chore: snapshot release workspace

docs/1.8-alpha-improvements-tracker.md

@@ -1,6 +1,6 @@
 # 1.8-alpha Improvements Tracker
 
-Last updated: 2026-06-11 00:17 EDT
+Last updated: 2026-06-12 01:15 EDT
 
 This tracks the user-facing improvement list that must land with the `1.8-alpha`
 container migration release and the next ISO cut produced from that release. It
@@ -116,6 +116,19 @@ header gap; and removed the My Apps desktop category dropdown. Focused
 Marketplace/App config tests, type-check, and scoped `git diff --check` passed.
 Browser smoke against the already-running local Vite/mock session is still next.
 
+Active-session update, 2026-06-12 01:15 EDT: system update UX hardening landed
+locally. `load_state()` now clears stale `update_in_progress` when no staged OTA
+files exist, so failed legacy update attempts cannot leave the update screen
+permanently stuck. Direct `update.git-apply` is gated behind
+`ARCHIPELAGO_GIT_UPDATES`, preventing production nodes from accidentally entering
+the local git/self-build path that requires `cargo`. `.116` was recovered from a
+failed self-build attempt by applying its already-staged manifest OTA; it is now
+on `1.7.84-alpha`, backend health is OK, nginx is active/config-valid, HTTP UI
+returns `200`, `update_in_progress=false`, and staging was removed. Validation:
+`cargo fmt --check`, `cargo check -p archipelago`, and scoped `git diff --check`
+passed; focused `cargo test` was blocked by a local `rust-lld` undefined hidden
+symbol linker failure unrelated to the updater patch.
+
 Done criteria for this tracker:
 
 - Code/UI items: implemented, covered by targeted test or manual smoke check,
@@ -148,6 +161,7 @@ Done criteria for this tracker:
 | Fix BTCPay issue from desktop file "BTCPay Issues" | blocked | Need file contents or path to that desktop artifact. |
 | Check Nostr Discoverable Nodes and get it working correctly | in-progress | Discover modal now keeps discovered rows visible during relay refresh/failure and shows `Searching relays...` instead of dropping to an empty state. Covered by `DiscoverModal.test.ts`, local type-check, and `git diff --check`. Needs live relay/trust validation before marking done. |
 | Make sure update password is working properly | done | Backend now returns separate SSH update status so a successful web password change is not reported as a full failure when optional SSH password update fails. Settings modal shows success plus SSH warning and stays open for review. Covered by local type-check, focused modal/RPC tests, auth unit test, `cargo check -p archipelago`, and `git diff --check`. |
+| Prevent System Update screen from getting permanently stuck | done | Update state loading now reconciles `update_in_progress` with the actual manifest OTA staging directory and clears stale stuck state when no staged files exist. Direct git/self-build apply is disabled unless `ARCHIPELAGO_GIT_UPDATES` is explicitly set, so production nodes cannot fall into the old `self-update.sh` path that requires local `cargo`. `.116` was recovered by applying its valid staged manifest OTA and verified on `1.7.84-alpha` with backend health OK, nginx active/config-valid, HTTP UI `200`, `update_in_progress=false`, and staging removed. Validated locally with `cargo fmt --check`, `cargo check -p archipelago`, and scoped `git diff --check`; focused `cargo test` was blocked by a local `rust-lld` linker artifact failure unrelated to the updater patch. |
 | Do UI performance and general performance improvements | todo | Needs profiling target; start with obvious loading/render issues. |
 | Make sure companion app is all working well, had issues with tab apps | in-progress | Mobile app-session now keeps apps that require a new tab inside the session fallback instead of auto-opening an external tab and closing immediately. Covered by `AppSessionMobileNewTab.test.ts`, existing app-session config tests, app launcher tests, local type-check, and `git diff --check`. Broader companion smoke test still needed before marking done. |
 | Even though performance is better, on reboot/restart backend/update show checking-containers notification instead of no apps | done | My Apps now shows a dedicated `Checking containers` card when initial backend data has loaded but `server-info.status-info.containers-scanned` is still false and no apps are ready to render, instead of falling through to the no-apps empty state. A follow-up UI pass preserves the last known app list when a later scanner/backoff update reports an empty package map with `containers-scanned=false`, and shows a refresh status banner above the grid. Validated by local type-check, targeted tests, and `git diff --check`; follow-up validation passed `npm test -- --run src/views/apps/__tests__/appPackageCache.test.ts` and `npm run type-check`. |
@@ -194,7 +208,7 @@ Done criteria for this tracker:
 | Work on setup screens function and flows | in-progress | Onboarding setup choice now shows only usable paths: Fresh Start and Restore from Seed. Removed the disabled `Connect Existing (Coming Soon)` option, and covered default Fresh routing plus Restore routing with `OnboardingOptions.test.ts`; `useOnboarding.test.ts`, local type-check, and `git diff --check` passed. Broader onboarding/setup audit still needed before marking done. |
 | Work on Easy Mode experience | in-progress | Easy Mode goal configure steps now route to their owning app/screen instead of silently completing without navigation; verify steps now expose a `Check & Continue` action; configure/info/verify actions start goal progress before completing the active step. Covered by `goalStepActions.test.ts`, existing goal store tests, local type-check, and `git diff --check`. Broader Easy Mode product scope still needed before marking done. |
 | Update My Apps homescreen to show most-used apps instead of hardcoded | done | App launches are recorded locally through the app launcher, and the Home My Apps card now shows the top three installed user apps by launch count/recency with a running-app/name fallback when there is no history. Covered by `appUsage.test.ts`, existing app launcher tests, local type-check, targeted tests, and `git diff --check`. |
-| Improve Full Archive Node dependent apps UX | todo | Already partly represented by Bitcoin-pruned install block; needs broader dependency UX. |
+| Improve Full Archive Node dependent apps UX | in-progress | Electrum-style apps already block install on pruned Bitcoin nodes; Marketplace/App Store cards now surface an inline warning that a full archive Bitcoin node is required instead of only showing a terse `Bitcoin Pruned` button. Covered by `MarketplaceAppCard.test.ts` and local type-check. Broader dependency UX remains. |
 | Fix incorrect modals that are wrong color and are not full-screen overlay | done | Custom Teleport modals that still used the old light `bg-black/10` overlay now use the same full-screen `bg-black/60` overlay treatment as BaseModal/newer modals. Verified no fixed modal overlays retain `bg-black/10`; validated by local type-check, targeted tests, and `git diff --check`. |
 | Prevent modals from allowing background scroll | done | Added shared scroll-lock composable, root-level body lock, wheel/touch containment, and explicit dashboard route-panel locking. User validated the background no longer scrolls behind modal overlays. |
 | Look over gamepad navigation | todo | Needs focused controller-nav pass. |
@@ -206,6 +220,7 @@ Done criteria for this tracker:
 | Delete app data option and uninstall warning | done | Uninstall dialogs in My Apps and App Details now include a clear warning plus a `Delete app data and reset it` choice. Leaving it off preserves app data for later reinstall; checking it passes `preserve_data=false` through `package.uninstall` so the app is fully reset. Covered by `AppsUninstallModal.test.ts`, `rpc-client.test.ts`, local type-check, targeted tests, and `git diff --check`. |
 | Add App Store container with recommended apps that change to Home Screen | done | Home now shows up to three uninstalled core/recommended App Store apps and routes clicks through the existing Marketplace App Details handoff. Installed aliases are honored, so recommendations disappear once the app is installed and the app moves into normal My Apps/Home behavior. Follow-up layout polish moved Cloud back into the second card slot, moved Recommended Apps into Cloud's previous slot, and placed Quick Start inside the grid next to Wallet to avoid an odd-width row. Covered by `homeRecommendations.test.ts`, local type-check, `git diff --check`, and Playwright Home dashboard smoke against local Vite/mock backend. |
 | Add QR code to download mobile companion app in login-triggered modal and improve modal | done | Companion intro modal now renders a QR code on desktop and a direct download button on mobile. It reads `VITE_COMPANION_APK_URL` and falls back to `/packages/archipelago-companion.apk.zip`; the APK zip is now published at `neode-ui/public/packages/archipelago-companion.apk.zip` so the modal can serve it immediately. Covered by local type-check, `git diff --check`, and manual file placement verification. |
+| Fix TV HDMI overscan clipping in kiosk mode | in-progress | Kiosk launcher now passes a browser safe-area fallback through `/kiosk?safe_area=...`; `/kiosk` now persists the safe-area value during redirect; self-update and deploy paths refresh kiosk launcher/services. The X11 safe-area attempt is opt-in because it stretched the live TV output on `100.66.157.120`. Wi-Fi UI fixes are included in the same OTA patch: scan errors are visible, scans can be retried, escaped SSIDs parse correctly, and open networks do not require a password. Needs live validation on HDMI node `100.66.157.120` after applying the visible OTA update. |
 | Video calling Picture-in-Picture | blocked | Need referenced document or desired provider/library. |
 | Card-based loading visuals on App Store pages | done | Discover and Marketplace now show app-card skeleton grids while community/Nostr catalog data is loading and no cards are available yet, instead of a centered spinner/empty state. Validated by local type-check, targeted tests, and `git diff --check`. |
 

docs/bitcoin-rpc-relay.md

@@ -27,6 +27,7 @@ Allowed RPC methods:
 
 ```text
 sendrawtransaction
+submitpackage
 testmempoolaccept
 getmempoolinfo
 getrawmempool
@@ -37,6 +38,7 @@ getblockcount
 getblockhash
 getblockheader
 getrawtransaction
+gettxout
 decoderawtransaction
 decodescript
 estimatesmartfee
@@ -113,7 +115,7 @@ The Bitcoin Knots app should add the restricted user only when the secret exists
 RPC_TXRELAY_AUTH="$(printenv BITCOIN_RPC_TXRELAY_RPCAUTH || true)"
 RPC_TXRELAY_FLAGS="-rpcwhitelistdefault=0"
 if [ -n "$RPC_TXRELAY_AUTH" ]; then
-  RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblockheader,getrawtransaction,decoderawtransaction,decodescript,estimatesmartfee"
+  RPC_TXRELAY_FLAGS="$RPC_TXRELAY_FLAGS -rpcauth=$RPC_TXRELAY_AUTH -rpcwhitelist=txrelay:sendrawtransaction,submitpackage,testmempoolaccept,getmempoolinfo,getrawmempool,getmempoolentry,getnetworkinfo,getblockchaininfo,getblockcount,getblockhash,getblock,getblockheader,getrawtransaction,gettxout,gettxspendingprevout,decoderawtransaction,decodescript,estimatesmartfee,uptime,ping,getconnectioncount,getpeerinfo,getindexinfo,getdeploymentinfo,getchaintips"
 fi
 ```
 
@@ -245,6 +247,15 @@ curl -sS --user "$BITCOIN_RPC_TXRELAY_USER:$BITCOIN_RPC_TXRELAY_PASSWORD" \
 Expected result is a Bitcoin RPC validation error such as `TX decode failed`,
 which confirms the request reached `sendrawtransaction`.
 
+If a wallet verifies the connection but reports `RPC Forbidden` during
+broadcast, the credentials authenticated but the broadcast method was outside
+the loaded `txrelay` whitelist. Restart the active Bitcoin backend after
+updating the whitelist, then test both `sendrawtransaction` and, for newer
+package-relay clients, `submitpackage`. Also confirm the public reverse proxy
+passes the wallet's `Authorization` header through to `127.0.0.1:8332`; do not
+point public wallet traffic at the Bitcoin UI `/bitcoin-rpc/` helper, because
+that helper injects the local dashboard credential.
+
 Check that wallet/admin RPC is blocked:
 
 ```sh