docs: resume artifact for the AIUI demo — task list, findings, traps

Persists the 17-item session task list so it can be rebuilt in a fresh session
(the task tool is session-scoped and would otherwise evaporate), with what
shipped and what each remaining item actually is.

Records the findings that change expectations rather than leaving them to be
rediscovered: the 16 federated peers are not serving content so peers_reached 0
is correct, IndeeHub's catalogue is genuinely empty, two AI permission stores
existed for the same ten categories, and tailscaled owns :443 so nginx must
bind LAN addresses explicitly or it fails EADDRINUSE and silently keeps the old
config.

STATE.md's stopped_at points at it, so /gsd-resume-work lands correctly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/STATE.md

@@ -5,7 +5,7 @@ milestone_name: milestone
 current_phase: 13
 current_phase_name: aiui-functional-conversational-node-control-and-content-surf
 status: executing
-stopped_at: "2026-08-07 resume. READ .planning/RESUME-2026-08-06-media-loop.md FIRST (loop protocol + deploy/test commands); evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase 14/15 — ONLY 13-15 left (device-close, blocking human-verify); CHECK 4 (CSP boundary) PASSED on-device. Checks 1/2/3 still need the operator. ITEM 1 (gate vs app-owned auth) is now DONE+PROVEN: round 2 (d9592c72) found the real cause — the gate DELETED the app's own Authorization header on every proxied request, so no Nostr signer anywhere could work (extension, iframe bridge, or AIUI); end-to-end proof aeb40b93 shows a node-signed NIP-98 event through the gate yielding a real IndeeHub JWT and /api/projects/private 200. IndeeHub relay 502 also fixed (root-owned volume vs uid-1000 container user) — same ownership-bug family still open for btcpay-server. NEXT, in order: (2) move AI Data Access grants node-side out of per-origin localStorage, (3) content-card parser pairs title n with description n-1, (4) IndeeHub content source, (5) node-side Nostr signer, (6) AIUI answers in prose where the content/context surfaces should carry it — only 1 of 10 transcript turns used a surface."
+stopped_at: "2026-08-07. READ .planning/RESUME-2026-08-07-aiui-demo.md FIRST — it carries the 17-item task list to rebuild in the session task tool, what shipped, and the findings. AIUI IS BEING DEMOED SOON + a clean ISO must be cut: prioritise #16 (surface stays empty while chat prints correct prose), #15 (surface header overlaps the close button; left heading shows the LAST search, should say Loading), #9 (surfaces not prose), #17 (ISO, UNBUNDLED=1 or it silently builds the wrong variant). DONE+DEPLOYED: gate no longer deletes apps Authorization header (broke every Nostr signer), gate no longer 401s credential-less PWA manifests, AI grants unified into ONE store (two existed for the same ten categories — that, not persistence, is why toggling Settings never helped the assistant), content-card description pairing, IndeeHub relay 502, content_list scopes + 2 RPCs, progressive content load, Mesh TDZ crash, peer-browse cap rebuilt as Cloud fan-out, cert section layout, LAN HTTPS (tailscaled owns :443 so nginx must bind LAN addrs explicitly). KEY FINDING: the 16 federated peers are NOT serving content — FIPS is healthy but 14 dials fail, so peers_reached 0 is CORRECT and no UI work fixes it; IndeeHub catalogue is genuinely empty. Phase 13: 14/15, only 13-15 left; operator verified checks 1, 3 and 4 — check 2 is the holdout because no film content exists here."
 last_updated: "2026-08-07T00:00:00.000Z"
 last_activity: 2026-08-06
 last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run)