Merge branch 'stage' into dev

Brings dev level with stage: runtime-configurable backend (v0.1.5), WS ticket
auth + desktop log channel (v0.1.6), per-installer latest.json (v0.1.7), TAG
bumps, and the admin-only update decision.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

.gitea/workflows/release.yml

@@ -129,8 +129,23 @@ jobs:
         # The Tauri updater fetches a manifest describing the newest version, its
         # notes, and per-target {signature, url}. The URL points at the MIRROR
         # repo (mca/public_releases) — that's the unauthenticated endpoint field
-        # appliances actually reach; see the workflow header for why. Adjust the
-        # platform keys you actually ship.
+        # appliances actually reach; see the workflow header for why.
+        #
+        # ONE ENTRY PER INSTALLER TYPE — this is what made every in-app update
+        # v0.1.0→v0.1.6 fail. tauri-plugin-updater looks up
+        # `{os}-{arch}-{installer}` FIRST (linux-x86_64-deb / -rpm / -appimage,
+        # from the running app's detected bundle type) and only then the bare
+        # `linux-x86_64`. The booths run the .deb, and the manifest used to
+        # carry ONLY `linux-x86_64` → the AppImage. So a .deb install found the
+        # "update", downloaded the AppImage, verified its signature fine, then
+        # handed the bytes to install_deb(), which checks they're a .deb
+        # (infer::archive::is_deb) and bails with InvalidUpdaterFormat — after
+        # the download, before any relaunch, with the error swallowed client-
+        # side until v0.1.6. Now each installer gets its own signed asset; the
+        # bare key stays for an AppImage install. .deb/.rpm updates run
+        # `pkexec dpkg -i` / `rpm -U`, so the operator sees a polkit password
+        # prompt — intended: updating a root-installed package IS an admin
+        # action on this box (see wiki/decisions/desktop-shell-tauri.md).
         env:
           SERVER_URL: ${{ github.server_url }}
           MIRROR_REPO: mca/public_releases
@@ -138,22 +153,41 @@ jobs:
         run: |
           set -e
           VERSION="${TAG#v}"
-          APPIMAGE=$(cd dist && ls *.AppImage | head -1)
-          SIG=$(cat "dist/${APPIMAGE}.sig")
-          ASSET_URL="${SERVER_URL}/${MIRROR_REPO}/releases/download/desktop-latest/${APPIMAGE}"
-          cat > dist/latest.json <<JSON
-          {
-            "version": "${VERSION}",
-            "notes": "Parking System ${TAG}",
-            "pub_date": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-            "platforms": {
-              "linux-x86_64": {
-                "signature": "${SIG}",
-                "url": "${ASSET_URL}"
-              }
-            }
+          ASSET_BASE="${SERVER_URL}/${MIRROR_REPO}/releases/download/desktop-latest"
+          cat > /tmp/latest.js <<'JS'
+          const fs = require("fs");
+          const [version, tag, base] = process.argv.slice(2);
+          const files = fs.readdirSync("dist");
+          const pick = (ext) => files.find((f) => f.endsWith(ext));
+          const entry = (f) => ({
+            signature: fs.readFileSync(`dist/${f}.sig`, "utf8").trim(),
+            url: `${base}/${f}`,
+          });
+          const deb = pick(".deb"), rpm = pick(".rpm"), appimage = pick(".AppImage");
+          if (!deb || !appimage) {
+            console.error(`missing bundle in dist/: deb=${deb} appimage=${appimage}`);
+            process.exit(1);
           }
-          JSON
+          const platforms = {
+            "linux-x86_64-deb": entry(deb),
+            ...(rpm ? { "linux-x86_64-rpm": entry(rpm) } : {}),
+            "linux-x86_64": entry(appimage),
+          };
+          fs.writeFileSync(
+            "dist/latest.json",
+            JSON.stringify(
+              {
+                version,
+                notes: `Parking System ${tag}`,
+                pub_date: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
+                platforms,
+              },
+              null,
+              2,
+            ) + "\n",
+          );
+          JS
+          node /tmp/latest.js "${VERSION}" "${TAG}" "${ASSET_BASE}"
           echo "latest.json:"; cat dist/latest.json
 
       - name: Create release + upload assets (Gitea API)

apps/desktop/README.md

@@ -44,6 +44,14 @@ see that workflow's header and `wiki/decisions/desktop-shell-tauri.md`). The upd
 signing pubkey live in `tauri.conf.json`; the private signing key is held outside the repo, never
 committed.
 
+**The manifest carries one entry per installer type** (`linux-x86_64-deb`, `linux-x86_64-rpm`,
+and bare `linux-x86_64` for AppImage). The updater picks the entry matching how the running app
+was installed — a `.deb` install will only ever accept a signed `.deb`. Booths run the `.deb`,
+so an in-app update ends in a **polkit password prompt** (`pkexec dpkg -i`): that is expected,
+and it is the right gate — the package lives in `/usr/bin`, root-owned, and the operator is not
+supposed to be able to replace it silently. Cancel the prompt and the app keeps running the old
+version; the failure is logged to the server's Logs viewer.
+
 ## Release gate — run the REAL bundle locally before tagging
 
 `tauri dev` loads the SPA from `http://localhost:5173`, a plain http origin. The shipped bundle

apps/web/src/lib/i18n/en.ts

@@ -58,7 +58,7 @@ export const en: Catalog = {
   },
   update: {
     available: "Update available",
-    prompt: "Version {{version}} is available. Install now and restart?",
+    prompt: "Version {{version}} is available. Install now and restart? (Installing requires the administrator password.)",
   },
   nav: {
     booth: "Booth",

apps/web/src/lib/i18n/sq.ts

@@ -61,7 +61,7 @@ export const sq = {
   },
   update: {
     available: "Përditësim i disponueshëm",
-    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis?",
+    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis? (Instalimi kërkon fjalëkalimin e administratorit.)",
   },
   nav: {
     booth: "Kabina",

komodo/resources.toml

@@ -49,7 +49,7 @@ REGISTRY=git.infra.msai.al/mca/parking_solution
 # Staging booth: pinned immutable stage-<sha>. After each promotion (merge dev → stage, CI builds
 # :stage-<sha>), bump this to the new sha and re-sync/deploy from Core. The moving `:stage` tag
 # exists as the pointer; we deploy the sha, not the mover.
-TAG=stage-5c6a21e
+TAG=stage-8fa66c9
 COOKIE_SECURE=0
 VISION_ENABLED=1
 # Desktop app WS handshake: Origin is tauri://localhost (set explicitly by
@@ -82,7 +82,7 @@ REGISTRY=git.infra.msai.al/mca/parking_solution
 # Staging booth: pinned immutable stage-<sha>. After each promotion (merge dev → stage, CI builds
 # :stage-<sha>), bump this to the new sha and re-sync/deploy from Core. The moving `:stage` tag
 # exists as the pointer; we deploy the sha, not the mover.
-TAG=stage-5c6a21e
+TAG=stage-8fa66c9
 COOKIE_SECURE=0
 VISION_ENABLED=1
 # Desktop app WS handshake: Origin is tauri://localhost (set explicitly by

wiki/decisions/appliance-provisioning.md

@@ -462,9 +462,11 @@ before vision finishes loading). Reach the UI at **`http://<name-or-ip>/`** (Cad
 **Web-access gotchas (all fixed in the images/compose — see [[container-deployment]] "Web access"):**
 the SPA uses a RELATIVE `/api` base (works from any host; do NOT bake a domain) + a Caddy proxy gives
 the clean port-80 URL; the domain (`parksystems.msai.al`) is pointed at the booth's LAN IP via
-`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** is hardcoded to
-`localhost:3000` (CSP + endpoints) and can't reach a remote booth without code changes — a browser
-works; the desktop app is a separate workstream.
+`hosts`/DNS ON-SITE, never an image rebuild. The **Tauri desktop app** (install the `.deb` from
+`mca/public_releases`, NOT the AppImage — see [[desktop-shell-tauri]]) asks for the server address
+on first launch (`127.0.0.1:3000` on the booth itself, or any `<ip>:3000` / `<name>` via Caddy);
+nothing is baked in since v0.1.5. In-app updates need the **admin** password (polkit) — by
+decision, updates are an admin action, so plan to be at the box when bringing it online for one.
 
 ## Quick-reference: the gotchas, in order they bit us
 

wiki/decisions/desktop-shell-tauri.md

@@ -399,7 +399,8 @@ a fresh handshake every 10 s (use-live-feed's capped backoff), i.e. every connec
   it as `Authorization: Bearer` (fastify-jwt would accept it) — that puts the session token in JS,
   which HttpOnly exists to prevent; the ticket keeps it out. Verified locally with an 11-case
   handshake script: ticket/no-cookie → 101 + hello; reused/bogus/absent → 401; ticket + bad Origin
-  → 403; cookie path unchanged.
+  → 403; cookie path unchanged. **Field-verified 2026-09-04:** v0.1.6 on the park-2 booth against
+  image `stage-8fa66c9` shows **LIVE** — the first desktop build to do so.
 - **Desktop client logs had never reached `app_logs`.** `logger.ts`'s flush read the CSRF token
   from `document.cookie` (null on desktop — the same jar split as above), so every
   `POST /api/logs` from the desktop 403'd under `requireAuth`→`assertCsrf`, and the flush drops
@@ -420,3 +421,66 @@ a fresh handshake every 10 s (use-live-feed's capped backoff), i.e. every connec
   cookie-jar split *cannot* reproduce in dev mode. The pre-tag gate is now: build the bundle
   locally, run the AppImage against a local server, log in, confirm **LIVE**, do one mutation,
   and confirm a desktop-sourced row appears in the Logs viewer (`apps/desktop/README.md`).
+
+### In-app update never worked: the manifest only described the AppImage, the booths run the .deb (2026-09-04)
+
+Every self-update attempt from v0.1.0 through v0.1.6 ended the same way — prompt, download
+traffic, then nothing, and the same prompt again next launch. The version-sync (v0.1.2) and
+error-logging fixes were real but not the cause. **Root cause:** `tauri-plugin-updater` resolves
+the download target as `{os}-{arch}-{installer}` **first** (`linux-x86_64-deb` here — the
+bundler stamps `__TAURI_BUNDLE_TYPE_VAR_DEB` into the `.deb`'s binary, verified with `strings`
+on a local build), then falls back to bare `{os}-{arch}`. `release.yml`'s `latest.json` carried
+**only** `linux-x86_64`, pointing at the **AppImage**. So a `.deb` install found the update,
+downloaded the AppImage, verified its signature (which was correct — for the AppImage), then
+handed the bytes to `install_deb()`, whose first line checks `infer::archive::is_deb(bytes)` and
+returns `InvalidUpdaterFormat`. Before v0.1.6 that error never reached the server (the desktop
+log channel was itself broken — see the previous section), so it looked like a silent no-op.
+Sources: `tauri-plugin-updater-2.10.1/src/updater.rs` (`get_urls`, `install_inner`,
+`install_deb`), `tauri-utils/src/platform.rs` (`bundle_type`).
+
+- **Fix:** `latest.json` now carries one signed entry per installer — `linux-x86_64-deb`,
+  `linux-x86_64-rpm` (when built), and bare `linux-x86_64` for the AppImage — assembled by a
+  small Node script in the workflow (the `.sig` files for `.deb`/`.rpm` were already being
+  produced and uploaded, just never referenced).
+- **What a booth update now looks like:** prompt → download → **polkit password dialog**
+  (`pkexec dpkg -i`) → relaunch into the new version. The prompt is deliberate, not a wart: the
+  package is root-owned in `/usr/bin`, and under the [[threat-model]] the operator must not be
+  able to replace the app silently; whoever brings the box online for an update is the admin.
+  Cancelling the dialog leaves the old version running and logs
+  `desktop_update_install_failed` to `app_logs`.
+- **Rejected:** switching booths to the AppImage so updates need no privilege. It would work
+  (the updater rewrites the AppImage in place), but the binary would then be operator-writable,
+  it needs FUSE on the appliance image, and launcher/autostart integration becomes manual —
+  three regressions to avoid one password prompt.
+- **Judgment note for the retrospective:** three fixes were shipped against this symptom
+  without reading the updater's install path once. The whole chain is ~60 lines of vendored
+  Rust in `~/.cargo/registry`; it names the exact failure (`InvalidUpdaterFormat`).
+
+### Decision: desktop updates are an admin-only action — the polkit prompt stays (2026-09-04)
+
+Settled with the user after the first successful self-update (v0.1.6 → v0.1.7 on the park-2
+booth, `pkexec dpkg -i`, polkit dialog, relaunch, badge shows 0.1.7). The prompt asks for an
+**admin** password the operator does not have — and that is now the intended gate, not a defect.
+
+- **AppImage was tried and rejected on evidence, not theory.** The v0.1.6 AppImage fails to
+  start on the Ubuntu 26.04 booth: `libgvfscommon.so: undefined symbol:
+  g_variant_builder_init_static` (the host's newer gvfs modules loading into the *bundled* older
+  glib) followed by `Could not create default EGL display: EGL_BAD_PARAMETER. Aborting...` (the
+  bundled WebKitGTK vs. the host's Mesa). Tauri's AppImage freezes the CI runner's (24.04)
+  GTK/WebKitGTK/glib into the bundle, which throws away the one property this platform decision
+  rests on — the **distro-maintained, Canonical-patched WebKitGTK** — and replaces it with a
+  host-mismatch hazard at every OS update. `WEBKIT_DISABLE_DMABUF_RENDERER=1` /
+  `WEBKIT_DISABLE_COMPOSITING_MODE=1` may paper over the EGL abort; they don't fix the shape.
+  **The `.deb` is the right artifact; only its install step needs root.**
+- **Passwordless polkit/sudoers for `dpkg -i` rejected:** any rule that lets the operator
+  account pass that prompt silently lets them run `pkexec dpkg -i <anything>` — root — which the
+  [[threat-model]] forbids outright.
+- **Deferred, not rejected — the fleet-grade answer:** a root systemd timer shipped inside the
+  `.deb` (via Tauri's deb `files` + postinstall) that fetches `latest.json` from
+  `public_releases`, verifies the `.deb` with `minisign` against the same embedded pubkey, and
+  `dpkg -i`s it when the box is online; the in-app updater then only *notifies*. No prompt, no
+  privileged code in the shell, standard appliance practice. Revisit when more than one booth
+  needs keeping current, or when someone other than the admin has to bring a box online.
+- **Operator-facing consequence:** the in-app prompt now says the install needs the
+  administrator password (i18n `update.prompt`, en + sq). An operator who accepts and can't
+  authenticate simply stays on the current version; nothing breaks, and the failure is logged.

wiki/decisions/standing-decisions.md

@@ -24,7 +24,10 @@ The decisions treated as settled in the design notes. (See [[parking-system-arch
   (chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a
   deny-by-default native surface that fits [[threat-model|the booth-operator threat model]]. The
   shell stays **thin**: all privileged logic remains in [[fastify]]. One open dependency — the
-  appliance's WebKitGTK version (see [[open-questions]] #11).
+  appliance's WebKitGTK version (see [[open-questions]] #11). Ships as a **`.deb`** (the AppImage
+  bundles a runner's WebKitGTK and fails on the 26.04 booth — 2026-09-04); its backend address is
+  **operator-entered at runtime**, not baked in; and **in-app updates are an admin-only action**
+  behind the polkit password prompt (user, 2026-09-04) — never make that prompt passwordless.
 - **Integrity:** append-only, hash-chained, **software-signed** event log
   ([[append-only-event-chain]]) — hardware-backed signing (a non-extractable key in the
   **[[tpm|TPM]]** or a **USB HSM**; the [[atecc608]] is [[open-questions|upcoming, not present]]) is

wiki/log.md

@@ -2860,3 +2860,28 @@ uses the unauthenticated /health (extended with app: "parking-system") instead o
 plugin does set Origin itself, the http-scope "quirk" is URLPattern default-port semantics) and
 added a local-AppImage pre-tag gate to the desktop README, since tauri dev cannot reproduce any
 of these origin-dependent bugs. Full detail on [[desktop-shell-tauri]].
+
+## [2026-09-04] fix | Desktop in-app update never worked: latest.json described only the AppImage, booths run the .deb
+
+tauri-plugin-updater looks up `{os}-{arch}-{installer}` first (linux-x86_64-deb — the bundler
+stamps the installer type into the binary; verified with strings on a local .deb) and only then
+bare linux-x86_64. release.yml's latest.json carried only the bare key → the AppImage, so every
+.deb install downloaded the AppImage, passed signature verification, then failed install_deb()'s
+is_deb check with InvalidUpdaterFormat — invisible until v0.1.6 fixed the desktop log channel.
+This, not version drift or swallowed errors, is why v0.1.0→…→v0.1.6 never self-updated.
+latest.json now has one signed entry per installer (deb, rpm, AppImage); a .deb update ends in a
+polkit password prompt (pkexec dpkg -i), which is the intended admin gate on a root-installed
+package. README + [[desktop-shell-tauri]] updated. First real test: tag v0.1.7 and accept the
+prompt on the v0.1.6 booth.
+
+## [2026-09-04] decision | Desktop updates are admin-only: keep the polkit prompt; AppImage rejected on field evidence
+
+First successful desktop self-update (v0.1.6 → v0.1.7, pkexec dpkg -i + polkit dialog) raised
+the question of the admin password the operator lacks. Tried the AppImage as the no-root path:
+it fails to start on the Ubuntu 26.04 booth (bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa —
+EGL_BAD_PARAMETER abort), and structurally it abandons the distro-maintained WebKitGTK the
+platform decision depends on. Passwordless polkit for dpkg is root-for-the-operator, rejected.
+Decision (user, 2026-09-04): the .deb stays, updates are an admin action behind the prompt; the
+in-app prompt now says so (en + sq). A root systemd updater timer shipped in the .deb (minisign-
+verified, notify-only in-app) is recorded as the deferred fleet-grade option on
+[[desktop-shell-tauri]].