diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index d041f05..4103e3e 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -163,6 +163,9 @@ Quality
 | Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | ✓ Good (Phase 3: fonoteka.go workspace, user + fonoteka plugins, app.Handler test seam) |
 | Shared core plugins live in their own `sm-<name>-plugin` repos, mounted into each application as git submodules (first: sm-user-plugin, module `git.golem15.com/golem15/sm-user-plugin`) | A second application (sm-summercmsio-app) exists and the Journal port is next; one copy per core plugin instead of forks; supersedes the Phase 1 keios.eu trigger (`.planning/notes/core-plugins-own-repos.md`) | ✓ Good (2026-10-02, quick 261002-esz) |
 | OAuth identities live in sm-user-plugin; Index/Destroy are host-mounted on the JWT group | Social-login rows are a user-plugin table (D-01); routes stay off `/_user` so the host owns Winter 404 and `throttle:10,1` | ✓ Good (Phase 14.1, 2026-10-05; corpus 175/175/0) |
+| The local dev stack is the Nuxt app proxied to the Go binary, guarded fail-closed (`fonoteka.go/scripts/dev-stack.sh`), with dev-only seed and marker route gated on `SUMMER_ENV=local` only | Proves the port in daily use before cutover without touching the production origin; `dev` is refused because shared servers often use that name (review WR-05) | ✓ Good (Phase 14.2, 2026-10-12; gate e2e 17/0/0/0, manual UAT 1-11) |
+| Framework serves public uploads itself (`storage.uploads.serve`, opt-in) with nosniff, a sandboxing CSP and attachment disposition for non-images | Local runs need WinterCMS upload URLs without nginx; the hardening keeps uploaded HTML or SVG from running on the app origin (review WR-03) | ✓ Good (Phase 14.2) |
+| The opt-in request log (`http.access_log`) records method, matched pattern, status and duration, never the URL path | Share and invitation tokens travel in paths (review WR-01); an unported route shows as a 404 with an empty pattern | ✓ Good (Phase 14.2) |
 
 ## Evolution
 
@@ -182,4 +185,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-10-05 after Phase 14.1 completion*
+*Last updated: 2026-10-12 after Phase 14.2 completion*
diff --git a/.planning/STATE.md b/.planning/STATE.md
index f3e933a..6b06884 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -5,10 +5,10 @@ current_phase: 17
 current_phase_name: Blog companions
 status: executing
 stopped_at: Phase 14.2 complete; Phase 17 at plan 3 of 4
-last_updated: "2026-10-12T11:02:57.775Z"
+last_updated: "2026-10-12T11:03:39.823Z"
 last_activity: 2026-10-12
 last_activity_desc: Phase 14.2 complete (Phase 17 position kept)
-state_head: 55476db582d76972cfcd7d18e1c28b86a73a0f39
+state_head: 3d42d35c8a733e5862dcbc52dfc91841582a9922
 progress:
   total_phases: 40
   completed_phases: 14
@@ -23,10 +23,10 @@ milestone_name: milestone
 
 ## Project Reference
 
-See: .planning/PROJECT.md (updated 2026-09-16)
+See: .planning/PROJECT.md (updated 2026-10-12)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 14.2 — Local Fonoteka frontend on local SummerCMS backend
+**Current focus:** Phase 17 — Blog companions
 
 ## Current Position