Minor fixes

lib/screens/app_stack_screen.dart

@@ -293,6 +293,15 @@ class _StackHeader extends StatelessWidget {
             ),
           ],
         ),
+        if (stack.description case final description?) ...[
+          const SizedBox(height: 12),
+          Text(
+            description,
+            style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                  color: Theme.of(context).colorScheme.onSurfaceVariant,
+                ),
+          ),
+        ],
       ],
     );
   }

lib/services/package_manager/android_package_manager.dart

@@ -751,14 +751,13 @@ final class AndroidPackageManager extends PackageManager {
         final installedPkg = packages[appId];
         final targetVc = op.target.versionCode;
         final installedVc = installedPkg?.versionCode;
-        final targetV = op.target.version;
-        final installedV = installedPkg?.version;
 
+        // Only use versionCode comparison — version string matching could
+        // give false positives when the same string maps to different builds.
         final completed =
-            (targetVc != null &&
-                installedVc != null &&
-                installedVc >= targetVc) ||
-            (installedV != null && installedV == targetV);
+            targetVc != null &&
+            installedVc != null &&
+            installedVc >= targetVc;
 
         // Only clear if we can establish completion reliably.
         // Transition to Completed (not clearOperation) so the op stays until
@@ -766,7 +765,7 @@ final class AndroidPackageManager extends PackageManager {
         if (completed) {
           debugPrint(
             '[PackageManager] Sync: completing operation for $appId '
-            '(installedVc=$installedVc, targetVc=$targetVc, installedV=$installedV, targetV=$targetV)',
+            '(installedVc=$installedVc, targetVc=$targetVc)',
           );
           // Sync fallback: state.installed was already overwritten with native
           // data above (line 723), so we must NOT call _updateInstalledPackage
@@ -778,7 +777,7 @@ final class AndroidPackageManager extends PackageManager {
         } else {
           debugPrint(
             '[PackageManager] Sync: keeping operation for $appId '
-            '(installedVc=$installedVc, targetVc=$targetVc, installedV=$installedV, targetV=$targetV)',
+            '(installedVc=$installedVc, targetVc=$targetVc)',
           );
         }
       }

lib/services/package_manager/package_manager.dart

@@ -564,7 +564,9 @@ abstract class PackageManager extends StateNotifier<PackageManagerState> {
     await _performInstall(appId, op.target, op.filePath);
   }
 
-  /// Retry install from InstallCancelled state
+  /// Retry install from InstallCancelled state.
+  /// Routes through the install queue to respect the single-active-install
+  /// constraint (Android PackageInstaller limitation).
   Future<void> retryInstall(String appId) async {
     final op = getOperation(appId);
     if (op is! InstallCancelled) return;
@@ -581,11 +583,7 @@ abstract class PackageManager extends StateNotifier<PackageManagerState> {
       return;
     }
 
-    // Exit InstallCancelled immediately so UI shows progress and native
-    // install events are no longer ignored by AndroidPackageManager.
-    setOperation(appId, Installing(target: op.target, filePath: op.filePath));
-
-    await _performInstall(appId, op.target, op.filePath);
+    _addToInstallQueue(appId, op.target, op.filePath);
   }
 
   /// Dismiss error and clean up

lib/widgets/batch_progress_banner.dart

@@ -23,8 +23,23 @@ class UpdateAllRow extends ConsumerWidget {
       child: TextButton.icon(
         onPressed: () async {
           final pm = ref.read(packageManagerProvider.notifier);
+          final pmState = ref.read(packageManagerProvider);
           final items = allUpdates
-              .where((app) => app.installable != null)
+              .where((app) {
+                final target = app.installable;
+                if (target == null) return false;
+                // Skip apps with cert mismatch — they will fail during
+                // install and waste bandwidth.
+                final installedHash =
+                    pmState.installed[app.identifier]?.signatureHash ?? '';
+                final targetHashes = target.certificateHashes;
+                if (installedHash.isNotEmpty &&
+                    targetHashes.isNotEmpty &&
+                    !targetHashes.contains(installedHash)) {
+                  return false;
+                }
+                return true;
+              })
               .map(
                 (app) => (
                   appId: app.identifier,

lib/widgets/install_alert_dialog.dart

@@ -33,7 +33,24 @@ class InstallAlertDialog extends HookConsumerWidget {
       _ => null,
     };
     if (publisher == null) {
-      return const SizedBox.shrink();
+      return const BaseDialog(
+        title: BaseDialogTitle('Trust this app?'),
+        content: BaseDialogContent(
+          children: [
+            Center(
+              child: Padding(
+                padding: EdgeInsets.symmetric(vertical: 24),
+                child: SizedBox(
+                  width: 24,
+                  height: 24,
+                  child: CircularProgressIndicator(strokeWidth: 2),
+                ),
+              ),
+            ),
+          ],
+        ),
+        actions: [],
+      );
     }
     final trustedSignerNotifier = useState(false);
     final signedInPubkey = ref.watch(Signer.activePubkeyProvider);
@@ -55,15 +72,17 @@ class InstallAlertDialog extends HookConsumerWidget {
               oneLine: false,
               size: baseTextSize,
             ),
-            Gap(10),
-            DownloadTextContainer(
-              beforeText:
-                  '${app.name ?? app.identifier} will be installed from its original release location:',
-              oneLine: false,
-              showFullUrl: true,
-              url: app.installable!.urls.first,
-              size: baseTextSize,
-            ),
+            if (app.installable?.urls.firstOrNull != null) ...[
+              Gap(10),
+              DownloadTextContainer(
+                beforeText:
+                    '${app.name ?? app.identifier} will be installed from its original release location:',
+                oneLine: false,
+                showFullUrl: true,
+                url: app.installable!.urls.first,
+                size: baseTextSize,
+              ),
+            ],
           ] else ...[
             canPersistTrust
                 ? RelevantWhoFollowContainer(app: app, size: baseTextSize)