diff --git a/docs/audits/2026-09-07-k1-connection-core-r15.md b/docs/audits/2026-09-07-k1-connection-core-r15.md
index f4351d8..01aad23 100644
--- a/docs/audits/2026-09-07-k1-connection-core-r15.md
+++ b/docs/audits/2026-09-07-k1-connection-core-r15.md
@@ -111,3 +111,33 @@ separate from synthetic checks; neither is claimed from a successful build.
 The board was online and published idle acquisition before staging. The local
 Docker daemon was not running; no Docker startup or parallel heavy builds were
 used. The original canonical Core process remained on port 8000.
+
+### Built and staged R15
+
+Source commit: `762d77ef95ccd763b7e3a0d62e04464a4f9289c1`. Node production
+build/typecheck passed. Both packages were inspected: no archive links, unsafe
+paths or private application-key member; matching source provenance. K1 public
+provenance has `application_material_included=false`, and every payload hash
+listed in its provenance matched. Node retains the admitted Design Guideline
+commit `5b882bc3d9b13a86e6c26111ef5ded687ea3a2fc`. Payload regular-file counts are
+71 for Node and 150 for K1.
+
+- `mission-core-node_0.8.12_amd64.deb`: 109838058 bytes; SHA-256 `b5ee0471e3dc61f5533e5e4e80b3b98a6afc73aa964f7a74fbb20d1df58ef44f`.
+- `mission-core-xgrids-k1_0.1.12_amd64.deb`: 318115004 bytes; SHA-256 `9b382258d358f8cabf5b75e4f46d3475b83856ec604a389b10d0a575ea85cd27`.
+
+The unique R15 directory is staged on the authorized board. Both remote SHA-256
+checks passed. Apt simulation upgrades exactly Node 0.8.11 → 0.8.12 and K1
+0.1.11 → 0.1.12, with zero additions/removals. Existing pre-install safe-state
+guards are unchanged. No credential extraction or replacement is included.
+
+The native “Mission Core · K1 R15” installer is open for owner-entered sudo.
+Actual installation status and physical acceptance remain pending. The owner
+should test through the regular UI with Chrome cache cleared: fresh scan/select,
+password visibility, one Apply, named start, stop, and Verify after returning to
+the device. No physical CLI probe or scanner command was issued by the agent.
+CUA exposes no documented cache/click controls in this session, so clean-cache
+visual/hardware acceptance is not inferred from unit or source checks.
+
+Final Core health returned HTTP 200 and `ok=true`. Port 8000 is still served by
+the original PID 88424; its HTML references the newly built `app-ClyCkvea.js` and
+`app-DD9yVBC_.css`. No service on port 8765 was started.