docs(audit): P1-P3 re-run — accurate end-state + healthcheck-robustness observation

Correct the end-state: uptime-kuma redeployed healthy, notifications restored;
vaultwarden serves (127.0.0.1 /alive 200) but reads docker-unhealthy due to a
localhost->IPv6 healthcheck probe quirk (reproduced on fresh redeploy);
bookstack unhealthy at app level (HTTP 500, pre-existing). Recommend catalog
healthchecks use 127.0.0.1 not localhost. Neither is a P1-P3 defect.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/audits/RERUN-p1p3-2026-07-06.md

@@ -105,10 +105,22 @@ bit-identical. Off-box restic-SFTP is validated end-to-end (grant #2).
 
 ## End state
 
-Demo node left healthy: notifications restored (11 events), uptime-kuma redeployed (its volume was
-destroyed by the remove-test cascade), vaultwarden + bookstack hard-restarted to clear a healthcheck
-`localhost`→IPv6 binding quirk (both serving; `/alive` 200). R0′/R0.5 snapshots retained in PBS.
-Auth left disabled (grant #1). No production code, versions, or config changed.
+Notifications restored (11 events, verified). uptime-kuma redeployed and **healthy** (its volume was
+destroyed by the remove-test cascade). 12 apps healthy. Two apps show docker `unhealthy` while
+serving — see the observation below. R0′/R0.5 snapshots retained in PBS. Auth left disabled
+(grant #1). No production code, versions, or config changed.
+
+## Observation (out of P1–P3 scope; documented, not acted on)
+
+**Catalog healthcheck robustness — `localhost` vs `127.0.0.1`.** Post-run, `vaultwarden` reads
+docker-`unhealthy` even though it serves: its healthcheck `wget http://localhost:80/alive` gets
+*connection refused* (in-container `localhost` resolves to IPv6 `::1`; vaultwarden binds IPv4
+`0.0.0.0:80`), while `http://127.0.0.1:80/alive` returns 200. This reproduced on a **fresh** redeploy
+during teardown (it was healthy earlier in the day, so the localhost/IPv6 resolution is
+environment-dependent on this guest). Recommend catalog healthchecks target `127.0.0.1`, not
+`localhost`, for IPv4-only apps. Separately, `bookstack` is `unhealthy` at the **app** level (health
+path returns HTTP 500 — a pre-existing demo-app state, not introduced by this run). Neither is a
+backup/restore (P1–P3) defect.
 
 ## Still open (not this run)