docs(13): fold the full-tree sweep into the open-tasks file

A resume that reads STATE.md plus this file was still missing real work:
two planning docs untracked on main since 2026-08-05, the indeedhub
crash-loop on .38/.88, nine items still OPEN in RELEASE-1.7.121-TASKS.md,
and 19 uncommitted files in the archy-mesh worktree. All now listed here
so this one file is the whole picture rather than most of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/todos/pending/2026-08-06-open-operational-tasks.md

@@ -54,3 +54,47 @@ change what is *possible* — move it node-side, derive the CSP from it, allowli
 B before C.
 
 Other captured todos in this directory: Routstr funding UX; web-search through node chat.
+
+## Found 2026-08-06 by a full-tree sweep (were NOT in this list)
+
+A resume that reads only STATE.md + this file misses all of the below. Recorded here so
+one file is genuinely the whole picture.
+
+### Was uncommitted — now fixed
+
+- `.planning/APP-PORT-AUTH-GATE.md` + `.planning/RESUME-2026-08-05-appgate-fixes.md` sat
+  **untracked on `main` since 2026-08-05**. Committed + pushed as `ab694009`. The first
+  carries the gate design; its open question #2 **is** the iframe-login fork above
+  (HTTPS dashboard + HTTP app port ⇒ a `Secure` cookie never travels).
+
+### Open, from RESUME-2026-08-05-appgate-fixes.md — not tracked anywhere else
+
+- **indeedhub crash-loop on `.38` and `.88`** — `indeedhub-minio` is absent, so nginx dies
+  on `host not found in upstream "minio"` and both `indeedhub` + `indeedhub-api` exit(1).
+  The stack member is never created. Pre-existing, NOT from the port work. Look at
+  `api/rpc/package/stacks.rs` + `dependencies.rs`.
+- **Verify `.38` refetched the signed catalog** and bitcoin-knots starts (`.88` already did).
+
+### Open, from RELEASE-1.7.121-TASKS.md
+
+Still marked OPEN/BLOCKED in that file: filebrowser insecure default login (item 2);
+federated nodes must message without a LoRa hop first (5); in-app app updates independent
+of OTA (6); multiversion for all apps + upstream release discovery (6b); `create-release.sh`
+signing order (7); dead `gitea-vps2` remote (8); fleet SSH host-key rotation (9, operator-
+gated); the 5× lifecycle gate (10); `prod_orchestrator.rs:3181` unreachable code (11).
+
+### Repo hygiene
+
+- **`archy-mesh` worktree (`mesh-multiversion-integration`) has 19 uncommitted files**,
+  including `mesh/listener/*`, `mesh/meshtastic.rs`, `Mesh.vue`, plus untracked
+  `docs/1.8.0-bug-list.md` and `neode-ui/src/api/connectivity.ts`. Unrelated to phase 13 and
+  at risk of being lost — needs a decision: commit as WIP, or discard.
+- `origin/main` is **100 behind** `gitea-ai/main`. Expected between releases (ship ritual
+  pushes origin last), not a fault — noted so it is not re-diagnosed.
+- Benign: `btcver-catalog-fix`, `p13-01`, `p13-02`, `demo-build` worktrees carry only
+  untracked `config.json` / media / an abandoned checkout.
+
+### Plan-graph gaps (pre-existing)
+
+`01-05`..`01-10` and `02-12` have PLAN.md with no SUMMARY.md. Phase 02's own close-out note
+said 02-12 was mid-gap-closure. Not touched today.