v1.37.0

• 442b530 chore: bump version to 1.37.0
• 25b3ff2 roadmap: archive A1, A8, S4 (shipped), M3 (had shipped in 89bd9dc, never archived) and B8; S2 down to worker-thread isolation; new I13 — device discovery when adding an instance, on the core's B-2 --discover: scan runs on the target host via a new helper verb, x-discover marks the schema property to prefill (network address or stable serial by-id path), blocked until the marker lands in mqtt-interfaces-core
• 2a830bc fix: SHE_* environment variables were documented but never read — .env('SHE_') with the trailing underscore so SHELL cannot leak in, SHE_SECRETS_KEY stripped before the config object is debug-logged, and the bare defaults become typed options so SHE_DISABLE_WATCH=false is a boolean rather than a truthy string (B8); --safe-mode & co. documented, the no-broker warning names the config file actually in use
• 1cf7329 ci: docker images on ghcr.io/hobbyquaker/she — multi-arch (amd64, arm64) build and push on every release tag, semver tags + latest (A8); Dockerfile split so the web bundle builds on the native arch while runtime deps install on the target arch, HEALTHCHECK on /she/health
• ed9889f feat: safe mode — after an unclean shutdown (stale .she-running whose PID is dead) or with --safe-mode, start everything except user scripts so the offending one can be fixed in the UI (S4): red banner with restart button, config toggles, safeMode on /she/status and /she/health; a script's synchronous top-level code gets a 5 s budget (scriptTimeout, 0 disables); a live PID means a second instance sharing the data dir — no safe mode, marker left alone; integration tests get their own --data-dir so a test daemon never touches the real ~/.she
• 715abbd feat: GET /she/health — public liveness/readiness probe for Docker HEALTHCHECK, nginx upstreams and monitoring (A1): 200 while the daemon can do its job, 503 during startup or with a configured broker disconnected; version only for authenticated callers; safe mode stays 200 and is reported as a field
• 66b6abe ui: event-loop lag per instance on the Instances tab — the peak the adapter measured over its stats interval (core 0.8+), amber from 100 ms; the Adapters nav dot now signals available updates (yellow) instead of connection state