docs(windows): record the live bitcoin-ui RPC exposure as window 14

Verified live on archi-dev-box, code fix committed in f6b5245b but not
deployed. Deliberately logged as open rather than fixed: the defect that
matters to an operator is the running node, not the source tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/WINDOWS.md

@@ -1,10 +1,10 @@
 ---
 schema_version: 1
-open_count: 12
+open_count: 13
 waived_count: 0
 fixed_count: 1
-total_count: 13
-last_updated: 2026-08-02T19:07:40.522Z
+total_count: 14
+last_updated: 2026-08-02T22:44:15.215Z
 ---
 
 # Broken Windows Ledger
@@ -28,6 +28,7 @@ last_updated: 2026-08-02T19:07:40.522Z
 | 11 | 10 | unrun-verify | docs/security/KEY-02-FLEET-ROTATION.md |  | C-3 FAILED: archipelago-1, archy-x250-beta and archipelago share all three SSH host keys; the first two also share their TLS private key. Not rotated — needs an operator-driven --apply --yes per node. | open |  | 2026-08-02T19:07:39.861Z |  |
 | 12 | 10 | unrun-verify | scripts/security/host-secrets-audit.sh |  | Rotation never exercised on real hardware: that 'systemctl reload ssh' keeps the operator's own forked session alive is proven only by design, not by observation. Needs --apply --yes on one disposable node from a session the operator is willing to lose. | open |  | 2026-08-02T19:07:40.217Z |  |
 | 13 | 10 | unrun-verify | core/archipelago/src/api/rpc/system/handlers.rs |  | system.stats host_secrets never observed on a real node — proven against the file contract in unit tests only. Needs a build carrying 10-04 deployed to the dev pair, then a system.stats call. | open |  | 2026-08-02T19:07:40.522Z |  |
+| 14 | 10 | unrun-verify | core/archipelago/src/container/prod_orchestrator.rs |  | LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched. | open |  | 2026-08-02T22:44:15.215Z |  |
 
 ````json
 [
@@ -186,6 +187,18 @@ last_updated: 2026-08-02T19:07:40.522Z
     "reason": "",
     "recorded_at": "2026-08-02T19:07:40.522Z",
     "resolved_at": null
+  },
+  {
+    "id": 14,
+    "kind": "unrun-verify",
+    "phase": "10",
+    "file": "core/archipelago/src/container/prod_orchestrator.rs",
+    "line": null,
+    "description": "LIVE EXPOSURE on archi-dev-box: archy-bitcoin-ui (systemd/Quadlet-owned, user-uninstalled marker set) still serves unauthenticated POST /bitcoin-rpc/ on 0.0.0.0:8334 with Access-Control-Allow-Origin *, reaching Bitcoin Core RPC through a credential-injecting proxy. Verified live 2026-08-02 (returned a real block height with no cookies). Code fix committed f6b5245b but NOT deployed: closing it needs the new binary on the node plus an archy-bitcoin-ui restart. archy-electrs-ui is in the same uninstalled-but-running state (static UI only, no credential proxy). Operator-gated; no node touched.",
+    "status": "open",
+    "reason": "",
+    "recorded_at": "2026-08-02T22:44:15.215Z",
+    "resolved_at": null
   }
 ]
 ````