docs(14.2): record planning checkpoint decisions D-18..D-22

.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-CONTEXT.md

@@ -59,6 +59,13 @@ Repos: `fonoteka.go` (seed command, start script, dev env template, any Go fixes
   - exercises the guard against a stale `:8422` origin and against an unset internal origin, and expects a refusal each time;
   - runs the Go-gate Playwright subset (D-15) against the started stack.
 
+### Planning checkpoint additions (2026-10-07, after research)
+- **D-18:** Realtime reuses the shared host Centrifugo (v6, systemd, `:8787`, `/etc/centrifugo/config.json`), the same topology as production, where PHP apps already use one instance. Inspected config: HMAC connection tokens (`client.token.hmac_secret_key`), HTTP API key (`http_api.key`), top-level channels with `allow_subscribe_for_client: true`, **no subscribe/connect proxy** (research assumption A1 was wrong). Go needs only the same HMAC secret and API key via `.env.dev` (`SUMMER_REALTIME__CENTRIFUGO__TOKEN_SECRET`, `SUMMER_REALTIME__CENTRIFUGO__API_KEY`, `SUMMER_REALTIME__CENTRIFUGO__API_URL=http://127.0.0.1:8787/api`). No dedicated Centrifugo is started. `http://localhost:3119` is not in `client.allowed_origins` today: adding it (and restarting the service) is a documented operator step, not done by the script; the script's preflight checks Centrifugo reachability and reports a missing origin when it can detect it.
+- **D-19:** The `/storage/app/uploads/public/...` mount (research G2) is a framework opt-in in `summercms.go` surf serve, behind a config key that mounts `attach.StaticHandlerPublic`; Phase 20 reuses it. Module README and docs updated in the same change.
+- **D-20:** No UI-SPEC: the phase adds no UI (the UI gate matched only the title). Plan as `--skip-ui`.
+- **D-21:** `vue-fonoteka-app/tests/e2e/realtime.spec.ts` (stale since 2026-06-12) is rewritten as a backend-agnostic spec and verified against PHP as well as Go, per D-11.
+- **D-22:** Plan count confirmed at 4: (01) Go glue — `dev:seed`, plugin-command DB fix (G1, incl. `fonoteka:reindex`), dev-only marker route, framework `/storage` mount, opt-in access log (G3), READMEs/docs; (02) `dev-stack.sh`, guard, `.env.dev.example`, `.gitignore`, run docs; (03) Nuxt `E2E_BACKEND=go` switch, realtime rewrite, new edit/rate/cover, search, wishlist specs, then the manual UAT session; (04, last) unit tests and `summercms.go/scripts/check-phase14.2.sh`.
+
 ### Claude's Discretion
 - The exact command name and flags of the seed command, the number of seeded albums and their content, and how the test images are produced.
 - Which Go-only route serves as the marker, and how a PHP answer is detected in the preflight.