diff --git a/.planning/RELEASE-1.7.121-TASKS.md b/.planning/RELEASE-1.7.121-TASKS.md
index f2783ccd..d58303ae 100644
--- a/.planning/RELEASE-1.7.121-TASKS.md
+++ b/.planning/RELEASE-1.7.121-TASKS.md
@@ -34,7 +34,7 @@ Status key: **DONE** (committed) · **READY** (written, not yet committed/tested
   recreate the running container for it to take effect (`06e0e695`) — the same trap
   applies here.
 
-### 3. Federation trust escalation — **READY** (compiles; tests running)
+### 3. Federation trust escalation — **DONE** (`c0cfc72a`, pushed)
 Two independent fail-open paths granted `Trusted` without any operator decision:
 
 - `federation.peer-joined` is **unauthenticated** (middleware no-session list) and
@@ -73,7 +73,7 @@ trail distinguishes it from the capped automatic ones.
 
 ## P1 — Correctness the operator hit directly
 
-### 4. LND UI never updates over OTA — **READY** (uncommitted)
+### 4. LND UI never updates over OTA — **DONE** (`5088aef5`, pushed)
 - `LND_UI_IMAGE` was `lnd-ui:latest` while `BITCOIN_UI_IMAGE` was pinned to
   `1.7.119-alpha`. Podman will not re-pull a tag it already holds locally, so nodes kept a
   stale lnd-ui forever. **Now pinned to `1.7.119-alpha`.**
@@ -140,3 +140,51 @@ below is dead on every path. Pre-existing; spotted in the v1.7.120 build warning
   bundle renders a black page.
 - Verify security claims on the node, not from the source. v1.7.120's headline bug was a
   fix that shipped in the binary and silently never reached the running container.
+
+---
+
+## RESUME HERE — next session
+
+**Landed this session (both pushed):**
+- `c0cfc72a` federation trust escalation (items 3) — 42/42 federation tests green
+- `5088aef5` lnd-ui OTA pin + host networking (item 4), and this task file
+
+**v1.7.120-alpha is SHIPPED** — signed, published, assets verified live. Do not re-cut it.
+
+### Start with item 3b (password gate) — groundwork already located
+
+Everything needed to implement it, so the next session does not re-search:
+
+- **The helper to use:** `self.auth_manager.verify_password(password).await?` — returns
+  `bool`. Existing callers to copy the shape from: `api/rpc/node.rs:176`,
+  `api/rpc/totp.rs:18` / `:66` / `:121`.
+- **Entry point A — minting a Trusted invite:** `handle_federation_invite`,
+  `api/rpc/federation/handlers.rs:58`. It reads `trust_level` from params and
+  **defaults to `TrustLevel::Trusted` at :72**. Gate only when the resolved level is
+  `Trusted`; leave Observer invites unchanged.
+- **Entry point B — the UI dropdown:** `handle_federation_set_trust`,
+  `api/rpc/federation/handlers.rs:326`, dispatched as `"federation.set-trust"`
+  (`api/rpc/dispatcher.rs:353`). Its parse is at `:342`.
+- **Rule:** gate PROMOTION to Trusted only. Demotion must stay ungated — making something
+  less privileged must never be harder than leaving it.
+- Set `TrustSource::Manual` on the operator path so the audit trail distinguishes a
+  deliberate grant from the capped automatic ones.
+- Frontend will need the password prompt in both places (invite modal, node dropdown).
+
+### Then item 1 (app ports unauthenticated) — the big one
+
+Start with the research the operator explicitly asked for: how **umbrelOS**
+(`getumbrel/umbrel`) and **StartOS** (`Start9Labs/start-os`) gate app access. Read their
+model rather than inventing one. Only then design the gate.
+
+Give this a fresh session with real context — it is the largest item here and is the same
+bug class as the `/lnd-connect-info` + `/bitcoin-rpc/` leaks fixed in v1.7.120, but across
+every app port and every transport.
+
+### Working notes
+- A separate agent is doing **AIUI planning with GSD** — do not touch AIUI.
+- The shared tree has concurrent agents: stage by explicit path, never `git add -A`.
+- Verify security claims **on the node**, not from source. v1.7.120's headline bug was a
+  fix that shipped in the binary and silently never reached the running container.
+- A piped command's exit code is the pipe's, not the script's — redirect to a log file and
+  read the content.
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 5bb0030d..c85927e4 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -5,10 +5,10 @@ milestone_name: milestone
 current_phase: 09
 current_phase_name: BotFights Platform Upgrade
 status: planning
-stopped_at: Phase 13 context gathered
+stopped_at: v1.7.120-alpha SHIPPED; 1.7.121 queue open — see .planning/RELEASE-1.7.121-TASKS.md (12 items, RESUME HERE section at the end)
 last_updated: "2026-08-03T12:57:51.075Z"
 last_activity: 2026-07-31
-last_activity_desc: Phase 02 complete, transitioned to Phase 09
+last_activity_desc: Shipped v1.7.120-alpha (signed+published+verified). Then fixed federation trust escalation (c0cfc72a) and the lnd-ui OTA pin/networking (5088aef5). 1.7.121 task list opened with 12 items; paused for context.
 progress:
   total_phases: 13
   completed_phases: 2