diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91a1450..c9ecc0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,19 @@
+## v0.286.1 — R-772 found live: a stopped probe container is seen on the next tick (2026-10-01)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings. **v0.286.0 was never floored**
+(scratch 9202 only); the fleet goes from 0.285.0 to 0.286.1 and takes everything in v0.286.0 below.
+
+- **R-772, measured live on 9202 with v0.286.0:** with a HEALTHY record 2 minutes old, stopping paperless-webserver
+  left the record `healthy: true` until its 5-minute interval ran out — the not-checked branch sat behind the interval
+  check. Finding the probe container costs no network call, so it now runs first: a stack with nothing to probe is
+  recorded not-checked on the very next tick. Test `TestRunHealthProbes_AStoppedContainerIsSeenAtOnce`; red-proof
+  RP-D1b (the 0.286.0 order fails it). Evidence `felhom.eu/documentation/audits/visitors-2026-10-01/D/`.
+- **Live on 9202 with v0.286.0 (unchanged in .1):** Part A — a stranger's 5 wrong dashboard logins through the simulated
+  tunnel, rotating a forged leftmost address, locked only him; the household signed in at once; a LAN or impostor
+  forgery counted as its own address (`…/A/L1-9202-live.txt`). R-773 — Karakeep removed (keeping backups) and restored:
+  record `opened_by: restore`, block file present, a stranger's `/signup` and `users.create` 403, the data back
+  (`…/D/r773-live.txt`).
+
 ## v0.286.0 — the box tells visitors apart (R-753); a health check that could not run is not "healthy" (R-772); a restore keeps the sign-up lock (R-773) (2026-10-01)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `login.msg.*` (3, both languages).