docs: record F1 live validation on .116 (green)

Before/after on the live node confirms the launch_url_port fix:
jellyfin/btcpay/fedimint/gitea/portainer/botfights all went from
lan_address=None to a resolved http://localhost:PORT/ URL; harness
focused audit passed, exit 0. Also documents that archipelago.service
restarts are safe on .116 (containers run in the user-1000 slice, a
different cgroup, and survived the restart).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/MIGRATION_STATUS_REPORT.md

@@ -2,6 +2,33 @@
 
 Last updated: 2026-06-14
 
+## RESUME CHECKPOINT (2026-06-14, after SSH drop)
+
+State right now, so any disconnect resumes cleanly:
+
+- **`main` = `a483fe4b`** = the other agent's 4 fixes (`0ed892a4`: wallet receive / bitcoin
+  install self-heal / ElectrumX tile / extended test gate) + **my F1 fix committed on top**
+  (`launch_url_port` in `docker_packages.rs` + 3 regression tests). Tree is clean (only two
+  untracked `docs/*.md` tracking files remain). Not pushed.
+- The old isolated `archy-f1` worktree was **removed** — built the combined tree in-place.
+- ✅ **DONE — combined backend release build** (`cd core && TMPDIR=/home/archipelago/.buildtmp
+  cargo build --release -p archipelago`, 7m46s, exit 0). `/tmp` is a full tmpfs so `TMPDIR`
+  MUST point at `/home/archipelago/.buildtmp`.
+- ✅ **DONE — sideloaded + restarted on `.116`.** Backed up old binary to
+  `/usr/local/bin/archipelago.pre-f1.bak`, `install`ed new binary (root:root 755),
+  `sudo systemctl restart archipelago` (new MainPID 2885863).
+- ✅ **F1 VALIDATED LIVE on `.116` (2026-06-14).** See "FINDING F1" below — before/after proves
+  the fix. Harness focused audit `jellyfin,filebrowser` → **all checks passed, exit 0**.
+- **IMPORTANT — restart is SAFE on this node:** containers run rootless under
+  `user-1000.slice/user@1000.service/app.slice`, a DIFFERENT cgroup from
+  `/system.slice/archipelago.service`. They survived both the 01:47 and this restart
+  (bitcoin/lnd/btcpay/immich/indeedhub all intact, count stayed 36). The
+  `feedback_no_systemctl_deploy_until_quadlet` cgroup-cascade warning does NOT apply to `.116`'s
+  current config. (The reconciler does recreate a few app containers like jellyfin/fedimint on
+  adoption — normal level-triggered behavior, not casualties.)
+- **NEXT (gated on user OK):** full fleet release via `create-release.sh` → publish vps2 →
+  push origin + gitea-local → tag. User chose "validate on .116 first" — validation now GREEN.
+
 ## Validation node (ACTIVE)
 
 As of 2026-06-14 the app-migration lifecycle validation moves from `.198` (remote, OVH) to
@@ -89,13 +116,26 @@ worktree is removed (`git worktree remove`). NOTE: sideloading replaces the OTA-
 `/usr/local/bin/archipelago` with a local 1.7.90-alpha+F1 build until the next OTA — back up the
 current binary first (`/usr/local/bin/archipelago.pre-f1.bak`).
 
-**Live validation status — PENDING, GATED ON USER OK.** Proving F1 on `.116` requires a backend
+**Live validation status — ✅ GREEN on `.116` (2026-06-14).** Built combined tree (`a483fe4b`),
-rebuild + redeploy + `systemctl restart archipelago`. Per `feedback_no_systemctl_deploy_until_quadlet`
+sideloaded, restarted `archipelago.service`. Before/after on the live node (old buggy binary → new):
-that restart SIGKILLs every container in the service cgroup (the boot reconciler re-adopts them, but
+
-it is disruptive on this live node that runs the user's real bitcoin/lnd/apps). So: unit test first
+| app | OLD lan_address | NEW lan_address |
-(non-disruptive), then ask before the redeploy. Do NOT run the prod binary directly to "check a
+|---|---|---|
-version" — `/usr/local/bin/archipelago <anyflag>` boots a whole second node instance (learned the
+| jellyfin | `None` ❌ | `http://localhost:8096/` ✅ |
-hard way 2026-06-14; it exited without leaving a stray, but don't repeat).
+| btcpay-server | `None` ❌ | `http://localhost:23000/` ✅ |
+| fedimint | `None` ❌ | `http://localhost:8175/` ✅ |
+| gitea | `None` ❌ | `http://localhost:3001/` ✅ |
+| portainer | `None` ❌ | `http://localhost:9000/` ✅ |
+| botfights | `None` ❌ | `http://localhost:9100/` ✅ |
+| nextcloud | `:8085` ✓ | `:8085` (unchanged — allocated-port path) |
+| filebrowser | `:8083` ✓ | `:8083` (unchanged) |
+
+Harness focused audit `jellyfin,filebrowser` → **all checks passed, exit 0**. Unit tests green.
+No container casualties (all 36 survived; see RESUME CHECKPOINT for the cgroup detail).
+
+NOTE: Do NOT run the prod binary directly to "check a version" —
+`/usr/local/bin/archipelago <anyflag>` boots a whole second node instance (learned the hard way
+2026-06-14; it exited without leaving a stray, but don't repeat).
 
 ## Goal