docs(15-04): complete journal tests, gate, and ASVS review plan

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: 15
 current_phase_name: Journal plugin
 status: executing
-stopped_at: Completed 15-03-PLAN.md
-last_updated: "2026-10-06T17:12:00Z"
+stopped_at: Completed 15-04-PLAN.md
+last_updated: "2026-10-06T17:22:19Z"
 last_activity: 2026-10-06
-last_activity_desc: Completed 15-03 journal public API, writes, media, RSS, Typesense gate
-state_head: 685837a3c8e23c2f05e2b367f42bd8d53e9b432b
+last_activity_desc: Completed 15-04 journal tests, phase gate, and ASVS review
+state_head: 7307b36baaad660c84b5b365f2dac17ca7313941
 progress:
   total_phases: 26
   completed_phases: 12
   total_plans: 135
-  completed_plans: 134
+  completed_plans: 135
 milestone_name: milestone
 ---
 
@@ -30,16 +30,16 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 
 Phase: 15 (Journal plugin) — EXECUTING
 Plan: 4 of 4
-Status: Ready to execute
-Last activity: 2026-10-06 — Completed 15-03 journal public API, writes, media, RSS, Typesense gate
+Status: Ready for phase verification
+Last activity: 2026-10-06 — Completed 15-04 journal tests, phase gate, and ASVS review
 
-Progress: [████████░░] 75%
+Progress: [██████████] 100%
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 64
+- Total plans completed: 65
 - Average duration: 21 min
 - Total execution time: 104 min
 
@@ -601,6 +601,8 @@ Recent decisions affecting current work:
 - [Phase 15]: journal:export-posts/import-posts are JSON-per-slug files matching PHP ExportPosts/ImportPosts (--path, --dry-run, --force), not a Winter CSV framework
 - [Phase 15]: Posts toolbar extra buttons are HasAdminActions names exportPosts/importPosts with golem15.journal.access_import_export; create/delete stay reserved
 - [Phase 15]: NavigationItem has no IconSvg; journal-icon.svg is go:embed in AdminFS; user_id is WritableForeignKey and FormBeforeCreate stamps it when empty
+- [Phase 15]: 15-04 security review was executor-self-performed (no gsd-security-auditor in this Cursor session); every cited TestName was re-run. Wave-3 HTTP tests stay at plugin root; controllers/api holds clampPerPage/media path units plus EndToEnd stubs.
+- [Phase 15]: Host journal gitlink is a nested clone; bump via file:// fetch with protocol.file.allow=always. TestSearchGateOff must not skip.
 
 ### Pending Todos