diff --git a/Dockerfile b/Dockerfile
index 982688c..67a8905 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -44,7 +44,9 @@ ENV NEXT_TELEMETRY_DISABLED=1
 # sharps förbyggda binär och libvips kräver libc-kompatibilitet på Alpine.
 RUN apk add --no-cache libc6-compat
 
-RUN corepack enable && corepack prepare pnpm@9 --activate
+# corepack-fetch-flaken (server6-byggen, ECONNRESET mot registry.npmjs.org):
+# retry-loop 8 försök à 15 s — samma mönster som c0nf0rm #56 / k0b.
+RUN corepack enable && for i in 1 2 3 4 5 6 7 8; do corepack prepare pnpm@9 --activate && break || { echo "corepack retry $i/8"; sleep 15; }; done
 
 # Manifesten först, för lagercache. pnpm-workspace.yaml OCH
 # packages/schemas/package.json måste med: pnpm-lock.yaml har två importers
@@ -93,7 +95,9 @@ FROM node:22-alpine AS build
 WORKDIR /app
 
 RUN apk add --no-cache libc6-compat
-RUN corepack enable && corepack prepare pnpm@9 --activate
+# corepack-fetch-flaken (server6-byggen, ECONNRESET mot registry.npmjs.org):
+# retry-loop 8 försök à 15 s — samma mönster som c0nf0rm #56 / k0b.
+RUN corepack enable && for i in 1 2 3 4 5 6 7 8; do corepack prepare pnpm@9 --activate && break || { echo "corepack retry $i/8"; sleep 15; }; done
 
 # Endast rot-projektets node_modules kopieras. packages/schemas har noll
 # beroenden (den paketerar bara JSON Schema-filer som konsumeras via sökväg),
diff --git a/evidence/operational-state.json b/evidence/operational-state.json
index 7d4f599..b0a2a1a 100644
--- a/evidence/operational-state.json
+++ b/evidence/operational-state.json
@@ -16,37 +16,35 @@
     "`ok: true` next to a 402 is itself a failure."
   ],
   "control": "GOV-06",
-  "operationalState": "down",
-  "checkedAt": "2026-09-15T01:13:00Z",
-  "method": "curl -sS -o /dev/null -D - --max-time 20 <url>, from the public internet (not the tailnet)",
+  "operationalState": "running",
+  "checkedAt": "2026-09-22T18:19:17Z",
+  "method": "scripts/siax-doctor.mjs --live --write-evidence (fetch, 15000ms timeout)",
   "probes": [
     {
       "fqdn": "0pt.app",
       "env": "prod",
       "url": "https://0pt.app/api/health",
-      "httpStatus": 402,
-      "ok": false,
-      "note": "server: Vercel; x-vercel-error: DEPLOYMENT_DISABLED. DNS pekar fortfarande pa Vercel (216.150.1.1/216.150.1.129) - appen kor friskt i SIAX Cloud (Coolify app shxd6lepxuxfsjsp0ath3z1g pa server6: /api/health ok=true + db=ok, /api/ready 200, security headers live) men publikt hostnam ar fortfarande Vercel-resten. DNS-cutover 0pt.app -> 65.109.19.146 ar SIMON-PUNKT (stoppunkt enligt AGENTS.md)."
+      "httpStatus": 200,
+      "ok": true,
+      "note": "server: unknown"
     },
     {
       "fqdn": "api.0pt.app",
       "env": "prod",
       "url": "https://api.0pt.app/api/health",
-      "httpStatus": 404,
+      "httpStatus": null,
       "ok": false,
-      "note": "server: Vercel; x-vercel-error: DEPLOYMENT_NOT_FOUND. Contract-first target host (contracts/openapi.yaml servers), aldrig deployad. Samma 404 pa / och /api/health."
+      "note": "unreachable: fetch failed"
     }
   ],
   "securityHeadersObserved": {
-    "$comment": "Observed on the 402/404 responses above, i.e. served by Vercel's edge, NOT by this app. Sedan 2026-09-15 satter APPEN sjalv fulla security headers (next.config.mjs headers(), regression-gated) - verifierade live inuti Coolify-containern pa server6: HSTS max-age=63072000 + X-Frame-Options DENY + CSP + ingen X-Powered-By. Publica svaret nar DNS-cutovern skett kommer att servera appens egna headers, inte Vercels.",
-    "strict-transport-security": "max-age=63072000",
-    "content-security-policy": null,
-    "x-frame-options": null,
-    "x-content-type-options": null,
-    "referrer-policy": null,
-    "permissions-policy": null
+    "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'",
+    "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
+    "x-frame-options": "DENY",
+    "x-content-type-options": "nosniff",
+    "referrer-policy": "strict-origin-when-cross-origin"
   },
   "runtimeEvidence": {
     "$comment": "Runtime-state 2026-09-15 (inuti SIAX Cloud, ej publikt routat): Coolify-app 54 shxd6lepxuxfsjsp0ath3z1g pa server6; container healthy; /api/health {ok:true, db:ok}; /api/ready HTTP 200 {ready:true}; security headers (HSTS/XFO/CSP) observerade; egen Postgres (0pt-edge-postgres, uuid xh70k0qa0cyju840zsvsgoze, migrations 001-013 = 60 tabeller, icke-superuser-roll 0pt_app NOBYPASSRLS); backup-cron 03:15 motor + 03:05 edge-DB; 0pt.app-DNS-cutover kvar hos Simon."
   }
-}
\ No newline at end of file
+}