# Assignment — R5 runbook for the actual VPS proxy containers

Base SHA: `8284eb5d006943d42133eb665c99dcbc3133d6a6`

Scope: only deploy templates and `docs/STAGE1_DEPLOYMENT_RUNBOOK.md`. Update the R5 procedure for the reported target containers `krona-proxy-mux` (`haproxy:3.0-alpine`) and `krona-reverse-proxy` (`caddy:2.8-alpine`). Add safe in-place additive SNI and site examples, preserve unrelated sites/default routes and the HTTP-01 path, include private backups, version-appropriate validation, non-restart reload only after inspection confirms the actual mechanism, before/after other-site baselines, and a concrete rollback. Use Basic Auth as the supported fallback; Authelia remains optional only if the existing policy is verified. Unknown mount/config paths, routing mode, reload mechanism, DNS/peer identity and live acceptance remain `UNVERIFIED` and must stop the operator until observed. No real remote changes.

Do not modify application source/tests, existing review reports, compose/auth/deploy app settings, unrelated services or existing user changes. No commit/delegation. Record result and evidence in this agent's `agents/codex/{notes,done}`.