diff --git a/.planning/RESUME-2026-08-06-media-loop.md b/.planning/RESUME-2026-08-06-media-loop.md
new file mode 100644
index 00000000..010719dd
--- /dev/null
+++ b/.planning/RESUME-2026-08-06-media-loop.md
@@ -0,0 +1,89 @@
+# RESUME — 2026-08-06 night. Fix → deploy → test → fix, in a loop.
+
+Start here. Read this, then `.planning/MEDIA-AND-INDEEHUB-SCOPE.md` (the evidence), then
+`.planning/todos/pending/2026-08-06-open-operational-tasks.md` (everything else open).
+
+Branch `gsd/phase-13-...` @ `5f343f5e`+, merged with `main`. Working tree clean, pushed.
+
+## The loop the operator asked for
+
+For each item below, in order:
+
+1. Fix on the phase branch. Small, focused commit.
+2. Build: `cd core && CARGO_INCREMENTAL=0 cargo build --release -p archipelago` (~7-8 min)
+   and/or `cd neode-ui && npm run build`, `bash scripts/build-aiui.sh`.
+3. Deploy to archi-dev-box (it IS this box — hostname `archi-dev-box`, also `archi-thinkpad`,
+   LAN `192.168.63.240`, Tailscale `100.69.68.39`):
+   - frontend: `sudo rsync -a --exclude 'aiui/' --exclude 'archipelago-runtime/' web/dist/neode-ui/ /opt/archipelago/web-ui/`
+   - AIUI: `sudo rsync -a --delete aiui/packages/app/dist/ /opt/archipelago/web-ui/aiui/`
+   - binary: `sudo cp -f /usr/local/bin/archipelago /opt/archipelago/rollback/archipelago.bak && sudo install -m 755 core/target/release/archipelago /usr/local/bin/archipelago && sudo systemctl restart archipelago`
+4. **Test live with curl before asking the operator to look.** Restarting the daemon does
+   NOT kill containers — verified: they live in `/user.slice`, the service cgroup holds 3 PIDs.
+5. Verify the built bundle actually contains the change (`grep` the dist) — builds no-op silently.
+6. Commit, push (`git push gitea-ai HEAD`), then loop.
+
+**Do not report a fix as done without a live check on the node.** Two bugs tonight only
+appeared on deployment: nginx edits went into the ISO template not the running config
+(`/etc/nginx/sites-enabled/archipelago`), and the TLS key was root-only while the daemon runs
+as `archipelago`.
+
+## Ordered work list
+
+### 1. Gate vs app-owned auth (fleet-wide) — HALF DONE
+Done + deployed + verified: credential-less allowlist, `manifest.json` 401→200, root and
+`/api/auth/*` still 401 (`is_credentialless_public_path`, exact match only, 2 tests).
+**Remaining:** the app's own `/api/auth/*` is still intercepted, so IndeeHub cannot establish
+its Nostr session. Needs a session-aware rule: once a VALID gate session exists, proxy the
+app's auth endpoints through instead of challenging. Security-critical — justify in code.
+
+### 2. AI Data Access grants → node-side (unblocks everything AI)
+`aiPermissions.ts` uses `localStorage` (`archipelago-ai-permissions`), which is PER-ORIGIN.
+A node has many origins, so grants vanish when you switch address/device. Move behind an RPC,
+localStorage as offline fallback, migrate existing local grants. This is what made a films
+search look broken.
+
+### 3. Content-card parser (the "idiotic responses")
+`updatePanelFromText` in `useContentPanel.ts` pairs title *n* with description *n-1* and
+promotes section headers ("Documentaries:") to titles. The model's prose was CORRECT.
+Fix the pairing + exclude headers; the real answer is structured model output, not regex.
+
+### 4. IndeeHub (needs 1 and 2 first)
+- Content source: films are `projects`, `GET /api/projects` via its nginx on :7778.
+  Public count on this node is **0**. Port 4000 is not host-mapped. `/graphql` is the SPA.
+- Private films need a **Nostr session** (`/api/projects/private` says Cognito is disabled).
+- `/relay` is 502 **direct on loopback** — IndeeHub's own nginx can't reach its relay
+  container. Independent of the gate. Fix separately.
+
+### 5. Node-side Nostr signer — the highest-leverage piece
+Collapses IndeeHub's private auth, the app-auth half of item 1, and Phase C's zaps into one
+design, with keys out of the browser and the model (the phase's non-negotiable). Precedent:
+`nostr-provider.js` already built for BotFights. **Research from AIUI's seed/history and the
+Nostr-first ethos before designing** — operator instruction.
+
+### 6. Operator's late asks
+Cmd/Ctrl+K → "search with AIUI" must open the EXPANDED chat with the query actually sent and
+answered. More mock content types. Performance across the content path. Audit all ten
+`AIContextCategory` values in `fetchAndSanitize` for real coverage, not stubs.
+
+### 7. Loose ends observed
+`/api/app-catalog` → 502 repeatedly · AIUI web search blocked by CSP (confirms 13-09: the
+web-search setting must drive the CSP node-side) · `Failed to scroll to index N` in
+ChatWindow · `strfry.png`/`.svg` 404.
+
+## Phase 13 GSD state
+
+14/15 plans done. **13-15 only** — device-close, `autonomous: false`, blocking human-verify.
+Check 4 (CSP boundary) **PASSED on-device tonight**: BLOCKED in the AIUI frame, GOT 200 from
+top. Checks 1, 2, 3 still need the operator in a browser; check 2's peer/owned half now has
+code behind it but this node has no film content.
+Resume with `/gsd-resume-work`, or `/gsd-plan-phase --research-phase 13` for the research pass.
+
+## Traps that cost time tonight — do not repeat
+
+- Verify on the NODE, not from source (nginx template vs `/etc/nginx/sites-enabled/`).
+- rustls does NOT check that a key matches its certificate — the explicit pairing check in
+  `appgate/tls.rs` is load-bearing, not redundant.
+- `build-aiui.sh` hangs after a successful build; the dist is complete — kill by PID/timeout.
+- AIUI must build with `VITE_BASE_PATH=/aiui/` or you get a black page.
+- Never `rm -rf /opt/archipelago/web-ui/*` — it destroys `aiui/`.
+- The `.planning` dirs on `main` and the phase branch diverge; merge before deploying both.
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 556be508..6d7b557b 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -5,7 +5,7 @@ milestone_name: milestone
 current_phase: 13
 current_phase_name: aiui-functional-conversational-node-control-and-content-surf
 status: executing
-stopped_at: "13-14 COMPLETE 2026-08-06 (14/15). ONLY 13-15 REMAINS (device-close, autonomous:false, blocking human-verify). archi-dev-box runs the current merged stack (binary 2d10b710-era + history replay + persona fix; neode-ui + AIUI deployed, live-chunk verified). Grants apps+system. 13-15 needs FOUR browser checks by the operator — see .planning/todos/pending/2026-08-06-open-operational-tasks.md for the exact list plus every open non-phase task and the follow-on phase proposal. Known gaps to RECORD not fix: music view (D-13 independent), Routstr live paid request, E-09 naive-user study."
+stopped_at: "2026-08-06 night. READ .planning/RESUME-2026-08-06-media-loop.md FIRST — it carries the fix→deploy→test loop, the ordered work list, and the deploy/test commands. Evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase: 14/15, ONLY 13-15 left (device-close, blocking human-verify); its CHECK 4 (CSP boundary) PASSED on-device tonight — BLOCKED in the AIUI frame, GOT 200 from top. Checks 1/2/3 still need the operator. Deployed+verified on archi-dev-box tonight: IndeeHub gate regression fixed (manifest.json 401->200, root and /api/auth/* still 401), content-grid sequence guard, owned+peer scopes, per-scope permission logging, warm-up app status, scheme-following app frames, per-node CA + Settings flow, app-port TLS alongside HTTP on one socket. NEXT, in order: (1) gate must proxy an app's own /api/auth/* once a valid session exists, (2) move AI Data Access grants node-side out of per-origin localStorage, (3) fix the content-card parser pairing title n with description n-1, (4) IndeeHub, (5) node-side Nostr signer — the highest-leverage piece."
 last_updated: "2026-08-06T18:07:49.641Z"
 last_activity: 2026-08-06
 last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run)
@@ -230,8 +230,16 @@ The 5x lifecycle gate was NOT run.
 
 ## Session Continuity
 
-Last session: 2026-08-06T18:07:49.600Z
-Stopped at: 13-14 COMPLETE 2026-08-06, next 13-15 device-close
+Last session: 2026-08-06 (resumed)
+Stopped at: Session resumed 2026-08-06 via /gsd-resume-work. Tree clean, in sync with
+gitea-ai @ 7bb09ffe. 13-14 COMPLETE (14/15), next 13-15 device-close — BLOCKED on four
+operator browser checks (list in .planning/todos/pending/2026-08-06-open-operational-tasks.md,
+which also carries the four non-phase node/infra tasks and the follow-on A/B/C proposal).
+Awaiting operator choice between: (a) run the four checks and close 13-15/the phase,
+(b) start follow-on Phase B (web-search setting derives the CSP, node-side), (c) take a
+node/infra task (app-gate iframe login decision, Starting-vs-Unreachable, .228 frontend).
+NOTE: .planning/HANDOFF.json + .planning/.continue-here.md are STALE (phase 09, 2026-08-02,
+fully reconciled) and should not be read as live resume context.
 
 Prior (13-12) stop note, retained for history: Completed 13-12-PLAN.md (D-10 untrusted-content boundary, G-B1/G-B2 cloud-egress screen, G-B3 read-only-loop rate limit + owner notices).
 `assistant::` tests incl. `approval_nonce_binds_to_exact_action` individually; dispatcher.rs