docs(hardening): tick transitional-state stick + install_log + gate 123/124 fixes

All three landed 2026-07-09 (dd3afbba, c3f0a306, 2683ad4f0). Files the
repair-wait user-stop preemption as the open follow-up of the stick fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -200,6 +200,27 @@ modules; production request/boot paths are essentially panic-free. The real risk
       `no such object` phrasing added to all 3 `is_missing_container_error` classifiers.
       Follow-up (open): reconciler-side cleanup of an orphan umbrella `mempool` container
       when the split stack owns the frontend, so the stale-tile state can't arise at all.
+- [x] 🟠 **Transitional package state sticks past the gate window on legacy apps**
+      (vaultwarden:stop run C, jellyfin:stop run D, uptime-kuma:start run E — .228
+      2026-07-09), FIXED `dd3afbba`: the scanner already saw the settled container every
+      60s but `merge_preserving_transitional` refused to report it until the RPC worker
+      wrote back — and workers legitimately trail the container by minutes (stop workers
+      queue behind the orchestrator app_lock that reconcile's host-port repair holds
+      through multi-minute stability waits; start workers hold `Starting` through
+      readiness budgets up to 420s for uptime-kuma against a 240s gate window, with the
+      20-minute Installing stuck-timeout as the only escape). New merge rules:
+      (Stopping, Stopped)+user-stop-marker → Stopped; (Starting, Running) → Running;
+      Restarting deliberately unresolved. Follow-up (open, same family as the op-lock
+      known-limit): repair/readiness waits should abort early when a user-stop marker
+      appears mid-wait, so an explicit stop is never queued behind a multi-minute repair.
+- [x] 🟢 **`install_log()` has been a no-op since April** — `/var/log/archipelago/
+      container-installs.log` is 0 bytes: the service sandbox leaves /var/log read-only,
+      the open() fails, fire-and-forget drops every line. FIXED `c3f0a306`: every line
+      now mirrors to tracing/journald; file append stays best-effort.
+- [x] 🟢 **Gate tests 123/124 false-fail on user-stopped apps with lingering quadlet
+      units** (run E: the inactive bitcoin-core of the multi-version pair), FIXED
+      `2683ad4f0`: `use-quadlet-backends-install.bats` active-state asserts now honour
+      `user-stopped.json`.
 - [ ] 🟠 **Backend recreate must cascade to dependent apps** (found on .228 2026-07-08):
       when bitcoin-knots was recreated mid-gate (one-time secret-env recreate) it got a new
       archy-net IP; **lnd caches the resolved backend IP** and kept dialing the dead one