diff --git a/.planning/STATE.md b/.planning/STATE.md
index 12947321..bcf44413 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -84,6 +84,7 @@ None yet.
 | # | Description | Date | Commit | Directory |
 |---|-------------|------|--------|-----------|
 | 260729-fw7 | improve mesh message hop graphic/animation: balanced desktop sizing, vertical mobile layout, archipelago branding | 2026-07-29 | ac09fc5d | [260729-fw7-improve-mesh-message-hop-graphic-animati](./quick/260729-fw7-improve-mesh-message-hop-graphic-animati/) |
+| 260729-gjd | demo: indee.tx1138.com in app iframe (:2101 whole-origin proxy), auto nostr signer sign-in, IndeeHub pre-installed on fresh session | 2026-07-29 | d00ca624 | [260729-gjd-demo-make-indee-tx1138-com-work-in-the-a](./quick/260729-gjd-demo-make-indee-tx1138-com-work-in-the-a/) |
 
 ## Deferred Items
 
diff --git a/.planning/quick/260729-gjd-demo-make-indee-tx1138-com-work-in-the-a/260729-gjd-SUMMARY.md b/.planning/quick/260729-gjd-demo-make-indee-tx1138-com-work-in-the-a/260729-gjd-SUMMARY.md
new file mode 100644
index 00000000..15f50ae7
--- /dev/null
+++ b/.planning/quick/260729-gjd-demo-make-indee-tx1138-com-work-in-the-a/260729-gjd-SUMMARY.md
@@ -0,0 +1,107 @@
+---
+phase: quick-260729-gjd
+plan: 01
+subsystem: public-demo
+tags: [demo, indeedhub, nginx, reverse-proxy, nostr, mock-backend]
+requires: []
+provides:
+  - "IndeeHub whole-origin demo proxy on :2101 (framing headers stripped, sign-in seeded)"
+  - "Demo iframe launch of indeedhub via demoAppUrl → <host>:2101/"
+  - "IndeeHub pre-installed/running on every fresh demo session"
+affects: [demo-deploy, neode-ui demo image]
+tech-stack:
+  added: []
+  patterns:
+    - "Whole-origin per-port reverse proxy for frame-busting external SPAs (vs broken path-prefix sub_filter)"
+    - "localStorage seeding via injected classic script on the proxied origin (applesauce-accounts nsec account)"
+key-files:
+  created:
+    - neode-ui/docker/indee-demo-signin.js
+  modified:
+    - neode-ui/docker/nginx-demo.conf
+    - neode-ui/Dockerfile.web
+    - docker-compose.demo.yml
+    - demo-deploy/docker-compose.yml
+    - neode-ui/src/composables/useDemoIntro.ts
+    - neode-ui/src/views/appSession/useAppIdentity.ts
+    - neode-ui/mock-backend.js
+decisions:
+  - "Primary sign-in path used (seeded nsec account, self-signing) — NIP-07 bridge fallback NOT needed; verified against the live bundle"
+  - "Dropped `sub_filter_types text/html` (text/html is nginx's default sub_filter type; explicit listing produced a duplicate-MIME warning)"
+metrics:
+  duration: "~50 min"
+  completed: 2026-07-29
+status: complete
+---
+
+# Quick Task 260729-gjd: IndeeHub in the Demo Summary
+
+**One-liner:** Whole-origin nginx proxy of indee.tx1138.com on :2101 with an injected throwaway-nsec sign-in seeder, demo iframe launch via same-host :2101, and IndeeHub pre-installed in every fresh mock-backend session.
+
+## Commits
+
+| Task | Commit | Scope |
+|------|--------|-------|
+| 1 | 69bc3d3f | nginx :2101 whole-origin proxy + indee-demo-signin.js seeder + Dockerfile.web COPY/EXPOSE + both compose files publish 2101 |
+| 2 | 66d540f8 | useDemoIntro: DEMO_EXTERNAL_URLS → DEMO_PROXY_PORTS, demoAppUrl builds `<protocol>//<hostname>:2101/`; useAppIdentity: picker suppressed under IS_DEMO |
+| 3 | d00ca624 | mock-backend.js staticDevApps gains indeedhub (running, lanPort 8190) → installed on every fresh session |
+
+## What was verified at exec time (live-bundle facts)
+
+- Live site still serves `X-Frame-Options: SAMEORIGIN`, no CSP; bundle `assets/index-BMWtjRCn.js`.
+- Account serialization confirmed by de-minifying the live bundle: private-key account class has `static type="nsec"`, `toJSON` → `{ signer: { key: <hex sk> }, id, pubkey, metadata, type }`; the manager registers the nsec type (`MM(Fe)` registers `mr`) and restores from `indeedhub-accounts` + activates by id from `indeedhub-active-account`. `Vn`/`je` confirmed hex decode/encode.
+- Pubkey math independently validated against BIP340 test vectors (sk=1 → Gx, sk=3 → F9308A01…) before embedding the generated pair. Mismatch would trigger the bundle's "Account signer mismatch" guard, so this was load-bearing.
+
+## Throwaway demo identity
+
+Freshly generated 2026-07-29 for this task (generator ran in scratchpad, not committed):
+- pk `7261540160244ec65ce0bf86ba03997e9b1b3b35c277e416bf1c7ba4271fee31`
+- sk embedded in `neode-ui/docker/indee-demo-signin.js`, clearly labelled PUBLIC-DEMO-ONLY / not a secret (threat T-gjd-01: accepted by design). Never a real user key.
+
+## Local verification results
+
+1. **nginx parse:** `nginx -t` clean in `nginx:alpine` (podman, with `--add-host neode-backend:127.0.0.1` to satisfy the pre-existing upstream reference).
+2. **Live proxy smoke (podman, config + seeder mounted):** `curl` through :2101 → 200, **no X-Frame-Options / CSP**, injected `<script src="/__demo/indee-demo-signin.js">` present in HTML, seed script served same-origin, hashed asset `/assets/index-BMWtjRCn.js` proxied 200.
+3. **Unit tests:** 195/195 green (`src/views/appSession` + `src/stores`), running with IS_DEMO=false — non-demo path exercised.
+4. **Demo build:** `VITE_DEMO=1 npm run build` succeeded; bundle (`web/dist/neode-ui/assets/index-ChDwfLt5.js`) contains the 2101 launch logic. This is exactly what Dockerfile.web builds (ARG VITE_DEMO=1 default).
+5. **Mock backend:** boots with DEMO=1; `/ws/db` initial dump of a fresh session contains `indeedhub` with `state=running`, ui=true, lan `http://localhost:8190`.
+6. **No IP leaks:** none of the changed files contain the private release-server IP; pre-existing occurrences in dist (catalog.json/marketplace data) are scrubbed+gated by the existing Dockerfile.web guard.
+7. **Submodule guard:** ran before all three commits; nothing under `indeedhub/` ever staged. No file deletions in any commit.
+
+## Deviations from Plan
+
+**1. [Minor] Dropped `sub_filter_types text/html` from the :2101 block**
+- **Found during:** Task 1 nginx parse check
+- **Issue:** nginx warns `duplicate MIME type "text/html"` — text/html is sub_filter's built-in default type
+- **Fix:** removed the redundant directive (identical behavior), noted in a comment
+- **Commit:** 69bc3d3f
+
+**2. [Environment] Plain (non-demo) build + vue-tsc typecheck could not be run — permission denied**
+- Three attempts (`npm run build`, `vite build --outDir <scratch>`, `vue-tsc --noEmit`) were denied by the permission system mid-execution.
+- **Proxy coverage:** 195 unit tests ran and passed under IS_DEMO=false (compiles + non-demo runtime behavior), and the demo build compiled the same source. All changed TS is IS_DEMO-gated with types unchanged at call sites.
+- **Residual risk:** low; a plain `npm run build` before the next real-node frontend ship will confirm (it runs vue-tsc).
+
+**3. [Flag] `web/dist/neode-ui/` currently holds a VITE_DEMO=1 bundle**
+- The demo verification build overwrote the (gitignored) `web/dist/neode-ui` output. **Rebuild with a plain `npm run build` before any real-node frontend deploy/ISO/OTA that rsyncs `web/dist`** — do not ship the demo bundle to real nodes.
+
+## Fallback status
+
+The plan's fallback (extension-type account + window.nostr postMessage shim + mock signer) was **not needed** — the primary seeded-nsec path matches the live bundle's restore contract exactly. If post-deploy testing shows a login wall anyway, the fallback is fully documented in the PLAN (Task 1 action block).
+
+## Post-deploy checklist for orchestrator (vps2, after demo image rebuild + redeploy)
+
+1. `curl -sI http://146.59.87.168:2101/` → 200, NO `X-Frame-Options`; `curl -s http://146.59.87.168:2101/ | grep indee-demo-signin` → hit. **If unreachable: open port 2101 in the vps2 firewall** (new requirement of this change).
+2. Fresh private window → `http://146.59.87.168:2100` → login `entertoexit` → IndeeHub shows installed/running in My Apps with no install step.
+3. Launch IndeeHub → renders inside the in-app iframe session (not a new tab), content browsable, **no identity-picker modal**.
+4. Signed-in check: IndeeHub header shows an active account (avatar/profile, not a sign-in button). Note: the throwaway key has no published kind-0 profile, so expect a default avatar/truncated npub rather than a named profile — that still counts as signed in. If a login wall appears, execute the documented fallback and redeploy.
+5. Spot-check served responses for the private release-server IP (should be none; build guard enforces).
+6. Reload the iframe once — sign-in must persist (localStorage already seeded even if a service worker serves cached HTML without the injected tag).
+7. Reminder: the `demo-deploy` thin stack now publishes `${DEMO_INDEE_PORT:-2101}:2101` — the public archy-demo repo copy of that compose file needs syncing when the images ship.
+
+## Self-Check: PASSED
+
+- neode-ui/docker/indee-demo-signin.js — FOUND
+- neode-ui/docker/nginx-demo.conf :2101 block — FOUND
+- Commits 69bc3d3f, 66d540f8, d00ca624 — FOUND in git log
+- No paths under indeedhub/ in any commit — VERIFIED
+- SUMMARY frontmatter status: complete — SET