feat(13-09): retarget AIUI build/deploy to the in-repo aiui/ tree (D-19)

Finishes the 13-09 build-aiui.sh WIP checkpoint (30b2e02f) that survived the
operator reboot ground-truthed and confirmed correct: require_base_path,
frozen-lockfile install, verify_dist's asset-href/commit-attribution checks
all verified working against a real build. Fixed one grep-forbidden leftover
(a comment mentioning the retired scripts/aiui.pin path).

Rewires both AIUI sections of deploy-to-target.sh (primary --live path and
the --both/secondary path) and setup-aiui-server.sh to build/deploy from
aiui/packages/app/dist instead of the retired ../AIUI sibling checkout:

- Primary section now calls scripts/build-aiui.sh instead of an inline
  `pnpm build`, then scripts/verify-aiui-deploy.sh after the copy. The
  demo/aiui/ fallback now prints a loud, unmissable warning naming that it
  is shipping a checked-in dist rather than a fresh build.
- Secondary/--both section retargeted to the in-repo dist path; its
  fallback-to-.228-streaming behavior is otherwise unchanged.
- setup-aiui-server.sh calls scripts/build-aiui.sh automatically when the
  dist is missing or stale, instead of printing a manual `cd ../AIUI/...`
  command and exiting (D-15: enforced, not remembered).

No remaining `../AIUI` reference in either script.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/build-aiui.sh

@@ -5,10 +5,10 @@
 # D-19 (2026-08-03): AIUI is no longer a second repository at
 # git.tx1138.com/lfg2025/AIUI. It was migrated in-repo to aiui/ via
 # `git subtree`, full history intact. There is no second checkout to clone,
-# no `scripts/aiui.pin` to read or write, and no dirty-second-tree refusal
+# no separate per-repo pin file to read or write, and no dirty-second-tree
-# to perform — this repo's own ordinary commit discipline is what keeps its
+# refusal to perform — this repo's own ordinary commit discipline is what
-# history honest now, not a second-repo-specific check. D-15's *delivery*
+# keeps its history honest now, not a second-repo-specific check. D-15's
-# half still stands and is what this script enforces:
+# *delivery* half still stands and is what this script enforces:
 #
 #   - VITE_BASE_PATH must be exactly /aiui/. A wrong value produces a BLACK
 #     PAGE when embedded — the router base breaks, not the assets (this has

scripts/deploy-to-target.sh

@@ -366,11 +366,12 @@ deploy_secondary() {
         sudo chown -R 1000:1000 /opt/archipelago/web-ui
     '
 
-    # Deploy AIUI — prefer a sibling dist on the build host, but fall back to
+    # Deploy AIUI — prefer the in-repo build (aiui/, D-19) on the build host,
-    # streaming from .228's /opt/archipelago/web-ui/aiui (where the ISO build
+    # but fall back to streaming from .228's /opt/archipelago/web-ui/aiui
-    # deposited it). Without the fallback, secondaries lose AIUI whenever the
+    # (where the ISO build deposited it). Without the fallback, secondaries
-    # deploy runs from a machine that doesn't have an ../AIUI checkout.
+    # lose AIUI whenever the deploy runs from a machine that hasn't run
-    AIUI_DIST="$PROJECT_DIR/../AIUI/packages/app/dist"
+    # scripts/build-aiui.sh yet.
+    AIUI_DIST="$PROJECT_DIR/aiui/packages/app/dist"
     if [ -d "$AIUI_DIST" ] && [ -f "$AIUI_DIST/index.html" ]; then
         echo "   Deploying AIUI to .$SEC_LABEL (from local sibling dist)..."
         ssh $SSH_OPTS "$SEC_TARGET" "sudo mkdir -p /opt/archipelago/web-ui/aiui && sudo rm -rf /opt/archipelago/web-ui/aiui/*"
@@ -706,32 +707,41 @@ if [ "$LIVE" = true ]; then
     ssh $SSH_OPTS "$TARGET_HOST" "sudo chown -R 1000:1000 /opt/archipelago/web-ui"
 
     # Build and deploy AIUI (non-fatal — never delete existing AIUI on failure)
+    # D-19 (2026-08-03): AIUI lives in-repo at aiui/ now — no second checkout
+    # to build from. scripts/build-aiui.sh is the one supported way to build
+    # it (enforces VITE_BASE_PATH, installs from the committed lockfile,
+    # attributes the build to this repo's own commit — see its own header).
     progress "Building & deploying AIUI"
-    AIUI_DIR="$PROJECT_DIR/../AIUI"
+    AIUI_DIR="$PROJECT_DIR/aiui"
     AIUI_DIST="$AIUI_DIR/packages/app/dist"
     # Auto-build AIUI if dist is missing or older than source
     if [ -d "$AIUI_DIR/packages/app/src" ] && ( [ ! -f "$AIUI_DIST/index.html" ] || [ "$(find "$AIUI_DIR/packages/app/src" -newer "$AIUI_DIST/index.html" -print -quit 2>/dev/null)" != "" ] ); then
         echo "$(timestamp)    Building AIUI (source newer than dist or dist missing)..."
-        (cd "$AIUI_DIR" && VITE_BASE_PATH=/aiui/ pnpm build 2>&1 | tail -5) || echo "$(timestamp)    ⚠️  AIUI build failed"
+        bash "$PROJECT_DIR/scripts/build-aiui.sh" || echo "$(timestamp)    ⚠️  AIUI build failed"
     fi
-    # Fallback: if the AIUI sibling checkout is missing, use the pre-built
+    # Fallback: if the in-repo aiui/ build didn't produce a dist, use the
-    # dist shipped in this repo at demo/aiui/. That path is what we ship in
+    # pre-built dist shipped in this repo at demo/aiui/. That path is what we
-    # the release tarball too, so local-and-fleet-update stay consistent.
+    # ship in the release tarball too, so local-and-fleet-update stay
+    # consistent. LOUD WARNING: this ships a checked-in dist, not a fresh
+    # build — its attribution (BUILD-INFO, if any) reflects whatever commit
+    # last regenerated demo/aiui/, not this deploy's own HEAD.
     if [ ! -f "$AIUI_DIST/index.html" ] && [ -f "$PROJECT_DIR/demo/aiui/index.html" ]; then
-        echo "$(timestamp)    AIUI sibling dist missing — using demo/aiui/ from repo"
+        echo "$(timestamp)    ⚠️⚠️  AIUI build missing/failed — falling back to the CHECKED-IN"
+        echo "$(timestamp)         demo/aiui/ dist. This is NOT a fresh build of this repo's"
+        echo "$(timestamp)         current commit — verify it is what you intend to ship."
         AIUI_DIST="$PROJECT_DIR/demo/aiui"
     fi
     if [ -d "$AIUI_DIST" ] && [ -f "$AIUI_DIST/index.html" ]; then
-        echo "$(timestamp)    Deploying AIUI..."
-        if true; then
         echo "$(timestamp)    Deploying AIUI..."
         ssh $SSH_OPTS "$TARGET_HOST" "sudo mkdir -p /opt/archipelago/web-ui/aiui"
         ssh $SSH_OPTS "$TARGET_HOST" "sudo rm -rf /opt/archipelago/web-ui/aiui/*"
         cd "$AIUI_DIST" && tar --no-xattrs -cf - . | ssh $SSH_OPTS "$TARGET_HOST" "sudo tar xf - -C /opt/archipelago/web-ui/aiui/"
         cd "$PROJECT_DIR"
         ssh $SSH_OPTS "$TARGET_HOST" "sudo chown -R 1000:1000 /opt/archipelago/web-ui/aiui && sudo chmod 755 /opt/archipelago/web-ui/aiui && sudo find /opt/archipelago/web-ui/aiui -type d -exec chmod 755 {} \;"
-        else
+        if [ -f "$PROJECT_DIR/scripts/verify-aiui-deploy.sh" ]; then
-            echo "$(timestamp)    ⚠️  AIUI build failed — keeping existing AIUI on server"
+            echo "$(timestamp)    Verifying AIUI deploy (live-fetch check)..."
+            bash "$PROJECT_DIR/scripts/verify-aiui-deploy.sh" "$TARGET_HOST" "$(git -C "$PROJECT_DIR" rev-parse HEAD)" \
+                || echo "$(timestamp)    ⚠️  AIUI post-deploy verification failed — see output above"
         fi
     else
         echo "$(timestamp)    ⚠️  AIUI not found at $AIUI_DIR, skipping"

scripts/setup-aiui-server.sh

@@ -24,8 +24,10 @@
 # script has nothing to do with the key anymore.
 #
 # Prerequisites:
-#   - AIUI must be built locally first: cd AIUI/packages/app && VITE_BASE_PATH=/aiui/ npx vite build
 #   - SSH key access to target server
+#   - AIUI is built automatically (via scripts/build-aiui.sh) when its dist
+#     is missing or stale — D-19 (2026-08-03): AIUI lives in-repo at aiui/
+#     now, so there is no second checkout to build separately first.
 
 set -e
 
@@ -41,15 +43,28 @@ if [ -z "$TARGET_HOST" ]; then
     exit 1
 fi
 
-AIUI_DIST="$PROJECT_DIR/../AIUI/packages/app/dist"
+AIUI_DIST="$PROJECT_DIR/aiui/packages/app/dist"
-if [ ! -f "$AIUI_DIST/index.html" ]; then
+AIUI_SRC="$PROJECT_DIR/aiui/packages/app/src"
-    echo "ERROR: AIUI build not found at $AIUI_DIST"
-    echo "Build it first: cd ../AIUI/packages/app && VITE_BASE_PATH=/aiui/ npx vite build"
-    exit 1
-fi
 
 timestamp() { echo "[$(date +%H:%M:%S)]"; }
 
+# D-19 (2026-08-03): AIUI lives in-repo at aiui/ — no second checkout to
+# build separately first. Build it automatically when the dist is missing
+# or stale, via the one supported build path (scripts/build-aiui.sh
+# enforces VITE_BASE_PATH, installs from the committed lockfile, and
+# attributes the build to this repo's own commit). D-15's "enforced, not
+# remembered" applies here too — a script that only prints instructions is
+# the remembered form.
+if [ ! -f "$AIUI_DIST/index.html" ] || [ "$(find "$AIUI_SRC" -newer "$AIUI_DIST/index.html" -print -quit 2>/dev/null)" != "" ]; then
+    echo "$(timestamp) AIUI dist missing or stale — building via scripts/build-aiui.sh..."
+    bash "$PROJECT_DIR/scripts/build-aiui.sh"
+fi
+
+if [ ! -f "$AIUI_DIST/index.html" ]; then
+    echo "ERROR: AIUI build not found at $AIUI_DIST after running scripts/build-aiui.sh"
+    exit 1
+fi
+
 echo "╔════════════════════════════════════════════════════════════╗"
 echo "║  Archipelago AIUI deploy                                    ║"
 echo "║  Target: $TARGET_HOST"