docs(paivana): clear postmortem — three failures that broke paywall

Document boot race (upstream unit exit 125), start-before-merchant 502,
and pasta AAAA/timeout needing 172.17.0.1 pin. Healthy smoke stays 302/402.

2026/2026-07-13--paivana-goa.md

@@ -7,13 +7,22 @@
 - Image `localhost/koopa-paivana:latest` (built from `git.taler.net/paivana` + deb.taler.net libs; package not on apt yet)
 - Merchant: instance **`goa-shop`**, template **`paivana`** (`template_type: paivana`, **GOA:4200**)
 - After payment: site-wide cookie (`-g`) → example upstream free to browse
-- `extra_hosts: taler.hacktivism.ch:host-gateway` so pasta can reach merchant
 - Flags: `-g` (site-wide), `-f` (X-Forwarded-For)
 - Smoke: `curl -si http://127.0.0.1:9025/` → **302** to `/.well-known/paivana/templates/paivana#…`
 - Config mirror: `configs/paivana/`
 - Caddy: `paivana.hacktivism.ch` → `:9025` (`configs/caddy/Caddyfile`)
 - User unit: `container-koopa-paivana.service` enabled
 
+## Was später kaputt / nachgezogen (klar)
+
+Siehe **`configs/paivana/README.md` → „Was kaputt war“**. Kurz:
+
+1. **Extra Upstream-systemd-Unit** race mit Compose → exit **125** / start-limit — **nur** Compose-Unit behalten.  
+2. **Paivana vor Merchant-Apps** → öffentliches **502** — `order.conf` `After=taler-merchant-apps`.  
+3. **Pasta DNS/AAAA**: `host-gateway` reichte nicht → `extra_hosts` auf **`172.17.0.1`** pin (`f26bf6a`).
+
+Gesund: **302** lokal / **402** public paywall + monitoring `www.paivana`.
+
 ## Refs
 
 - https://docs.taler.net/taler-paivana-manual.html

2026/2026-07-17.md

@@ -3,3 +3,8 @@
 - Bank: `taler://withdraw` **ohne `:443`** (Wallet-Apps); live deployed
 - Merchant/bank in-container apps after reboot via `ensure-taler-apps` + user units
 - Admin-log: 13 Commits (19:04–01:07) + follow-up; `main` force-pushed → Forgejo
+- **Paivana — was kaputt war** klar dokumentiert (`configs/paivana/README.md`):
+  1. Upstream-only systemd race (exit 125)
+  2. Start vor Merchant-Apps → 502
+  3. Pasta AAAA/timeout → pin `172.17.0.1`
+  Live-Stack war gesund (302/402); Ursache/Fix nicht wiederholen.