diff --git a/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md b/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md
index 93efdff3..3b868415 100644
--- a/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md
+++ b/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md
@@ -27,6 +27,7 @@ must_haves:
     - "AIUI's own JavaScript is browser-prevented from reaching /rpc/v1 with the ambient session cookie — the sandbox is an enforced boundary, not only a code-discipline convention (AIUI-04, RESEARCH Open Question 2)"
     - "AIUI keeps its standalone mode and its own fast dev loop — none of this requires a node to work on the UI (D-17)"
     - "A same-host deploy whose resolved source and destination differ is refused before rsync --delete can run, whether the mismatch is containment or sibling directories — the 2026-07-31 data-loss guard now covers the shape it originally missed"
+    - "`/aiui/api/openrouter/` returns an explicit 404, not the SPA catch-all's 200/405. Carried over from 13-02's Task 3 checkpoint (operator-accepted deviation 2026-08-03): the relay is already structurally gone — no `proxy_pass` reaches openrouter.ai and the live config mentions it only in comments — but the path still answers 200 because `location / { try_files ... /index.html; }` serves the SPA shell for any unmatched GET. Verified by a made-up path returning byte-identical HTML. Add the explicit `return 404` here rather than bolting it onto 13-02 after the fact."
     - "NO script sources AIUI from `$PROJECT_DIR/../AIUI` any more. `grep -rn '\\.\\./AIUI' scripts/*.sh` must return nothing but comments explaining the retirement. Affected: `dev-start.sh`, `deploy-tailscale.sh`, `deploy-to-target.sh` (two sections — primary AND the `--both`/secondary path), `setup-aiui-server.sh`. HISTORY, so the urgency is not misread: when this was written the orphaned pre-migration clone still sat at /home/archipelago/Projects/AIUI WITH a built `packages/app/dist`, so those scripts copied stale bytes and reported success — silent staleness. The operator deleted that clone on 2026-08-03 after the subtree import was proven byte-identical (tree 5ac3173a on both sides), which downgrades this from silent-wrong to loud-broken: the paths now simply do not resolve. Still must be fixed — a deploy script that dies on a missing directory is not a shipping story — but it can no longer ship the wrong bytes."
   artifacts:
     - path: "scripts/build-aiui.sh"