CHANGELOG: the boot window's sample refreshes first

CHANGELOG.md

@@ -46,7 +46,15 @@ at 95 s. Extending the grace to fit was rejected outright (§8.3) — that hides
 of reporting it. A window that genuinely overruns now emits a **`LATE RECOVERY` WARN naming the
 apps**, so a stale alarm never stands without counter-evidence.
 
-**Sampling is read-only and there is still exactly ONE sweep.** Sweeping per sample was rejected: the
+**The sample REFRESHES first, and that was found by live validation rather than review.**
+`GetStacks()` returns the Manager's in-memory map, which the scheduler refreshes on its own **10 s**
+cadence — so sampling it every 5 s without refreshing means two consecutive samples can be identical
+because *the cache did not update*, not because the fleet settled. Observed on 9201: a container
+removed ~5 s before the window closed was still in the sampled fleet, and the sweep logged
+`no boot-orphaned apps` for an app that had none. `sampleBootFleet` now calls `RefreshStatus()` first
+(≈10 extra cheap `docker ps` calls per boot); a refresh error degrades rather than aborting.
+
+**Sampling is otherwise read-only and there is still exactly ONE sweep.** Sweeping per sample was rejected: the
 sweep's own `StartStack` changes the fleet, so it would never observe a settled one. The per-app
 attempt bound is untouched — this widens a bounded window, it does not remove the bound.