docs(report): header/§1/§4 reflect the deploy + STOP-1 results

REPORT.md

@@ -1,8 +1,9 @@
 # REPORT — TASK-D Parts 1–2: dead-primary alerting (R-51) + boot reconciliation (R-52)
 
 **Controller v0.155.0 → v0.156.0.** Session 2026-07-21, on DooPlex as `kisfenyo`.
-**Status: code SHIPPED and image published; the three live STOP legs are operator-present and have
-NOT run.** Nothing below claims live behaviour that was not observed.
+**Status: SHIPPED, deployed via the floor save, and STOP-1 RAN — both legs passed (§6).** P1 is
+answered (§4). The validation also surfaced a real pre-existing gap, filed as **R-55** (§6). Nothing
+below claims live behaviour that was not observed.
 
 ---
 
@@ -14,9 +15,10 @@ NOT run.** Nothing below claims live behaviour that was not observed.
 | felhom-agent | `08b55a1` | yes | `98adb72` (v0.92.1) |
 | felhom.eu | `50a7ffa` | yes | docs commit (see §9) |
 
-Image: `gitea.dooplex.hu/admin/felhom-controller:0.156.0`, pushed, **deliberately not hand-deployed**
-— the floor save at STOP-3 deploys it, which banks another single-fire self-update datapoint free
-(the R-23 pattern). 9201 still runs 0.155.0.
+Image: `gitea.dooplex.hu/admin/felhom-controller:0.156.0`, pushed and **never hand-deployed** — the
+operator's floor save deployed it, which banked the R-23 single-fire datapoint for free:
+`update successful (0.155.0 → 0.156.0)` then `Current version 0.156.0 is up to date`. 9201 runs
+**0.156.0**.
 
 ---
 
@@ -86,13 +88,12 @@ restart-policy guard protects a case that does not exist in today's catalog —
 templates and for the fail-closed decision above, and it costs one cached `docker inspect` per down
 member of a mixed stack.
 
-**P1 (why `unless-stopped` did not resurrect immich/calibre-web) — NOT RUN, and deliberately not a
-blocker.** It requires stopping a container on a live guest and rebooting it: STOP-1's territory,
-operator-present. The reconciliation is correct either way — if Docker did record them as
-user-stopped, `unless-stopped` will never bring them back and only R-52 can; if it did not, R-52 is
-a harmless no-op because the containers are already up when the sweep looks. Recorded as an open
-question, not a dependency. **It can be answered for free during STOP-1**, whose R-52 leg reboots
-9201 with containers stopped — precisely P1's experiment.
+**P1 (why `unless-stopped` did not resurrect immich/calibre-web) — ANSWERED during STOP-1, and the
+F5 hypothesis is CONFIRMED.** It was never made a blocker (the reconciliation is correct either
+way), and it fell out of the R-52 leg for free, as predicted. bookstack carries
+`restart=unless-stopped`; the Docker daemon came up at ~10:53:15Z; the container's `StartedAt` is
+**`10:53:28.05Z`, the exact moment `bootrecon`'s `StartStack` returned**. Docker did not bring it
+back — a container stopped before shutdown is recorded user-stopped and stays down. Details in §6.
 
 **P3/P4** were agent-side — see `felhom-agent/REPORT.md`.