Merge branch 'stage' into dev

Brings dev level with stage: runtime-configurable backend (v0.1.5), WS ticket
auth + desktop log channel (v0.1.6), per-installer latest.json (v0.1.7), TAG
bumps, and the admin-only update decision.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/web/src/lib/i18n/en.ts

@@ -58,7 +58,7 @@ export const en: Catalog = {
   },
   update: {
     available: "Update available",
-    prompt: "Version {{version}} is available. Install now and restart?",
+    prompt: "Version {{version}} is available. Install now and restart? (Installing requires the administrator password.)",
   },
   nav: {
     booth: "Booth",

apps/web/src/lib/i18n/sq.ts

@@ -61,7 +61,7 @@ export const sq = {
   },
   update: {
     available: "Përditësim i disponueshëm",
-    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis?",
+    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis? (Instalimi kërkon fjalëkalimin e administratorit.)",
   },
   nav: {
     booth: "Kabina",

wiki/decisions/appliance-provisioning.md

@@ -462,9 +462,11 @@ before vision finishes loading). Reach the UI at **`http://<name-or-ip>/`** (Cad
 **Web-access gotchas (all fixed in the images/compose — see [[container-deployment]] "Web access"):**
 the SPA uses a RELATIVE `/api` base (works from any host; do NOT bake a domain) + a Caddy proxy gives
 the clean port-80 URL; the domain (`parksystems.msai.al`) is pointed at the booth's LAN IP via
-`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** is hardcoded to
-`localhost:3000` (CSP + endpoints) and can't reach a remote booth without code changes — a browser
-works; the desktop app is a separate workstream.
+`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** (install the `.deb` from
+`mca/public_releases`, NOT the AppImage — see [[desktop-shell-tauri]]) asks for the server address
+on first launch (`127.0.0.1:3000` on the booth itself, or any `<ip>:3000` / `<name>` via Caddy);
+nothing is baked in since v0.1.5. In-app updates need the **admin** password (polkit) — by
+decision, updates are an admin action, so plan to be at the box when bringing it online for one.
 
 ## Quick-reference: the gotchas, in order they bit us
 

wiki/decisions/desktop-shell-tauri.md

@@ -455,3 +455,32 @@ Sources: `tauri-plugin-updater-2.10.1/src/updater.rs` (`get_urls`, `install_inne
 - **Judgment note for the retrospective:** three fixes were shipped against this symptom
   without reading the updater's install path once. The whole chain is ~60 lines of vendored
   Rust in `~/.cargo/registry`; it names the exact failure (`InvalidUpdaterFormat`).
+
+### Decision: desktop updates are an admin-only action — the polkit prompt stays (2026-09-04)
+
+Settled with the user after the first successful self-update (v0.1.6 → v0.1.7 on the park-2
+booth, `pkexec dpkg -i`, polkit dialog, relaunch, badge shows 0.1.7). The prompt asks for an
+**admin** password the operator does not have — and that is now the intended gate, not a defect.
+
+- **AppImage was tried and rejected on evidence, not theory.** The v0.1.6 AppImage fails to
+  start on the Ubuntu 26.04 booth: `libgvfscommon.so: undefined symbol:
+  g_variant_builder_init_static` (the host's newer gvfs modules loading into the *bundled* older
+  glib) followed by `Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...` (the
+  bundled WebKitGTK vs. the host's Mesa). Tauri's AppImage freezes the CI runner's (24.04)
+  GTK/WebKitGTK/glib into the bundle, which throws away the one property this platform decision
+  rests on — the **distro-maintained, Canonical-patched WebKitGTK** — and replaces it with a
+  host-mismatch hazard at every OS update. `WEBKIT_DISABLE_DMABUF_RENDERER=1` /
+  `WEBKIT_DISABLE_COMPOSITING_MODE=1` may paper over the EGL abort; they don't fix the shape.
+  **The `.deb` is the right artifact; only its install step needs root.**
+- **Passwordless polkit/sudoers for `dpkg -i` rejected:** any rule that lets the operator
+  account pass that prompt silently lets them run `pkexec dpkg -i <anything>` — root — which the
+  [[threat-model]] forbids outright.
+- **Deferred, not rejected — the fleet-grade answer:** a root systemd timer shipped inside the
+  `.deb` (via Tauri's deb `files` + postinstall) that fetches `latest.json` from
+  `public_releases`, verifies the `.deb` with `minisign` against the same embedded pubkey, and
+  `dpkg -i`s it when the box is online; the in-app updater then only *notifies*. No prompt, no
+  privileged code in the shell, standard appliance practice. Revisit when more than one booth
+  needs keeping current, or when someone other than the admin has to bring a box online.
+- **Operator-facing consequence:** the in-app prompt now says the install needs the
+  administrator password (i18n `update.prompt`, en + sq). An operator who accepts and can't
+  authenticate simply stays on the current version; nothing breaks, and the failure is logged.

wiki/decisions/standing-decisions.md

@@ -24,7 +24,10 @@ The decisions treated as settled in the design notes. (See [[parking-system-arch
   (chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a
   deny-by-default native surface that fits [[threat-model|the booth-operator threat model]]. The
   shell stays **thin**: all privileged logic remains in [[fastify]]. One open dependency — the
-  appliance's WebKitGTK version (see [[open-questions]] #11).
+  appliance's WebKitGTK version (see [[open-questions]] #11). Ships as a **`.deb`** (the AppImage
+  bundles a runner's WebKitGTK and fails on the 26.04 booth — 2026-09-04); its backend address is
+  **operator-entered at runtime**, not baked in; and **in-app updates are an admin-only action**
+  behind the polkit password prompt (user, 2026-09-04) — never make that prompt passwordless.
 - **Integrity:** append-only, hash-chained, **software-signed** event log
   ([[append-only-event-chain]]) — hardware-backed signing (a non-extractable key in the
   **[[tpm|TPM]]** or a **USB HSM**; the [[atecc608]] is [[open-questions|upcoming, not present]]) is

wiki/log.md

@@ -2873,3 +2873,15 @@ latest.json now has one signed entry per installer (deb, rpm, AppImage); a .deb
 polkit password prompt (pkexec dpkg -i), which is the intended admin gate on a root-installed
 package. README + [[desktop-shell-tauri]] updated. First real test: tag v0.1.7 and accept the
 prompt on the v0.1.6 booth.
+
+## [2026-09-04] decision | Desktop updates are admin-only: keep the polkit prompt; AppImage rejected on field evidence
+
+First successful desktop self-update (v0.1.6 → v0.1.7, pkexec dpkg -i + polkit dialog) raised
+the question of the admin password the operator lacks. Tried the AppImage as the no-root path:
+it fails to start on the Ubuntu 26.04 booth (bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa —
+EGL_BAD_PARAMETER abort), and structurally it abandons the distro-maintained WebKitGTK the
+platform decision depends on. Passwordless polkit for dpkg is root-for-the-operator, rejected.
+Decision (user, 2026-09-04): the .deb stays, updates are an admin action behind the prompt; the
+in-app prompt now says so (en + sq). A root systemd updater timer shipped in the .deb (minisign-
+verified, notify-only in-app) is recorded as the deferred fleet-grade option on
+[[desktop-shell-tauri]].