diff --git a/.planning/RESUME-2026-08-07-late.md b/.planning/RESUME-2026-08-07-late.md
new file mode 100644
index 00000000..03b274ab
--- /dev/null
+++ b/.planning/RESUME-2026-08-07-late.md
@@ -0,0 +1,77 @@
+# RESUME — 2026-08-07 (session 2 close, late night). Full-day state.
+
+**Read first on any resume.** Branch `gsd/phase-13-…` — everything below is
+committed AND pushed to gitea-ai. Deployed to archi-dev-box: binary build9
+(/usr/local/bin/archipelago), neode-ui + AIUI in /opt/archipelago/web-ui.
+
+## Shipped + verified live today (26 commits)
+
+Highlights, all pushed: owner-never-pays (c25fd8b6), recommendation previews
+(1ac08a3e + 7d57e2c3), node-first playback (c2e71bc7), permission banner
+deterministic (6815a7d1 + anchor eaf0f073), app_install/app_uninstall behind
+confirm gate (7686a486), S6 replay fix, mesh !ai on the shared tool loop
+(4361a5cb), mock-free prod bundle + build gate (8329b826 + 3cd210f2), honest
+metadata (31fd789b), strfry icon fallback (2787a9bb), web-search 401 + fleet
+self-heal (482c4e30), ISO builder newest-AIUI + IPv4 + wgetrc fixes
+(e669a3e4 + a2254648 + 34085e30), phase-13 close-out (494400df), chown loop
+killed (b9e64eb6), btcpay full-stack wipe (7c7cd76c).
+
+## ISO
+
+`image-recipe/results/archipelago-installer-1.7.125-alpha-unbundled-x86_64_RC3.iso`
+(2.5G) — BUILT + VERIFIED INSIDE (fresh neode-ui `DFmKTA_D`, clean AIUI
+`DKWp4MFh` + webp backdrop, binary has install tools). NOTE: RC3 predates the
+chown-loop and btcpay-wipe fixes (b9e64eb6/7c7cd76c) — **recut if the demo
+needs those** (the fixes are deploy-level, not first-boot-visible).
+
+## Test state at close
+
+- Rust assistant suite: **130/130**. Container suite: **206/206**. Package suite: 53/53.
+- neode-ui suites green (adapter 37, broker 25, toolConfirm, audioPlayer 11, appsConfig 13).
+- AIUI: 353/356 — the 3 failures are the documented pre-existing seed-fixture ones (W1.7).
+
+## #7 status (app lifecycle family)
+
+- **chown loop: FIXED + live-verified** (0 chowns/4min, apps healthy, reconciler active).
+  Root cause: pre-start hooks for btcpay/fedimint/fmcd chowned unconditionally on every
+  prepare; prepare re-runs every reconcile touch. Now drift-gated via root stat probe.
+- **btcpay wipe: FIXED** (postgres-btcpay + nbxplorer included). Full wipe/reinstall
+  cycle verification is owed (needs a throwaway btcpay install — don't do it on .228).
+- **Open, need failing-node evidence:** fedimint guardian installs-but-doesn't-work,
+  fedimint gateway dying at 88%, Knots "disappearing again". On archi-dev-box right
+  now: bitcoin-knots Up+healthy, fedimint-clientd Up, archy-fedimint-ui Up — no
+  guardian installed here. `/var/lib/archipelago/fedimint.broken-20260423` is an old
+  remnant. Reproduce on archi-dev-box by installing fedimint guardian via RPC and
+  watching (its install pulls big images; do it when the box is idle).
+
+## Open next (operator-visible priority order)
+
+7c (fedimint/knots evidence) → 8 (LND UI/filebrowser 401s — *-ui session passthrough
+via disk manifests) → 4 live-radio smoke → 10 console noise → 9 surfaces decision →
+W1.6 (node-side web-search tool + enrichment) → W2.1 (Routstr funding UX).
+
+## Traps learned today (do not repeat)
+
+- **Never run the ISO build in parallel with cargo builds** — debootstrap downloads
+  died under load until the IPv4 pin (a2254648). And `pkill -f build-debian-iso`
+  self-matches your own shell — use `[b]uild` bracket patterns.
+- **The ISO bakes the DEPLOYED binary** (/usr/local/bin/archipelago) — deploy first,
+  then recut. Verify the frontend INSIDE the ISO by mounting + diffing bundle hashes.
+- **shell quoting:** backticks in a double-quoted `git commit -m` get
+  command-substituted ("stat" was eaten once) — use single-quoted heredoc or avoid
+  backticks in commit messages.
+- **Detach heavy builds with `setsid nohup ... < /dev/null`** — a shell timeout kill
+  otherwise takes the build down with it (lost build #190 to exactly that).
+- **`/home/archipelago/archy` is a SYMLINK on this box** — the daemon's nginx
+  self-heal skips it by design (dev-laptop guard). Hand-patch this node and let the
+  fleet self-heal.
+- The string-replacement edit tools (Edit) match EXACTLY including indentation —
+  a partial oldString leaves orphaned tails (brace errors); re-read after editing.
+
+## Verification drivers (uncommitted, in neode-ui/, all use https://192.168.63.240, pw ThisIsWeb54321@)
+
+`verify-owner.tmp.mjs` (own locked counts) · `verify-reco.tmp.mjs` (recommendation
+turn) · `verify-banner.tmp.mjs` (permission banner, incl. grants revoke/restore) ·
+`verify-cmdk.tmp.mjs` (spotlight prefill) · `verify-grants.tmp.mjs` (grants across
+reload) · `verify-install.tmp.mjs` + `verify-install-rpc.tmp.mjs` (confirm gate) ·
+`verify-grid*.tmp.mjs` (content grid checks). Playwright runs from neode-ui/.