docs(19.6.1): record post-research decisions D-19..D-22

.planning/phases/19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md

@@ -82,6 +82,12 @@ The phase is kept short (1-2 plans). Existing cabana payloads and the `admin:*`
 ### Quality gates
 - **D-18:** Unit tests are the last plan (project rule). They cover every privilege rule in D-05 to D-09, including the concurrent last-superuser case, plus D-12 revocation and the D-14 seam (boot errors, permission filtering, run path). Docs: the cabana README and the affected `docs/` pages are updated in the same commits as the API, config and permission changes. If `admin/` changes, `check-admin-openapi.sh` and the committed `modules/boardwalk/dist` gate (`check-admin-dist.sh`) apply.
 
+### Post-research decisions (2026-10-21, plan-phase)
+- **D-19:** **No outranking.** A non-superuser with the manage-administrators permission is refused (403) when updating, deleting or running record/bulk actions on a non-superuser admin whose effective role + permissions grant more than the caller holds (closes the password-set account-takeover path).
+- **D-20:** **Own password is not set on this screen.** Sending a password for your own record on the Administrators form is refused; the error points to My Account, which checks the current password.
+- **D-21:** **SPA support is in scope.** D-06 (permission override disabled while `is_superuser` is on) gets a real field `trigger` in fields.yaml and the admin SPA, and D-16 (code-declared role grants) gets per-record locked permission values rendered as locked in the permission editor. Server-side enforcement stays authoritative. The `admin/` change regenerates `admin/openapi/admin.json` + `schema.d.ts` (`scripts/check-admin-openapi.sh`) and rebuilds the committed `modules/boardwalk/dist` (`scripts/check-admin-dist.sh`).
+- **D-22:** **Three plans:** 01 the pact action-extension seam, the internal cabana pseudo-plugin with Administrators + Roles controllers, privilege guards, lang keys and docs (server side); 02 a short plan for the SPA support in D-21; 03 unit + Postgres tests (last, per project rule).
+
 ### Claude's Discretion
 - How the internal pseudo-plugin is shaped and named (id, for example `summercms.cabana` / `backend.*` controller IDs), as long as it reuses the existing `summercms.cabana` migration id and doesn't collide with the reserved first path segments.
 - Exact Go identifiers for the D-14 capability and its types.