runbook(park 100): pfi-tacticalrmm patched; reboot list now 8 hosts

docs/runbooks/fleet-guest-patch-2026-10-05.md

@@ -106,14 +106,16 @@ bouncer failing closed on slow LAPI answers. Self-cleared.
 - ~~pfi-pteradactyl~~ **FIXED + patched 2026-10-05 ~1045 (Prime):** "apache2 failed / panel down" was a leftover apache2
   losing :80 to nginx; the panel (nginx + php-fpm) was up all along (the curl that read 000 used https or the dead
   `ptero.phasefinal.com`). apache2 masked; 163 → 0; Docker engine held (live game server); reboot deferred.
-- pfi-tacticalrmm: certbot renewal failed 2026-10-04 1831 (web + MeshCentral fine). 164 pending.
+- ~~pfi-tacticalrmm~~ **cert fixed (infra-ops) + patched 2026-10-05 ~1055 (infra-hermes):** 164 → 0, postgres restarted,
+  RMM/daphne/nats/meshcentral healthy, MeshCentral never restarted (AMT CIRA :4433 untouched), `certbot renew --dry-run`
+  passes after the patch. Kernel 6.1.0-53 needs a reboot (deferred).
 - pfi-gx10: wants a `dgx-release` 7.5 → 7.6 upgrade, a new bootloader package (`nvidia-spark-grub-kho`) and kernel
   7.0.0-1019-nvidia. 212 pending.
 - ana-nas (NFS SPOF) and irv-ml1 (Prime: off-limits): out of scope.
 
 **Deferred to a daytime window:**
-- reboots to activate new kernels: ana-docker, nh3-dev, nh3-extdev, corviduo-dev, vm-esh-nas, esh-vm-db. None
-  builds NVIDIA with DKMS.
+- reboots to activate new kernels: ana-docker, nh3-dev, nh3-extdev, corviduo-dev, vm-esh-nas, esh-vm-db, plus
+  pfi-tacticalrmm and pfi-pteradactyl (added later on 10-05). None builds NVIDIA with DKMS.
 - Docker engine bumps held on ana-docker, nh3-docker, esh-docker-vm, corviduo-dev, nh3-dev, esh-ml1, nh3-ml1, pfi-gx10.
 - fv-ml1: ZFS 2.3.9, nvidia-container-toolkit 1.20, and a kernel with an NVIDIA driver that builds on it.
 - CrowdSec bouncer `updateMaxFailure` (0 = block on the first failed LAPI pull): infra-ops leans toward ~3.