Record the Docker deployment and the live 2026-07-29 state

The deployment moved from orchestra.service to Docker Compose, but both
CLAUDE.md and AUDIT.md still described the systemd unit. A stopped unit
plus a stale /usr/local/bin/orchestra reads exactly like a dead service,
so document where the live deployment actually is and that deploying now
means rebuilding the compose images.

Also record what a live check found: the running image predates the B18
auth commit, all six herdrs are unreachable (the sole remaining blocker
on live proof for B13-B17), GET /v1/tasks has no authz gate but sits
behind a ufw-restricted bind, and ntfy still 403s.

Sharpen the herdr-logging note: successes are never logged, so a herdr
with no log line is up, not down, and the logs can't confirm one coming
back. Probe the ports directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd

CLAUDE.md

@@ -57,21 +57,34 @@ the live herdr instance and check.
   today — don't "clean up" that code without checking this note first, or it
   might start doing a real numeric-vs-string comparison and break.
 
-## Deployment topology (as of 2026-07-27)
+## Deployment topology (as of 2026-07-29)
 
-- Runs as `orchestra.service` on **homesrv** (this machine's own systemd —
-  `journalctl -u orchestra.service` for logs; `sudo` isn't available in this
-  sandbox environment, but plain `journalctl` without sudo works here).
-- Config: `.orchestra-config/orchestra.env` (env vars) +
-  `.orchestra-config/config.jsonc` (projects/machines/herdrs registry).
-  `ORCHESTRA_CONFIG=/etc/orchestra/config.jsonc` — the deployed copy, not the
-  repo's `deploy/config.example.jsonc`.
+- **Runs under Docker Compose, not systemd.** `docker compose -f compose.yaml
+  -f compose.live.yaml` in `/home/kami/docker-apps/orchestra-web-ui`, building
+  both images from this repo: `orchestra-api` (bound `0.0.0.0:9145`) and
+  `orchestra-web-ui` (nginx proxy, `127.0.0.1:19145`). Logs are
+  `docker logs orchestra-api`. **Deploying a code change means rebuilding the
+  compose images** (`up -d --build`) — the running image can silently predate
+  recent commits, so compare its build time against `git log`.
+- `orchestra.service` is the **previous** deployment and is retired —
+  `compose.live.yaml` requires it stopped, since both bind the same port and
+  data dir. Do not start it. (`sudo` isn't available in this sandbox, so
+  `systemctl disable` needs the operator.)
+- Config: `/etc/orchestra/orchestra.env` (env vars) + `/etc/orchestra/
+  config.jsonc` (projects/machines/herdrs registry) — the deployed copies, not
+  the repo's `.orchestra-config/` or `deploy/config.example.jsonc`. The
+  container bind-mounts `/etc/orchestra:ro` and its entrypoint sources the env
+  file, so Docker never copies the secrets.
+- The `0.0.0.0` bind on 9145 is **intentional**: ufw restricts the port to one
+  other LAN machine. Don't report it as an exposure.
 - Two machines in the registry: `homesrv` (192.168.1.104) and `workpc`
   (192.168.1.105), each nominally running 3 herdrs (claude/codex/opencode).
-  In practice **homesrv has no local herdr running** (connection refused on
-  9245) — only workpc's herdr is live and reachable. `main.go` only logs
-  herdr connection *failures* at startup, never successes, so "no log line"
-  for a herdr does not mean it's down — check reachability directly.
+  As of 2026-07-29 **all six are unreachable** — workpc refuses on 9245-9247,
+  homesrv times out (filtered). Nothing can be leased until one is brought up.
+- `main.go` logs herdr connection *failures* at startup and **never logs a
+  success**, so a herdr with no log line is *up*, not down — absence of a line
+  is evidence in the opposite direction, and an operator cannot confirm a
+  herdr came back by tailing the logs. Always probe reachability directly.
 - There was a real, live, stuck task as of 2026-07-27: workspace `wA`, task
   id `06FT6CKD9Y98AZRX6X8K3QXFZG`, opencode harness, pane `wA:p1`,
   `agent_status: "blocked"`. Likely stuck because rotation/release could