ultix perf/ops workbench: complete 2026-08-31 optimization pass for VM 5111

Everything for the ultix-streaming (VM 5111, pfv-tsys5) performance pass:
full report + host audit results, staged/gated configs, guest prep + host
one-shot + post-reboot-fix + netcheck lifecycle scripts, grow-root manual
runbook, rolling tracking HUD, questions v1, and the gateway boot-race
hardening units. Applied and verified live 2026-08-31; open work is
tracked in Redmine project 55 as #601-#607. [#602]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

staged/ukrrs-gateway-ensure.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Boots are racy for the gateway containers (both root-caused 2026-08-31):
+#  - prod binds :4000/:9090 to the tailscale IP; if dockerd wins the race over
+#    tailscaled, the bind fails and docker NEVER retries failed starts;
+#  - live-restore can drop a container's network endpoint across a boot,
+#    leaving it started with the host resolver (gateway-db unresolvable,
+#    crash loop). A plain `docker start` does NOT reattach the endpoint.
+# Waits for the tailscale IP, then recreates any lane not actually serving.
+# Idempotent; recreating is safe at boot time (nothing in flight).
+set -u
+GW_DIR=/home/reachableceo/projects/ukrrs/gateway
+TS_IP=100.101.187.119
+
+for _ in $(seq 1 60); do
+  /usr/sbin/ip -o addr | grep -q "$TS_IP/" && break
+  sleep 2
+done
+
+ensure_lane() { # name host:port project compose_file
+  local name=$1 hostport=$2 project=$3 file=$4
+  if timeout 5 bash -c "</dev/tcp/$hostport" 2>/dev/null; then
+    echo "$name: serving on $hostport"
+    return 0
+  fi
+  echo "$name: NOT serving on $hostport; recreating"
+  docker compose -p "$project" -f "$GW_DIR/$file" up -d --no-deps --force-recreate gateway
+}
+
+ensure_lane prod  "$TS_IP:4000"    mopac-gateway       docker-compose.yml
+ensure_lane beta "127.0.0.1:4002" mopac-gateway-beta  compose.beta.yaml
+exit 0