diff --git a/docs/PRODUCTION-MASTER-PLAN.md b/docs/PRODUCTION-MASTER-PLAN.md
index 55e3b7ad..1df42f61 100644
--- a/docs/PRODUCTION-MASTER-PLAN.md
+++ b/docs/PRODUCTION-MASTER-PLAN.md
@@ -192,6 +192,17 @@ no-regression; the original hang was load/timing-induced and not separately repr
    restart / uninstall / reinstall / reboot-survive) driven by the manifest set, so grafana and
    the ~30 uncovered apps are gated too — not just the 8 core. Manifest-driven, so new apps are
    covered automatically.
+   *(✅ 2026-06-26 `43934eef`: `bats/all-apps-lifecycle.bats` — DESTRUCTIVE counterpart to the
+   read-only `all-apps-matrix.bats`. Discovers the app set from My Apps ∩ the node `catalog.json`;
+   drives stop/start/restart for every app and, under `ARCHY_ALLOW_CASCADE_DESTRUCTIVE`, a FULL
+   teardown (uninstall→no-ghost→reinstall) with the catalog `{dockerImage, containerConfig}` as the
+   reinstall spec. PROTECTED (never touched): bitcoin*/electrum* (resync cost) + lnd/btcpay*/fedimint*
+   (irreversible wallet loss — user asked to protect only bitcoin+electrum; wallet apps added for
+   safety, override via `ARCHY_MATRIX_PROTECT`). Validated on .228 (discovery + 1-app lifecycle
+   green). HEAVY/destructive → a supervised pass on LAN nodes (.116/.198/.228), NOT folded into
+   run-gate. Invoke: `ARCHY_ALLOW_DESTRUCTIVE=1 ARCHY_ALLOW_CASCADE_DESTRUCTIVE=1 ARCHY_PASSWORD=…
+   ARCHY_SCHEME=https bats bats/all-apps-lifecycle.bats`. STILL TODO: run the full destructive pass
+   on a LAN node + fix whatever reinstall failures it surfaces; add reboot-survive + UI-reach per app.)*
 4. **Guardian/IBD-dependent states:** assert that "waiting for bitcoin sync"-style states are a
    legitimate, surfaced wait (with a path to ready) and never a permanent stuck state.