diff --git a/scripts/check-phase32.sh b/scripts/check-phase32.sh
new file mode 100755
index 00000000..9702cb98
--- /dev/null
+++ b/scripts/check-phase32.sh
@@ -0,0 +1,760 @@
+#!/usr/bin/env bash
+# check-phase32: fail-closed gate for Phase 32, SEO foundation: the
+# framework seams (form extensions, record events, content descriptors),
+# the Journal plugin's descriptors and events, the SEO plugin
+# (sm-seo-plugin) and the demo application that mounts it.
+#
+# Stages:
+#   self-test  the go test -json and vitest detectors on planted output,
+#              the marker rule on a planted repository, the route-drift
+#              comparison, the mount detection and the docker NOT RUN rule
+#              on a faked host.
+#   go         go vet ./..., go test -short ./... and the Docker-free
+#              framework tests of the phase by required name (GO_TESTS).
+#   plugins    sm-seo-plugin and sm-journal-plugin: the workspace check (the
+#              framework resolves to this checkout), go vet, go test -short
+#              and the Docker-free tests by required name.
+#   consumers  the demo application: the workspace check, go build ./...
+#              untagged and with -tags summercms_mcp, go test -short ./...
+#              both ways, the SEO mount (NOT MOUNTED golem15.seo fails unless
+#              PHASE32_ALLOW_UNMOUNTED=1: the mount waits for the plugin tag,
+#              plan 32-06) and the route-drift check (each Journal pattern of
+#              config/menu_items.yaml equals the route the demo's Nuxt app
+#              configures for the Journal layer, else the layer default;
+#              strict URLs 301 valid pages when the two drift).
+#   docker     Docker host only: the Postgres suites by required name in the
+#              framework, both plugins and, once mounted, the demo (tagged).
+#   admin      the FormView vitest file, scripts/check-admin-openapi.sh
+#              --check, and scripts/check-admin-dist.sh when admin/src
+#              changed since the phase base.
+#   docs       TestDocsTree, summer docs:build --check, the grobotstxt
+#              decision note and its STACK row, and the SEO plugin's
+#              element typecheck and dist check.
+#   marker     D-90: the lines this phase added to non-test Go files,
+#              READMEs and docs under modules/ and docs/ name neither SEO
+#              nor a consuming application; the Journal plugin imports
+#              neither the SEO nor the sitemap plugin; the framework go.mod
+#              does not require grobotstxt.
+#
+# A Go stage exits non-zero on a failing command, or on a go test -json run
+# that fails, skips a test (a subtest included), matches zero tests, prints
+# "no tests to run" or misses a required name.
+#
+# Several stages may be given at once (--go --plugins ...). --all runs
+# self-test, go, plugins, consumers, admin, docs and marker, then docker
+# when a Docker daemon answers (NOT RUN docker otherwise, a failure with
+# PHASE32_REQUIRE_DOCKER=1). Plan 32-06 adds the additive and compat
+# stages.
+#
+# Environment overrides (default: the sibling checkouts next to this
+# repository): PHASE32_ROOT, SEO_PLUGIN, JOURNAL_PLUGIN, DEMO_APP,
+# JOURNAL_LAYER, PHASE32_BASE (the commit before the phase, plan 32-01's
+# start), PHASE32_ALLOW_UNMOUNTED, PHASE32_REQUIRE_DOCKER.
+set -euo pipefail
+
+unset FORCE_COLOR
+export NO_COLOR=1
+
+ROOT="${PHASE32_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+SEO_PLUGIN="${SEO_PLUGIN:-$ROOT/../sm-seo-plugin}"
+JOURNAL_PLUGIN="${JOURNAL_PLUGIN:-$ROOT/../sm-journal-plugin}"
+DEMO_APP="${DEMO_APP:-$ROOT/../sm-demo-app}"
+JOURNAL_LAYER="${JOURNAL_LAYER:-$ROOT/../vue-journal-layer}"
+# The framework commit before the phase (plan 32-01's start).
+PHASE32_BASE="${PHASE32_BASE:-9868838fe3d01e07d578f2b2dd557d4296c48e10}"
+
+MCP_TAG="summercms_mcp"
+SEO_ID="golem15.seo"
+
+# ---------------------------------------------------------------------------
+# Required test names: <package>:<TestName> for the framework, names for the
+# plugins and the demo (package .).
+
+# go stage: Docker-free framework tests (-short).
+GO_TESTS=(
+	./modules/cabana:TestFormExtensionPlacement ./modules/cabana:TestFormExtensionBootErrors
+	./modules/cabana:TestFormExtensionUnextendedSchemaUnchanged ./modules/cabana:TestFormExtensionTwoPluginsSameAnchor
+	./modules/cabana:TestFormExtensionOnePluginTwoControllers ./modules/cabana:TestFormExtensionWidgetsAndPartials
+	./modules/signpost:TestContentLookups ./modules/signpost:TestContentRecordsOptional
+	./modules/signpost:TestContentBootErrors ./modules/signpost:TestContentMatchPattern
+	./modules/signpost:TestContentMatchPath
+)
+
+# docker stage: Postgres tests in the framework.
+DOCKER_TESTS=(
+	./modules/cabana:TestFormExtensionTracer ./modules/cabana:TestFormExtensionSave
+	./modules/cabana:TestRecordEvents
+)
+
+# plugins stage: Docker-free tests by required name (<package>:<TestName>).
+SEO_SHORT_TESTS=(.:TestEveryAdminOperationHasTool .:TestMCPReadToolsAreGET .:TestLangKeysComplete .:TestNormalize)
+JOURNAL_SHORT_TESTS=(.:TestJournalMCP ./classes:TestMenuItemTypesPatterns)
+
+# docker stage: the plugins' and the demo's Postgres suites.
+SEO_TESTS=(
+	TestSEOTabTracer TestSEOTabPermission TestSEOTab TestRuleFormPreview TestHistoryRecordsAdminWrite
+	TestEntryDeletedWithRecord TestGenerateEntries TestResolverPrecedence
+	TestSlugChange301 TestRedirectEngine TestLoopRefused TestNotFoundLog TestAddressChangeFromEvent
+	TestStrictURL TestOneHop TestRobotsServed TestRobotsTester TestRobotsScreen TestVerificationFile
+	TestMCPSetURLSeoTracer TestManagementAPI TestIssues TestBatch TestUndo TestCSVTransfer
+)
+JOURNAL_TESTS=(TestContentDescriptors TestJournalTagType TestAPIRecordEvents TestRecordSavedDescribesNewURL TestTranslatedSlug)
+DEMO_TESTS=(TestSEOTabMounted TestSEOToolsCatalog)
+
+# admin stage: vitest files that must pass.
+ADMIN_FILES=(tests/form/FormView.test.ts)
+
+# docs stage: the decision note and the STACK row of the plugin-only
+# dependency.
+DECISION_NOTE=".planning/notes/2026-10-27-robots-txt-grobotstxt.md"
+STACK_NAMES=("github.com/jimsmart/grobotstxt")
+
+# marker stage: names of consuming applications (split so this file does
+# not match itself; the list check-phase19.7.sh uses).
+APP_NAMES=("p[lł]yta""rium" "fono""teka" "wave""path" "horo""skopia" "bm\\.jakub""zych" "grzyby""funkcjonalne" "stu""dia")
+
+usage() {
+	cat >&2 <<'EOF'
+usage:
+  check-phase32.sh --self-test
+  check-phase32.sh [--go] [--plugins] [--consumers] [--docker] [--admin] [--docs] [--marker]
+  check-phase32.sh --all
+EOF
+	exit 2
+}
+
+# detect_go reads go test -json. Exit 1 fail/build, 2 skip, 3 zero/no-tests,
+# 4 non-JSON, 5 missing required name (REQUIRE_TESTS, space-separated).
+detect_go() {
+	python3 - "$1" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+require = [n for n in os.environ.get("REQUIRE_TESTS", "").split() if n]
+passed = set()
+failed = []
+with open(path, encoding="utf-8", errors="replace") as fh:
+    for raw in fh:
+        line = raw.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            ev = json.loads(line)
+        except json.JSONDecodeError:
+            print("refuse: non-json test output", file=sys.stderr)
+            sys.exit(4)
+        action = ev.get("Action")
+        test = ev.get("Test") or ""
+        pkg = ev.get("Package") or ev.get("ImportPath") or ""
+        if action == "build-fail" or (action == "fail" and ev.get("FailedBuild")):
+            print(f"refuse: build failed {pkg}", file=sys.stderr)
+            sys.exit(1)
+        text = ev.get("Output") or ""
+        if action == "output" and "no tests to run" in text:
+            print(f"refuse: no tests to run in {pkg}", file=sys.stderr)
+            sys.exit(3)
+        if action == "skip" and test:
+            print(f"refuse: skipped {pkg} {test}", file=sys.stderr)
+            sys.exit(2)
+        if action == "fail":
+            failed.append(f"{pkg} {test}".strip())
+        if action == "pass" and test:
+            passed.add(test)
+if failed:
+    print("refuse: failed " + ", ".join(failed), file=sys.stderr)
+    sys.exit(1)
+if not passed:
+    print("refuse: zero tests", file=sys.stderr)
+    sys.exit(3)
+missing = [n for n in require if n not in passed]
+if missing:
+    print("refuse: required tests did not pass: " + ", ".join(missing), file=sys.stderr)
+    sys.exit(5)
+PY
+}
+
+# detect_vitest reads a vitest run's output. Exit 1 failed, skipped or todo
+# tests, 3 no all-passing summary, 5 a required file (REQUIRE_FILES) did
+# not pass.
+detect_vitest() {
+	python3 - "$1" <<'PY'
+import os, re, sys
+text = open(sys.argv[1], encoding="utf-8", errors="replace").read()
+text = re.sub(r"\x1b\[[0-9;]*m", "", text)
+need = os.environ.get("REQUIRE_FILES", "").split()
+summary = re.findall(r"^\s*(Test Files|Tests)\s+(.*)$", text, re.M)
+if any(re.search(r"\b(failed|skipped|todo)\b", rest) for _, rest in summary) or re.search(r"^\s*(FAIL|×)\s", text, re.M):
+    print("refuse: vitest reports failed, skipped or todo tests", file=sys.stderr)
+    sys.exit(1)
+m = re.search(r"^\s*Tests\s+(\d+) passed \((\d+)\)\s*$", text, re.M)
+if not m or m.group(1) != m.group(2) or m.group(1) == "0":
+    print("refuse: no all-passing vitest summary", file=sys.stderr)
+    sys.exit(3)
+missing = [f for f in need if not re.search(r"^\s*✓ (?:\|\w+\| )?" + re.escape(f) + r" \(\d+ tests?\)", text, re.M)]
+if missing:
+    print("refuse: did not pass: " + ", ".join(missing), file=sys.stderr)
+    sys.exit(5)
+PY
+}
+
+# go_json DIR ARGS... runs go test -json ARGS in DIR and checks the stream
+# with detect_go.
+go_json() {
+	local dir="$1"
+	shift
+	local log err rc=0 dc=0
+	log="$(mktemp)"
+	err="$(mktemp)"
+	(cd "$dir" && go test -json "$@") >"$log" 2>"$err" || rc=$?
+	detect_go "$log" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
+		cat "$err" >&2 || true
+		python3 -c 'import json,sys
+for raw in open(sys.argv[1], errors="replace"):
+    try: ev = json.loads(raw)
+    except ValueError: continue
+    out = ev.get("Output", "")
+    if ev.get("Action") == "output" and ("FAIL" in out or "SKIP" in out or "_test.go:" in out):
+        sys.stderr.write(out)' "$log" 2>&1 | tail -n 40 >&2 || true
+		rm -f "$log" "$err"
+		echo "refuse: go test $* in $dir (test=$rc detect=$dc)" >&2
+		return 1
+	fi
+	echo "go: $(grep -c '"Action":"pass","Package":"[^"]*","Test":"[^"/]*","Elapsed"' "$log") top-level tests passed in $dir ($*)"
+	rm -f "$log" "$err"
+}
+
+# go_named DIR PACKAGE FLAGS NAME... runs exactly the named top-level tests
+# and requires every one to pass. FLAGS is word-split.
+go_named() {
+	local dir="$1" pkg="$2" flags="$3"
+	shift 3
+	if [[ "$#" -eq 0 ]]; then
+		echo "refuse: go_named $pkg in $dir without required names" >&2
+		return 1
+	fi
+	local names=("$@") regex
+	regex="^($(IFS='|'; echo "${names[*]}"))\$"
+	# shellcheck disable=SC2086
+	REQUIRE_TESTS="${names[*]}" go_json "$dir" $flags -count=1 -run "$regex" "$pkg"
+}
+
+# go_pkg_named DIR FLAGS ENTRY... groups <package>:<TestName> entries by
+# package and runs go_named once per package.
+go_pkg_named() {
+	local dir="$1" flags="$2"
+	shift 2
+	local entry pkg name pkgs=()
+	declare -A by=()
+	for entry in "$@"; do
+		pkg="${entry%%:*}"
+		name="${entry#*:}"
+		if [[ -z "$pkg" || -z "$name" || "$pkg" == "$entry" ]]; then
+			echo "refuse: malformed required test entry $entry" >&2
+			return 1
+		fi
+		if [[ -z "${by[$pkg]+x}" ]]; then
+			pkgs+=("$pkg")
+			by[$pkg]="$name"
+		else
+			by[$pkg]="${by[$pkg]} $name"
+		fi
+	done
+	for pkg in "${pkgs[@]}"; do
+		# shellcheck disable=SC2086
+		go_named "$dir" "$pkg" "$flags" ${by[$pkg]}
+	done
+}
+
+# go_short DIR [FLAGS] runs go test -short ./... in DIR.
+go_short() {
+	local dir="$1" flags="${2:-}" out
+	# shellcheck disable=SC2086
+	if ! out="$(cd "$dir" && go test $flags -count=1 -short ./... 2>&1)"; then
+		printf '%s\n' "$out" | grep -v '^ok ' | tail -n 60 >&2
+		echo "refuse: go test -short ./... $flags in $dir" >&2
+		return 1
+	fi
+	echo "short: $dir ($flags)"
+}
+
+go_vet() {
+	local dir="$1"
+	shift
+	(cd "$dir" && go vet "$@")
+	echo "vet: $dir ($*)"
+}
+
+require_dir() {
+	[[ -d "$1" ]] || {
+		echo "refuse: $2 $1 not found" >&2
+		return 1
+	}
+}
+
+# workspace_check DIR refuses a repository that does not resolve the
+# framework to this checkout (no trust in local go.work files).
+workspace_check() {
+	local dir="$1" got rgot rwant
+	got="$( (cd "$dir" && go list -m -f '{{if .Replace}}{{.Replace.Dir}}{{else}}{{.Dir}}{{end}}' git.golem15.com/golem15/summercms 2>/dev/null) || true)"
+	rgot="$(realpath -e -- "$got" 2>/dev/null || true)"
+	rwant="$(realpath -e -- "$ROOT" 2>/dev/null || true)"
+	if [[ -z "$got" || -z "$rgot" || "$rgot" != "$rwant" ]]; then
+		echo "refuse: $dir resolves git.golem15.com/golem15/summercms to ${got:-<nothing>}, not $ROOT" >&2
+		return 1
+	fi
+	echo "workspace: $dir resolves the framework to $rwant"
+}
+
+# seo_mounted MANIFEST reports whether an application's summer.yaml lists
+# the SEO plugin.
+seo_mounted() {
+	grep -qE "^[[:space:]]*-[[:space:]]*id:[[:space:]]*${SEO_ID//./\\.}[[:space:]]*$" "$1"
+}
+
+# mount_verdict DIR prints the mount state of an application and refuses
+# an unmounted one unless PHASE32_ALLOW_UNMOUNTED=1.
+mount_verdict() {
+	local dir="$1"
+	if seo_mounted "$dir/summer.yaml"; then
+		echo "mount: $dir mounts $SEO_ID"
+		return 0
+	fi
+	echo "NOT MOUNTED $SEO_ID in $dir (the mount waits for the plugin tag: .planning/phases/32-seo-foundation/32-05-demo-mount.patch, plan 32-06)"
+	if [[ "${PHASE32_ALLOW_UNMOUNTED:-0}" == "1" ]]; then
+		return 0
+	fi
+	echo "refuse: $SEO_ID is not mounted in $dir; set PHASE32_ALLOW_UNMOUNTED=1 before plan 32-06" >&2
+	return 1
+}
+
+# route_drift MENU_ITEMS NUXT_CONFIG LAYER_ROUTES compares each Journal
+# pattern of menu_items.yaml (journal-post, journal-category, journal-tag
+# when set) with the route the Nuxt app configures for the Journal layer,
+# else the layer default; placeholder names do not count. It prints one
+# refuse: line per drift and exits 1 on any.
+route_drift() {
+	python3 - "$1" "$2" "$3" <<'PY'
+import re, sys
+menu_path, nuxt_path, layer_path = sys.argv[1:4]
+
+def norm(p):
+    return re.sub(r":[A-Za-z_][A-Za-z0-9_]*", ":*", p.strip().strip("'\"")) if isinstance(p, str) else p
+
+menu = {}
+for line in open(menu_path, encoding="utf-8"):
+    m = re.match(r"^\s+(journal-[a-z]+):\s*(\S+)\s*$", line)
+    if m:
+        menu[m.group(1)] = m.group(2).strip("'\"")
+
+def routes_of(text, block):
+    m = re.search(block, text, re.S)
+    out = {}
+    if not m:
+        return out
+    for k, v in re.findall(r"(\w+):\s*('[^']*'|\"[^\"]*\"|false)", m.group(1)):
+        out[k] = False if v == "false" else v.strip("'\"")
+    return out
+
+layer = {}
+try:
+    layer = routes_of(open(layer_path, encoding="utf-8").read(), r"DEFAULT_JOURNAL_ROUTES[^{]*\{(.*?)\}")
+except OSError:
+    pass
+nuxt = {}
+try:
+    nuxt = routes_of(open(nuxt_path, encoding="utf-8").read(), r"journal:\s*\{\s*routes:\s*\{(.*?)\}")
+except OSError:
+    pass
+drift = 0
+for item, key in (("journal-post", "post"), ("journal-category", "category"), ("journal-tag", "tag")):
+    if item not in menu:
+        continue
+    want = nuxt.get(key, layer.get(key))
+    if want is None:
+        print(f"refuse: no Nuxt route for {key} (menu_items {item} {menu[item]})", file=sys.stderr)
+        drift += 1
+        continue
+    if want is False or norm(want) != norm(menu[item]):
+        print(f"refuse: route drift: menu_items {item} {menu[item]} but the Nuxt {key} route is {want}", file=sys.stderr)
+        drift += 1
+        continue
+    print(f"route: {item} {menu[item]} matches the Nuxt {key} route {want}")
+sys.exit(1 if drift else 0)
+PY
+}
+
+# marker_hits DIR BASE prints file:line for every line added since BASE to
+# a non-test Go file, a README or a docs page under modules/ or docs/ that
+# names SEO or a consuming application (D-90).
+marker_hits() {
+	local dir="$1" base="$2" pattern
+	pattern="\\bseo\\b|$(IFS='|'; echo "${APP_NAMES[*]}")"
+	git -C "$dir" diff -U0 "$base" HEAD -- 'modules/*.go' 'modules/**/*.go' 'modules/**/README.md' 'docs' ':(exclude)*_test.go' ':(exclude)**/*_test.go' |
+		PATTERN="$pattern" python3 -c '
+import os, re, sys
+pat = re.compile(os.environ["PATTERN"], re.I)
+path, line = "", 0
+for raw in sys.stdin:
+    if raw.startswith("+++ "):
+        path = raw[6:].rstrip("\n") if raw.startswith("+++ b/") else ""
+        continue
+    m = re.match(r"^@@ -\S+ \+(\d+)", raw)
+    if m:
+        line = int(m.group(1))
+        continue
+    if raw.startswith("+") and not raw.startswith("+++"):
+        if path and pat.search(raw[1:]):
+            print(f"{path}:{line}: {raw[1:].strip()[:120]}")
+        line += 1
+'
+}
+
+expect_detector() {
+	local detector="$1" name="$2" want="$3" payload="$4" log dc=0
+	log="$(mktemp)"
+	printf '%s\n' "$payload" >"$log"
+	"$detector" "$log" >/dev/null 2>&1 || dc=$?
+	rm -f "$log"
+	if [[ "$dc" -ne "$want" ]]; then
+		echo "refuse: self-test $detector $name: exit $dc, want $want" >&2
+		return 1
+	fi
+	echo "PASS self-test $detector $name"
+}
+
+# expect_mode NAME WANT_EXIT WANT_TEXT MODE ENV... runs this script in MODE
+# with ENV and checks its exit status and output.
+expect_mode() {
+	local name="$1" want="$2" text="$3" mode="$4"
+	shift 4
+	local out rc=0
+	out="$(env "$@" bash "${BASH_SOURCE[0]}" "$mode" 2>&1)" || rc=$?
+	if [[ "$rc" -ne "$want" ]] || ! grep -qF -- "$text" <<<"$out"; then
+		printf '%s\n' "$out" | tail -n 10 >&2
+		echo "refuse: self-test $name: exit $rc (want $want), output must carry \"$text\"" >&2
+		return 1
+	fi
+	echo "PASS self-test $name"
+}
+
+run_self_test() {
+	bash -n "${BASH_SOURCE[0]}"
+	expect_detector detect_go pass 0 '{"Action":"pass","Package":"p","Test":"TestBatch"}'
+	expect_detector detect_go fail 1 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"fail","Package":"p","Test":"TestUndo"}'
+	expect_detector detect_go build 1 '{"Action":"build-fail","ImportPath":"p"}'
+	expect_detector detect_go skip 2 '{"Action":"pass","Package":"p","Test":"TestA"}
+{"Action":"skip","Package":"p","Test":"TestSEOTabMounted"}'
+	expect_detector detect_go subtest-skip 2 '{"Action":"skip","Package":"p","Test":"TestLoopRefused/mcp"}
+{"Action":"pass","Package":"p","Test":"TestLoopRefused"}'
+	expect_detector detect_go zero 3 '{"Action":"pass","Package":"p"}'
+	expect_detector detect_go no-tests 3 '{"Action":"output","Package":"p","Output":"testing: warning: no tests to run\n"}
+{"Action":"pass","Package":"p"}'
+	expect_detector detect_go nonjson 4 '{"Action":"pass",'
+	REQUIRE_TESTS="TestBatch TestUndo" expect_detector detect_go missing-named 5 '{"Action":"pass","Package":"p","Test":"TestBatch"}'
+	REQUIRE_TESTS="TestLoopRefused" expect_detector detect_go subtest-is-not-parent 5 '{"Action":"pass","Package":"p","Test":"TestOuter/TestLoopRefused"}
+{"Action":"pass","Package":"p","Test":"TestOther"}'
+	local ok=' ✓ tests/form/FormView.test.ts (12 tests) 15ms
+
+ Test Files  1 passed (1)
+      Tests  12 passed (12)'
+	REQUIRE_FILES="tests/form/FormView.test.ts" expect_detector detect_vitest pass 0 "$ok"
+	REQUIRE_FILES="tests/form/Other.test.ts" expect_detector detect_vitest missing-file 5 "$ok"
+	expect_detector detect_vitest failed 1 ' Test Files  1 failed | 1 passed (2)
+      Tests  1 failed | 16 passed (17)'
+	expect_detector detect_vitest no-summary 3 ' ✓ tests/form/FormView.test.ts (12 tests) 15ms'
+
+	local tmp
+	tmp="$(mktemp -d)"
+	# The marker rule on a planted repository: an added SEO name or
+	# application name in a module source or a docs page is found; a test
+	# file, and a line that was there before the base, are not.
+	git -C "$tmp" init -q
+	mkdir -p "$tmp/modules/cabana" "$tmp/docs"
+	printf 'package cabana\n\n// Old mentions SEO from before the phase.\nfunc Old() {}\n' >"$tmp/modules/cabana/old.go"
+	git -C "$tmp" add -A
+	git -C "$tmp" -c user.name=t -c user.email=t@example.test commit -q -m base
+	local base
+	base="$(git -C "$tmp" rev-parse HEAD)"
+	printf 'package cabana\n\n// Extension adds fields to a form.\nfunc Extension() {}\n' >"$tmp/modules/cabana/ext.go"
+	printf 'package cabana\n\n// The SEO tab test.\nfunc helper() {}\n' >"$tmp/modules/cabana/ext_test.go"
+	git -C "$tmp" add -A
+	git -C "$tmp" -c user.name=t -c user.email=t@example.test commit -q -m clean
+	if [[ -n "$(marker_hits "$tmp" "$base")" ]]; then
+		rm -rf "$tmp"
+		echo "refuse: self-test marker_hits flagged a clean change or a test file" >&2
+		return 1
+	fi
+	printf 'package cabana\n\n// Extension adds the SEO tab.\nfunc Extension() {}\n' >"$tmp/modules/cabana/ext.go"
+	printf '# Forms\n\nUsed by fono''teka.\n' >"$tmp/docs/forms.md"
+	git -C "$tmp" add -A
+	git -C "$tmp" -c user.name=t -c user.email=t@example.test commit -q -m dirty
+	local hits
+	hits="$(marker_hits "$tmp" "$base")"
+	if ! grep -q '^modules/cabana/ext.go:3:' <<<"$hits" || ! grep -q '^docs/forms.md:3:' <<<"$hits"; then
+		rm -rf "$tmp"
+		echo "refuse: self-test marker_hits missed a planted name: $hits" >&2
+		return 1
+	fi
+	echo "PASS self-test marker_hits"
+
+	# The route-drift comparison: placeholder names do not count, a moved
+	# route and a disabled one do.
+	mkdir -p "$tmp/rd"
+	printf 'patterns:\n    journal-post: /blog/:slug\n    journal-category: /blog/category/:slug\n' >"$tmp/rd/menu.yaml"
+	printf "export default {\n  journal: {\n    routes: {\n      post: '/blog/:slug',\n      category: '/blog/category/:category',\n      tag: false,\n    },\n  },\n}\n" >"$tmp/rd/nuxt.ts"
+	printf "export const DEFAULT_JOURNAL_ROUTES = Object.freeze({\n  post: '/blog/:slug',\n  category: '/blog/category/:category',\n  tag: '/blog/tag/:tag',\n})\n" >"$tmp/rd/routes.ts"
+	if ! route_drift "$tmp/rd/menu.yaml" "$tmp/rd/nuxt.ts" "$tmp/rd/routes.ts" >/dev/null 2>&1; then
+		rm -rf "$tmp"
+		echo "refuse: self-test route_drift refused matching routes" >&2
+		return 1
+	fi
+	printf 'patterns:\n    journal-post: /news/:slug\n' >"$tmp/rd/moved.yaml"
+	printf 'patterns:\n    journal-tag: /blog/tag/:slug\n' >"$tmp/rd/tag.yaml"
+	if route_drift "$tmp/rd/moved.yaml" "$tmp/rd/nuxt.ts" "$tmp/rd/routes.ts" >/dev/null 2>&1 ||
+		route_drift "$tmp/rd/tag.yaml" "$tmp/rd/nuxt.ts" "$tmp/rd/routes.ts" >/dev/null 2>&1; then
+		rm -rf "$tmp"
+		echo "refuse: self-test route_drift accepted a moved or disabled route" >&2
+		return 1
+	fi
+	if ! route_drift "$tmp/rd/menu.yaml" "$tmp/rd/missing.ts" "$tmp/rd/routes.ts" >/dev/null 2>&1; then
+		rm -rf "$tmp"
+		echo "refuse: self-test route_drift did not fall back to the layer defaults" >&2
+		return 1
+	fi
+	echo "PASS self-test route_drift"
+
+	# The mount detection and the NOT MOUNTED rule.
+	printf 'plugins:\n  - id: golem15.sitemap\n    module: x\n  - id: golem15.seo\n    module: y\n' >"$tmp/mounted.yaml"
+	printf 'plugins:\n  - id: golem15.sitemap\n    module: x\n  - id: golem15.seox\n    module: y\n' >"$tmp/unmounted.yaml"
+	if ! seo_mounted "$tmp/mounted.yaml" || seo_mounted "$tmp/unmounted.yaml"; then
+		rm -rf "$tmp"
+		echo "refuse: self-test seo_mounted misread a manifest" >&2
+		return 1
+	fi
+	mkdir -p "$tmp/app"
+	cp "$tmp/unmounted.yaml" "$tmp/app/summer.yaml"
+	expect_mode not-mounted 1 "NOT MOUNTED golem15.seo" --mount-verdict "DEMO_APP=$tmp/app" PHASE32_ALLOW_UNMOUNTED=0
+	expect_mode not-mounted-allowed 0 "NOT MOUNTED golem15.seo" --mount-verdict "DEMO_APP=$tmp/app" PHASE32_ALLOW_UNMOUNTED=1
+
+	# The docker NOT RUN rule: a docker that does not answer.
+	mkdir -p "$tmp/bin"
+	printf '#!/bin/sh\nexit 1\n' >"$tmp/bin/docker"
+	chmod +x "$tmp/bin/docker"
+	expect_mode docker-not-run 0 "NOT RUN docker" --docker-gate "PATH=$tmp/bin:$PATH" PHASE32_REQUIRE_DOCKER=0
+	expect_mode docker-required 1 "FAIL docker" --docker-gate "PATH=$tmp/bin:$PATH" PHASE32_REQUIRE_DOCKER=1
+	expect_mode docker-stage-needs-daemon 1 "needs a reachable Docker daemon" --docker "PATH=$tmp/bin:$PATH"
+	rm -rf "$tmp"
+	echo "phase32 self-test passed"
+}
+
+run_go() {
+	go_vet "$ROOT" ./...
+	go_short "$ROOT"
+	go_pkg_named "$ROOT" "-short" "${GO_TESTS[@]}"
+	echo "phase32 go passed"
+}
+
+run_plugins() {
+	require_dir "$SEO_PLUGIN" "SEO plugin"
+	require_dir "$JOURNAL_PLUGIN" "Journal plugin"
+	workspace_check "$SEO_PLUGIN"
+	workspace_check "$JOURNAL_PLUGIN"
+	go_vet "$SEO_PLUGIN" ./...
+	go_short "$SEO_PLUGIN"
+	go_pkg_named "$SEO_PLUGIN" "-short" "${SEO_SHORT_TESTS[@]}"
+	go_vet "$JOURNAL_PLUGIN" ./...
+	go_short "$JOURNAL_PLUGIN"
+	go_pkg_named "$JOURNAL_PLUGIN" "-short" "${JOURNAL_SHORT_TESTS[@]}"
+	echo "phase32 plugins passed"
+}
+
+run_consumers() {
+	require_dir "$DEMO_APP" "demo application"
+	workspace_check "$DEMO_APP"
+	(cd "$DEMO_APP" && go build ./...)
+	echo "build: $DEMO_APP"
+	(cd "$DEMO_APP" && go build -tags "$MCP_TAG" ./...)
+	echo "build: $DEMO_APP (-tags $MCP_TAG)"
+	go_short "$DEMO_APP"
+	go_short "$DEMO_APP" "-tags $MCP_TAG"
+	mount_verdict "$DEMO_APP"
+	route_drift "$DEMO_APP/config/menu_items.yaml" "$DEMO_APP/vue-demo-app/nuxt.config.ts" "$JOURNAL_LAYER/app/utils/routes.ts"
+	echo "phase32 consumers passed"
+}
+
+docker_up() {
+	command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1
+}
+
+run_docker() {
+	if ! docker_up; then
+		echo "refuse: the docker stage needs a reachable Docker daemon (testcontainers); run it on a Docker host" >&2
+		return 1
+	fi
+	require_dir "$SEO_PLUGIN" "SEO plugin"
+	require_dir "$JOURNAL_PLUGIN" "Journal plugin"
+	require_dir "$DEMO_APP" "demo application"
+	workspace_check "$SEO_PLUGIN"
+	workspace_check "$JOURNAL_PLUGIN"
+	go_pkg_named "$ROOT" "-timeout 20m" "${DOCKER_TESTS[@]}"
+	go_named "$SEO_PLUGIN" . "-timeout 20m" "${SEO_TESTS[@]}"
+	go_named "$JOURNAL_PLUGIN" . "-timeout 20m" "${JOURNAL_TESTS[@]}"
+	if seo_mounted "$DEMO_APP/summer.yaml"; then
+		workspace_check "$DEMO_APP"
+		go_named "$DEMO_APP" . "-timeout 20m -tags $MCP_TAG" "${DEMO_TESTS[@]}"
+	else
+		mount_verdict "$DEMO_APP"
+	fi
+	echo "phase32 docker passed"
+}
+
+# docker_gate is the docker step of --all: run the stage when a daemon
+# answers, fail with PHASE32_REQUIRE_DOCKER=1, print NOT RUN otherwise.
+docker_gate() {
+	if docker_up; then
+		if bash "${BASH_SOURCE[0]}" --docker; then
+			echo "PASS docker"
+			return 0
+		fi
+		echo "FAIL docker"
+		return 1
+	fi
+	if [[ "${PHASE32_REQUIRE_DOCKER:-0}" == "1" ]]; then
+		echo "FAIL docker: no reachable Docker daemon and PHASE32_REQUIRE_DOCKER=1"
+		return 1
+	fi
+	cat >&2 <<'EOF'
+************************************************************************
+NOT RUN docker: no reachable Docker daemon on this host.
+The Postgres suites of the framework, the SEO and Journal plugins and the
+demo did NOT run. Run on a Docker host (through sudo -u golem when the
+socket is denied) before /msd-verify-work:
+  bash scripts/check-phase32.sh --docker
+************************************************************************
+EOF
+	echo "NOT RUN docker (Docker-host only; see the notice above)"
+}
+
+run_admin() {
+	local log rc=0 dc=0
+	log="$(mktemp)"
+	npm --prefix "$ROOT/admin" run test >"$log" 2>&1 || rc=$?
+	REQUIRE_FILES="${ADMIN_FILES[*]}" detect_vitest "$log" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
+		grep -E '(FAIL|×|Error|expected)' "$log" | head -n 40 >&2 || true
+		tail -n 20 "$log" >&2
+		rm -f "$log"
+		echo "refuse: npm run test in admin (test=$rc detect=$dc)" >&2
+		return 1
+	fi
+	echo "vitest (admin): $(grep -E '^\s*Tests\s' "$log" | tr -s ' ')"
+	rm -f "$log"
+	(cd "$ROOT" && bash scripts/check-admin-openapi.sh --check)
+	if git -C "$ROOT" diff --quiet "$PHASE32_BASE" HEAD -- admin/src; then
+		echo "admin: admin/src unchanged since $PHASE32_BASE, dist check not needed"
+	else
+		(cd "$ROOT" && bash scripts/check-admin-dist.sh)
+	fi
+	echo "phase32 admin passed"
+}
+
+run_docs() {
+	go_named "$ROOT" ./cmd/summer "" TestDocsTree
+	(cd "$ROOT" && go run ./cmd/summer docs:build --check)
+	if [[ ! -f "$ROOT/$DECISION_NOTE" ]] || ! grep -qF "grobotstxt" "$ROOT/$DECISION_NOTE"; then
+		echo "refuse: the decision note $DECISION_NOTE is missing or does not name grobotstxt" >&2
+		return 1
+	fi
+	echo "note: $DECISION_NOTE"
+	local name
+	for name in "${STACK_NAMES[@]}"; do
+		if ! grep -qF -- "| \`$name\`" "$ROOT/.planning/research/STACK.md"; then
+			echo "refuse: .planning/research/STACK.md has no row for $name" >&2
+			return 1
+		fi
+	done
+	echo "stack: rows for ${STACK_NAMES[*]}"
+	require_dir "$SEO_PLUGIN" "SEO plugin"
+	npm --prefix "$SEO_PLUGIN" run typecheck >/dev/null
+	echo "typecheck: $SEO_PLUGIN elements"
+	bash "$SEO_PLUGIN/scripts/check-dist.sh"
+	echo "phase32 docs passed"
+}
+
+run_marker() {
+	if ! git -C "$ROOT" rev-parse --verify -q "$PHASE32_BASE^{commit}" >/dev/null; then
+		echo "refuse: PHASE32_BASE $PHASE32_BASE is not a commit of $ROOT" >&2
+		return 1
+	fi
+	local hits imports
+	hits="$(marker_hits "$ROOT" "$PHASE32_BASE")"
+	if [[ -n "$hits" ]]; then
+		printf '%s\n' "$hits" | head -n 40 >&2
+		echo "refuse: framework lines added since $PHASE32_BASE name SEO or a consuming application (D-90)" >&2
+		return 1
+	fi
+	echo "marker: no line added since ${PHASE32_BASE:0:7} under modules/ or docs/ names SEO or a consuming application"
+	require_dir "$JOURNAL_PLUGIN" "Journal plugin"
+	imports="$(grep -rnE '"git\.golem15\.com/golem15/sm-(seo|sitemap)-plugin' --include='*.go' "$JOURNAL_PLUGIN" || true)"
+	if [[ -n "$imports" ]]; then
+		printf '%s\n' "$imports" >&2
+		echo "refuse: the Journal plugin imports the SEO or the sitemap plugin (D-90: content plugins import nothing)" >&2
+		return 1
+	fi
+	echo "journal: imports neither sm-seo-plugin nor sm-sitemap-plugin"
+	if grep -q 'jimsmart/grobotstxt' "$ROOT/go.mod"; then
+		echo "refuse: the framework go.mod requires grobotstxt (plugin-only dependency)" >&2
+		return 1
+	fi
+	echo "go.mod: the framework does not require grobotstxt"
+	echo "phase32 marker passed"
+}
+
+run_all() {
+	local stage
+	for stage in self-test go plugins consumers admin docs marker; do
+		if bash "${BASH_SOURCE[0]}" "--$stage"; then
+			echo "PASS $stage"
+		else
+			echo "FAIL $stage"
+			exit 1
+		fi
+	done
+	docker_gate || exit 1
+	echo "Phase 32 gate passed"
+}
+
+run_stage() {
+	case "$1" in
+		--self-test | self-test) run_self_test ;;
+		--go | go) run_go ;;
+		--plugins | plugins) run_plugins ;;
+		--consumers | consumers) run_consumers ;;
+		--docker | docker) run_docker ;;
+		--docker-gate) docker_gate ;;
+		--mount-verdict) mount_verdict "$DEMO_APP" ;;
+		--admin | admin) run_admin ;;
+		--docs | docs) run_docs ;;
+		--marker | marker) run_marker ;;
+		--all | all) run_all ;;
+		*) usage ;;
+	esac
+}
+
+if [[ "$#" -eq 0 ]]; then
+	run_all
+	exit 0
+fi
+if [[ "$#" -eq 1 ]]; then
+	run_stage "$1"
+	exit 0
+fi
+for arg in "$@"; do
+	if bash "${BASH_SOURCE[0]}" "$arg"; then
+		echo "PASS ${arg#--}"
+	else
+		echo "FAIL ${arg#--}"
+		exit 1
+	fi
+done