diff --git a/scripts/check-phase18.sh b/scripts/check-phase18.sh
new file mode 100755
index 0000000..4766b51
--- /dev/null
+++ b/scripts/check-phase18.sh
@@ -0,0 +1,570 @@
+#!/usr/bin/env bash
+# Phase 18 fail-closed gate: payment gateway. The framework pieces in this
+# repository (cabana money field and column, write-only settings secrets,
+# richeditor and tabs on settings forms, danger record actions, the preview
+# Edit rule, the admin SPA), the two plugin repositories (sm-paymentgateway-
+# plugin, sm-pgstripe-plugin, whose proof host is a test inside pgstripe) and
+# the Nuxt layer vue-paymentgateway-layer.
+#
+# Stages:
+#   go        go vet ./... here; the Docker-free framework suites by required
+#             name (-short).
+#   plugins   go vet ./... and go test -short ./... in both plugins; their
+#             Docker-free suites by required name and package (-short).
+#   admin     the admin SPA typecheck and the vitest JSON report with required
+#             spec files and test names.
+#   layers    pnpm test (node --test, TAP) in the layer with required test
+#             files and names.
+#   docs      TestDocsTree, summer docs:build --check, check-admin-openapi.sh
+#             --check, check-admin-dist.sh, and check-phase10.sh --hygiene, so
+#             admin changes made here cannot silently break Phase 10's gate.
+#   postgres  Docker host only: the testcontainers suites by required name in
+#             every Go repository. Without a reachable Docker daemon this
+#             stage fails.
+#
+# Every stage exits non-zero on a failing command; a go test -json run that
+# fails, skips, matches zero tests, prints "no tests to run" or misses a named
+# required test; a vitest JSON report with a failed, skipped or todo test, a
+# failed file, no passing test or a missing required file or test; a TAP run
+# with a "not ok", a fail, cancelled, skipped or todo count, zero passing tests
+# or a missing required test; or a missing required layer test file.
+# --self-test proves the detectors fail on planted output.
+#
+# --all runs self-test, go, plugins, admin, layers and docs, then postgres
+# when a Docker daemon answers. When none does, --all says so loudly
+# (NOT RUN postgres) and the Docker suites stay a manual step for a Docker
+# host:
+#   bash scripts/check-phase18.sh postgres
+# Set PHASE18_REQUIRE_POSTGRES=1 to make --all fail instead.
+#
+# Environment overrides (default: the sibling checkouts next to this
+# repository): PHASE18_ROOT (this repository), PG (sm-paymentgateway-plugin),
+# PGSTRIPE (sm-pgstripe-plugin), PG_LAYER (vue-paymentgateway-layer).
+set -euo pipefail
+
+unset FORCE_COLOR
+export NO_COLOR=1
+
+ROOT="${PHASE18_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+PG="${PG:-$ROOT/../sm-paymentgateway-plugin}"
+PGSTRIPE="${PGSTRIPE:-$ROOT/../sm-pgstripe-plugin}"
+PG_LAYER="${PG_LAYER:-$ROOT/../vue-paymentgateway-layer}"
+
+# ---------------------------------------------------------------------------
+# Required test names. Each list is run with -run '^(a|b|...)$' and every name
+# must pass; a name that skips or does not run fails the stage.
+
+# go stage: Docker-free framework suites (-short).
+CABANA_SHORT_TESTS=(TestMoneyFieldCompile TestMoneyListCompile TestSettingsSecretCompile TestSettingsDropdownMethod)
+
+# plugins stage: Docker-free suites (-short), per repository and package.
+PG_MONEY_TESTS=(TestMoneyVectorsSmoke TestAmount4ScanValue)
+PG_ROOT_TESTS=(TestNotificationRoute)
+PGSTRIPE_ROOT_TESTS=(TestStripeWebhook TestFixtureAbsentFromProduction)
+
+# postgres stage: testcontainers suites.
+PG_CABANA_TESTS=(TestMoneyFieldSmoke)
+PG_PG_TESTS=(TestPaymentGatewayTracer)
+PG_PGSTRIPE_TESTS=(TestHostStripeFlow)
+
+# admin stage: vitest spec files and full test names (describe + it).
+ADMIN_FILES=(
+	tests/form/MoneyField.test.ts
+)
+ADMIN_REQUIRE=(
+	"money field component (UI-SPEC F1) submits an untouched 85.4193 byte-identical: no emit on load or blur"
+	"money field component (UI-SPEC F1) emits the canonical dot string for \"1 234,56\" and null for empty"
+	"money field component (UI-SPEC F1) refuses 12.34567 at scale 4 on blur, neither rounded nor truncated"
+	"money helpers formats through Intl with the string itself, keeping four decimals"
+)
+
+# layers stage: test files (must exist and match the test script's glob) and
+# TAP test names.
+LAYER_FILES=(tests/checkout.test.ts tests/orderPage.test.ts)
+LAYER_REQUIRE=(
+	"a redirect answer calls location.assign once with the URL and the button stays busy"
+	"an AwaitingPayment order is polled every 3 s and polling stops at Paid"
+)
+
+usage() {
+	cat >&2 <<'EOF'
+usage:
+  check-phase18.sh --self-test
+  check-phase18.sh go | plugins | admin | layers | docs | postgres
+  check-phase18.sh --go | --plugins | --admin | --layers | --docs | --postgres
+  check-phase18.sh --all
+EOF
+	exit 2
+}
+
+# detect_go reads go test -json. Exit 1 fail/build, 2 skip, 3 zero/no-tests,
+# 4 non-JSON, 5 missing required name.
+detect_go() {
+	python3 - "$1" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+require = [n for n in os.environ.get("REQUIRE_TESTS", "").split() if n]
+passed = set()
+failed = []
+with open(path, encoding="utf-8", errors="replace") as fh:
+    for raw in fh:
+        line = raw.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            ev = json.loads(line)
+        except json.JSONDecodeError:
+            print("refuse: non-json test output", file=sys.stderr)
+            sys.exit(4)
+        action = ev.get("Action")
+        test = ev.get("Test") or ""
+        pkg = ev.get("Package") or ev.get("ImportPath") or ""
+        if action == "build-fail" or (action == "fail" and ev.get("FailedBuild")):
+            print(f"refuse: build failed {pkg}", file=sys.stderr)
+            sys.exit(1)
+        text = ev.get("Output") or ""
+        if action == "output" and "no tests to run" in text:
+            print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
+            sys.exit(3)
+        if action == "skip" and test:
+            print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
+            sys.exit(2)
+        if action == "fail":
+            failed.append(f"{pkg} {test}".strip())
+        if action == "pass" and test:
+            passed.add(test)
+if failed:
+    print("refuse: failed " + ", ".join(failed), file=sys.stderr)
+    sys.exit(1)
+if not passed:
+    print("refuse: zero tests", file=sys.stderr)
+    sys.exit(3)
+missing = [n for n in require if n not in passed]
+if missing:
+    print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
+    sys.exit(5)
+PY
+}
+
+# detect_vitest reads a vitest --reporter=json report. Exit 1 a failed test
+# or file or an unsuccessful run, 2 a skipped or todo test, 3 no passing
+# test, 4 an unreadable report, 5 a missing required file or test.
+# REQUIRE_FILES and REQUIRE_NAMES hold one entry per line.
+detect_vitest() {
+	python3 - "$1" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+files = [n for n in os.environ.get("REQUIRE_FILES", "").split("\n") if n.strip()]
+names = [n for n in os.environ.get("REQUIRE_NAMES", "").split("\n") if n.strip()]
+try:
+    with open(path, encoding="utf-8") as fh:
+        report = json.load(fh)
+except (OSError, ValueError) as err:
+    print(f"refuse: unreadable vitest report: {err}", file=sys.stderr)
+    sys.exit(4)
+results = report.get("testResults") or []
+bad = [r.get("name", "?") for r in results if r.get("status") != "passed"]
+if bad or report.get("numFailedTests", 0) or report.get("numFailedTestSuites", 0) or report.get("success") is not True:
+    print("refuse: failed " + ", ".join(bad or ["run"]), file=sys.stderr)
+    sys.exit(1)
+if report.get("numPendingTests", 0) or report.get("numTodoTests", 0):
+    print(f"refuse: {report.get('numPendingTests', 0)} skipped, {report.get('numTodoTests', 0)} todo", file=sys.stderr)
+    sys.exit(2)
+passed = set()
+by_file = {}
+for r in results:
+    for a in r.get("assertionResults") or []:
+        status = a.get("status")
+        if status != "passed":
+            print(f"refuse: {status} {a.get('fullName')}", file=sys.stderr)
+            sys.exit(2 if status in ("skipped", "pending", "todo") else 1)
+        passed.add(a.get("fullName", ""))
+        by_file[r.get("name", "")] = by_file.get(r.get("name", ""), 0) + 1
+if report.get("numPassedTests", 0) < 1 or not passed:
+    print("refuse: no passing tests", file=sys.stderr)
+    sys.exit(3)
+missing = [f for f in files if not any(name.endswith("/" + f) and count > 0 for name, count in by_file.items())]
+missing += [n for n in names if n not in passed]
+if missing:
+    print("refuse: required files or tests did not pass: " + "; ".join(missing), file=sys.stderr)
+    sys.exit(5)
+print(f"vitest: {report.get('numPassedTests')} passed in {len(results)} files")
+PY
+}
+
+# detect_tap reads node --test --test-reporter=tap output. Exit 1 "not ok" or
+# a fail/cancelled count, 2 a skip/todo directive or count, 3 no passing test,
+# 5 a missing required name. REQUIRE_NAMES holds one test name per line.
+detect_tap() {
+	python3 - "$1" <<'PY'
+import os, re, sys
+path = sys.argv[1]
+require = [n for n in os.environ.get("REQUIRE_NAMES", "").split("\n") if n.strip()]
+passed = set()
+counts = {}
+with open(path, encoding="utf-8", errors="replace") as fh:
+    for raw in fh:
+        line = raw.rstrip("\n")
+        body = line.lstrip()
+        if body.startswith("not ok"):
+            print(f"refuse: {body}", file=sys.stderr)
+            sys.exit(1)
+        m = re.match(r"ok \d+ - (.*?)(\s+#\s*(SKIP|TODO)\b.*)?$", body, re.I)
+        if m:
+            if m.group(2):
+                print(f"refuse: {body}", file=sys.stderr)
+                sys.exit(2)
+            passed.add(m.group(1).replace("\\#", "#"))
+            continue
+        m = re.match(r"# (tests|suites|pass|fail|cancelled|skipped|todo) (\d+)$", line)
+        if m:
+            counts[m.group(1)] = int(m.group(2))
+for key in ("fail", "cancelled"):
+    if counts.get(key, 0) > 0:
+        print(f"refuse: {counts[key]} {key}", file=sys.stderr)
+        sys.exit(1)
+for key in ("skipped", "todo"):
+    if counts.get(key, 0) > 0:
+        print(f"refuse: {counts[key]} {key}", file=sys.stderr)
+        sys.exit(2)
+if counts.get("pass", 0) < 1 or not passed:
+    print("refuse: no passing tests", file=sys.stderr)
+    sys.exit(3)
+missing = [n for n in require if n not in passed]
+if missing:
+    print("refuse: required tests did not pass: " + "; ".join(missing), file=sys.stderr)
+    sys.exit(5)
+PY
+}
+
+# detect_files fails (exit 5) unless every REQUIRE_FILES entry (one per line,
+# relative to the directory given) is a non-empty regular file whose name
+# ends in .test.ts, the glob of the layer's test script.
+detect_files() {
+	python3 - "$1" <<'PY'
+import os, sys
+base = sys.argv[1]
+files = [n for n in os.environ.get("REQUIRE_FILES", "").split("\n") if n.strip()]
+missing = [f for f in files if not (f.startswith("tests/") and f.endswith(".test.ts") and os.path.isfile(os.path.join(base, f)) and os.path.getsize(os.path.join(base, f)) > 0)]
+if missing:
+    print("refuse: required test files missing in " + base + ": " + ", ".join(missing), file=sys.stderr)
+    sys.exit(5)
+PY
+}
+
+go_json() {
+	local dir="$1"
+	shift
+	local log err rc=0 dc=0
+	log="$(mktemp)"
+	err="$(mktemp)"
+	(cd "$dir" && go test -json "$@") >"$log" 2>"$err" || rc=$?
+	detect_go "$log" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
+		cat "$err" >&2 || true
+		grep -v '^{' "$log" | tail -n 40 >&2 || true
+		python3 -c 'import json,sys
+for raw in open(sys.argv[1], errors="replace"):
+    try: ev = json.loads(raw)
+    except ValueError: continue
+    if ev.get("Action") == "output" and ("FAIL" in ev.get("Output", "") or "_test.go:" in ev.get("Output", "")):
+        sys.stderr.write(ev["Output"])' "$log" 2>&1 | tail -n 40 >&2 || true
+		rm -f "$log" "$err"
+		echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
+		return 1
+	fi
+	echo "go: $(grep -c '"Action":"pass","Package":"[^"]*","Test":"[^"/]*","Elapsed"' "$log") top-level tests passed in $dir ($*)"
+	rm -f "$log" "$err"
+}
+
+# go_named DIR PACKAGES FLAGS NAME... runs exactly the named top-level tests
+# and requires every one of them to pass. PACKAGES and FLAGS are word-split.
+go_named() {
+	local dir="$1" pkgs="$2" flags="$3"
+	shift 3
+	local names=("$@") regex
+	regex="^($(IFS='|'; echo "${names[*]}"))\$"
+	# shellcheck disable=SC2086
+	REQUIRE_TESTS="${names[*]}" go_json "$dir" $flags -count=1 -run "$regex" $pkgs
+}
+
+# vitest_json DIR [VITEST ARGS...]: extra arguments (such as --config) go to vitest.
+vitest_json() {
+	local dir="$1" report out rc=0 dc=0
+	shift
+	report="$(mktemp)"
+	out="$(mktemp)"
+	(cd "$dir" && ./node_modules/.bin/vitest run "$@" --reporter=json --outputFile="$report") >"$out" 2>&1 || rc=$?
+	detect_vitest "$report" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
+		grep -E 'FAIL|Error|×' "$out" | tail -n 40 >&2 || true
+		rm -f "$report" "$out"
+		echo "refuse: vitest in $dir (test=$rc detect=$dc)" >&2
+		return 1
+	fi
+	rm -f "$report" "$out"
+}
+
+# pnpm_tap runs `pnpm -C <dir> test` (node --test, TAP) and checks the
+# required files on disk and the TAP output.
+pnpm_tap() {
+	local dir="$1" log rc=0 dc=0 fc=0
+	REQUIRE_FILES="${REQUIRE_FILES:-}" detect_files "$dir" || fc=$?
+	log="$(mktemp)"
+	pnpm -C "$dir" test >"$log" 2>&1 || rc=$?
+	detect_tap "$log" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 || "$fc" -ne 0 ]]; then
+		grep -E '^\s*(not ok|# )|Error' "$log" | tail -n 40 >&2 || true
+		rm -f "$log"
+		echo "refuse: pnpm test in $dir (test=$rc detect=$dc files=$fc)" >&2
+		return 1
+	fi
+	echo "tap: $(grep -E '^# (tests|pass|fail) ' "$log" | tr '\n' ' ')in $dir"
+	rm -f "$log"
+}
+
+expect_detector() {
+	local detector="$1" name="$2" want="$3" payload="$4" log dc=0
+	log="$(mktemp)"
+	printf '%s\n' "$payload" >"$log"
+	"$detector" "$log" >/dev/null 2>&1 || dc=$?
+	rm -f "$log"
+	if [[ "$dc" -ne "$want" ]]; then
+		echo "refuse: self-test $detector $name: exit $dc, want $want" >&2
+		return 1
+	fi
+}
+
+expect_files() {
+	local name="$1" want="$2" dir="$3" dc=0
+	detect_files "$dir" >/dev/null 2>&1 || dc=$?
+	if [[ "$dc" -ne "$want" ]]; then
+		echo "refuse: self-test detect_files $name: exit $dc, want $want" >&2
+		return 1
+	fi
+}
+
+run_self_test() {
+	bash -n "${BASH_SOURCE[0]}"
+
+	expect_detector detect_go pass 0 '{"Action":"pass","Package":"p","Test":"TestOrderMatrix"}'
+	expect_detector detect_go fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p","Test":"TestPaymentMatrix"}'
+	expect_detector detect_go package-fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p"}'
+	expect_detector detect_go build 1 '{"Action":"build-fail","ImportPath":"p"}'
+	expect_detector detect_go skip 2 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"skip","Package":"p","Test":"TestHostStripeFlow"}'
+	expect_detector detect_go zero 3 '{"Action":"pass","Package":"p"}'
+	expect_detector detect_go no-tests 3 '{"Action":"output","Package":"p","Output":"testing: warning: no tests to run\n"}
+{"Action":"pass","Package":"p"}'
+	expect_detector detect_go nonjson 4 '{"Action":"pass",'
+	REQUIRE_TESTS="TestMoneyVectors TestStripeWebhook" expect_detector detect_go missing-named 5 \
+		'{"Action":"pass","Package":"p","Test":"TestMoneyVectors"}'
+	REQUIRE_TESTS="TestMoney" expect_detector detect_go prefix-is-not-the-test 5 \
+		'{"Action":"pass","Package":"p","Test":"TestMoneyVectors"}'
+	REQUIRE_TESTS="TestCart" expect_detector detect_go subtest-is-not-the-test 5 \
+		'{"Action":"pass","Package":"p","Test":"TestLegacyFixtures/TestCart"}
+{"Action":"pass","Package":"p","Test":"TestOther"}'
+
+	local vok='{"success":true,"numPassedTests":2,"numFailedTests":0,"numFailedTestSuites":0,"numPendingTests":0,"numTodoTests":0,"testResults":[{"name":"/r/tests/form/MoneyField.test.ts","status":"passed","assertionResults":[{"fullName":"money field component (UI-SPEC F1) submits an untouched 85.4193 byte-identical: no emit on load or blur","status":"passed"},{"fullName":"money helpers formats through Intl with the string itself, keeping four decimals","status":"passed"}]}]}'
+	expect_detector detect_vitest pass 0 "$vok"
+	REQUIRE_FILES='tests/form/MoneyField.test.ts' REQUIRE_NAMES='money field component (UI-SPEC F1) submits an untouched 85.4193 byte-identical: no emit on load or blur' expect_detector detect_vitest named 0 "$vok"
+	expect_detector detect_vitest failed-test 1 '{"success":false,"numPassedTests":1,"numFailedTests":1,"testResults":[{"name":"/r/a.test.ts","status":"failed","assertionResults":[{"fullName":"x","status":"failed"}]}]}'
+	expect_detector detect_vitest failed-file 1 '{"success":false,"numPassedTests":0,"numFailedTests":0,"numFailedTestSuites":1,"testResults":[{"name":"/r/a.test.ts","status":"failed","assertionResults":[]}]}'
+	expect_detector detect_vitest unsuccessful 1 '{"success":false,"numPassedTests":1,"numFailedTests":0,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"}]}]}'
+	expect_detector detect_vitest skipped 2 '{"success":true,"numPassedTests":1,"numPendingTests":1,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"},{"fullName":"y","status":"skipped"}]}]}'
+	expect_detector detect_vitest todo 2 '{"success":true,"numPassedTests":1,"numTodoTests":1,"testResults":[{"name":"/r/a.test.ts","status":"passed","assertionResults":[{"fullName":"x","status":"passed"}]}]}'
+	expect_detector detect_vitest zero 3 '{"success":true,"numPassedTests":0,"testResults":[]}'
+	expect_detector detect_vitest unreadable 4 'not json'
+	REQUIRE_FILES='tests/app/money.test.ts' expect_detector detect_vitest missing-file 5 "$vok"
+	REQUIRE_NAMES='missing case' expect_detector detect_vitest missing-name 5 "$vok"
+
+	local tok='TAP version 13
+# Subtest: a redirect answer calls location.assign once with the URL and the button stays busy
+ok 1 - a redirect answer calls location.assign once with the URL and the button stays busy
+ok 2 - the allowlist takes http, https, mailto, tel, / and \#
+1..2
+# tests 2
+# suites 0
+# pass 2
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0'
+	expect_detector detect_tap pass 0 "$tok"
+	REQUIRE_NAMES=$'a redirect answer calls location.assign once with the URL and the button stays busy\nthe allowlist takes http, https, mailto, tel, / and #' expect_detector detect_tap named 0 "$tok"
+	expect_detector detect_tap not-ok 1 'ok 1 - a
+not ok 2 - b
+# pass 1
+# fail 1'
+	expect_detector detect_tap nested-not-ok 1 '    not ok 1 - sub
+ok 1 - a
+# pass 1
+# fail 0'
+	expect_detector detect_tap fail-count 1 'ok 1 - a
+# pass 1
+# fail 1'
+	expect_detector detect_tap cancelled 1 'ok 1 - a
+# pass 1
+# cancelled 1'
+	expect_detector detect_tap skip 2 'ok 1 - a # SKIP later
+# pass 1'
+	expect_detector detect_tap todo-count 2 'ok 1 - a
+# pass 1
+# todo 1'
+	expect_detector detect_tap zero 3 '# tests 0
+# pass 0
+# fail 0'
+	expect_detector detect_tap no-output 3 ''
+	REQUIRE_NAMES=$'a redirect answer calls location.assign once with the URL and the button stays busy\nmissing' expect_detector detect_tap missing-named 5 "$tok"
+
+	local tmp
+	tmp="$(mktemp -d)"
+	mkdir -p "$tmp/tests"
+	printf 'test\n' >"$tmp/tests/a.test.ts"
+	: >"$tmp/tests/empty.test.ts"
+	REQUIRE_FILES='tests/a.test.ts' expect_files present 0 "$tmp" || { rm -rf "$tmp"; return 1; }
+	REQUIRE_FILES=$'tests/a.test.ts\ntests/missing.test.ts' expect_files missing 5 "$tmp" || { rm -rf "$tmp"; return 1; }
+	REQUIRE_FILES='tests/empty.test.ts' expect_files empty 5 "$tmp" || { rm -rf "$tmp"; return 1; }
+	REQUIRE_FILES='tests/a.ts' expect_files outside-glob 5 "$tmp" || { rm -rf "$tmp"; return 1; }
+	rm -rf "$tmp"
+
+	grep -qF 'bash "$ROOT/scripts/check-phase10.sh" --hygiene' "${BASH_SOURCE[0]}" || {
+		echo "refuse: the docs stage does not run check-phase10.sh --hygiene" >&2
+		return 1
+	}
+	grep -qF 'PHASE18_REQUIRE_POSTGRES' "${BASH_SOURCE[0]}" || {
+		echo "refuse: --all does not honour PHASE18_REQUIRE_POSTGRES" >&2
+		return 1
+	}
+
+	local mode
+	for mode in self-test go plugins admin layers docs postgres all; do
+		grep -q -- "^	--$mode" "${BASH_SOURCE[0]}" || {
+			echo "refuse: missing mode --$mode" >&2
+			return 1
+		}
+	done
+	echo "phase18 self-test passed"
+}
+
+require_dir() {
+	[[ -d "$1" ]] || {
+		echo "refuse: $2 $1 not found" >&2
+		return 1
+	}
+}
+
+run_go() {
+	(cd "$ROOT" && go vet ./...)
+	go_named "$ROOT" ./modules/cabana -short "${CABANA_SHORT_TESTS[@]}"
+	echo "phase18 go passed"
+}
+
+run_plugins() {
+	require_dir "$PG" "payment gateway plugin"
+	require_dir "$PGSTRIPE" "Stripe operator plugin"
+	local repo
+	for repo in "$PG" "$PGSTRIPE"; do
+		go -C "$repo" vet ./...
+		echo "vet: $repo"
+		# Every package of the plugin compiles and its Docker-free tests pass;
+		# the Docker suites skip here and run by name in the postgres stage.
+		go -C "$repo" test -count=1 -short ./... >/dev/null
+		echo "short: $repo"
+	done
+	go_named "$PG" ./money -short "${PG_MONEY_TESTS[@]}"
+	go_named "$PG" . -short "${PG_ROOT_TESTS[@]}"
+	go_named "$PGSTRIPE" . -short "${PGSTRIPE_ROOT_TESTS[@]}"
+	echo "phase18 plugins passed"
+}
+
+run_admin() {
+	(cd "$ROOT/admin" && ./node_modules/.bin/vue-tsc --noEmit)
+	REQUIRE_FILES="$(printf '%s\n' "${ADMIN_FILES[@]}")" REQUIRE_NAMES="$(printf '%s\n' "${ADMIN_REQUIRE[@]}")" vitest_json "$ROOT/admin"
+	echo "phase18 admin passed"
+}
+
+run_layers() {
+	require_dir "$PG_LAYER" "payment gateway layer"
+	REQUIRE_FILES="$(printf '%s\n' "${LAYER_FILES[@]}")" REQUIRE_NAMES="$(printf '%s\n' "${LAYER_REQUIRE[@]}")" pnpm_tap "$PG_LAYER"
+	echo "phase18 layers passed"
+}
+
+run_docs() {
+	go_named "$ROOT" ./cmd/summer "" TestDocsTree
+	(cd "$ROOT" && go run ./cmd/summer docs:build --check)
+	bash "$ROOT/scripts/check-admin-openapi.sh" --check
+	bash "$ROOT/scripts/check-admin-dist.sh"
+	# Cross-phase: Phase 10's SPA hygiene (raw-HTML sinks, dist origins, every
+	# module imported by a test) must stay green after Phase 18 admin changes.
+	bash "$ROOT/scripts/check-phase10.sh" --hygiene
+	echo "phase18 docs passed"
+}
+
+docker_up() {
+	command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1
+}
+
+run_postgres() {
+	require_dir "$PG" "payment gateway plugin"
+	require_dir "$PGSTRIPE" "Stripe operator plugin"
+	if ! docker_up; then
+		echo "refuse: the postgres stage needs a reachable Docker daemon (testcontainers); run it on a Docker host" >&2
+		return 1
+	fi
+	go_named "$ROOT" ./modules/cabana "-timeout 20m" "${PG_CABANA_TESTS[@]}"
+	go_named "$PG" . "-timeout 20m" "${PG_PG_TESTS[@]}"
+	go_named "$PGSTRIPE" . "-timeout 20m" "${PG_PGSTRIPE_TESTS[@]}"
+	echo "phase18 postgres passed"
+}
+
+run_all() {
+	local stage
+	for stage in self-test go plugins admin layers docs; do
+		if bash "${BASH_SOURCE[0]}" "--$stage"; then
+			echo "PASS $stage"
+		else
+			echo "FAIL $stage"
+			exit 1
+		fi
+	done
+	if docker_up; then
+		if bash "${BASH_SOURCE[0]}" --postgres; then
+			echo "PASS postgres"
+		else
+			echo "FAIL postgres"
+			exit 1
+		fi
+	elif [[ "${PHASE18_REQUIRE_POSTGRES:-0}" == "1" ]]; then
+		echo "FAIL postgres: no reachable Docker daemon and PHASE18_REQUIRE_POSTGRES=1"
+		exit 1
+	else
+		cat >&2 <<'EOF'
+************************************************************************
+NOT RUN postgres: no reachable Docker daemon on this host.
+The testcontainers suites of the framework (cabana money, settings
+secrets, richeditor, danger, OpenAPI conformance), sm-paymentgateway-plugin
+(tracer, admin screens, settings, mail, commands, import, customer API,
+migrations) and sm-pgstripe-plugin (TestHostStripeFlow, settings, import)
+did NOT run. Run on a Docker host before /msd-verify-work:
+  bash scripts/check-phase18.sh postgres
+************************************************************************
+EOF
+		echo "NOT RUN postgres (Docker-host only; see the notice above)"
+	fi
+	echo "Phase 18 gate passed"
+}
+
+case "${1:---all}" in
+	--self-test | self-test) run_self_test ;;
+	--go | go) run_go ;;
+	--plugins | plugins) run_plugins ;;
+	--admin | admin) run_admin ;;
+	--layers | layers) run_layers ;;
+	--docs | docs) run_docs ;;
+	--postgres | postgres) run_postgres ;;
+	--all | all) run_all ;;
+	*) usage ;;
+esac