docs(hardening): record the four user decisions of 2026-07-08

Bitcoin RPC loopback+gateway bind DONE dd61a204; version = 1.8.0-alpha;
bitcoin multi-version rides the next OTA; 3ccc RF validation dropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -140,16 +140,14 @@ modules; production request/boot paths are essentially panic-free. The real risk
       revalidate) instead of blocking on systemctl. `image_verifier.rs` cosign sites have no
       callers yet — handled with the §A cosign item. Tests: container 155 / transport 29 /
       config 29 / package 46 all green.
-- [ ] 🟡 **Restrict Bitcoin RPC exposure.** INVESTIGATED 2026-07-03 — the fix is NOT
+- [x] 🟡 **Restrict Bitcoin RPC exposure.** DECIDED (user, 2026-07-08: break external
-      `rpcallowip`: under rootless-podman NAT every forwarded connection reaches bitcoind
+      wallets) + DONE `dd61a204`: manifest port mappings grew a validated `bind` field;
-      with an in-subnet source IP, so scoping `rpcallowip` blocks nothing (and container
+      bitcoin-knots/-core publish 8332 on `127.0.0.1` + the archy-net gateway `10.89.0.1`
-      consumers use archy-net DNS anyway). The actual exposure is the host-side publish
+      only (in-node consumers dial host.archipelago/host.containers.internal → 10.89.0.1,
-      `8332:8332` (binds 0.0.0.0 → LAN can hit RPC, auth-only barrier; 4 write sites:
+      unaffected; P2P 8333 stays public); legacy config.rs strings get the same incl.
-      `bootstrap.rs:424`, `package/config.rs:694`, `package/install.rs:1333/2450`, plus
+      unauthenticated ZMQ 28332/28333. Unbound ports render byte-identical (no false-drift
-      the knots manifest). Real fix = `127.0.0.1:8332:8332` host bind (P2P 8333 stays
+      wave). **Still to roll out:** catalog regen + re-sign for catalog-covered nodes;
-      public; zmq 28332/28333 should get the same look — unauthenticated). ⚠ May break
+      each node's bitcoin container recreates once on deploy → restart lnd after (IP cache).
-      external wallets pointed straight at nodeIP:8332 — needs a user call + on-node gate
-      re-run, so NOT changed drive-by from the dev box.
 - [x] 🟡 **Move secret env out of plaintext channels → podman secrets.** DONE 2026-07-05,
       **VERIFIED ON .228 2026-07-08**: recreate wave settled (only fedimint-gateway lagged —
       restart-sensitive, converged via a controlled quadlet restart, healthy, 0 plaintext
@@ -360,11 +358,13 @@ media (latest artifact only one minor behind).
       `config.rs:256` once the .5 gate reports clean.
 - [ ] 🟠 **Developer CLI suite** (`archy app validate/render/install/test`) — gates external
       app publishing (`APP-PACKAGING-MIGRATION-PLAN.md` step 5).
-- [ ] ⛔🟡 **Version-naming decision** (`1.7.99-alpha` → `1.8.0` vs `1.8.00-alpha`) — a one-line
+- [ ] 🟡 **Version bump + tag** — DECIDED (user, 2026-07-08): the release ships as
-      call, then a mechanical bump + tag. **Needs your decision.**
+      **`1.8.0-alpha`**. Remaining work is the mechanical bump + `create-release.sh` run
-- [ ] ⛔🟢 **Bitcoin multi-version fleet OTA** — `.228` working on branch; rollout timing is
+      when the gate criteria are met.
-      held for your call (`docs/bitcoin-version-bulletproof-rollout.md`).
+- [ ] 🟢 **Bitcoin multi-version fleet OTA** — DECIDED (user, 2026-07-08): timing doesn't
-- [ ] ⛔🟢 **3ccc stock-Meshtastic RF validation** — code fix in place; needs a live radio send.
+      matter; fold the branch into the next fleet OTA (`docs/bitcoin-version-bulletproof-rollout.md`).
+- [x] ~~⛔🟢 **3ccc stock-Meshtastic RF validation**~~ — DROPPED per user 2026-07-08; the
+      code fix stays in, no live-radio validation will be scheduled.
 
 ---