docs(13): defer dev3 console-noise triage — embedded web-search/rss, wiki demo spam, content timeout pairing

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/deferred-items.md

@@ -74,3 +74,30 @@ Out-of-scope discoveries found while executing this phase. Logged, not fixed.
   discoveries are logged, not fixed.
 - Suggested fix: add `'opus'` to `AUDIO_EXTS` in `useFileType.ts` (one line, matches this same
   extension's already-correct treatment in `classifyByMime`/`ShareModal.vue`/`content.rs`).
+
+## Deferred from dev3 console triage (2026-08-06, during 13-14 test prep)
+
+Operator console dump from the embedded AIUI on archy-x250-dev3 surfaced four classes of noise;
+the fatal one (egress false-positive) is being fixed in-line, these three are deferred:
+
+1. **AIUI web-search calls a nonexistent endpoint in embedded mode** — `/api/web-search?...`
+   has no node-side handler; nginx SPA-fallback serves index.html and AIUI logs
+   `SyntaxError: Unexpected token '<', "<!doctype "` per attempt (same for `[AIUI rss]`).
+   Embedded mode should not offer/attempt web-search+rss against the node origin, or the node
+   should answer a clean JSON 404. Fix belongs in aiui/ embedded-mode gating (useArchy
+   isEmbedded), not nginx.
+2. **Wikipedia enrichment spam from demo/seed content** — AIUI's built-in demo datasets
+   (restaurants/films: "Franklin Barbecue", "Jiro Sushi", "Blade Runner 2049"…) fire dozens of
+   live `en.wikipedia.org/api/rest_v1/page/summary/*` lookups that 404. In embedded mode this
+   is junk traffic from the operator's browser and against the phase's local-first posture.
+   Demo-content enrichment should be disabled when embedded (or demo content suppressed
+   entirely on nodes).
+3. **`content fetch failed: Content request timed out: all`** while the same session already
+   received explicit `not permitted` pushes for content+library — suggests a second in-flight
+   `content:request` whose one-shot response listener was already consumed, so the denial never
+   resolves that promise and it rides the 10s timeout. Broker/bridge pairing bug, cosmetic but
+   confusing; look at pendingRequests keying in archyBridge + announced-dedupe in contextBroker.
+
+Note (not a bug): `content: not permitted — enable Media/File access` is the D-16 gate working
+as designed — media/files categories are browser-side disabled by default. Enabling Media+Files
+in Archy Settings both silences it and populates the grids (needed for 13-15's content checks).