test(19.7-05): framework unit tests for every validation row and the gate's admin stage

- pier: TestCatalog, TestDispatch, TestGuardRules, TestSessions (Redis
  across two instances and the memory store), TestFanOut; the store clock
  and stateless-server seams in export_test.go
- surf: TestStreamingRoute (throttle, CORS profile and access-log pattern on
  a stream route) and TestPierMount in both builds; the streaming smoke
  restores the mount hook it replaces
- wristband TestMCPScopes; cabana TestAccountContributions (Postgres part:
  transaction and unchanged My account payloads), TestRecordActionPrompt,
  TestScopeLimitForMethods; TestRecordActionPromptRun pins the empty Value
  of an action without a prompt
- vitest: 403 and failed-load cases for My account contributions, the
  cancelled prompt
- gate: every name required (tagged runs included), account.go unchanged
  since 51d088a, admin stage live

scripts/check-phase19.7.sh

@@ -88,21 +88,44 @@ GO_TESTS=(
 	./modules/pier:TestPierTracerSmoke ./modules/pier:TestPierSessionsSmoke
 	./modules/pier:TestPierFanOutSmoke ./modules/pier:TestPierStatelessSmoke
 	./modules/pier:TestExampleBlogPlugin
-	# Plan 05: the validation map (SC-3, D-17, D-20, D-23).
-	./modules/pier:TestToolsList
+	# The cabana subject-event fix (d96c726).
+	./modules/cabana:TestFireSubjectChangedReachesPointerListener
+	# Plan 05: the validation map (SC-1..SC-3, D-04, D-10..D-17, D-20..D-27,
+	# D-30, D-34).
+	./modules/pier:TestToolsList ./modules/pier:TestCatalog ./modules/pier:TestDispatch
+	./modules/pier:TestGuardRules ./modules/pier:TestSessions ./modules/pier:TestFanOut
 	./modules/bouncer:TestDispatchMarker ./modules/cabana:TestDispatchMarker
+	./modules/surf:TestStreamingRoute ./modules/surf:TestPierMount
+	./modules/wristband:TestMCPScopes
+	./modules/cabana:TestAccountContributions ./modules/cabana:TestRecordActionPrompt
+	./modules/cabana:TestScopeLimitForMethods
 )
 
-# go stage: framework tests that run in a binary built with the MCP tag.
+# go stage: framework tests that also run in a binary built with the MCP
+# tag (surf links pier there; TestPierMount takes its tagged branch).
 GO_TAGGED_TESTS=(
-	./modules/pier:TestToolsList
+	./modules/pier:TestToolsList ./modules/pier:TestCatalog ./modules/pier:TestDispatch
+	./modules/pier:TestGuardRules ./modules/pier:TestSessions ./modules/pier:TestFanOut
+	./modules/pier:TestPierTracerSmoke ./modules/pier:TestPierStatelessSmoke
+	./modules/surf:TestPierMount ./modules/surf:TestStreamingRoute ./modules/surf:TestDispatchSmoke
 )
 
 # docker stage: Postgres tests in the framework.
 DOCKER_TESTS=(
-	./modules/cabana:TestDispatchMarker ./modules/cabana:TestRecordActionPromptRun
+	./modules/cabana:TestDispatchMarker ./modules/cabana:TestAccountContributions
+	./modules/cabana:TestRecordActionPromptRun ./modules/cabana:TestFireSubjectChangedWaitsForCommit
 )
 
+# admin stage: vitest files that must pass.
+ADMIN_FILES=(
+	tests/account/AccountContributions.test.ts
+	tests/form/RecordActionsPrompt.test.ts
+)
+
+# go stage: My account's own handlers stay as they were before the phase
+# (D-04: existing payloads unchanged).
+ACCOUNT_BASE="51d088a"
+
 # docs stage: names of consuming applications (split so this file does not
 # match itself), the decision note and the dependency names it must carry.
 APP_NAMES=("p[lł]yta""rium" "fono""teka" "wave""path" "horo""skopia" "bm\\.jakub""zych" "grzyby""funkcjonalne" "stu""dia")
@@ -453,6 +476,11 @@ run_go() {
 		return 1
 	fi
 	echo "untagged: examples/hello links no MCP SDK"
+	if ! (cd "$ROOT" && git diff --quiet "$ACCOUNT_BASE" -- modules/cabana/account.go); then
+		echo "refuse: modules/cabana/account.go changed since $ACCOUNT_BASE (D-04: My account's payloads stay as they were)" >&2
+		return 1
+	fi
+	echo "account: modules/cabana/account.go unchanged since $ACCOUNT_BASE"
 	go_pkg_named "$ROOT" "-short" "${GO_TESTS[@]}"
 	go_pkg_named "$ROOT" "-short -tags $MCP_TAG" "${GO_TAGGED_TESTS[@]}"
 	echo "phase19.7 go passed"
@@ -532,9 +560,42 @@ EOF
 	echo "NOT RUN docker (Docker-host only; see the notice above)"
 }
 
+# npm_checked NAME DETECT_FILES... runs npm --prefix admin run NAME and
+# checks its output with detect_vitest, requiring DETECT_FILES.
+npm_checked() {
+	local script="$1"
+	shift
+	local log rc=0 dc=0
+	log="$(mktemp)"
+	npm --prefix "$ROOT/admin" run "$script" >"$log" 2>&1 || rc=$?
+	REQUIRE_FILES="$*" detect_vitest "$log" || dc=$?
+	if [[ "$rc" -ne 0 || "$dc" -ne 0 ]]; then
+		grep -E '(FAIL|×|Error|expected)' "$log" | head -n 40 >&2 || true
+		tail -n 20 "$log" >&2
+		rm -f "$log"
+		echo "refuse: npm run $script in admin (test=$rc detect=$dc)" >&2
+		return 1
+	fi
+	echo "vitest ($script): $(grep -E '^\s*Tests\s' "$log" | tr -s ' ')"
+	rm -f "$log"
+}
+
 run_admin() {
-	echo "TODO stage admin" >&2
-	return 1
+	local log rc=0
+	log="$(mktemp)"
+	npm --prefix "$ROOT/admin" run typecheck >"$log" 2>&1 || rc=$?
+	if [[ "$rc" -ne 0 ]]; then
+		tail -n 40 "$log" >&2
+		rm -f "$log"
+		echo "refuse: npm run typecheck in admin" >&2
+		return 1
+	fi
+	rm -f "$log"
+	echo "typecheck: admin"
+	npm_checked test "${ADMIN_FILES[@]}"
+	(cd "$ROOT" && bash scripts/check-admin-openapi.sh --check)
+	(cd "$ROOT" && bash scripts/check-admin-dist.sh)
+	echo "phase19.7 admin passed"
 }
 
 run_docs() {