diff --git a/.planning/todos/pending/2026-08-06-open-operational-tasks.md b/.planning/todos/pending/2026-08-06-open-operational-tasks.md
index c75bd8d6..22858200 100644
--- a/.planning/todos/pending/2026-08-06-open-operational-tasks.md
+++ b/.planning/todos/pending/2026-08-06-open-operational-tasks.md
@@ -35,7 +35,20 @@ request (protocol unverified, zero allowance), E-09 naive-user comprehension stu
   operator ("never works ever, breaks all the websites historically"). Remaining: TLS on app
   ports (gate or an nginx TLS front) vs. enforcing one dashboard scheme per node. Needs a
   decision before code.
-- **App health UX** — a container that is up but not yet answering its probe renders as
+- **Gated-app iframe login — DECIDED 2026-08-06: per-node CA.** Root cause corrected: the
+  node's cert was a bare self-signed leaf, so trust is per-ORIGIN (scheme+host+**port**) and
+  a cert interstitial **cannot be accepted inside an iframe** — an embedded app over HTTPS
+  could never render. Mixed content blocks the HTTP variant before the SameSite cookie
+  question even arises. **Shipped `aab74127`**: `scripts/setup-node-ca.sh`, `/ca.crt` on both
+  nginx schemes, Settings → System install flow. Proven locally (two ports, one CA,
+  `ssl_verify_result=0`; rejected without it). **STILL OPEN:** app ports serve plain HTTP —
+  putting the CA-signed leaf on them is what actually closes the bug. UX polish deferred by
+  the operator ("we'll decide on the actual UX later").
+- **App health UX — FIXED `c65ee03a`** (needs deploy to be real). A container that is up but
+  not answering its probe now reads "<App> is starting…" with its own pulsing icon while the
+  6×10s auto-retries are in flight; the hard failure copy returns once they are exhausted.
+  6 regression tests. Original entry kept below for the record.
+- **App health UX (original)** — a container that is up but not yet answering its probe renders as
   **"Unreachable"** instead of **"Starting…"**. Hit today by both LND and bitcoind (`-28`
   warm-up). Fix the status mapping with a grace window.
 - **.228 mempool** — NOT down (API serves live data; ElectrumX is rebuilding its index from