fix: fresh-ISO feedback bug-bash — onboarding, status truthfulness, recovery, kiosk, logs

Fixes from real fresh-install feedback (Framework node .81) + its log bundle:

Backend:
- websocket: subscribe before initial snapshot — broadcasts in the gap were
  silently lost, stranding clients on stale state until a hard refresh
  (the "everything needs ctrl-r" bug: My Apps stuck Loading, App Store
  stuck Checking, containers-scanned never arriving)
- crash recovery: check the crash marker BEFORE writing our own PID —
  recovery had never run on any node (always saw its own PID and skipped);
  PID-reuse guard via /proc cmdline
- boot status: pending-boot-starts registry (recovery, stack recovery,
  reconciler, adoption) — scanner overlays queued-but-down apps as
  Restarting instead of Stopped after a reboot; scanner-authored
  Restarting resolves immediately on a settled scan (no transitional wedge)
- install deps: bounded wait (36x5s) when a dependency is installed but
  still starting ("Waiting for Bitcoin to start…") instead of instant
  rejection; dependency-gate rejections remove the optimistic entry (no
  phantom Stopped tile) and surface as a notification
- seed backup: auth.setup persists the onboarding mnemonic as the
  encrypted seed backup (reveal previously failed on EVERY node — nothing
  ever wrote master_seed.enc); seed.restore stashes too; error sanitizer
  lets seed/2FA errors through instead of "Check server logs"
- lnd: bitcoind.rpchost resolved from the running Bitcoin variant
  (hardcoded bitcoin-knots broke Core nodes); manifest uses derived_env
- bitcoin status: clean human message for connection-reset/startup; raw
  URLs + os-error chains no longer reach the app card
- fedimint-clientd: chown /var/lib/archipelago/fmcd to 1000:1000 (root-
  created dir crash-looped the rootless container, EACCES) — first-boot
  script + pre-start self-heal
- log volume (>1GB/day on a day-old node): journald caps drop-in (ISO +
  bootstrap self-heal), bitcoind -printtoconsole=0 everywhere (90% of the
  journal was IBD UpdateTip spam), tracing default debug→info

Frontend:
- Login: Enter advances to confirm field then submits; submit always
  clickable with inline errors (was silently disabled on mismatch);
  Restart Onboarding needs a confirming second click (the mismatch →
  "onboarding restarted" trap)
- sync store: 30s state reconciliation + refetch on re-entrant connect;
  20s containers-scanned escape hatch so Checking can never show forever;
  fresh empty node reaches the real "no apps yet" state
- intro video: CRF20 re-encode (SSIM 0.988) + faststart — moov was at EOF
  so playback needed the full 15MB first (the intro lag)
- backgrounds: 10 heaviest JPEGs → WebP q90 (9.4MB→6.6MB); 7 stayed JPEG
  (WebP larger on noisy sources)
- Web5ConnectedNodes: drop unused template ref that failed vue-tsc -b

ISO/kiosk:
- nginx: /assets/ 404s no longer cached immutable for a year; HTTPS block
  gained the missing /assets/ location (served index.html as images)
- kiosk: launcher/service spliced from configs/ at ISO build (stale
  heredoc force-disabled GPU); MemoryHigh/Max 1200/1500→2200/2800M (kiosk
  rode the reclaim throttle = the lag); firmware-intel-graphics +
  firmware-amd-graphics (trixie split DMC blobs out of misc-nonfree)

Verified: cargo test 898/898 green, npm run build green with dist
contents confirmed (webp refs, lnd.png, faststart video, new strings).
Handover for ISO build + deploy: docs/HANDOVER-2026-07-02-iso-feedback.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/bootstrap.rs

@@ -39,6 +39,16 @@ const KIOSK_LAUNCHER: &str =
 const KIOSK_SERVICE_PATH: &str = "/etc/systemd/system/archipelago-kiosk.service";
 const KIOSK_LAUNCHER_PATH: &str = "/usr/local/bin/archipelago-kiosk-launcher";
 
+// Journald log-volume policy (size cap + per-service rate limit). Fresh ISOs
+// write the identical file at build time (image-recipe/_archived/
+// build-auto-installer-iso.sh); this heals already-deployed nodes via OTA.
+// A fresh node produced >1 GB/day of journal (bitcoind IBD console spam plus
+// debug-level backend logging) — the cap bounds disk use and the rate limit
+// keeps one chatty service from drowning everything else.
+const JOURNALD_DROPIN: &str =
+    include_str!("../../../image-recipe/configs/journald-archipelago.conf");
+const JOURNALD_DROPIN_PATH: &str = "/etc/systemd/journald.conf.d/10-archipelago-persistent.conf";
+
 const NGINX_CONF_PATH: &str = "/etc/nginx/sites-available/archipelago";
 const NGINX_ENABLED_CONF_PATH: &str = "/etc/nginx/sites-enabled/archipelago";
 /// Per-app proxy snippet included by the HTTPS (:443) server block. Carries its
@@ -120,6 +130,11 @@ pub async fn ensure_doctor_installed() {
         Ok(false) => debug!("Bitcoin RPC bind settings already usable"),
         Err(e) => warn!("Bitcoin RPC repair failed (non-fatal): {:#}", e),
     }
+    match run_journald_dropin().await {
+        Ok(true) => info!("Installed journald log-volume policy drop-in"),
+        Ok(false) => debug!("journald log-volume policy already in place"),
+        Err(e) => warn!("journald drop-in bootstrap failed (non-fatal): {:#}", e),
+    }
     match tighten_secrets_dir().await {
         Ok(n) if n > 0 => info!(tightened = n, "Tightened mode on secret files"),
         Ok(_) => debug!("Secrets directory already at expected mode"),
@@ -408,6 +423,14 @@ ensure_line() {
 ensure_line server=1
 ensure_line rpcallowip=0.0.0.0/0
 ensure_line listen=1
+# Log-volume fix: printtoconsole=1 duplicated every log line (incl. per-block
+# IBD "UpdateTip" spam) into journald via conmon on top of the datadir
+# debug.log bitcoind already writes. Console off; debug.log stays (bitcoind
+# self-shrinks it on restart).
+if grep -q '^printtoconsole=1' "$conf"; then
+    sed -i 's/^printtoconsole=1$/printtoconsole=0/' "$conf"
+    changed=1
+fi
 [ "$changed" -eq 0 ] && exit 0
 exit 2
 "#;
@@ -428,6 +451,44 @@ exit 2
     }
 }
 
+/// Install the journald log-volume policy drop-in (JOURNALD_DROPIN) so nodes
+/// deployed before the ISO shipped it get the size cap + rate limit via OTA.
+/// Idempotent; restarts journald only when the file actually changed (safe:
+/// the sockets are held by pid1, so at most a few messages queue briefly).
+async fn run_journald_dropin() -> Result<bool> {
+    // Same dev-box guards as the doctor bootstrap: never touch /etc on
+    // contributors' laptops (symlinked or absent /home/archipelago/archy).
+    let home_archy = Path::new("/home/archipelago/archy");
+    if fs::symlink_metadata(home_archy)
+        .await
+        .map(|m| m.file_type().is_symlink())
+        .unwrap_or(false)
+    {
+        debug!("/home/archipelago/archy is a symlink — skipping journald bootstrap (dev box)");
+        return Ok(false);
+    }
+    if fs::metadata(home_archy).await.is_err() {
+        debug!("/home/archipelago/archy missing — skipping journald bootstrap");
+        return Ok(false);
+    }
+
+    let dropin_dir = "/etc/systemd/journald.conf.d";
+    let status = host_sudo(&["mkdir", "-p", dropin_dir])
+        .await
+        .with_context(|| format!("mkdir {}", dropin_dir))?;
+    if !status.success() {
+        anyhow::bail!("mkdir {} exited with {}", dropin_dir, status);
+    }
+
+    let changed = write_root_if_needed(JOURNALD_DROPIN_PATH, JOURNALD_DROPIN).await?;
+    if changed {
+        if let Err(e) = host_sudo(&["systemctl", "restart", "systemd-journald"]).await {
+            warn!("journald restart after drop-in update failed: {:#}", e);
+        }
+    }
+    Ok(changed)
+}
+
 async fn run() -> Result<bool> {
     // Dev-box guard: on contributors' laptops `/home/archipelago/archy` is
     // typically a symlink into the git checkout, and writing through it