docs(18-01): complete framework admin pieces plan

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: 18
 current_phase_name: Payment Gateway
 status: executing
-stopped_at: Phase 18 UI-SPEC approved
-last_updated: "2026-10-13T03:17:07.125Z"
-last_activity: 2026-10-12
-last_activity_desc: "Completed quick task 261012-s3g: Phase 10 security blockers (DOMPurify, check-phase10 hygiene)"
-state_head: 79b1f855646abf44e470a6f9ce1a1a1ae6376d04
+stopped_at: Completed 18-01-PLAN.md
+last_updated: "2026-10-13T09:49:54.928Z"
+last_activity: 2026-10-13
+last_activity_desc: Phase 18 execution started
+state_head: 1e841b4281c0e4280ae5af2f5fed338242f0f7d6
 progress:
   total_phases: 40
   completed_phases: 14
   total_plans: 175
-  completed_plans: 168
+  completed_plans: 169
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -25,14 +25,14 @@ milestone_name: milestone
 See: .planning/PROJECT.md (updated 2026-10-12)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 17 — Blog companions
+**Current focus:** Phase 18 — Payment Gateway
 
 ## Current Position
 
-Phase: 18 (Payment Gateway) — READY TO EXECUTE
-Plan: 6 of 6
+Phase: 18 (Payment Gateway) — EXECUTING
+Plan: 2 of 7
 Status: Ready to execute
-Last activity: 2026-10-12 — Completed quick task 261012-s3g: Phase 10 security blockers (DOMPurify, check-phase10 hygiene)
+Last activity: 2026-10-13 — Phase 18 execution started
 
 Progress: [████░░░░░░] 44%
 
@@ -225,6 +225,7 @@ Progress: [████░░░░░░] 44%
 | Phase 17 P04 | 32min | 5 tasks | 70 files |
 | Phase 17 P05 | 93min | 5 tasks | 103 files |
 | Phase 17 P06 | 53 min | 4 tasks | 50 files |
+| Phase 18 P01 | 43min | 4 tasks | 59 files |
 
 ## Accumulated Context
 
@@ -743,6 +744,9 @@ Recent decisions affecting current work:
 - [Phase 17]: 17-06: cabana singleton route reruns its transaction once on a Postgres unique violation from SingletonRecord (first-open race); fix 6312929 needs the next framework tag
 - [Phase 17]: 17-06: scripts/check-phase17.sh is the Phase 17 gate; every Phase 17 test name sits in one stage list (go, plugins, admin, layers, postgres)
 - [Phase 17]: 17-06: protocol-relative menu URLs stay anchors (D-16 rule) in the server and layer; the plan's text-without-href wording is a deferred question
+- [Phase 18]: Phase 18 plan 01 release gate: framework tag v0.1.25 held until the phase gate after plan 07 (human reply: hold); nothing pushed or tagged, plans 02 to 06 build against the checkout through go.work replace — One tag for the whole phase with the unit tests of plan 07 included; the plugin plans use go.work replace and need no published version, so holding costs only a later bump
+- [Phase 18]: Money is a decimal string on the wire and in the SPA (never a float, never rounded or truncated); MoneyField emits the raw compact text for a malformed or too-precise draft so the server 422 stays the gate — D-07 and D-10 forbid rounding and truncation; emitting the last valid prefix on a bad draft would let Save write a truncated amount
+- [Phase 18]: Settings secrets are write-only: the GET omits the value and reports meta.secrets.<field> as stored, env or empty; on PUT an absent key or empty string keeps the stored value and JSON null clears it; meta is omitted when there is nothing to report so existing payloads stay byte-identical — The value must never leave the server (D-13, T-18-03); omitempty on meta and danger keeps the Phase 10 conformance fixtures and the PHP-shaped payloads unchanged
 
 ### Pending Todos
 
@@ -821,6 +825,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-12T20:45:53.030Z
-Stopped at: Phase 18 UI-SPEC approved
-Resume file: .planning/phases/18-payment-gateway/18-UI-SPEC.md
+Last session: 2026-10-13T09:49:33.284Z
+Stopped at: Completed 18-01-PLAN.md
+Resume file: None