docs: resume artifact for the AIUI demo — task list, findings, traps

Persists the 17-item session task list so it can be rebuilt in a fresh session
(the task tool is session-scoped and would otherwise evaporate), with what
shipped and what each remaining item actually is.

Records the findings that change expectations rather than leaving them to be
rediscovered: the 16 federated peers are not serving content so peers_reached 0
is correct, IndeeHub's catalogue is genuinely empty, two AI permission stores
existed for the same ten categories, and tailscaled owns :443 so nginx must
bind LAN addresses explicitly or it fails EADDRINUSE and silently keeps the old
config.

STATE.md's stopped_at points at it, so /gsd-resume-work lands correctly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/RESUME-2026-08-07-aiui-demo.md

@@ -0,0 +1,98 @@
+# RESUME — 2026-08-07. AIUI demo prep + task list.
+
+**Read this first.** Then `.planning/RESUME-2026-08-06-media-loop.md` (the fix→deploy→test
+loop and deploy commands), then `.planning/MEDIA-AND-INDEEHUB-SCOPE.md` (evidence).
+
+Branch `gsd/phase-13-…` @ `55155f2d`, clean, pushed. Deployed to archi-dev-box.
+
+**Context: AIUI is being demoed soon and a clean ISO must be cut.** Prioritise #16, #15,
+#9 (the surfaces) and #17 (the ISO).
+
+---
+
+## THE TASK LIST — rebuild this in the session task tool on resume
+
+`[x]` = done, deployed AND verified on the node.
+
+- [x] **1. Unify AI Data Access toggles with assistant tool grants** — `55155f2d`
+- [ ] **2. Verify AI grants persist across refresh through the real UI path**
+- [ ] **3. Add `app_install` / `app_uninstall` tools** (behind the 13-08 confirm gate)
+- [ ] **4. `!archy` / `!ai` over mesh must action commands** with text responses
+- [x] **5. Cap `content.browse-all-peers`** — `75919a20`, then rebuilt as Cloud's fan-out
+- [ ] **6. Settings link when a request needs an ungranted permission** — a button, so the
+      user can decide to enable it, instead of silence or "I have no tool"
+- [ ] **7. App lifecycle defects** — fedimint guardian installs but doesn't work; BTCPay
+      uninstall-with-wipe reinstalls with an account still enabled; Bitcoin Knots and other
+      apps disappeared; fedimint gateway died at 88%; reconciler `chown postgres-btcpay`
+      failures (same volume-ownership family as the IndeeHub relay fix)
+- [ ] **8. LND UI + filebrowser 401s** — every `:18083/proxy/lnd/*` and
+      `/app/filebrowser/api/resources/`. Node-owned `*-ui` apps need session passthrough;
+      memory says that rides DISK manifests because the catalog refuses build-source
+- [ ] **9. AIUI must answer with content + context surfaces, not prose** — only 1 of 10
+      transcript turns used a surface
+- [ ] **10. AIUI slow background image** + console noise (files context timeout, web-search
+      CSP on every query, `strfry.png`/`.svg` 404, ChatWindow scroll failure,
+      `/api/app-catalog` 502)
+- [ ] **11. Cmd/Ctrl+K → AIUI** must carry the query into the expanded chat
+- [x] **12. Node certificate settings section** container/layout — `75919a20`
+- [ ] **13. HTTPS dynamically on EVERY address** alongside Tailscale (LAN done; must
+      re-apply as addresses change, and the bare hostname must resolve)
+- [ ] **14. Nostr signer + service worker over HTTPS** (operator: lower priority than AIUI)
+- [ ] **15. Content-surface header** — goes UNDER the container's close button, and the left
+      heading shows the LAST thing searched; should read "Loading…" until it knows
+- [ ] **16. Populate the content surface for own shared content + rich chat previews** —
+      "show me my own shared content" gave a correct prose list (photos, music, APKs, docs,
+      with sizes and sat prices) while the surface stayed EMPTY. The visuals/layouts exist
+- [ ] **17. Cut a clean ISO for the demo** — `UNBUNDLED=1 bash
+      image-recipe/build-debian-iso.sh` (the default env silently builds the wrong
+      full-bundle variant); verify the frontend INSIDE the ISO
+
+---
+
+## Shipped this session (all deployed to archi-dev-box)
+
+| What | Commit |
+|---|---|
+| Gate stopped deleting apps' `Authorization` header (broke every Nostr signer) | `d9592c72` |
+| Gate stopped 401ing credential-less PWA manifest fetches | `8e3e8e9a` |
+| AI grants node-side, then unified with the assistant's store | `762c72b4`, `55155f2d` |
+| Content cards carried the PREVIOUS item's description | `086d381c` |
+| IndeeHub relay 502 (root-owned volume vs uid-1000 user) | (session) |
+| `content_list` scope: own\|peers\|purchased\|films + 2 RPCs | (session) |
+| Progressive content load (peers no longer block the grid) | `05b459a6` |
+| Mesh view TDZ crash | `0a23c994` |
+| Peer cap, cert section, LAN HTTPS listener | `75919a20` |
+
+## Findings that change what to expect
+
+- **The 16 federated peers are NOT serving content.** FIPS is healthy (anchor connected, 3
+  authenticated peers, 4 `fips_ok` dials) but 14 dials fall back and fail, so
+  `peers_reached: 0` is CORRECT. No AIUI work makes peer films appear until the peers
+  answer. This is a fleet problem, not a UI one.
+- **IndeeHub's catalogue is empty** (`/api/projects/count` = 0). The adapter is wired and
+  returns `count: 0` honestly. Operator says there is a source called "top documentary
+  films" — find which endpoint serves it, and whether it needs the Nostr session.
+- **Two permission stores existed** for the same ten categories. That, not a persistence
+  bug, is why toggling Settings never helped the assistant.
+- **tailscaled owns `:443`** on tailnet addresses. `listen 443 default_server` binds
+  0.0.0.0, fails `EADDRINUSE`, and nginx then keeps the OLD config while the reload reports
+  success. Bind LAN addresses explicitly.
+- Testing set `media` + `files` in both grant stores on archi-dev-box.
+
+## Phase 13 GSD
+
+14/15. **13-15 only** (device-close, blocking human-verify).
+Operator verified: check 1 ✅ ("it's fine"), check 3 ✅ ("seems fine"), check 4 ✅ (CSP
+boundary, BLOCKED in frame / GOT 200 at top). **Check 2 is the holdout** — no film content
+exists on this node to display. Then write `13-UAT.md`, fill `13-VALIDATION.md`, close.
+
+## Traps — do not repeat
+
+- Verify on the NODE, not from source (nginx template vs `/etc/nginx/sites-enabled/`).
+- rustls does NOT check key/cert pairing — the check in `appgate/tls.rs` is load-bearing.
+- `build-aiui.sh` hangs AFTER succeeding; dist is complete — kill by timeout.
+- AIUI must build with `VITE_BASE_PATH=/aiui/` or you get a black page.
+- Never `rm -rf /opt/archipelago/web-ui/*` — it destroys `aiui/`.
+- Restarting `archipelago` does NOT kill containers (they live in `/user.slice`; the
+  service cgroup holds 3 PIDs) — verified, despite the older CLAUDE.md warning.
+- Release build is ~8 min. Budget for it.

.planning/STATE.md

@@ -5,7 +5,7 @@ milestone_name: milestone
 current_phase: 13
 current_phase_name: aiui-functional-conversational-node-control-and-content-surf
 status: executing
-stopped_at: "2026-08-07 resume. READ .planning/RESUME-2026-08-06-media-loop.md FIRST (loop protocol + deploy/test commands); evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase 14/15 — ONLY 13-15 left (device-close, blocking human-verify); CHECK 4 (CSP boundary) PASSED on-device. Checks 1/2/3 still need the operator. ITEM 1 (gate vs app-owned auth) is now DONE+PROVEN: round 2 (d9592c72) found the real cause — the gate DELETED the app's own Authorization header on every proxied request, so no Nostr signer anywhere could work (extension, iframe bridge, or AIUI); end-to-end proof aeb40b93 shows a node-signed NIP-98 event through the gate yielding a real IndeeHub JWT and /api/projects/private 200. IndeeHub relay 502 also fixed (root-owned volume vs uid-1000 container user) — same ownership-bug family still open for btcpay-server. NEXT, in order: (2) move AI Data Access grants node-side out of per-origin localStorage, (3) content-card parser pairs title n with description n-1, (4) IndeeHub content source, (5) node-side Nostr signer, (6) AIUI answers in prose where the content/context surfaces should carry it — only 1 of 10 transcript turns used a surface."
+stopped_at: "2026-08-07. READ .planning/RESUME-2026-08-07-aiui-demo.md FIRST — it carries the 17-item task list to rebuild in the session task tool, what shipped, and the findings. AIUI IS BEING DEMOED SOON + a clean ISO must be cut: prioritise #16 (surface stays empty while chat prints correct prose), #15 (surface header overlaps the close button; left heading shows the LAST search, should say Loading), #9 (surfaces not prose), #17 (ISO, UNBUNDLED=1 or it silently builds the wrong variant). DONE+DEPLOYED: gate no longer deletes apps Authorization header (broke every Nostr signer), gate no longer 401s credential-less PWA manifests, AI grants unified into ONE store (two existed for the same ten categories — that, not persistence, is why toggling Settings never helped the assistant), content-card description pairing, IndeeHub relay 502, content_list scopes + 2 RPCs, progressive content load, Mesh TDZ crash, peer-browse cap rebuilt as Cloud fan-out, cert section layout, LAN HTTPS (tailscaled owns :443 so nginx must bind LAN addrs explicitly). KEY FINDING: the 16 federated peers are NOT serving content — FIPS is healthy but 14 dials fail, so peers_reached 0 is CORRECT and no UI work fixes it; IndeeHub catalogue is genuinely empty. Phase 13: 14/15, only 13-15 left; operator verified checks 1, 3 and 4 — check 2 is the holdout because no film content exists here."
 last_updated: "2026-08-07T00:00:00.000Z"
 last_activity: 2026-08-06
 last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run)