned fixture, P4 owns lifecycle); filesystem
+  Evidence stops with `evidence_materialization_required` (P6); HTTP Evidence enforces an
+  installation private-host allowlist; `ssh_tunnel` stays fail-closed (P10); cross-revision DWH
+  reuse is explicitly P3.
+- **Retained evidence:** `.artifacts/p2-integration/p2-b109757b26388a5ed6b1d173dee86584/`
+  (11/11 checks PASS), bound to clean source commit
+  `de5de36f9a4edfd4fbebf277822090871ccdd61f`.
+- **Manual gate:** P2 walkthrough in `docs/testing/p2-p6-manual-verification.md`; decision
+  **PENDING** and recorded independently. P3 and later start only after an explicit new
+  authorization.
+
 ### P1.1 workspace-directory registry — automated integration PASS, manual PENDING (2026-08-11)
 
 - **Scope:** P1 correction (not preprocessing). Root curator-owned catalog `thoth-workspaces.yaml`;