diff --git a/scripts/check-phase16.2.sh b/scripts/check-phase16.2.sh
index 0c757c5..f26e068 100755
--- a/scripts/check-phase16.2.sh
+++ b/scripts/check-phase16.2.sh
@@ -5,21 +5,34 @@
 #
 # Stages:
 #   go        go vet in both Go repositories; the framework's field type tests
-#             and the Journal classes and controllers tests (including the
-#             editor-corpus policy cross-check); the 16.1 policy test files
-#             must be unchanged since c60abc6.
+#             and the Docker-free admin route conformance inventory
+#             (TestPhase10ConformanceInventory: every inventoried admin route
+#             has a conformance case); the Journal classes and controllers
+#             tests (including the editor-corpus policy cross-check and the
+#             site cache purger, TestSiteCachePurgeConfig and
+#             TestSiteCachePurgeRequest); the 16.1 policy test files must be
+#             unchanged since c60abc6.
 #   admin     the admin SPA typecheck and full vitest suite.
 #   editor    the Blog Editor typecheck and full vitest suite (smoke, corpus,
 #             preview, element, schema, serializer, embed).
-#   layer     the vue-journal-layer node --test suite and the editor corpus
-#             copy, which must equal the plugin's byte for byte (cmp).
+#   layer     the vue-journal-layer node --test suite (including the site
+#             cache purge tests) and the editor corpus copy, which must equal
+#             the plugin's byte for byte (cmp).
+#   cache     builds the layer playground (routeRules swr) and runs
+#             testing/purge-check.mjs on it (post hello-acme at
+#             /blog/hello-acme: a cached page shows a change on the first
+#             request after an authorized purge, guards refuse the rest), then
+#             the acme SSR smoke against the same build.
 #   docs      TestDocsTree, the admin OpenAPI and dist drift gates and the
 #             plugin's assets/dist drift gate.
 #   postgres  Docker host only: the testcontainers suites (cabana, including
-#             TestFieldTypeSavePostgres; the Journal admin harness, including
-#             TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML,
-#             TestCategoriesAdminContent and TestCategoriesAdminBlogEditor).
-#             Without a reachable Docker daemon this stage fails.
+#             TestFieldTypeSavePostgres and TestPhase10OpenAPIConformance; the
+#             Journal admin harness, including TestPostsAdminResaveKeepsHTML,
+#             TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent,
+#             TestCategoriesAdminBlogEditor, TestJournalSVGEmbed and the site
+#             cache purge suites TestCategoriesAdminPurgesSiteCache and
+#             TestPostsAdminPurgesSiteCache). Without a reachable Docker daemon
+#             this stage fails.
 #
 # Every stage exits non-zero on a failing command; a go test -json run that
 # fails, skips, matches zero tests, prints "no tests to run" or misses a named
@@ -29,7 +42,7 @@
 # test. --self-test proves the detectors and the corpus comparison fail on
 # planted output.
 #
-# --all runs self-test, go, admin, editor, layer and docs, then postgres when
+# --all runs self-test, go, admin, editor, layer, cache and docs, then postgres when
 # a Docker daemon answers. When none does, --all says so loudly (NOT RUN
 # postgres) and the Docker suites stay a manual step for a Docker host:
 #   bash scripts/check-phase16.2.sh postgres
@@ -48,7 +61,7 @@ LAYER="${LAYER:-$ROOT/../vue-journal-layer}"
 POLICY_BASE="c60abc6"
 
 # Framework tests (modules/pact, modules/cabana) that must pass by name.
-FRAMEWORK_RUN='^(TestFormFieldErrorMessage|TestFormFieldTypeContract|TestFieldTypeRegistry|TestFieldTypeOptions|TestFieldTypeCompile|TestFieldTypeDecode|TestFieldTypeNotices|TestFieldTypeUntouched|TestFieldTypeLoad|TestFieldTypeListValue|TestFieldTypeWrites|TestFieldTypesRoute|TestFieldUpload|TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase10CSRF|TestPhase09ContractInventory|TestPhase09PermissionMatrix|ExampleCompileFormWithTypes)$'
+FRAMEWORK_RUN='^(TestFormFieldErrorMessage|TestFormFieldTypeContract|TestFieldTypeRegistry|TestFieldTypeOptions|TestFieldTypeCompile|TestFieldTypeDecode|TestFieldTypeNotices|TestFieldTypeUntouched|TestFieldTypeLoad|TestFieldTypeListValue|TestFieldTypeWrites|TestFieldTypesRoute|TestFieldUpload|TestFieldTypeTracerSmoke|TestFieldTypeExpansionSmoke|TestPhase10CSRF|TestPhase09ContractInventory|TestPhase09PermissionMatrix|TestPhase10ConformanceInventory|ExampleCompileFormWithTypes)$'
 FRAMEWORK_REQUIRE=(
 	TestFormFieldErrorMessage TestFormFieldTypeContract
 	TestFieldTypeRegistry TestFieldTypeOptions TestFieldTypeCompile TestFieldTypeDecode
@@ -56,6 +69,7 @@ FRAMEWORK_REQUIRE=(
 	TestFieldTypeWrites TestFieldTypesRoute TestFieldUpload
 	TestFieldTypeTracerSmoke TestFieldTypeExpansionSmoke
 	TestPhase10CSRF TestPhase09ContractInventory TestPhase09PermissionMatrix
+	TestPhase10ConformanceInventory
 	ExampleCompileFormWithTypes
 )
 # Journal classes and controllers tests that must pass by name (the packages
@@ -68,13 +82,15 @@ JOURNAL_REQUIRE=(
 	TestMediaObjectPath TestMediaFolderPatternRejectsDotDot
 	TestPostsEditorHooks TestBlogEditorTracerSmoke TestBlogEditorUploadSmoke
 	TestWriteMediaStoreError
+	TestSiteCachePurgeConfig TestSiteCachePurgeRequest
 )
 # Docker-host suites.
-PG_FRAMEWORK_REQUIRE=(TestFieldTypeSavePostgres TestListRelationSearchPostgres)
+PG_FRAMEWORK_REQUIRE=(TestFieldTypeSavePostgres TestListRelationSearchPostgres TestPhase10OpenAPIConformance)
 PG_JOURNAL_REQUIRE=(
 	TestPostsFormCompiles TestPostsAdminCreateSmoke TestPostsAdminResaveKeepsHTML
 	TestPostsAdminSaveSanitizesHTML TestCategoriesAdminContent TestCategoriesAdminBlogEditor
 	TestJournalSVGEmbed
+	TestCategoriesAdminPurgesSiteCache TestPostsAdminPurgesSiteCache
 )
 
 ADMIN_FILES=(
@@ -107,14 +123,18 @@ LAYER_REQUIRE=(
 	"the sinks expand after sanitizing and the payload transforms never expand"
 	"the Go policy negatives are stripped the same way here"
 	"the editor corpus has the entries the mirror rules are for"
+	"purge auth: a missing or short token disables the route"
+	"purge auth: a proxied request is refused before the token is checked"
+	"purge auth: a missing or wrong bearer token is unauthorized"
+	"purge removes every route cache entry and only those"
 )
 
 usage() {
 	cat >&2 <<'EOF'
 usage:
   check-phase16.2.sh --self-test
-  check-phase16.2.sh go | admin | editor | layer | docs | postgres
-  check-phase16.2.sh --go | --admin | --editor | --layer | --docs | --postgres
+  check-phase16.2.sh go | admin | editor | layer | cache | docs | postgres
+  check-phase16.2.sh --go | --admin | --editor | --layer | --cache | --docs | --postgres
   check-phase16.2.sh --all
 EOF
 	exit 2
@@ -434,7 +454,7 @@ ok 1 - a
 	rm -f "$a" "$b"
 
 	local mode
-	for mode in self-test go admin editor layer docs postgres all; do
+	for mode in self-test go admin editor layer cache docs postgres all; do
 		grep -q -- "^	--$mode" "${BASH_SOURCE[0]}" || {
 			echo "refuse: missing mode --$mode" >&2
 			return 1
@@ -484,6 +504,28 @@ run_layer() {
 	echo "phase16.2 layer passed"
 }
 
+# run_cache proves the site cache purge end to end on the layer playground,
+# whose routeRules cache every page, then runs the acme SSR smoke against the
+# same build.
+run_cache() {
+	require_dir "$LAYER" "layer repository"
+	local log rc=0
+	pnpm -C "$LAYER" run build:playground >/dev/null
+	log="$(mktemp)"
+	node "$LAYER/testing/purge-check.mjs" --output "$LAYER/.playground/.output" --fixtures "$LAYER/testing/fixtures/acme" \
+		--kind post --slug hello-acme --path /blog/hello-acme >"$log" 2>&1 || rc=$?
+	if [[ "$rc" -ne 0 ]] || ! tail -n 1 "$log" | grep -q '^purge-check: ok'; then
+		cat "$log" >&2
+		rm -f "$log"
+		echo "refuse: purge-check on the layer playground (exit $rc)" >&2
+		return 1
+	fi
+	tail -n 1 "$log"
+	rm -f "$log"
+	node "$LAYER/testing/smoke-ssr.mjs" --output "$LAYER/.playground/.output" --fixtures "$LAYER/testing/fixtures/acme" --expect "$LAYER/testing/expect-acme.txt"
+	echo "phase16.2 cache passed"
+}
+
 run_docs() {
 	require_dir "$JOURNAL" "Journal plugin"
 	REQUIRE_TESTS="TestDocsTree" go_json "$ROOT" -count=1 -run '^TestDocsTree$' ./cmd/summer
@@ -510,7 +552,7 @@ run_postgres() {
 
 run_all() {
 	local stage
-	for stage in self-test go admin editor layer docs; do
+	for stage in self-test go admin editor layer cache docs; do
 		if bash "${BASH_SOURCE[0]}" "--$stage"; then
 			echo "PASS $stage"
 		else
@@ -532,9 +574,11 @@ run_all() {
 		cat >&2 <<'EOF'
 ************************************************************************
 NOT RUN postgres: no reachable Docker daemon on this host.
-The testcontainers suites (TestFieldTypeSavePostgres, the Journal admin
-harness incl. TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML,
-TestCategoriesAdminContent, TestCategoriesAdminBlogEditor) did NOT run.
+The testcontainers suites (TestFieldTypeSavePostgres,
+TestPhase10OpenAPIConformance, the Journal admin harness incl.
+TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML,
+TestCategoriesAdminContent, TestCategoriesAdminBlogEditor, TestJournalSVGEmbed
+and the site cache purge suites) did NOT run.
 Run on a Docker host before /msd-verify-work:
   bash scripts/check-phase16.2.sh postgres
 ************************************************************************
@@ -550,6 +594,7 @@ case "${1:---all}" in
 	--admin | admin) run_admin ;;
 	--editor | editor) run_editor ;;
 	--layer | layer) run_layer ;;
+	--cache | cache) run_cache ;;
 	--docs | docs) run_docs ;;
 	--postgres | postgres) run_postgres ;;
 	--all | all) run_all ;;