diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index 61d5f3d..f9ccf07 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -1156,7 +1156,7 @@ Plans:
   4. A host test proves checkout, activation, `invoice.paid`, `past_due` with its grace period, cancel and duplicate-event idempotency against a Stripe fake.
   5. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 3/6 plans executed
+**Plans:** 4/6 plans executed
 
 Plans:
 **Wave 1**
@@ -1165,7 +1165,7 @@ Plans:
 
 **Wave 2** *(blocked on Wave 1 completion)*
 - [x] 18.1-03-PLAN.md — sm-pgstripe-plugin: subscription secret columns and import target (D-18), plugin `golem15.pgstripesubscriptions` (webhook contract gate, gateway with plan sync from `d00f850`, both webhook URLs, claim-first River job, app-tag config), `TestHostSubscriptionFlow`
-- [ ] 18.1-04-PLAN.md — sm-paymentgatewaysubscriptions-plugin admin (plans with taglist, flat reorder and sync actions; subscriptions list and preview), permissions, EN/PL, customer API after its contract gate (D-13)
+- [x] 18.1-04-PLAN.md — sm-paymentgatewaysubscriptions-plugin admin (plans with taglist, flat reorder and sync actions; subscriptions list and preview), permissions, EN/PL, customer API after its contract gate (D-13)
 
 **Wave 3** *(blocked on 18.1-04)*
 - [ ] 18.1-05-PLAN.md — vue-paymentgateway-layer subscription client, composables and Pg components (D-14); tag `v0.2.0` with go-ahead
@@ -1364,7 +1364,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 16.3. Backend admin personal API tokens with scopes (INSERTED) | 4/4 | Complete   | 2026-10-12 |
 | 17. Blog companions | 6/6 | Complete   | 2026-10-13 |
 | 18. Payment Gateway | 8/8 | Complete   | 2026-10-14 |
-| 18.1. Payment Gateway Subscriptions | 3/6 | In Progress|  |
+| 18.1. Payment Gateway Subscriptions | 4/6 | In Progress|  |
 | 19. Chat and ChatChannels | 0/TBD | Not started | - |
 | 19.1. Chat satellites | 0/TBD | Not started | - |
 | 19.2. Chat polish against WavePath clients | 0/TBD | Not started | - |
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 6983f64..6e3996b 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "18.1"
 current_phase_name: Payment Gateway Subscriptions (INSERTED)
 status: executing
-stopped_at: Completed 18.1-03-PLAN.md
-last_updated: "2026-10-14T15:54:33.368Z"
+stopped_at: Completed 18.1-04-PLAN.md
+last_updated: "2026-10-14T16:19:47.735Z"
 last_activity: 2026-10-14
 last_activity_desc: Phase 18.1 execution started
-state_head: 7b679a9cf3ed781b95ac194075c765f833614c26
+state_head: 35887109a07a9507288f7079f0d1a35fbf394e71
 progress:
   total_phases: 40
   completed_phases: 31
   total_plans: 182
-  completed_plans: 179
+  completed_plans: 180
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12)
 ## Current Position
 
 Phase: 18.1 (Payment Gateway Subscriptions (INSERTED)) — EXECUTING
-Plan: 4 of 6
+Plan: 5 of 6
 Status: Ready to execute
 Last activity: 2026-10-14 — Phase 18.1 execution started
 
@@ -236,6 +236,7 @@ Progress: [████░░░░░░] 44%
 | Phase 18.1 P01 | 31min | 5 tasks | 37 files |
 | Phase 18.1 P02 | 45min | 5 tasks | 30 files |
 | Phase 18.1 P03 | 21 min | 4 tasks | 27 files |
+| Phase 18.1 P04 | 22 min | 5 tasks | 36 files |
 
 ## Accumulated Context
 
@@ -792,6 +793,9 @@ Recent decisions affecting current work:
 - [Phase 18.1]: 18.1-03: Stripe plan sync looks prices up with Prices List (lookup_keys, active) instead of PHP Prices Search
 - [Phase 18.1]: 18.1-03: golem15.pgstripesubscriptions is its own plugin in sm-pgstripe-plugin/subscriptions; the root package never imports it (payments-only builds link no pgsub)
 - [Phase 18.1]: 18.1-03: pgstripe:import-winter --webhook-secret-target defaults to payments (Phase 18 mapping); ReadWinterSettingsFor is additive
+- [Phase 18.1]: Customer API contract confirmed as api-research (18.1-04 Task 4): money objects per currency, 404 Subscription not found when the user has none, latest subscription with has_access and in_grace_period
+- [Phase 18.1]: pgsub plan sync admin actions never fail after the first gateway call: per-plan failures are code: message lines in the result, so provider ids saved in the bulk transaction survive
+- [Phase 18.1]: Customer API redirect targets come only from api.success_url, api.cancel_url and api.portal_return_url, resolved at boot (absolute http(s), a path joined to app.url, or empty = app.url); malformed values fail boot naming the key
 
 ### Pending Todos
 
@@ -870,6 +874,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-14T15:54:32.579Z
-Stopped at: Completed 18.1-03-PLAN.md
+Last session: 2026-10-14T16:19:37.668Z
+Stopped at: Completed 18.1-04-PLAN.md
 Resume file: None