docs(runbook): HAOS NUT addon installed and verified

- NUT addon a0d7b954_nut installed as netclient secondary on HAOS
- Monitors cyberpower1@192.168.99.200:3493 (upsuser/Sparky$100)
- HAOS confirmed in Beast's connected client list (upsc -c)
- Replaces "Pending" NUT gap entry in RB-001 Prevention section
- Updated root cause paragraph: NUT gap resolved 2026-05-23

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

runbooks/phase5-incident-log.md

@@ -1,6 +1,6 @@
 # Phase 5 — Incident Log / State Drift
 
-Last updated: 2026-05-23 (RB-001: root cause confirmed — HAOS 17.3 supervisor mount-reload deletes cred file; VAULT1 monitor added)
+Last updated: 2026-05-23 (RB-001: VAULT1 root cause + monitor added; HAOS NUT addon installed and verified)
 Purpose: Consolidates real findings from the Phase 4 worksession. Inputs to Phase 5 planning and repair.
 
 ---
@@ -387,7 +387,7 @@ The credential file loss is **NOT caused by unclean shutdown**. Confirmed: crede
 
 **Pattern:** This will recur every time the supervisor decides to cycle the VAULT1 CIFS mount. HAOS update to a newer supervisor version may fix or change this behavior.
 
-**NUT/UPS protection gap (separate issue):** HAOS has no NUT client. Unclean shutdowns from power events (cyberpower UPS→Beast→CT104 NUT chain, but HAOS is not a slave) can corrupt the journal but do NOT cause credential file loss per above analysis. Still recommended to add the HAOS NUT addon (Community store, monitor cyberpower1@192.168.99.200 as slave) to prevent hard power cuts to HAOS.
+**NUT/UPS protection gap (resolved 2026-05-23):** HAOS previously had no NUT client. Unclean shutdowns from power events (cyberpower UPS→Beast→CT104 NUT chain, but HAOS was not a slave) could corrupt the journal but do NOT cause credential file loss per above analysis. The HAOS Community NUT addon (`a0d7b954_nut`) has been installed and configured — see Prevention/monitoring section for details.
 
 The supervisor credential file at `/mnt/data/supervisor/.mounts_credentials/VAULT1` can be lost after the HAOS supervisor cycles the CIFS mount. Symptoms: supervisor log shows `error 2 (No such file or directory) opening credential file` every 15 min; `/media/VAULT1` falls through to sda8 and Frigate writes recordings there instead of the USB drive.
 
@@ -417,4 +417,4 @@ Orphan dirs on sda8 are outside Frigate's media path — handle manually (move o
 - Uptime Kuma "Frigate Stats" monitor (http://192.168.99.100:5000/api/stats, 60s, 2 retries) → ntfy `grafana-alerts` (added 2026-05-23)
 - Uptime Kuma "Home Assistant" monitor (http://192.168.99.100:8123, 60s) → ntfy `grafana-alerts` (added 2026-05-23)
 - USB enclosure is self-powered (own PSU) and directly connected — no hub to replace. If repeated disconnects occur, suspect: (a) PSU/power cable on enclosure, (b) USB cable quality, (c) motherboard USB port.
-- **Pending**: Add HAOS NUT addon (Community store) monitoring `cyberpower1@192.168.99.200` as slave to prevent hard power cuts from UPS events. NUT chain currently: Beast (master) → CT104 (slave). HAOS is not in the chain.
+- **HAOS NUT addon** (`a0d7b954_nut`, installed 2026-05-23): netclient mode, monitors `cyberpower1@192.168.99.200:3493` as secondary. Credentials: `upsuser / Sparky$100` (same as CT104 slave). `shutdown_host: true` → runs `/usr/bin/shutdownhost` on FSD. NUT chain is now: Beast (master) → CT104 (secondary) + HAOS (secondary). Verified: `upsc cyberpower1@192.168.99.200` returns full UPS data (OL, 36% load, battery 100%); Beast `upsc -c cyberpower1` lists 192.168.99.100 as a connected client. No `test.shutdown` available on CP1500PFCLCDa firmware — live FSD test skipped (would cut UPS load).