docs(state): record the on-node verification outcome and what stayed open

Names the four open items explicitly, including the one that is easy to
lose: the reconcile fix is deployed but unexercised, so the node's 401
proves the template and not the delivery path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/STATE.md

@@ -5,10 +5,10 @@ milestone_name: milestone
 current_phase: 09
 current_phase_name: BotFights Platform Upgrade
 status: planning
-stopped_at: Phase 10 COMPLETE (10-01..10-06); OTA prep in progress — dev-pair deploy + macaroon rotation outstanding
-last_updated: "2026-08-02T21:30:00.000Z"
+stopped_at: Phase 10 COMPLETE (10-01..10-06); security-fix verification on archi-dev-box done — found and fixed a delivery gap that would have made the OTA's Bitcoin-RPC fix a no-op on affected nodes
+last_updated: "2026-08-02T23:20:00.000Z"
 last_activity: 2026-08-02
-last_activity_desc: 10-06 KEY-05 entropy enforcement shipped; LND macaroon rotation + Tor auto-onion fix
+last_activity_desc: Verified a05956c4 on-node — LND closed, Bitcoin RPC still OPEN; root-caused to reconcile skipping Quadlet-running apps behind an uninstall marker; fixed (f6b5245b), deployed, node re-probed 401. Macaroon/credential rotation NOT actioned (user-gated).
 progress:
   total_phases: 11
   completed_phases: 1
@@ -165,6 +165,18 @@ Decisions are logged in PROJECT.md (10 locked ADRs in the `<decisions>` block +
 
 ## Session Continuity
 
-Last session: 2026-08-02T21:30:00.000Z
-Stopped at: Phase 10 complete; OTA prep — dev-pair deploy + macaroon rotation outstanding
-Resume file: .planning/phases/10-key-material-hardening/10-06-SUMMARY.md
+Last session: 2026-08-02T23:20:00.000Z
+Stopped at: Phase 10 complete; a05956c4 verified on archi-dev-box, delivery gap found + fixed + deployed
+Resume file: docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md
+
+Open on this thread (all recorded as broken windows, none blocking):
+- Window 15: f6b5245b's reconcile path is deployed but NEVER EXERCISED — an unrelated
+  bitcoin-ui rebuild cleared the stale state before the fix landed. Needs a node whose
+  bitcoin-ui conf is still stale, or a deliberately re-staled one.
+- Windows 11/12: host-secret rotation on three fleet nodes sharing SSH host keys —
+  detect-only so far; rotation is USER-GATED and deliberately not actioned.
+- LND macaroon + Bitcoin RPC password rotation: scripts/ordering understood, NOT run on
+  any node per explicit user instruction 2026-08-02. A general "rotate credentials later"
+  path is wanted and unbuilt.
+- archy-x250-dev has been offline 2 days, so every "dev pair" verification this session
+  reached one node, not two.