docs(13): 13-09 complete — nginx sync merged live, CSP boundary browser-verified

Recovered after a broken-pipe session cut off right after Task 4 finished:
the summary was fully written (Self-Check PASSED) but never committed.
Re-verified on resume before committing: /aiui/-scoped CSP header live on
archi-dev-box, build/verify scripts present+executable, render screenshot
intact. STATE.md advanced: 6/15 plans done, next is 13-04.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.8.0
 milestone_name: milestone
 current_phase: 13
 current_phase_name: aiui-functional-conversational-node-control-and-content-surf
-status: paused
-stopped_at: "13-09 CHECKPOINT (Task 4, gate=blocking) 2026-08-04 ~04:24. Continuation executor ground-truthed the 30b2e02f WIP build-aiui.sh checkpoint: it was actually COMPLETE and CORRECT (not truncated despite its commit message's caution) — verified via bash -n, executable bit, wrong-VITE_BASE_PATH rejection, and a real end-to-end build producing a correctly-based dist with commit-attributed BUILD-INFO. Finished the plan's remaining tasks: Task 2 (deploy-to-target.sh + setup-aiui-server.sh retargeted to in-repo aiui/, 073bf6f3), Task 3 (assert_safe_same_host_deploy widened guard + regression test incl. the exact archy-phase13-vs-archy sibling pin, c3bffbd5), and scripts/verify-aiui-deploy.sh (sw.js-resolved live-chunk fetch check, 3756ebff). Task 1 (CSP, 6ac0ebbf) was already correct from the pre-reboot executor. Discovered this machine IS archi-dev-box (local nginx+backend) — ran the real build+deploy+verify-aiui-deploy.sh cycle against it live: positive marker match + negative-control failure both confirmed on the real node. BLOCKED at Task 4's remaining human/browser steps: the live node's deployed nginx config is stale (predates even 13-02's proxy removal) so the new /aiui/-scoped CSP is not yet observable there — syncing the full nginx config is a bigger, security-sensitive diff than this plan's own changes and was deliberately left for human-supervised deploy rather than pushed unilaterally by the executor. RESUME: operator (or a fresh gsd-executor continuation) syncs image-recipe/configs/nginx-archipelago.conf to archi-dev-box (this machine, 127.0.0.1), reloads nginx, then does the browser-side checks in 13-09-PLAN.md Task 4 steps 5-7 (visual render, CSP-blocked RPC fetch from inside the AIUI frame vs succeeding from top-level). Everything pushed to gitea-ai. Then continue to 13-04, then waves 3+. Stale-but-harmless: p13-01/p13-02 worktrees (already merged, safe to remove), archy-aiui-migrate worktree (branch pushed, awaiting merge to main). Operator asks all landed: overlay opacity 5e3aab30, banner fix 86129d5d, keyboard triage+handover 57628a2a (companion-side doc: docs/companion-keyboard-viewport.md). Open for operator: merge chore/aiui-monorepo-migration to main before next OTA; set a Claude key on archy-x250-dev3 for chat testing; window 18 (nginx self-heal reverts /etc/nginx deploys) matters for the OTA; archi-dev-box's live nginx config is meaningfully behind this repo's image-recipe config (predates 13-02) — worth a dedicated sync pass, not just this plan's CSP addition."
+status: executing
+stopped_at: "13-09 COMPLETE 2026-08-04 (session broke on a pipe right after Task 4 finished; summary recovered+committed on resume). Task 4 resolved with operator approval: live nginx config MERGED (repo base, :443 block kept removed, /api/peer-content/ + /ext/ demo proxies preserved; rollback at /etc/nginx/archipelago.conf.bak-pre-1302-sync; sites-enabled/archipelago is a SYMLINK — back up the TARGET). Browser steps 5-7 verified via playwright Chromium on the real node: AIUI renders in the Chat iframe, fetch('/rpc/v1') CSP-BLOCKED from inside the frame but 200 from top-level (T-13-54 mitigated), embedded chat answered via the node's Claude key. CSP header re-confirmed live on resume. NEXT: execute 13-04, then waves 3+. Window 20 (NEW): repo/ISO nginx config lacks /api/peer-content/ — fresh installs silently lose peer media streaming; decide add-or-retire. Still open for operator: merge chore/aiui-monorepo-migration to main before next OTA; Claude key on archy-x250-dev3; window 18 (nginx self-heal reverting /etc/nginx deploys) at next OTA. Stale-but-harmless: p13-01/p13-02 worktrees (merged, safe to remove); stale phase-09 HANDOFF.json in .planning/ predates this and is NOT a resume source. Prior 13-09 detail preserved in git history of this file (b3b580aa)."
 last_updated: "2026-08-04T08:24:00.000Z"
 last_activity: 2026-08-04
-last_activity_desc: "13-09 continuation: Tasks 1-3 + verify-aiui-deploy.sh done and pushed; paused at Task 4's human/browser checkpoint (nginx sync needed first)"
+last_activity_desc: "13-09 COMPLETE — Task 4 nginx sync + browser verification done; summary recovered after broken-pipe and committed. Next: 13-04"
 progress:
   total_phases: 13
   completed_phases: 2
   total_plans: 60
-  completed_plans: 39
+  completed_plans: 40
   percent: 15
 ---
 
@@ -29,9 +29,9 @@ See: .planning/PROJECT.md (updated 2026-07-29)
 ## Current Position
 
 Phase: 13 (aiui-functional-conversational-node-control-and-content-surf) — EXECUTING
-Plan: 1 of 15
+Plan: 6 of 15 complete (13-01, 13-02, 13-03, 13-05, 13-06, 13-09) — next: 13-04, then waves 3+
 Status: Executing Phase 13
-Last activity: 2026-08-03 — Phase 13 execution resumed (wave continue)
+Last activity: 2026-08-04 — 13-09 complete (nginx sync + CSP browser verification on archi-dev-box)
 
 Progress: [█████░░░░░] 54%