diff --git a/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
index b1c43fa..5c08692 100644
--- a/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
+++ b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-RESEARCH.md
@@ -535,13 +535,13 @@ Values are discretionary; verified working DSN shape: `postgres://summer:summer@
 | A6 | Compose `.env` interpolation tolerates the generated `.env` | compose.yaml | Low — values verified free of `$` |
 | A7 | Exact Docker CLI install method for node:24-bookworm | Container acceptance | Low |
 
-## Open Questions
+## Open Questions (RESOLVED)
 
-1. **Denylist beyond D-02's regex (`main`, `internal`, Go keywords).** Known: they break the build (verified). Unclear: whether the user wants this stated in the public contract. Recommendation: reject them in `summer new` and mention the rule in docs and `--help`; confirm at the plan checkpoint.
-2. **Default DB port/credentials.** Recommendation: user/password `summer`/`summer`, DB `<name>`, a fixed non-5432 loopback host port (e.g. 54320–54399; optionally derived from the name to avoid clashes between several apps). Planner's call.
-3. **Where next steps are printed** (script vs `summer new`). Recommendation: `summer new` prints them (useful for manual runs); the script adds only the PATH hint.
-4. **New module name** for the embedded script (e.g. `sunrise`) — planner's call; it needs a README and root table row.
-5. **`go.sum` at the app root.** Not needed in workspace mode; running `go mod tidy` after `generate()` would add one for `GOWORK=off` builds. Recommendation: skip (matches both reference apps' reliance on `go.work`).
+1. **Denylist beyond D-02's regex (`main`, `internal`, Go keywords).** Known: they break the build (verified). Unclear: whether the user wants this stated in the public contract. Recommendation: reject them in `summer new` and mention the rule in docs and `--help`; confirm at the plan checkpoint. **RESOLVED:** D-22 (adopted).
+2. **Default DB port/credentials.** Recommendation: user/password `summer`/`summer`, DB `<name>`, a fixed non-5432 loopback host port (e.g. 54320–54399; optionally derived from the name to avoid clashes between several apps). Planner's call. **RESOLVED:** D-23; plan 01 picks 127.0.0.1:54320, summer/summer, DB <name>.
+3. **Where next steps are printed** (script vs `summer new`). Recommendation: `summer new` prints them (useful for manual runs); the script adds only the PATH hint. **RESOLVED:** D-24.
+4. **New module name** for the embedded script (e.g. `sunrise`) — planner's call; it needs a README and root table row. **RESOLVED:** D-26; plan 02 names it `sunrise`.
+5. **`go.sum` at the app root.** Not needed in workspace mode; running `go mod tidy` after `generate()` would add one for `GOWORK=off` builds. Recommendation: skip (matches both reference apps' reliance on `go.work`). **RESOLVED:** D-25.
 
 ## Environment Availability