diff --git a/documentation/audits/RERUN-p1p3-2026-07-06.md b/documentation/audits/RERUN-p1p3-2026-07-06.md
index 1709490..ecd2f6e 100644
--- a/documentation/audits/RERUN-p1p3-2026-07-06.md
+++ b/documentation/audits/RERUN-p1p3-2026-07-06.md
@@ -105,10 +105,22 @@ bit-identical. Off-box restic-SFTP is validated end-to-end (grant #2).
 
 ## End state
 
-Demo node left healthy: notifications restored (11 events), uptime-kuma redeployed (its volume was
-destroyed by the remove-test cascade), vaultwarden + bookstack hard-restarted to clear a healthcheck
-`localhost`→IPv6 binding quirk (both serving; `/alive` 200). R0′/R0.5 snapshots retained in PBS.
-Auth left disabled (grant #1). No production code, versions, or config changed.
+Notifications restored (11 events, verified). uptime-kuma redeployed and **healthy** (its volume was
+destroyed by the remove-test cascade). 12 apps healthy. Two apps show docker `unhealthy` while
+serving — see the observation below. R0′/R0.5 snapshots retained in PBS. Auth left disabled
+(grant #1). No production code, versions, or config changed.
+
+## Observation (out of P1–P3 scope; documented, not acted on)
+
+**Catalog healthcheck robustness — `localhost` vs `127.0.0.1`.** Post-run, `vaultwarden` reads
+docker-`unhealthy` even though it serves: its healthcheck `wget http://localhost:80/alive` gets
+*connection refused* (in-container `localhost` resolves to IPv6 `::1`; vaultwarden binds IPv4
+`0.0.0.0:80`), while `http://127.0.0.1:80/alive` returns 200. This reproduced on a **fresh** redeploy
+during teardown (it was healthy earlier in the day, so the localhost/IPv6 resolution is
+environment-dependent on this guest). Recommend catalog healthchecks target `127.0.0.1`, not
+`localhost`, for IPv4-only apps. Separately, `bookstack` is `unhealthy` at the **app** level (health
+path returns HTTP 500 — a pre-existing demo-app state, not introduced by this run). Neither is a
+backup/restore (P1–P3) defect.
 
 ## Still open (not this run)