From a3e09eab578c0ce4566ea499fc08769f25d2d869 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Fri, 26 Jun 2026 06:29:51 -0400
Subject: [PATCH] =?UTF-8?q?docs(master-plan):=20WS-F#3=20=E2=80=94=20destr?=
 =?UTF-8?q?uctive=20all-apps=20lifecycle=20matrix=20landed=20(43934eef)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/PRODUCTION-MASTER-PLAN.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docs/PRODUCTION-MASTER-PLAN.md b/docs/PRODUCTION-MASTER-PLAN.md
index 55e3b7ad..1df42f61 100644
--- a/docs/PRODUCTION-MASTER-PLAN.md
+++ b/docs/PRODUCTION-MASTER-PLAN.md
@@ -192,6 +192,17 @@ no-regression; the original hang was load/timing-induced and not separately repr
    restart / uninstall / reinstall / reboot-survive) driven by the manifest set, so grafana and
    the ~30 uncovered apps are gated too — not just the 8 core. Manifest-driven, so new apps are
    covered automatically.
+   *(✅ 2026-06-26 `43934eef`: `bats/all-apps-lifecycle.bats` — DESTRUCTIVE counterpart to the
+   read-only `all-apps-matrix.bats`. Discovers the app set from My Apps ∩ the node `catalog.json`;
+   drives stop/start/restart for every app and, under `ARCHY_ALLOW_CASCADE_DESTRUCTIVE`, a FULL
+   teardown (uninstall→no-ghost→reinstall) with the catalog `{dockerImage, containerConfig}` as the
+   reinstall spec. PROTECTED (never touched): bitcoin*/electrum* (resync cost) + lnd/btcpay*/fedimint*
+   (irreversible wallet loss — user asked to protect only bitcoin+electrum; wallet apps added for
+   safety, override via `ARCHY_MATRIX_PROTECT`). Validated on .228 (discovery + 1-app lifecycle
+   green). HEAVY/destructive → a supervised pass on LAN nodes (.116/.198/.228), NOT folded into
+   run-gate. Invoke: `ARCHY_ALLOW_DESTRUCTIVE=1 ARCHY_ALLOW_CASCADE_DESTRUCTIVE=1 ARCHY_PASSWORD=…
+   ARCHY_SCHEME=https bats bats/all-apps-lifecycle.bats`. STILL TODO: run the full destructive pass
+   on a LAN node + fix whatever reinstall failures it surfaces; add reboot-survive + UI-reach per app.)*
 4. **Guardian/IBD-dependent states:** assert that "waiting for bitcoin sync"-style states are a
    legitimate, surfaced wait (with a path to ready) and never a permanent stuck state.