diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index dad38b1..641eb4f 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -474,7 +474,7 @@ Plans:
   4. A controller registers named toolbar actions listed in `toolbar.buttons`; a click POSTs the action and toasts while `create` and `delete` keep their behaviour; unknown YAML keys, missing templates, unregistered actions and unknown permissions fail boot.
   5. The Albums list shows a statistics strip scoped to the admin's collection, the Albums form shows a "Load from Discogs" widget whose stub fills Release year and Format, and a "Sync with Discogs" toolbar action toasts from its stub.
 
-**Plans:** 1/4 plans executed
+**Plans:** 2/4 plans executed
 
 Plans:
 
@@ -482,7 +482,7 @@ Plans:
 - [x] 10.1-01-PLAN.md — Framework Go: pact capability interfaces, cabana widget/partial/toolbar/asset boot rules, cabana-owned action, partial and asset routes, sanitizer, OpenAPI (summercms.go)
 
 **Wave 2** *(blocked on Wave 1 completion)*
-- [ ] 10.1-02-PLAN.md — Framework SPA: plugin asset loader, WidgetField, PartialHost and PartialField, list-header slot, custom toolbar buttons, rebuilt dist (summercms.go/admin)
+- [x] 10.1-02-PLAN.md — Framework SPA: plugin asset loader, WidgetField, PartialHost and PartialField, list-header slot, custom toolbar buttons, rebuilt dist (summercms.go/admin)
 
 **Wave 3** *(blocked on Wave 2 completion)*
 - [ ] 10.1-03-PLAN.md — Application: Albums stats strip, Discogs lookup widget stub, discogsSync toolbar stub, plugin assets and copy (fonoteka.go)
diff --git a/.planning/STATE.md b/.planning/STATE.md
index a7b9e1a..a634e0e 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "10.1"
 current_phase_name: Runtime admin extension point
 status: executing
-stopped_at: Completed 10.1-01-PLAN.md
-last_updated: "2026-09-29T00:03:16.308Z"
+stopped_at: Completed 10.1-02-PLAN.md
+last_updated: "2026-09-29T00:15:38.110Z"
 last_activity: 2026-09-28
 last_activity_desc: Phase 10.1 execution started
-state_head: c3b76b1afb977cb3f72272f9876c65c8da7877ed
+state_head: 55c47ca3bc0d291c2eaa3fc2b80e9e934951a06a
 progress:
   total_phases: 19
   completed_phases: 9
   total_plans: 78
-  completed_plans: 75
+  completed_plans: 76
 milestone_name: milestone
 ---
 
@@ -29,7 +29,7 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 ## Current Position
 
 Phase: 10.1 (Runtime admin extension point) — EXECUTING
-Plan: 2 of 4
+Plan: 3 of 4
 Status: Ready to execute
 Last activity: 2026-09-28 — Phase 10.1 execution started
 
@@ -130,6 +130,7 @@ Progress: [██████░░░░] 60%
 | Phase 10.2 P01 | 10h56m | 3 tasks | 404 files |
 | Phase 10.2 P02 | 14m | 3 tasks | 20 files |
 | Phase 10.1 P01 | 25min | 3 tasks | 33 files |
+| Phase 10.1 P02 | 17 min | 3 tasks | 29 files |
 
 ## Accumulated Context
 
@@ -350,6 +351,9 @@ Recent decisions affecting current work:
 - [Phase 10.1]: 10.1-01: create and delete are reserved names in the single controller action namespace shared by toolbar.buttons and widget action: keys
 - [Phase 10.1]: 10.1-01: toolbar action body must be exactly {}; record_id or values is a 422
 - [Phase 10.1]: 10.1-01: partial view-model guard also refuses html/template trusted content types; href/src with whitespace or control characters are dropped
+- [Phase 10.1]: 10.1-02: a widget posts only its fill keys' current values; loadControllerAssets resolves with failed script URLs so a widget fails fast instead of waiting 5000 ms
+- [Phase 10.1]: 10.1-02: plugin stylesheet links are keyed by controller and URL and toggled on every list and form open
+- [Phase 10.1]: 10.1-02: the client partial allowlist drops the server's removed tags with their subtree and unwraps other unknown tags
 
 ### Pending Todos
 
@@ -380,6 +384,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-09-28T21:54:18.922Z
-Stopped at: Completed 10.1-01-PLAN.md
+Last session: 2026-09-29T00:15:37.740Z
+Stopped at: Completed 10.1-02-PLAN.md
 Resume file: None